@flytedesk/app-kit 0.5.0 → 0.7.0

package/dist/auth/oidc-client.d.ts

@@ -1,3 +1,4 @@
+import type { AppSwitcherEntry } from "./shared-types.js";
 import type { UserinfoClaims } from "./types.js";
 export interface OidcClientOptions {
     issuer: string;
@@ -25,19 +26,7 @@ export interface IdpAuthorization {
     }>;
     permissions: string[];
 }
-/**
- * One entry from `GET {issuer}/me/apps` — an app the caller holds any role in.
- * Shaped to drop straight into `@flytedan/flytebot-design-system`'s `AppEntry`
- * ("All flytedesk apps" switcher, MP-209): `icon` is that same convention's bare
- * Phosphor icon-library key (e.g. "chart-bar"), not a URL, and either field is
- * `null` for an app flytedesk-id hasn't been seeded with one for yet.
- */
-export interface IdpAppSwitcherEntry {
-    key: string;
-    name: string;
-    url: string | null;
-    icon: string | null;
-}
+export type { AppSwitcherEntry };
 export interface OidcClient {
     buildAuthorizeUrl(opts: {
         state: string;
@@ -52,7 +41,7 @@ export interface OidcClient {
      *  design system's "All flytedesk apps" switcher. Computed live by flytedesk-id on
      *  every call (never cached there — see fetchAuthorization's doc comment, same
      *  reasoning), so callers must call this live too rather than memoizing the result. */
-    fetchMyApps(idpAccessToken: string): Promise<IdpAppSwitcherEntry[]>;
+    fetchMyApps(idpAccessToken: string): Promise<AppSwitcherEntry[]>;
     /** Best-effort — never throws. Returns whether flytedesk-id accepted the revocation. */
     revokeIdpToken(token: string): Promise<boolean>;
 }

package/dist/auth/oidc-client.js

@@ -1,4 +1,5 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
+import { OidcHttpError } from "./errors.js";
 /**
  * One instance per FlytedeskAuthOptions (i.e. per plugin registration), not a module
  * singleton — keeps the JWKS/discovery caches below scoped to one issuer/client pair
@@ -33,7 +34,7 @@ export function createOidcClient(opts) {
         });
         if (!res.ok) {
             const text = await res.text().catch(() => "");
-            throw new Error(`flytedesk-id /token returned ${res.status}: ${text}`);
+            throw new OidcHttpError(`flytedesk-id /token returned ${res.status}: ${text}`, res.status);
         }
         return (await res.json());
     }
@@ -108,7 +109,7 @@ export function createOidcClient(opts) {
                 headers: { Authorization: `Bearer ${idpAccessToken}` },
             });
             if (!res.ok) {
-                throw new Error(`flytedesk-id userinfo (/me) returned ${res.status}`);
+                throw new OidcHttpError(`flytedesk-id userinfo (/me) returned ${res.status}`, res.status);
             }
             const body = (await res.json());
             if (typeof body.sub !== "string" || typeof body.email !== "string") {
@@ -130,7 +131,7 @@ export function createOidcClient(opts) {
                 headers: { Authorization: `Bearer ${idpAccessToken}` },
             });
             if (!res.ok) {
-                throw new Error(`flytedesk-id authorization endpoint returned ${res.status}`);
+                throw new OidcHttpError(`flytedesk-id authorization endpoint returned ${res.status}`, res.status);
             }
             return (await res.json());
         },
@@ -140,7 +141,7 @@ export function createOidcClient(opts) {
                 headers: { Authorization: `Bearer ${idpAccessToken}` },
             });
             if (!res.ok) {
-                throw new Error(`flytedesk-id /me/apps returned ${res.status}`);
+                throw new OidcHttpError(`flytedesk-id /me/apps returned ${res.status}`, res.status);
             }
             const body = (await res.json());
             return body.apps;

package/dist/auth/oidc-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/auth/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAgE3E;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,SAAS,SAAS,CAAC,IAAY;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,eAAe;QACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAA4B;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,eAAe,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,SAAS,OAAO;QACd,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAsD,CAAC;IAC3D,SAAS,YAAY;QACnB,cAAc,KAAK,KAAK,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO;QACL,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,4FAA4F;QAC5F,qBAAqB,CAAC,IAAI,EAAE,QAAQ;YAClC,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;qCAC6B;QAC7B,gBAAgB,CAAC,YAAY;YAC3B,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED;