@synqauth/js 0.2.0 → 0.4.0

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { A as SignInFlowStep, M as StartSignInOptions, O as SavedSignIn, c as SynqError, j as SignInStepResult, k as SignInFlow, l as isSynqError, m as IdTokenClaims, r as paths, t as components } from "./management-CWdCiiEv.js";
+import { A as SignInFlowStep, M as StartSignInOptions, O as SavedSignIn, V as LinkedAccount, c as SynqError, j as SignInStepResult, k as SignInFlow, l as isSynqError, m as IdTokenClaims, r as paths, t as components } from "./management-BN4KI1ZH.js";
 import { JWTPayload, JWTVerifyGetKey } from "jose";
 //#region src/api.d.ts
 type HttpMethod = 'get' | 'post' | 'put' | 'patch' | 'delete';
@@ -38,7 +38,12 @@ type Success<O> = O extends {
   };
 } ? J : never : S extends 204 ? undefined : never; }[keyof R] : never;
 type Common = {
-  /** Sent as `Idempotency-Key`: a POST with the same key runs once (the management API keeps the answer 24 hours). */
+  /**
+   * Sent as `Idempotency-Key`: a POST with the same key runs once (the
+   * management API keeps the answer 24 hours). The management client makes
+   * one for every POST you don't give one, unless `maxRetries` is 0, and
+   * sends the same key on each retry.
+   */
   idempotencyKey?: string;
   signal?: AbortSignal;
 };
@@ -60,6 +65,14 @@ type RequestOptions<O> = ([PathParams<O>] extends [never] ? {
 }) & Common;
 type Args<O> = object extends RequestOptions<O> ? [options?: RequestOptions<O>] : [options: RequestOptions<O>];
 type Call<Paths, M extends HttpMethod> = <P extends PathsWith<Paths, M>>(path: P, ...args: Args<Operation<Paths, P, M>>) => Promise<Success<Operation<Paths, P, M>>>;
+/** One item of a list's page: what `paginate` yields. */
+type PageItem<O> = Success<O> extends {
+  readonly data: readonly (infer T)[];
+  readonly next_cursor: string | null;
+} ? T : never;
+/** The paths of a contract whose GET answers a page (`{ data, next_cursor }`). */
+type PagedPaths<Paths> = { [P in PathsWith<Paths, 'get'>]: [PageItem<Operation<Paths, P, 'get'>>] extends [never] ? never : P; }[PathsWith<Paths, 'get'>] & string;
+type Paginate<Paths> = <P extends PagedPaths<Paths>>(path: P, ...args: Args<Operation<Paths, P, 'get'>>) => AsyncIterable<PageItem<Operation<Paths, P, 'get'>>>;
 /** A client for one Synq contract: one method per HTTP method, each typed by the contract. */
 interface ApiClient<Paths> {
   get: Call<Paths, 'get'>;
@@ -67,6 +80,14 @@ interface ApiClient<Paths> {
   put: Call<Paths, 'put'>;
   patch: Call<Paths, 'patch'>;
   delete: Call<Paths, 'delete'>;
+  /**
+   * Every item of a list, page by page: `for await (const user of
+   * client.paginate('/v1/orgs/{org}/brands/{brand}/users', { path }))`. It
+   * asks for the next page (`cursor`, from the last page's `next_cursor`)
+   * only when the loop reaches it, so `break` stops asking. `query.limit`
+   * is the size of each page.
