@flytedesk/app-kit 0.6.0 → 0.7.0

package/dist/auth/client/httpClient.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Browser-safe BFF session client for `@flytedesk/app-kit/auth`'s cookie/bearer
+ * pattern (POST {api}/auth/refresh -> Bearer on every call, transparent 401 -> refresh
+ * -> retry-once). Extracted (AK-16) from media-planner's
+ * packages/design-system/src/apiClient.ts, which every @flytedesk/app-kit/auth
+ * consumer was otherwise on track to re-implement by hand (see sms-app's
+ * apps/web/src/api/client.ts before this card: no 401-retry, no deadline, a different
+ * single-flight mechanism). This module has ZERO Node imports — no `node:*`, no
+ * Fastify, nothing server-only — so it is safe to import from a browser bundle. If a
+ * future change here ever needs one, it belongs in the server (`../plugin.js`) or in a
+ * new Node-only module instead.
+ */
+import type { ApiErrorBody } from "../shared-types.js";
+/** `expires_in`-free deadline for every call this client makes, unless a caller passes
+ *  its own `deadlineMs` — matches media-planner's AUTH_REQUEST_DEADLINE_MS. */
+export declare const DEFAULT_REQUEST_DEADLINE_MS = 10000;
+export declare class ApiRequestError extends Error {
+    code: string;
+    field?: string;
+    status: number;
+    /** The full decoded error body, beyond the standard `{error, code, field?}` shape —
+     *  every route's error body still satisfies ApiErrorBody; this is that same object,
+     *  untyped, for routes that add fields to it. */
+    body: ApiErrorBody & Record<string, unknown>;
+    constructor(status: number, body: ApiErrorBody & Record<string, unknown>);
+}
+/** A request that missed its deadline (see withDeadline). */
+export declare class RequestDeadlineError extends Error {
+    constructor(what: string, ms: number);
+}
+export declare function configureApiClient(opts: {
+    baseUrl: string;
+}): void;
+export declare function setAccessToken(token: string | null): void;
+export declare function getAccessToken(): string | null;
+/** As configured via configureApiClient — same origin/path every request in this
+ *  module targets. */
+export declare function getBaseUrl(): string;
+export interface AuthRecovery {
+    /** Runs (or joins) the shared recovery; resolves when it is over, however it ended. */
+    recover(): Promise<void>;
+    /** Whose session this is right now — a stable user id — or null when signed out. */
+    principal(): string | null;
+}
+/** Registers what runs when a request 401s and the automatic refresh-then-retry dance
+ *  (below) also fails to recover it — i.e. the session is genuinely gone, not just a
+ *  normal access-token expiry a refresh already fixed silently. A consuming app's own
+ *  session layer (e.g. one doing a silent OIDC resume, as media-planner's session.ts
+ *  does) is the one owner: it decides what "recovered" means and, failing that,
+ *  invalidates its session state. Left entirely unset is fine — decodeWithAuthRetry
+ *  then just reports the second 401 as a failure, with no recovery attempt. */
+export declare function setAuthRecovery(recovery: AuthRecovery): () => void;
+export interface RequestOptions {
+    method?: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+    body?: unknown;
+    query?: Record<string, string | number | boolean | string[] | undefined>;
+    /** Skip the automatic 401 -> refresh -> retry dance (used by auth routes themselves). */
+    skipAuthRetry?: boolean;
+    /** Bounds the whole call — first attempt, any refresh it waits on, the retry and the
+     *  body decode. Past it the call rejects with a RequestDeadlineError and does nothing
+     *  further (no retry, no auth-failure event). */
+    deadlineMs?: number;
+    /** Set only by a session layer's own bootstrap/probe calls, which ARE the auth
+     *  recovery (or start it): a 401 that survives the refresh still starts the shared
+     *  recovery, but this call does not wait for it — waiting would mean the recovery
+     *  waiting on itself. */
+    ownsAuthRecovery?: boolean;
+    /** Passed straight to `fetch`'s own `keepalive` — lets a request started right
+     *  before the page unloads actually complete instead of being cancelled the instant
+     *  the page goes away. Only meaningfully used with a small body: the browser caps
+     *  the total size of in-flight keepalive requests (~64KB combined). */
+    keepalive?: boolean;
+}
+/** The one place a browser app talks to its own BFF api. Handles bearer auth,
+ *  transparent access-token refresh on 401, and the { error, code, field? } error
+ *  contract every @flytedesk/app-kit/auth-backed api returns. */
+export declare function apiRequest<T>(path: string, options?: RequestOptions): Promise<T>;
+/** Sibling to apiRequest for multipart/form-data uploads. Same bearer auth, 401 ->
+ *  refresh -> retry-once dance, and error contract — but always POSTs `formData` as-is
+ *  (no JSON.stringify) and deliberately never sets a Content-Type header: the browser
+ *  must set its own multipart boundary, and setting Content-Type manually on a
+ *  FormData body breaks that boundary. */
+export declare function apiUpload<T>(path: string, formData: FormData, options?: {
+    skipAuthRetry?: boolean;
+}): Promise<T>;