0EACkE;QAClE,KAAK,CAAC,aAAa,CAAC,cAAc;YAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;gBACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC;QACJ,CAAC;QAED;;;sFAG8E;QAC9E,KAAK,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,gBAAgB,CAAC,EAAE;gBACjE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;QAED,kFAAkF;QAClF,KAAK,CAAC,WAAW,CAAC,cAAc;YAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;gBAC7C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED;;;8FAGsF;QACtF,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE;oBACrD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,eAAe,EAAE;qBACjC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;iBAChD,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/auth/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqD5C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,SAAS,SAAS,CAAC,IAAY;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,eAAe;QACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAA4B;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,eAAe,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,aAAa,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,SAAS,OAAO;QACd,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAsD,CAAC;IAC3D,SAAS,YAAY;QACnB,cAAc,KAAK,KAAK,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO;QACL,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,4FAA4F;QAC5F,qBAAqB,CAAC,IAAI,EAAE,QAAQ;YAClC,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;qCAC6B;QAC7B,gBAAgB,CAAC,YAAY;YAC3B,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED;0EACkE;QAClE,KAAK,CAAC,aAAa,CAAC,cAAc;YAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;gBACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC;QACJ,CAAC;QAED;;;sFAG8E;QAC9E,KAAK,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,gBAAgB,CAAC,EAAE;gBACjE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,gDAAgD,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;QAED,kFAAkF;QAClF,KAAK,CAAC,WAAW,CAAC,cAAc;YAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;gBAC7C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YAChE,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED;;;8FAGsF;QACtF,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE;oBACrD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,eAAe,EAAE;qBACjC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;iBAChD,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/plugin.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 import fastifyCookie from "@fastify/cookie";
+import { AuthStoreError, IdpAccessRevokedError, classifyIdpError } from "./errors.js";
 import { createOidcClient } from "./oidc-client.js";
 import { generatePkce, randomState } from "./pkce.js";
 import { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken } from "./tokens.js";
@@ -57,12 +58,22 @@ const flytedeskAuthPlugin = async (fastify, options) => {
     fastify.decorateRequest("authUser", undefined);
     // __Host- requires Secure, no Domain attribute, and Path=/ — so the prefix (and the
     // Path=/ it forces) is only used when options.secureCookies says this is actually an
-    // HTTPS deployment. Plain, routePrefix-scoped cookies are used for local HTTP dev,
-    // where __Host- would just make the browser silently refuse to set the cookie.
+    // HTTPS deployment. Plain, scoped cookies are used for local HTTP dev, where __Host-
+    // would just make the browser silently refuse to set the cookie.
     const useHostPrefix = options.secureCookies;
     const refreshCookieName = useHostPrefix ? "__Host-fd_refresh" : "fd_refresh";
     const loginCookieName = useHostPrefix ? "__Host-fd_login_attempt" : "fd_login_attempt";
-    const cookiePath = useHostPrefix ? "/" : routePrefix;
+    // fastify-plugin (fp, below) keeps this plugin's routes in the SAME encapsulation
+    // context as whatever it's registered under — so if a consumer nests it inside an
+    // outer `{ prefix: "/api/v1" }` context, `fastify.prefix` here is already "/api/v1"
+    // and the routes below actually land at `/api/v1${routePrefix}/*`. A cookie's Path
+    // scopes which request paths the browser will ever send it back on; computing it from
+    // `routePrefix` alone (AK-16) ignored that outer prefix entirely, so a browser at
+    // `/api/v1/auth/login` would set a cookie the browser then refuses to send back on
+    // `/api/v1/auth/callback` or `/api/v1/auth/refresh` — a real browser enforces Path
+    // scoping; Fastify's own `inject()` test helper doesn't, which is why this only
+    // surfaced against a real browser (see the nested-prefix test below).