+   */
+  paginate: Paginate<Paths>;
 }
 //#endregion
 //#region src/server.d.ts
@@ -112,6 +133,12 @@ export interface AccessTokenClaims {
     readonly type?: string;
     readonly client_id?: string;
   } | undefined;
+  /** The person's email, when your API asks for it (`identity_claims`) and they have one. */
+  readonly email: string | undefined;
+  /** Whether Synq verified it, when your API asks for it. */
+  readonly email_verified: boolean | undefined;
+  /** Their accounts at upstream providers (GitHub, Google…), when your API asks for them. */
+  readonly linked_accounts: readonly LinkedAccount[] | undefined;
   /** Every claim, as the token carries it. */
   readonly payload: JWTPayload;
 }
@@ -169,6 +196,12 @@ export interface ApiKeyClaims {
   readonly iat: number;
   /** When it stops working, in seconds; undefined for a key that doesn't expire. */
   readonly exp: number | undefined;
+  /** The person's email, when your API asks for it (`identity_claims`) and they have one. */
+  readonly email: string | undefined;
+  /** Whether Synq verified it, when your API asks for it. */
+  readonly email_verified: boolean | undefined;
+  /** Their accounts at upstream providers (GitHub, Google…), when your API asks for them. */
+  readonly linked_accounts: readonly LinkedAccount[] | undefined;
 }
 /**
  * Checks one of your users' API keys, as `createApiKeyVerifier` makes it:
@@ -217,13 +250,35 @@ export interface ManagementClientOptions {
   /** Or a Synq access token, acting as that person: a function so it can be refreshed. */
   accessToken?: () => string | Promise<string>;
   fetch?: typeof fetch;
+  /**
+   * How many times a call is tried again when Synq's answer says it may
+   * work later: 2 by default, 0 for never (and then a POST carries only
+   * the `idempotencyKey` you give it). Every method retries a 429, a
+   * 503 and `idempotency_key_in_flight`; a GET, PUT, PATCH or POST (with
+   * its key) also retries a 502, a 504 and a dropped connection; a GET, PUT
+   * or PATCH a 500. A DELETE retries only refusals, since a second try
+   * could answer 404 for a delete that worked. Each try waits the
+   * `Retry-After` Synq names, up to 60 seconds (a longer one is thrown at
+   * once, with `retryAfter`), or else backs off from half a second, and an
+   * aborted `signal` stops the waiting.
+   */
+  maxRetries?: number;
 }
+/** How many times the management client tries a call again by default. */
+export declare const DEFAULT_MAX_RETRIES = 2;
 /** The management API's typed client: every path, parameter, body and answer from its contract. */
 export type ManagementClient = ApiClient<paths>;
 /**
  * A client for Synq's management API (`/v1`), typed by its contract. Server
  * only: an API key never reaches a browser. Failures throw a `SynqError`
  * with the problem's `code`, such as `insufficient_permissions`.
+ *
+ * Every POST carries an `Idempotency-Key` (yours, or a new one unless
+ * `maxRetries` is 0), the same on each try, so a retry never makes two of
+ * anything. An answer that holds a secret or a link only its holder may use
+ * isn't kept with the key: a retry of it is `conflict`. A call is tried
+ * again, up to `maxRetries` times, when Synq's answer says it may work
+ * later, and `paginate` walks a list's pages with `for await`.
  */
 export declare function createManagementClient(options: ManagementClientOptions): ManagementClient;
 /** What a server needs to sign people in on its app's own screens (AERO-1411). */
@@ -278,4 +333,4 @@ export interface OwnUiSignIn {
  */
 export declare function createOwnUiSignIn(options: OwnUiSignInOptions): OwnUiSignIn;
 //#endregion
-export { type components as ManagementComponents, type paths as ManagementPaths, type SavedSignIn, SignInFlow, type SignInFlowStep, type SignInStepResult, type StartSignInOptions, SynqError, isSynqError };
+export { type LinkedAccount, type components as ManagementComponents, type paths as ManagementPaths, type SavedSignIn, SignInFlow, type SignInFlowStep, type SignInStepResult, type StartSignInOptions, SynqError, isSynqError };

package/dist/server.js

@@ -1,4 +1,4 @@