package/dist/auth/client/httpClient.js

@@ -0,0 +1,218 @@
+/** `expires_in`-free deadline for every call this client makes, unless a caller passes
+ *  its own `deadlineMs` — matches media-planner's AUTH_REQUEST_DEADLINE_MS. */
+export const DEFAULT_REQUEST_DEADLINE_MS = 10_000;
+export class ApiRequestError extends Error {
+    code;
+    field;
+    status;
+    /** The full decoded error body, beyond the standard `{error, code, field?}` shape —
+     *  every route's error body still satisfies ApiErrorBody; this is that same object,
+     *  untyped, for routes that add fields to it. */
+    body;
+    constructor(status, body) {
+        super(body.error);
+        this.name = "ApiRequestError";
+        this.code = body.code;
+        this.field = body.field;
+        this.status = status;
+        this.body = body;
+    }
+}
+/** A request that missed its deadline (see withDeadline). */
+export class RequestDeadlineError extends Error {
+    constructor(what, ms) {
+        super(`${what} did not complete within ${ms}ms`);
+        this.name = "RequestDeadlineError";
+    }
+}
+let accessToken = null;
+let refreshPromise = null;
+let baseUrl = "/api/v1";
+export function configureApiClient(opts) {
+    baseUrl = opts.baseUrl;
+}
+export function setAccessToken(token) {
+    accessToken = token;
+}
+export function getAccessToken() {
+    return accessToken;
+}
+/** As configured via configureApiClient — same origin/path every request in this
+ *  module targets. */
+export function getBaseUrl() {
+    return baseUrl;
+}
+let authRecovery = null;
+/** Registers what runs when a request 401s and the automatic refresh-then-retry dance
+ *  (below) also fails to recover it — i.e. the session is genuinely gone, not just a
+ *  normal access-token expiry a refresh already fixed silently. A consuming app's own
+ *  session layer (e.g. one doing a silent OIDC resume, as media-planner's session.ts
+ *  does) is the one owner: it decides what "recovered" means and, failing that,
+ *  invalidates its session state. Left entirely unset is fine — decodeWithAuthRetry
+ *  then just reports the second 401 as a failure, with no recovery attempt. */
+export function setAuthRecovery(recovery) {
+    authRecovery = recovery;
+    return () => {
+        if (authRecovery === recovery)
+            authRecovery = null;
+    };
+}
+/** Runs `run` under a deadline: past `ms`, its AbortSignal aborts (so the underlying
+ *  fetch, and any body read on it, is cancelled) and the returned promise rejects with
+ *  a RequestDeadlineError — the rejection does not depend on whatever `run` awaits
+ *  honouring the signal, so this settles no matter what. */
+async function withDeadline(what, ms, run) {
+    const controller = new AbortController();
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            const reason = new RequestDeadlineError(what, ms);
+            controller.abort(reason);
+            reject(reason);
+        }, ms);
+    });
+    try {
+        return await Promise.race([run(controller.signal), deadline]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Single-flighted, and always deadline-bound: every caller that 401s shares this one
+ *  refresh, so a refresh that never answered would stall all of them. Any failure — a
+ *  non-2xx, a network error, the deadline — resolves null ("no new token"), which
+ *  sendAndDecode treats exactly like a refused refresh. */
+async function refreshAccessToken() {
+    if (!refreshPromise) {
+        refreshPromise = withDeadline("POST /auth/refresh", DEFAULT_REQUEST_DEADLINE_MS, async (signal) => {
+            const res = await fetch(`${baseUrl}/auth/refresh`, {
+                method: "POST",
+                credentials: "include",
+                signal,
+            });
+            if (!res.ok)
+                return null;
+            const body = (await res.json());
+            setAccessToken(body.accessToken);
+            return body.accessToken;
+        })
+            .catch(() => null)
+            .finally(() => {
+            refreshPromise = null;
+        });
+    }
+    return refreshPromise;
+}
+/** True when baseUrl is itself a full origin (e.g. "https://api.example.com/api/v1"),
+ *  as opposed to a same-origin path like "/api/v1" that a dev proxy handles. */
+function isAbsoluteUrl(value) {
+    return /^[a-z][a-z\d+.-]*:\/\//i.test(value);
+}
+function buildUrl(path, query) {
+    const url = new URL(baseUrl + path, typeof window !== "undefined" ? window.location.origin : "http://localhost");
+    if (query) {
+        for (const [key, value] of Object.entries(query)) {
+            if (value == null || value === "")
+                continue;
+            if (Array.isArray(value))
+                value.forEach((v) => url.searchParams.append(key, String(v)));
+            else
+                url.searchParams.set(key, String(value));
+        }
+    }
+    // baseUrl is either a real absolute origin (production/deployed builds) or a