+    const cookiePath = useHostPrefix ? "/" : `${fastify.prefix}${routePrefix}`;
     function refreshCookieOptions(maxAgeSeconds) {
         return {
             httpOnly: true,
@@ -73,35 +84,70 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         };
     }
     const authorizationCache = new Map();
+    const EXPIRY_SKEW_MS = 5_000;
+    /**
+     * Returns a live IdP access token for this session — the one already on the row if
+     * it's not near expiry, otherwise a freshly refreshed one (persisted back via
+     * store.updateIdpSession before returning, since flytedesk-id rotates the refresh
+     * token on every use — see ./oidc-client.ts's refreshIdpTokens doc comment). Shared
+     * by loadAuthedUser (below) and the GET {routePrefix}/apps route, so the refresh
+     * behaviour — and its failure classification — can't drift between the two call
+     * sites. Throws IdpAccessRevokedError (nothing left to refresh with, or flytedesk-id
+     * rejected the refresh token) or IdpUnavailableError (an outage) — never swallows;
+     * every caller is expected to log what it decides to do with the failure (fail
+     * loudly, AK-16).
+     */
+    async function getLiveIdpAccessToken(session) {
+        if (session.idpAccessTokenExpiresAt.getTime() - EXPIRY_SKEW_MS >= Date.now()) {
+            return session.idpAccessToken;
+        }
+        if (!session.idpRefreshToken) {
+            throw new IdpAccessRevokedError("No IdP refresh token on this session — re-login required");
+        }
+        try {
+            const refreshed = await oidc.refreshIdpTokens(session.idpRefreshToken);
+            await store.updateIdpSession(session.id, {
+                idpAccessToken: refreshed.access_token,
+                idpAccessTokenExpiresAt: new Date(Date.now() + refreshed.expires_in * 1000),
+                idpRefreshToken: refreshed.refresh_token ?? session.idpRefreshToken,
+            });
+            return refreshed.access_token;
+        }
+        catch (err) {
+            throw classifyIdpError(err);
+        }
+    }
     /**
      * Live per-request by default: resolves `request.authUser` from the access token's
      * `sid` by looking up the IdpSession, refreshing the IdP token pair if it's near
      * expiry, then calling flytedesk-id's authorization endpoint fresh — see
      * FlytedeskAuthOptions.authorizationCacheTtlMs for the one opt-in exception. Never
-     * throws: any failure just means no AuthedUser gets attached.
+     * throws: any failure just means no AuthedUser gets attached — requireAuth 401s from
+     * there. Every failure that is NOT a routine "no session"/"nothing to refresh with"
+     * outcome is still logged with context (fail loudly, AK-16), distinguishing a
+     * flytedesk-id outage from a genuinely revoked session from an AuthStore failure.
      */
-    async function loadAuthedUser(claims) {
-        const session = await store.findIdpSession(claims.sid);
+    async function loadAuthedUser(request, claims) {
+        let session;
+        try {
+            session = await store.findIdpSession(claims.sid);
+        }
+        catch (err) {
+            request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), sid: claims.sid }, "@flytedesk/app-kit/auth: AuthStore error looking up IdP session");
+            return undefined;
+        }
         if (!session || session.subject !== claims.sub)
+            return undefined; // no session for this claim — expected, not an error
+        let idpAccessToken;
+        try {
+            idpAccessToken = await getLiveIdpAccessToken(session);
+        }
+        catch (err) {
+            const classified = classifyIdpError(err);
+            request.log.error({ err: classified, sid: claims.sid }, classified instanceof IdpAccessRevokedError
+                ? "@flytedesk/app-kit/auth: flytedesk-id refresh token revoked or expired — forcing re-login"
+                : "@flytedesk/app-kit/auth: flytedesk-id token refresh failed — possible IdP outage");
             return undefined;
-        let idpAccessToken = session.idpAccessToken;
-        const EXPIRY_SKEW_MS = 5_000;
-        if (session.idpAccessTokenExpiresAt.getTime() - EXPIRY_SKEW_MS < Date.now()) {
-            if (!session.idpRefreshToken)
-                return undefined; // nothing left to refresh with — force re-login
-            try {
-                const refreshed = await oidc.refreshIdpTokens(session.idpRefreshToken);
-                idpAccessToken = refreshed.access_token;
-                await store.updateIdpSession(session.id, {
-                    idpAccessToken: refreshed.access_token,
-                    idpAccessTokenExpiresAt: new Date(Date.now() + refreshed.expires_in * 1000),
-                    // flytedesk-id rotates refresh tokens on every use — must persist the new one.