-import { a as readSavedSignIn, i as newSignIn, n as secureUrl, o as SynqError, r as SignInFlow, s as isSynqError, t as createApiClient } from "./api-CeYAjkvX.js";
+import { a as readSavedSignIn, c as SynqError, i as newSignIn, l as isSynqError, n as secureUrl, o as linkedAccountsOf, r as SignInFlow, t as createApiClient } from "./api-D2jDzTRO.js";
 import * as oauth from "oauth4webapi";
 import { createRemoteJWKSet, customFetch, errors, jwtVerify } from "jose";
 //#region src/server.ts
@@ -105,6 +105,9 @@ function accessTokenClaims(payload) {
 		acr: string(payload.acr),
 		amr,
 		act,
+		email: string(payload.email),
+		email_verified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
+		linked_accounts: linkedAccountsOf(payload.linked_accounts),
 		payload
 	};
 }
@@ -183,7 +186,10 @@ function createApiKeyVerifier(options) {
 			keyId: string(body.key_id),
 			name: string(body.name),
 			iat: typeof body.iat === "number" ? body.iat : 0,
-			exp: typeof body.exp === "number" ? body.exp : void 0
+			exp: typeof body.exp === "number" ? body.exp : void 0,
+			email: typeof body.email === "string" ? body.email : void 0,
+			email_verified: typeof body.email_verified === "boolean" ? body.email_verified : void 0,
+			linked_accounts: linkedAccountsOf(body.linked_accounts)
 		};
 		if (claims.iss !== issuer) throw new SynqError("invalid_response", "Synq's answer names another issuer", { status: 502 });
 		const missing = (verify.scopes ?? []).filter((scope) => !claims.scopes.includes(scope));
@@ -248,10 +254,19 @@ function fromBase64(value) {
 		return;
 	}
 }
+/** How many times the management client tries a call again by default. */
+const DEFAULT_MAX_RETRIES = 2;
 /**
 * A client for Synq's management API (`/v1`), typed by its contract. Server
 * only: an API key never reaches a browser. Failures throw a `SynqError`
 * with the problem's `code`, such as `insufficient_permissions`.
+*
+* Every POST carries an `Idempotency-Key` (yours, or a new one unless
+* `maxRetries` is 0), the same on each try, so a retry never makes two of
+* anything. An answer that holds a secret or a link only its holder may use
+* isn't kept with the key: a retry of it is `conflict`. A call is tried
+* again, up to `maxRetries` times, when Synq's answer says it may work
+* later, and `paginate` walks a list's pages with `for await`.
 */
 function createManagementClient(options) {
 	const { apiKey, accessToken } = options;
@@ -259,7 +274,9 @@ function createManagementClient(options) {
 	return createApiClient({
 		baseUrl: options.baseUrl,
 		credential: apiKey ? () => apiKey : accessToken,
-		fetch: options.fetch
+		fetch: options.fetch,
+		maxRetries: options.maxRetries ?? 2,
+		idempotencyKeys: true
 	});
 }
 /**
@@ -314,4 +331,4 @@ function createOwnUiSignIn(options) {
 	};
 }
 //#endregion
-export { SignInFlow, SynqError, createAccessTokenVerifier, createApiKeyVerifier, createManagementClient, createOwnUiSignIn, isApiKey, isSynqError, verifyWebhook };
+export { DEFAULT_MAX_RETRIES, SignInFlow, SynqError, createAccessTokenVerifier, createApiKeyVerifier, createManagementClient, createOwnUiSignIn, isApiKey, isSynqError, verifyWebhook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synqauth/js",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Synq's framework-agnostic client: sign-in and sessions in the browser, the account API, and token and webhook verification on your server.",
   "license": "MIT",
   "repository": {

package/dist/api-CeYAjkvX.js

@@ -1,467 +0,0 @@
-import * as oauth from "oauth4webapi";
-import { AuthorizationResponseError, OperationProcessingError, ResponseBodyError, WWWAuthenticateChallengeError } from "oauth4webapi";
-//#region src/errors.ts
-/**
-* Every error the SDK throws. Branch on `code`, which is stable: the API's
-* problem `code`, OAuth's `error`, or one of the SDK's own; never on the
-* message.
-*/
-var SynqError = class extends Error {
-	name = "SynqError";
-	code;
-	/** The HTTP status Synq answered with, when it answered. */
-	status;
-	/** What Synq said about it: OAuth's `error_description` or a problem's `detail`. */
-	description;
-	/**
-	* How many seconds to wait before trying again, from Synq's `Retry-After`:
-	* set on `rate_limited` (429), and wherever else Synq sends one.