+    // same-origin path proxied by a dev server. Only strip the origin in the dev case —
+    // a deployed build must keep the real API origin or every request silently resolves
+    // against the web app's own origin instead.
+    return isAbsoluteUrl(baseUrl) ? url.toString() : url.pathname + url.search;
+}
+/** Shared tail of both apiRequest and apiUpload: fires `doFetch`, transparently
+ *  retries once after a refresh on 401 (unless skipped) — and, if that still 401s, once
+ *  more after the shared auth recovery (see setAuthRecovery) — and applies the same
+ *  { error, code, field? } error contract / 204-handling / JSON decode to the result —
+ *  all under `deadlineMs` when one is given (see withDeadline). Kept as one place so
+ *  the auth-retry dance can't drift between the JSON and multipart transports. */
+async function sendAndDecode(label, doFetch, options) {
+    const { deadlineMs } = options;
+    if (deadlineMs === undefined)
+        return decodeWithAuthRetry(doFetch, options);
+    return withDeadline(label, deadlineMs, (signal) => decodeWithAuthRetry(doFetch, options, signal));
+}
+async function decodeWithAuthRetry(doFetch, { skipAuthRetry, ownsAuthRecovery }, signal) {
+    // Who this request is being sent as — the only identity a recovery may replay it for.
+    const recovery = authRecovery;
+    const sentAs = recovery?.principal() ?? null;
+    let res = await doFetch(signal);
+    if (res.status === 401 && !skipAuthRetry) {
+        const refreshed = await refreshAccessToken();
+        // The shared refresh is not cancelled by this call's deadline (other callers may
+        // still want it) — but a call that has already missed its deadline must not act on
+        // its outcome: no retry, and no auth-failure event for a caller that gave up.
+        signal?.throwIfAborted();
+        if (refreshed)
+            res = await doFetch(signal);
+        signal?.throwIfAborted();
+        if (res.status === 401) {
+            // Both the original request and the refresh-then-retry (or the refresh call
+            // itself, if it never returned a token) came back 401 — the session is gone,
+            // not just this in-memory access token. See setAuthRecovery.
+            if (recovery && ownsAuthRecovery) {
+                void recovery.recover();
+            }
+            else if (recovery) {
+                await recovery.recover();
+                signal?.throwIfAborted();
+                // Replay only for the same user. A recovery that ended signed out, or signed
+                // in as someone else, leaves this request failed.
+                if (sentAs !== null && recovery.principal() === sentAs)
+                    res = await doFetch(signal);
+            }
+            signal?.throwIfAborted();
+        }
+    }
+    if (!res.ok) {
+        const errorBody = (await res
+            .json()
+            .catch(() => ({ error: res.statusText, code: "unknown" })));
+        throw new ApiRequestError(res.status, errorBody);
+    }
+    if (res.status === 204)
+        return undefined;
+    return (await res.json());
+}
+/** The one place a browser app talks to its own BFF api. Handles bearer auth,
+ *  transparent access-token refresh on 401, and the { error, code, field? } error
+ *  contract every @flytedesk/app-kit/auth-backed api returns. */
+export async function apiRequest(path, options = {}) {
+    const { method = "GET", body, query, skipAuthRetry, deadlineMs, ownsAuthRecovery, keepalive } = options;
+    const doFetch = async (signal) => fetch(buildUrl(path, query), {
+        method,
+        credentials: "include",
+        headers: {
+            ...(body != null ? { "Content-Type": "application/json" } : {}),
+            ...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}),
+        },
+        body: body != null ? JSON.stringify(body) : undefined,
+        signal,
+        ...(keepalive ? { keepalive: true } : {}),
+    });
+    return sendAndDecode(`${method} ${path}`, doFetch, { skipAuthRetry, deadlineMs, ownsAuthRecovery });
+}
+/** Sibling to apiRequest for multipart/form-data uploads. Same bearer auth, 401 ->
+ *  refresh -> retry-once dance, and error contract — but always POSTs `formData` as-is
+ *  (no JSON.stringify) and deliberately never sets a Content-Type header: the browser
+ *  must set its own multipart boundary, and setting Content-Type manually on a
+ *  FormData body breaks that boundary. */
+export async function apiUpload(path, formData, options = {}) {
+    const { skipAuthRetry } = options;
+    const doFetch = async () => fetch(buildUrl(path), {
+        method: "POST",
+        credentials: "include",
+        headers: {
+            ...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}),
+        },
+        body: formData,
+    });
+    return sendAndDecode(`POST ${path}`, doFetch, { skipAuthRetry });
+}
+//# sourceMappingURL=httpClient.js.map