-                    idpRefreshToken: refreshed.refresh_token ?? session.idpRefreshToken,
-                });
-            }
-            catch {
-                return undefined; // flytedesk-id refresh token revoked/expired — force re-login
-            }
         }
         let authorization;
         if (options.authorizationCacheTtlMs) {
@@ -113,7 +159,11 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             try {
                 authorization = await oidc.fetchAuthorization(idpAccessToken, options.appId);
             }
-            catch {
+            catch (err) {
+                const classified = classifyIdpError(err);
+                request.log.error({ err: classified, sid: claims.sid }, classified instanceof IdpAccessRevokedError
+                    ? "@flytedesk/app-kit/auth: flytedesk-id revoked this session's authorization"
+                    : "@flytedesk/app-kit/auth: flytedesk-id authorization lookup failed — possible IdP outage");
                 return undefined;
             }
             if (options.authorizationCacheTtlMs) {
@@ -145,7 +195,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             return;
         try {
             const claims = await verifyAccessToken(options.accessTokenSecret, header.slice(7));
-            const user = await loadAuthedUser(claims);
+            const user = await loadAuthedUser(request, claims);
             if (user)
                 request.authUser = user;
         }
@@ -330,6 +380,59 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         reply.setCookie(refreshCookieName, next.token, refreshCookieOptions(refreshTokenTtlSeconds));
         return reply.send({ accessToken, accessTokenExpiresAt: accessExpiresAt.toISOString() });
     });
+    /**
+     * GET {routePrefix}/apps — the "All flytedesk apps" switcher feed (flytedesk-id's
+     * `GET /me/apps`, MP-213/MP-209), served by the plugin itself so every consumer gets
+     * it for free instead of building a second OIDC client and reading the IdP token
+     * straight out of its own AuthStore to call this (the workaround AK-16 replaces —
+     * see sms-app's app.ts before this card). Uses the caller's live, auto-refreshed IdP
+     * access token via getLiveIdpAccessToken, through this plugin's own encapsulated
+     * oidc client — never exposed on request.authUser (AuthedUser deliberately carries
+     * no token). Every upstream failure is mapped to a typed, logged error: never an
+     * unmapped 500 carrying flytedesk-id's raw response text.
+     */
+    fastify.get(`${routePrefix}/apps`, async (request, reply) => {
+        if (!request.authUser) {
+            return reply.code(401).send({ error: "Authentication required", code: "unauthenticated" });
+        }
+        let session;
+        try {
+            session = await store.findIdpSession(request.authUser.sessionId);
+        }
+        catch (err) {
+            request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), sessionId: request.authUser.sessionId }, "@flytedesk/app-kit/auth: /apps AuthStore error looking up IdP session");
+            return reply.code(502).send({ error: "Could not load the signed-in session", code: "auth_store_failed" });
+        }
+        if (!session) {
+            return reply.code(401).send({ error: "Session not found", code: "unauthenticated" });
+        }
+        let idpAccessToken;
+        try {
+            idpAccessToken = await getLiveIdpAccessToken(session);
+        }
+        catch (err) {
+            const classified = classifyIdpError(err);
+            request.log.error({ err: classified, sessionId: session.id }, classified instanceof IdpAccessRevokedError
+                ? "@flytedesk/app-kit/auth: /apps — flytedesk-id refresh token revoked or expired"
+                : "@flytedesk/app-kit/auth: /apps — flytedesk-id token refresh failed, possible outage");
+            if (classified instanceof IdpAccessRevokedError) {
+                return reply.code(401).send({ error: "Sign-in with flytedesk-id has expired", code: "idp_access_revoked" });
+            }
+            return reply.code(502).send({ error: "flytedesk-id is unavailable", code: "idp_unavailable" });
+        }
+        try {
+            const apps = await oidc.fetchMyApps(idpAccessToken);
+            return reply.send({ apps });
+        }
+        catch (err) {
+            const classified = classifyIdpError(err);
+            request.log.error({ err: classified, sessionId: session.id }, "@flytedesk/app-kit/auth: /apps — flytedesk-id /me/apps lookup failed");
+            if (classified instanceof IdpAccessRevokedError) {
+                return reply.code(401).send({ error: "Sign-in with flytedesk-id has expired", code: "idp_access_revoked" });
+            }
+            return reply.code(502).send({ error: "flytedesk-id is unavailable", code: "idp_unavailable" });
+        }
+    });
     /**
      * POST {routePrefix}/logout — revokes the whole refresh-token family (not just the
      * presented cookie) and the IdpSession row, then best-effort revokes the IdP-side
@@ -344,12 +447,30 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             const hash = hashRefreshToken(token);
             const stored = await store.findRefreshTokenByHash(hash);
             if (stored) {
+                // Revoke the local family FIRST and unconditionally — that's what actually
+                // keeps a signed-out browser locked out, independent of anything below.