-	*/
-	retryAfter;
-	constructor(code, message, options = {}) {
-		super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
-		this.code = code;
-		this.status = options.status;
-		this.description = options.description;
-		this.retryAfter = options.retryAfter;
-	}
-};
-/** Whether `error` is a `SynqError`, with `code` when given. */
-function isSynqError(error, code) {
-	return error instanceof SynqError && (code === void 0 || error.code === code);
-}
-/** A `SynqError` for a problem document a Synq API answered with. */
-function problemError(status, problem, retryAfter) {
-	const code = typeof problem.code === "string" ? problem.code : `http_${status}`;
-	const description = typeof problem.detail === "string" ? problem.detail : void 0;
-	return new SynqError(code, description ?? problem.title ?? `Synq answered ${status}`, {
-		status,
-		description,
-		retryAfter,
-		cause: problem
-	});
-}
-/**
-* The seconds a `Retry-After` header asks for: a number of seconds, or an
-* HTTP date, counted from `now`. Undefined when there is none, or it can't
-* be read.
-*/
-function retryAfterSeconds(header, now = Date.now()) {
-	const value = header?.trim();
-	if (!value) return void 0;
-	if (/^[0-9]+$/.test(value)) return Number(value);
-	if (!/[A-Za-z]/.test(value)) return void 0;
-	const at = Date.parse(value);
-	return Number.isNaN(at) ? void 0 : Math.max(0, Math.ceil((at - now) / 1e3));
-}
-/**
-* A `SynqError` for whatever went wrong talking to Synq's issuer: OAuth's
-* error responses keep their `error`, a failed check of Synq's answer is
-* `invalid_response`, and a request that never got an answer is
-* `network_error`.
-*/
-function toSynqError(error) {
-	if (error instanceof SynqError) return error;
-	if (error instanceof ResponseBodyError) return new SynqError(error.error, error.error_description ?? error.error, {
-		status: error.status,
-		description: error.error_description,
-		cause: error
-	});
-	if (error instanceof AuthorizationResponseError) return new SynqError(error.error, error.error_description ?? error.error, {
-		description: error.error_description,
-		cause: error
-	});
-	if (error instanceof WWWAuthenticateChallengeError) {
-		const challenge = error.cause[0];
-		const code = challenge?.parameters.error ?? "invalid_token";
-		const description = challenge?.parameters.error_description;
-		return new SynqError(code, description ?? code, {
-			status: error.status,
-			description,
-			cause: error
-		});
-	}
-	if (error instanceof OperationProcessingError) return new SynqError("invalid_response", error.message, { cause: error });
-	if (error instanceof TypeError) return new SynqError("network_error", `Synq couldn't be reached: ${error.message}`, { cause: error });
-	return new SynqError("invalid_response", error instanceof Error ? error.message : "Synq answered with something unexpected", { cause: error });
-}
-//#endregion
-//#region src/sign-in-flow.ts
-/** A new flow's state: a PKCE verifier and nonce of its own. */
-function newSignIn(scope, options) {
-	return {
-		v: 1,
-		verifier: oauth.generateRandomCodeVerifier(),
-		nonce: oauth.generateRandomNonce(),
-		scope,
-		...options.resource ? { resource: options.resource } : {},
-		...options.additionalResources?.length ? { additionalResources: [...options.additionalResources] } : {},
-		...options.acr ? { acr: options.acr } : {},
-		step: "start"
-	};
-}
-/** A saved flow, checked: one this SDK wrote. */
-function readSavedSignIn(saved) {
-	const value = typeof saved === "string" ? JSON.parse(saved) : saved;
-	if (value?.v !== 1 || typeof value.verifier !== "string" || typeof value.nonce !== "string" || typeof value.scope !== "string" || typeof value.step !== "string") throw new SynqError("invalid_options", "That is not a sign-in this SDK saved");
-	return value;
-}
-/** One sign-in on an app's own screens. */
-var SignInFlow = class {
-	#port;
-	#state;
-	constructor(port, state) {
-		this.#port = port;
-		this.#state = state;
-	}
-	/** What the app's screen asks for now. */