package/dist/auth/client/httpClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../../src/auth/client/httpClient.ts"],"names":[],"mappings":"AAsBA;+EAC+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IACf,MAAM,CAAS;IACf;;qDAEiD;IACjD,IAAI,CAAyC;IAC7C,YAAY,MAAc,EAAE,IAA4C;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,EAAU;QAClC,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,cAAc,GAAkC,IAAI,CAAC;AACzD,IAAI,OAAO,GAAG,SAAS,CAAC;AAExB,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;sBACsB;AACtB,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C;;;;;;+EAM+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,YAAY,GAAG,QAAQ,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,IAAI,YAAY,KAAK,QAAQ;YAAE,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;;4DAG4D;AAC5D,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,EAAU,EACV,GAAwC;IAExC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;2DAG2D;AAC3D,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,YAAY,CAC3B,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,eAAe,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC,CACF;aACE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACjB,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AA0BD;gFACgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA+B;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,GAAG,IAAI,EACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAC5E,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oFAAoF;IACpF,oFAAoF;IACpF,4CAA4C;IAC5C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAID;;;;;kFAKkF;AAClF,KAAK,UAAU,aAAa,CAAI,KAAa,EAAE,OAAgB,EAAE,OAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAI,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAI,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,EAAE,aAAa,EAAE,gBAAgB,EAAe,EAChD,MAAoB;IAEpB,sFAAsF;IACtF,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,iFAAiF;QACjF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS;YAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,4EAA4E;YAC5E,6EAA6E;YAC7E,6DAA6D;YAC7D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACjC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,6EAA6E;gBAC7E,kDAAkD;gBAClD,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,MAAM;oBAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG;aACzB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAA2C,CAAC;QACxG,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;iEAEiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,UAA0B,EAAE;IAC5E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAExG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAqB,EAAE,CAChE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM;QACN,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;0CAI0C;AAC1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/auth/client/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Browser-safe client for `@flytedesk/app-kit/auth` — a separate subpath export (see
+ * package.json's "exports") so this never drags a single Node/Fastify import into a
+ * browser bundle. See httpClient.ts and useAuthSession.ts's own doc comments for what
+ * was extracted from where and why (AK-16).
+ */
+export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, type AuthRecovery, type RequestOptions, } from "./httpClient.js";
+export { useAuthSession, type AuthStatus, type AuthSessionState } from "./useAuthSession.js";
+export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody } from "../shared-types.js";