                 await store.revokeFamily(stored.familyId);
                 const idpSession = await store.findIdpSession(stored.idpSessionId);
                 if (idpSession?.idpRefreshToken) {
-                    await oidc.revokeIdpToken(idpSession.idpRefreshToken).catch(() => undefined);
+                    // revokeIdpToken's own contract (see oidc-client.ts) is never to throw — this
+                    // is best-effort by design (flytedesk-id currently advertises no
+                    // revocation_endpoint at all), not a swallowed failure.
+                    await oidc.revokeIdpToken(idpSession.idpRefreshToken);
+                }
+                try {
+                    await store.deleteIdpSession(stored.idpSessionId);
+                }
+                catch (err) {
+                    // Fail loudly (AK-16): the family is already revoked above, so the browser is
+                    // locked out either way — but a store failure here means the IdpSession row
+                    // (and the IdP tokens it holds) leaked, which is worth surfacing rather than
+                    // reporting a silent, fully-clean "signed out".
+                    request.log.error({ err: new AuthStoreError("AuthStore.deleteIdpSession failed", err), idpSessionId: stored.idpSessionId }, "@flytedesk/app-kit/auth: logout failed to delete the IdP session — the refresh token family is revoked either way");
+                    reply.clearCookie(refreshCookieName, { path: cookiePath });
+                    return reply
+                        .code(502)
+                        .send({ error: "Sign-out did not fully complete", code: "logout_store_failed" });
                 }
-                await store.deleteIdpSession(stored.idpSessionId).catch(() => undefined);
             }
         }
         reply.clearCookie(refreshCookieName, { path: cookiePath });

package/dist/auth/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,+EAA+E;IAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;IAErD,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F;;;;;;OAMG;IACH,KAAK,UAAU,cAAc,CAAC,MAAoC;QAChE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAEjE,IAAI,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC5C,MAAM,cAAc,GAAG,KAAK,CAAC;QAC7B,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5E,IAAI,CAAC,OAAO,CAAC,eAAe;gBAAE,OAAO,SAAS,CAAC,CAAC,gDAAgD;YAChG,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACvE,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC;gBACxC,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE;oBACvC,cAAc,EAAE,SAAS,CAAC,YAAY;oBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;oBAC3E,+EAA+E;oBAC/E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,eAAe;iBACpE,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC,CAAC,8DAA8D;YAClF,CAAC;QACH,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAE5B,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE;YACpE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,GAAG,WAAW,WAAW,EACzB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,kDAAkD;gBACzD,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,0CAA0C;gBACjD,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAwC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,iDAAiD;oBACxD,IAAI,EAAE,kBAAkB;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,4CAA4C;oBACnD,IAAI,EAAE,oBAAoB;iBAC3B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8EAA8E;YAC9E,8EAA8E;YAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,+EAA+E;YAC/E,uCAAuC;YACvC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,YAAY;QACZ,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC/E,CAAC;gBACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,iEAAiE;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,sFAAsF;IACtF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;IAE3E,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F,MAAM,cAAc,GAAG,KAAK,CAAC;IAE7B;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAsB;QACzD,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,cAAc,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAAC,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACvE,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE;gBACvC,cAAc,EAAE,SAAS,CAAC,YAAY;gBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC3E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,eAAe;aACpE,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,MAAoC;QAEpC,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpF,iEAAiE,CAClE,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,CAAC,qDAAqD;QAEvH,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,kFAAkF,CACvF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;oBACzC,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,yFAAyF,CAC9F,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAE5B,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE;YACpE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,GAAG,WAAW,WAAW,EACzB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,kDAAkD;gBACzD,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,0CAA0C;gBACjD,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAwC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,iDAAiD;oBACxD,IAAI,EAAE,kBAAkB;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,4CAA4C;oBACnD,IAAI,EAAE,oBAAoB;iBAC3B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8EAA8E;YAC9E,8EAA8E;YAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,+EAA+E;YAC/E,uCAAuC;YACvC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,YAAY;QACZ,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,EAC1G,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,qFAAqF,CAC1F,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,sEAAsE,CACvE,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,2EAA2E;gBAC3E,wEAAwE;gBACxE,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,8EAA8E;oBAC9E,iEAAiE;oBACjE,wDAAwD;oBACxD,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,gDAAgD;oBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,mCAAmC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACxG,mHAAmH,CACpH,CAAC;oBACF,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC3D,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}

package/dist/auth/shared-types.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Pure data shapes shared between the Node-only server surface (./types.ts,
+ * ./oidc-client.ts) and the browser-safe client (./client/*). This file MUST stay free
+ * of Node built-ins, Fastify, jose, or any other runtime import — it exists precisely so
+ * a browser bundle can import these types (and, post-erasure, nothing else) without
+ * pulling a single byte of server-only code across the boundary. If a type here ever
+ * needs a helper function, that function belongs in a Node-only or browser-only module,
+ * never here.