-	get step() {
-		return this.#state.step;
-	}
-	/** The address the sign-in is for, once one was typed. */
-	get address() {
-		return this.#state.email;
-	}
-	/** Email and password. */
-	password = {
-		signIn: (input) => this.#ask(this.#method("password", {
-			username: input.email,
-			password: input.password
-		}), { email: input.email }),
-		/** Makes an account where the brand lets people sign up; its address is verified next. */
-		signUp: (input) => this.#ask(this.#method("password", {
-			username: input.email,
-			password: input.password,
-			synq_screen: "sign-up"
-		}), { email: input.email })
-	};
-	/** A code by email. */
-	email = {
-		send: (email) => this.#ask(this.#method("email", { username: email }), { email }),
-		verify: (code) => this.#ask({ otp: code }),
-		resend: () => this.#ask({ synq_action: "resend" })
-	};
-	/** A passkey: `options()`, then the browser's assertion to `signIn`. */
-	passkey = {
-		options: () => this.#ask(this.#method("passkey", {})),
-		signIn: (credential, options = {}) => this.#ask({
-			synq_passkey: JSON.stringify(credential),
-			...options.related ? { synq_passkey_rp: "related" } : {}
-		})
-	};
-	/** Verifying an address after a sign-in that didn't prove it. */
-	verifyEmail = {
-		verify: (code) => this.#ask({ otp: code }),
-		resend: () => this.#ask({ synq_action: "resend" }),
-		skip: () => this.#ask({ synq_action: "skip" })
-	};
-	/** The flow, to keep between requests (a server's sealed cookie, a phone's secure storage). */
-	toJSON() {
-		return this.#state;
-	}
-	/** Fields that name `method`, which a session already under way switches to. */
-	#method(method, fields) {
-		return {
-			synq_method: method,
-			...fields
-		};
-	}
-	async #ask(fields, changes = {}) {
-		if (this.#state.step === "done") throw new SynqError("invalid_session", "This sign-in has finished: start another");
-		if (changes.email !== void 0) this.#state = {
-			...this.#state,
-			email: changes.email
-		};
-		const answer = await this.#send(fields);
-		return this.#read(answer);
-	}
-	async #send(fields) {
-		const port = this.#port;
-		const server = await port.server();
-		const endpoint = server.authorization_challenge_endpoint;
-		if (typeof endpoint !== "string") throw new SynqError("discovery_failed", "The issuer doesn't sign people in on apps' own screens");
-		const body = new URLSearchParams(fields);
-		const state = this.#state;
-		if (state.authSession) body.set("auth_session", state.authSession);
-		else {
-			body.set("response_type", "code");
-			body.set("scope", state.scope);
-			body.set("nonce", state.nonce);
-			body.set("code_challenge", await oauth.calculatePKCECodeChallenge(state.verifier));
-			body.set("code_challenge_method", "S256");
-			if (state.resource) body.set("resource", state.resource);
-			for (const extra of state.additionalResources ?? []) if (extra !== state.resource) body.append("resource", extra);
-			if (state.acr) {
-				if (state.acr.essential) body.set("claims", JSON.stringify({ id_token: { acr: {
-					essential: true,
-					values: [...state.acr.values]
-				} } }));
-				else body.set("acr_values", state.acr.values.join(" "));
-			}
-		}
-		const headers = new Headers({
-			accept: "application/json",
-			"content-type": "application/x-www-form-urlencoded",
-			...port.headers
-		});
-		await port.auth(server, port.client, body, headers);
-		let response;
-		try {
-			response = await port.fetch(endpoint, {
-				method: "POST",
-				headers,
-				body: body.toString(),
-				redirect: "manual"
-			});
-		} catch (error) {
-			throw toSynqError(error);
-		}
-		let parsed;
-		try {
-			parsed = await response.json();
-		} catch {
-			parsed = void 0;
-		}
-		if (!parsed || typeof parsed !== "object") throw new SynqError("invalid_response", `Synq answered ${response.status} with no JSON`, { status: response.status });
-		return {
-			status: response.status,
-			body: parsed,
-			retryAfter: retryAfterSeconds(response.headers.get("retry-after"))
-		};