package/dist/auth/client/index.js

@@ -0,0 +1,9 @@
+/**
+ * Browser-safe client for `@flytedesk/app-kit/auth` — a separate subpath export (see
+ * package.json's "exports") so this never drags a single Node/Fastify import into a
+ * browser bundle. See httpClient.ts and useAuthSession.ts's own doc comments for what
+ * was extracted from where and why (AK-16).
+ */
+export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, } from "./httpClient.js";
+export { useAuthSession } from "./useAuthSession.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAA0C,MAAM,qBAAqB,CAAC"}

package/dist/auth/client/useAuthSession.d.ts

@@ -0,0 +1,25 @@
+import type { AppSwitcherEntry } from "../shared-types.js";
+export type AuthStatus = "loading" | "authenticated" | "unauthenticated" | "error";
+export interface AuthSessionState<TUser> {
+    status: AuthStatus;
+    user: TUser | null;
+    apps: AppSwitcherEntry[];
+    /** Set only when loading the session failed for a reason OTHER than being signed
+     *  out — the api errored, or a request it depends on missed its deadline. */
+    error: Error | null;
+    /** Surfaces a failed sign-out as a rejection (fail loudly, AK-16) — local state is
+     *  cleared ONLY once the api confirms it, never optimistically. A caller showing a
+     *  pending state on this promise (as a design system's AccountMenu typically does)
+     *  gets an honest failure instead of a UI that claims "signed out" while the refresh
+     *  cookie and its token family are still valid server-side. */
+    signOut: () => Promise<void>;
+    /** Starts a new bootstrap load from scratch — e.g. a Retry action on the error state. */
+    refetch: () => void;
+}
+/**
+ * `TUser` defaults to `unknown` deliberately: a consuming app almost always has its
+ * own richer local type (or the exact shape @flytedesk/app-kit/auth's AuthedUser
+ * describes) it wants `GET {api}/me`'s `user` decoded as, and should pass it
+ * explicitly (`useAuthSession<MyUser>(...)`) rather than this module guessing.
+ */
+export declare function useAuthSession<TUser = unknown>(): AuthSessionState<TUser>;