+ */
+export interface IdpRole {
+    id: string;
+    key: string;
+    name: string;
+}
+/** The shape of `request.authUser` (server) / `GET {api}/me`'s `user` (browser) —
+ *  one definition, so a consuming app's browser code never hand-declares a copy that
+ *  can drift from what the server plugin actually attaches (see AK-16 AC 2247: SMS-5's
+ *  useAuthSession.ts redeclared this by hand before this type existed). */
+export interface AuthedUserDto {
+    id: string;
+    email: string;
+    name: string;
+    roles: IdpRole[];
+    /** Already stripped of the `${appId}:` prefix flytedesk-id's catalog uses — see
+     *  ./plugin.ts's loadAuthedUser. */
+    permissions: string[];
+    sessionId: string;
+}
+/**
+ * One entry from `GET {issuer}/me/apps` — an app the caller holds any role in. Shaped to
+ * drop straight into `@flytedan/flytebot-design-system`'s `AppEntry` ("All flytedesk
+ * apps" switcher, MP-209): `icon` is that same convention's bare Phosphor icon-library
+ * key (e.g. "chart-bar"), not a URL, and either field is `null` for an app flytedesk-id
+ * hasn't been seeded with one for yet.
+ */
+export interface AppSwitcherEntry {
+    key: string;
+    name: string;
+    url: string | null;
+    icon: string | null;
+}
+/** The standard `{error, code, field?}` error body every @flytedesk/app-kit/auth route
+ *  (server) sends on failure, and every consumer's error handling (browser) should
+ *  branch on. */
+export interface ApiErrorBody {
+    error: string;
+    code: string;
+    field?: string;
+}

package/dist/auth/shared-types.js

@@ -0,0 +1,11 @@
+/**
+ * Pure data shapes shared between the Node-only server surface (./types.ts,
+ * ./oidc-client.ts) and the browser-safe client (./client/*). This file MUST stay free
+ * of Node built-ins, Fastify, jose, or any other runtime import — it exists precisely so
+ * a browser bundle can import these types (and, post-erasure, nothing else) without
+ * pulling a single byte of server-only code across the boundary. If a type here ever
+ * needs a helper function, that function belongs in a Node-only or browser-only module,
+ * never here.
+ */
+export {};
+//# sourceMappingURL=shared-types.js.map

package/dist/auth/shared-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-types.js","sourceRoot":"","sources":["../../src/auth/shared-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/auth/testing/fake-idp.d.ts

@@ -0,0 +1,98 @@
+import type { AppSwitcherEntry } from "../oidc-client.js";
+/**
+ * A fake flytedesk-id (OIDC provider) for e2e/integration harnesses, generalized out of
+ * media-planner's `apps/web/e2e/fake-idp.ts` (AK-10 follow-up, R-2/R-10) so every
+ * `@flytedesk/app-kit/auth` consumer gets ONE maintained fixture instead of each app
+ * hand-rolling its own. It serves the exact endpoints `./oidc-client.ts` calls —
+ * discovery, JWKS, `/auth` (authorize), `/token` (authorization_code + refresh, PKCE
+ * S256, Basic client auth), `/me` (userinfo), `/apps/:appId/authorization` (roles +
+ * permissions) and `/me/apps` (the "All flytedesk apps" switcher feed, `fetchMyApps`) —
+ * so a consumer's REAL login → callback → refresh chain runs UNMODIFIED against it. No
+ * bypass ever lands in production code: the consuming app simply points
+ * `FLYTEDESK_ID_ISSUER` at this server in its own e2e setup.