-	}
-	async #read(answer) {
-		const { body } = answer;
-		const text = (name) => typeof body[name] === "string" ? body[name] : void 0;
-		const message = text("error_description") ?? "";
-		const problem = text("synq_problem");
-		const session = text("auth_session");
-		if (session) this.#state = {
-			...this.#state,
-			authSession: session
-		};
-		if (answer.status === 200 && typeof body.authorization_code === "string") {
-			this.#state = {
-				...this.#state,
-				step: "done"
-			};
-			return {
-				status: "signed-in",
-				session: await this.#redeem(body.authorization_code)
-			};
-		}
-		const error = text("error");
-		switch (error) {
-			case "insufficient_authorization": return this.#next(body, problem, message);
-			case "redirect_to_web": {
-				this.#state = {
-					...this.#state,
-					step: "done"
-				};
-				const method = text("synq_method");
-				const loginHint = text("login_hint") ?? this.#state.email;
-				return {
-					status: "hosted",
-					reason: text("synq_reason"),
-					...method ? { method } : {},
-					...loginHint ? { loginHint } : {},
-					continue: () => this.#port.hosted({
-						...method ? { method } : {},
-						...loginHint ? { loginHint } : {}
-					})
-				};
-			}
-			case "access_denied":
-				this.#state = {
-					...this.#state,
-					step: "done"
-				};
-				return {
-					status: "refused",
-					reason: text("synq_reason"),
-					message
-				};
-			case "too_many_requests":
-				if (session && problem) return {
-					status: "retry",
-					problem,
-					message,
-					...answer.retryAfter === void 0 ? {} : { retryAfter: answer.retryAfter }
-				};
-				throw new SynqError("too_many_requests", message || "Too many requests", {
-					status: answer.status,
-					description: message,
-					...answer.retryAfter === void 0 ? {} : { retryAfter: answer.retryAfter }
-				});
-			default:
-				if (error === "invalid_session") this.#state = {
-					...this.#state,
-					step: "done"
-				};
-				throw new SynqError(error ?? `http_${answer.status}`, message || `Synq answered ${answer.status}`, {
-					status: answer.status,
-					description: message || void 0
-				});
-		}
-	}
-	/** What Synq asks for next, or the same step again with what went wrong. */
-	#next(body, problem, message) {
-		const next = body.synq_next;
-		const step = next === "otp" ? "code" : next === "verify_email" ? "verify-email" : next === "method" ? "start" : next;
-		this.#state = {
-			...this.#state,
-			step
-		};
-		if (next === "passkey") {
-			const related = body.synq_passkey_related_options;
-			return {
-				status: "passkey",
-				options: body.synq_passkey_options,
-				...related ? { related: {
-					rpId: related.rp_id,
-					options: related.options
-				} } : {},
-				...problem ? {
-					problem,
-					message
-				} : {}
-			};
-		}
-		if (problem) return {
-			status: "retry",
-			problem,
-			message
-		};
-		const email = this.#state.email ?? "";
-		if (next === "otp") {
-			const seconds = typeof body.synq_code_expires_in === "number" ? body.synq_code_expires_in : 0;
-			return {
-				status: "code-sent",
-				email,
-				expiresAt: new Date(Date.now() + seconds * 1e3)
-			};
-		}
-		if (next === "verify_email") return {
-			status: "verify-email",
-			email,
-			canSkip: body.synq_can_skip === true
-		};
-		return {
-			status: "retry",
-			problem: "missing",
-			message
-		};
-	}
-	/** Redeems the code at the token endpoint, with the verifier and no redirect URI. */
-	async #redeem(code) {
-		const port = this.#port;
-		const server = await port.server();
-		if (!server.token_endpoint) throw new SynqError("discovery_failed", "The issuer has no token endpoint");
-		const body = new URLSearchParams({
-			grant_type: "authorization_code",
-			code,
-			code_verifier: this.#state.verifier
-		});
-		if (this.#state.resource) body.set("resource", this.#state.resource);
-		const headers = new Headers({
-			accept: "application/json",
-			"content-type": "application/x-www-form-urlencoded"
-		});