package/dist/auth/client/useAuthSession.js

@@ -0,0 +1,97 @@
+/**
+ * Generic browser session hook for `@flytedesk/app-kit/auth`'s BFF pattern: bootstraps
+ * via POST {api}/auth/refresh (the httpOnly refresh cookie) -> GET {api}/me -> GET
+ * {api}/apps (the "All flytedesk apps" switcher feed, now served by the plugin itself —
+ * see ../plugin.js's GET {routePrefix}/apps). Every consuming app was on track to
+ * re-implement this by hand (sms-app's apps/web/src/session/useAuthSession.ts, before
+ * this card) — extracting it here (AK-16) means every one gets the StrictMode-safe
+ * single-flight bootstrap and the fail-loudly sign-out for free, instead of each app
+ * getting a slightly different (and possibly wrong) version of the same ~80 lines.
+ *
+ * Deliberately narrower than media-planner's SessionKit (packages/design-system/src/
+ * session.ts): no silent OIDC resume, no cross-tab identity-switch reload, no RBAC
+ * flag helpers. Those stay app-specific policy layered on top of this shared
+ * mechanism — media-planner's own switch-over (the PLN-1 card this AK-16 card files)
+ * keeps SessionKit, just pointed at this module's apiRequest instead of its local copy.
+ */
+import * as React from "react";
+import { apiRequest, ApiRequestError, setAccessToken } from "./httpClient.js";
+/**
+ * `TUser` defaults to `unknown` deliberately: a consuming app almost always has its
+ * own richer local type (or the exact shape @flytedesk/app-kit/auth's AuthedUser
+ * describes) it wants `GET {api}/me`'s `user` decoded as, and should pass it
+ * explicitly (`useAuthSession<MyUser>(...)`) rather than this module guessing.
+ */
+export function useAuthSession() {
+    const [status, setStatus] = React.useState("loading");
+    const [user, setUser] = React.useState(null);
+    const [apps, setApps] = React.useState([]);
+    const [error, setError] = React.useState(null);
+    const [generation, setGeneration] = React.useState(0);
+    // POST /auth/refresh ROTATES the refresh cookie on every call (reuse detection — see
+    // @flytedesk/app-kit/auth's plugin.ts) — a second call presenting the same,
+    // now-already-consumed cookie is treated as token replay and revokes the whole
+    // session. React 18+'s <StrictMode> intentionally double-invokes this effect in dev
+    // (mount -> cleanup -> mount, on the SAME fiber, so this ref survives it) with the
+    // SAME `generation`, which without a guard fires two concurrent /auth/refresh calls
+    // against that one cookie: the loser gets "token_reuse_detected" and this hook
+    // bounces to "unauthenticated" for no signed-out reason at all. Tracking which
+    // generation has already started a load — rather than an unconditional `cancelled`
+    // flag — is what makes the second StrictMode invocation a no-op while still letting
+    // `refetch()` (which bumps `generation`) start a genuinely new load.
+    const startedGenerationRef = React.useRef(null);
+    React.useEffect(() => {
+        if (startedGenerationRef.current === generation)
+            return;
+        startedGenerationRef.current = generation;
+        async function load() {
+            setStatus("loading");
+            setError(null);
+            try {
+                const refreshed = await apiRequest("/auth/refresh", { method: "POST" });
+                setAccessToken(refreshed.accessToken);
+                const me = await apiRequest("/me");
+                setUser(me.user);
+                try {
+                    const appsRes = await apiRequest("/apps");
+                    setApps(appsRes.apps);
+                }
+                catch (err) {
+                    // 403 (no permission to see the switcher) is an expected, non-error outcome
+                    // — every other failure is a real error and must propagate.
+                    if (err instanceof ApiRequestError && err.status === 403) {
+                        setApps([]);
+                    }
+                    else {
+                        throw err;
+                    }
+                }
+                setStatus("authenticated");
+            }
+            catch (err) {
+                if (err instanceof ApiRequestError && err.status === 401) {
+                    setStatus("unauthenticated");
+                }
+                else {
+                    setError(err instanceof Error ? err : new Error(String(err)));
+                    setStatus("error");
+                }
+            }
+        }
+        void load();
+    }, [generation]);
+    const signOut = React.useCallback(async () => {
+        // Fail loudly: only clear local state once the api actually confirms sign-out —
+        // swallowing this and clearing state regardless would leave the refresh cookie and
+        // its token family valid server-side, silently signing the user back in on the
+        // next load (exactly the SMS-5 code-quality gate finding this hook fixes for good).
+        await apiRequest("/auth/logout", { method: "POST" });
+        setAccessToken(null);
+        setUser(null);
+        setApps([]);
+        setStatus("unauthenticated");
+    }, []);
+    const refetch = React.useCallback(() => setGeneration((g) => g + 1), []);
+    return { status, user, apps, error, signOut, refetch };
+}
+//# sourceMappingURL=useAuthSession.js.map