+ *
+ * Unlike the media-planner original, this fixture takes NO opinion on what identities or
+ * permission catalog exist — the caller supplies a map of named identities up front
+ * (`identities`) and picks which one the next `/auth` grants with `setNextIdentity` (in-
+ * process, for a Vitest-style harness) or the cross-process `/__set-identity` HTTP hook
+ * (for a Playwright spec driving a real browser against a real server process).
+ */
+export interface FakeIdpIdentity {
+    sub: string;
+    email: string;
+    name: string;
+    roles: Array<{
+        id: string;
+        key: string;
+        name: string;
+    }>;
+    /** UNPREFIXED permission keys — this fixture app-prefixes them on
+     *  `/apps/:appId/authorization`, exactly as real flytedesk-id does (the consuming
+     *  app's `flytedeskAuth` plugin strips the prefix back off). */
+    permissions: string[];
+    /** Fed to `/me/apps` for `fetchMyApps`/the design system's "All flytedesk apps"
+     *  switcher. Defaults to an empty list. */
+    apps?: AppSwitcherEntry[];
+}
+export interface FakeIdpOptions {
+    clientId: string;
+    /** Defaults to `clientId` — distinct because real flytedesk-id keys the authorization
+     *  catalog on `appId`, not `clientId` (see `FlytedeskAuthOptions.appId`). */
+    appId?: string;
+    /** Every identity this fixture can grant, keyed by a caller-chosen name (e.g. role). */
+    identities: Record<string, FakeIdpIdentity>;
+    /** Which key in `identities` `/auth` grants until `setNextIdentity`/`/__set-identity`
+     *  says otherwise. */
+    defaultIdentityKey: string;
+    /** `expires_in` reported on every access/refresh token response. Default 900 (15
+     *  minutes, matching real flytedesk-id's default) — lets a consumer's test drive a
+     *  real expiry-then-refresh cycle on its own clock instead of waiting on a real one. */
+    accessTokenTtlSeconds?: number;
+}
+export declare class FakeIdp {
+    private server?;
+    private baseUrl;
+    private readonly clientId;
+    private readonly appId;
+    private readonly identities;
+    private nextIdentityKey;
+    private idpSessionLive;
+    private readonly accessTokenTtlSeconds;
+    private forceRefreshFailure;
+    private keys;
+    private publicJwk;
+    private readonly kid;
+    private readonly codes;
+    private readonly grants;
+    constructor(opts: FakeIdpOptions);
+    /** Pick the identity the NEXT `/auth` grants. */
+    setNextIdentity(key: string): void;
+    /** See `idpSessionLive`'s doc comment. */
+    setIdpSessionLive(live: boolean): void;
+    /** Forces every subsequent `grant_type=refresh_token` call to fail with
+     *  `invalid_grant`, exactly as real flytedesk-id would for a revoked/expired refresh
+     *  token — lets a consumer's test exercise its refresh-failure handling (AK-16;
+     *  `@flytedesk/app-kit/auth`'s `loadAuthedUser`/`getLiveIdpAccessToken` force
+     *  re-login on this) without waiting on a real expiry or needing a separate
+     *  `/revoke` call. */
+    setForceRefreshFailure(force: boolean): void;
+    /**
+     * Mutates a registered identity's roles/permissions/apps IN PLACE. Every live grant
+     * already holds a reference to this identity object (this fixture keeps identities by
+     * reference, never a copy — see the file doc comment), so the change is visible on
+     * that identity's very next request, with NO new login required. Lets a consumer's
+     * test simulate flytedesk-id revoking a role or changing an app's catalog entry mid-
+     * session (AK-16), which the plain "log in as a different identity" flow can't do.
+     */
+    updateIdentity(key: string, patch: Partial<Omit<FakeIdpIdentity, "sub">>): void;
+    get url(): string;
+    start(port?: number): Promise<string>;
+    stop(): Promise<void>;
+    private json;
+    private readForm;
+    private bearer;
+    private signIdToken;
+    private issueGrant;
+    private handle;
+    private tokenGrant;
+}