-		await port.auth(server, port.client, body, headers);
-		try {
-			const response = await port.fetch(server.token_endpoint, {
-				method: "POST",
-				headers,
-				body: body.toString(),
-				redirect: "manual"
-			});
-			const result = await oauth.processAuthorizationCodeResponse(server, port.client, response, {
-				expectedNonce: this.#state.nonce,
-				maxAge: oauth.skipAuthTimeCheck,
-				requireIdToken: true
-			});
-			const claims = oauth.getValidatedIdTokenClaims(result);
-			const acr = this.#state.acr;
-			if (acr?.essential && !(typeof claims?.acr === "string" && acr.values.includes(claims.acr))) throw new SynqError("unmet_authentication_requirements", "The sign-in did not reach the level this app requires");
-			return await port.finish(result, claims);
-		} catch (error) {
-			throw toSynqError(error);
-		}
-	}
-};
-//#endregion
-//#region src/urls.ts
-/** Whether a host is this machine: a Synq stack under `localhost`, or a loopback address. */
-function isLoopback(hostname) {
-	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-/**
-* `value` as a URL, which must be https: Synq's hosts always are. Plain http
-* only on this machine, for a local Synq stack. `what` names it in the error.
-*/
-function secureUrl(value, what) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		throw new SynqError("invalid_options", `${what} isn't a URL: ${String(value)}`);
-	}
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback(url.hostname))) throw new SynqError("invalid_options", `${what} must be https: (http: only for a Synq stack on this machine, under 'localhost')`);
-	return url;
-}
-//#endregion
-//#region src/api.ts
-function createApiClient(options) {
-	const base = secureUrl(options.baseUrl, "The API base URL").href.replace(/\/+$/, "");
-	const call = (method) => ((path, request = {}) => send(method, path, request));
-	async function send(method, path, request) {
-		const url = new URL(base + fill(path, request.path));
-		for (const [name, value] of Object.entries(request.query ?? {})) {
-			if (value === void 0) continue;
-			for (const item of Array.isArray(value) ? value : [value]) url.searchParams.append(name, String(item));
-		}
-		const headers = new Headers({
-			accept: "application/json, application/problem+json",
-			authorization: `Bearer ${await options.credential()}`
-		});
-		if (request.body !== void 0) headers.set("content-type", "application/json");
-		if (request.idempotencyKey) headers.set("idempotency-key", request.idempotencyKey);
-		let response;
-		try {
-			response = await (options.fetch ?? fetch)(url, {
-				method: method.toUpperCase(),
-				headers,
-				body: request.body === void 0 ? void 0 : JSON.stringify(request.body),
-				signal: request.signal
-			});
-		} catch (error) {
-			throw new SynqError("network_error", `Synq couldn't be reached: ${String(error)}`, { cause: error });
-		}
-		const text = await response.text();
-		let json;
-		try {
-			json = text ? JSON.parse(text) : void 0;
-		} catch {
-			json = void 0;
-		}
-		if (!response.ok) throw problemError(response.status, json !== null && typeof json === "object" ? json : {}, retryAfterSeconds(response.headers.get("retry-after")));
-		return json;
-	}
-	return {
-		get: call("get"),
-		post: call("post"),
-		put: call("put"),
-		patch: call("patch"),
-		delete: call("delete")
-	};
-}
-/** The path with each `{name}` replaced by its parameter, encoded. */
-function fill(path, params = {}) {
-	return path.replace(/\{([^}]+)\}/g, (_, name) => {
-		const value = params[name];
-		if (value === void 0 || value === "") throw new SynqError("invalid_options", `The path ${path} needs ${name}`);
-		if (/^\.+$/.test(String(value))) throw new SynqError("invalid_options", `${name} can't be ${String(value)}`);
-		return encodeURIComponent(String(value));
-	});
-}
-//#endregion
-export { readSavedSignIn as a, problemError as c, newSignIn as i, toSynqError as l, secureUrl as n, SynqError as o, SignInFlow as r, isSynqError as s, createApiClient as t };