package/dist/auth/client/useAuthSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../src/auth/client/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA2B9E;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAa,SAAS,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAqB,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtD,qFAAqF;IACrF,4EAA4E;IAC5E,+EAA+E;IAC/E,oFAAoF;IACpF,mFAAmF;IACnF,oFAAoF;IACpF,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAgB,IAAI,CAAC,CAAC;IAE/D,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,oBAAoB,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO;QACxD,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;QAE1C,KAAK,UAAU,IAAI;YACjB,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAkB,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzF,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,EAAE,GAAG,MAAM,UAAU,CAAkB,KAAK,CAAC,CAAC;gBACpD,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAA+B,OAAO,CAAC,CAAC;oBACxE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACxB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,4EAA4E;oBAC5E,4DAA4D;oBAC5D,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBACzD,OAAO,CAAC,EAAE,CAAC,CAAC;oBACd,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,SAAS,CAAC,eAAe,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACzD,SAAS,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9D,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;IACd,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,gFAAgF;QAChF,mFAAmF;QACnF,+EAA+E;QAC/E,oFAAoF;QACpF,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzD,CAAC"}

package/dist/auth/errors.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Typed error surface for @flytedesk/app-kit/auth's calls out to flytedesk-id —
+ * mirrors ../bigquery/errors.ts's classify-into-a-small-known-set pattern so a caller
+ * (the plugin's own routes, or a consuming app) can branch on WHY an upstream call
+ * failed instead of string-matching flytedesk-id's raw response. Fail loudly (AK-16):
+ * every one of these is meant to be logged with context, never swallowed silently.
+ */
+/** Base class for every typed error this module raises talking to flytedesk-id. */
+export declare class IdpError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/** flytedesk-id itself is unreachable, erroring, or timed out — a transient outage
+ *  unrelated to this particular user's access. Safe to retry later; not a reason to
+ *  force re-login. */
+export declare class IdpUnavailableError extends IdpError {
+    constructor(message: string, cause?: unknown);
+}
+/** flytedesk-id answered and said no: the access/refresh token it was given is no
+ *  longer valid — revoked, expired past recovery, or the account's access to this app
+ *  was pulled. The caller should force re-login, not retry. */
+export declare class IdpAccessRevokedError extends IdpError {
+    constructor(message: string, cause?: unknown);
+}
+/** The injected AuthStore (findIdpSession/updateIdpSession/deleteIdpSession/...) threw —
+ *  a storage-layer failure (DB down, constraint violation, ...), never to be confused
+ *  with "no session found" (which is a legitimate, expected outcome, not an error). */
+export declare class AuthStoreError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/** Thrown by ./oidc-client.ts for any non-2xx HTTP response from flytedesk-id, carrying
+ *  the real status code so classifyIdpError (below) can tell an outage (5xx, network
+ *  failure) apart from a revocation (401/403) without parsing response text. */
+export declare class OidcHttpError extends Error {
+    readonly status: number;
+    readonly cause?: unknown | undefined;
+    constructor(message: string, status: number, cause?: unknown | undefined);
+}
+/**
+ * Normalizes anything a flytedesk-id call in ./oidc-client.ts can throw/reject with
+ * into an IdpUnavailableError or IdpAccessRevokedError. 401/403 means flytedesk-id
+ * actively rejected the token (revoked/expired/forbidden); anything else — a 5xx, a
+ * network failure, a timeout — is treated as an outage. Never throws itself; always
+ * returns an Error to `throw`/log at the call site.
+ */
+export declare function classifyIdpError(err: unknown): IdpUnavailableError | IdpAccessRevokedError;

package/dist/auth/errors.js

@@ -0,0 +1,75 @@
+/**
+ * Typed error surface for @flytedesk/app-kit/auth's calls out to flytedesk-id —
+ * mirrors ../bigquery/errors.ts's classify-into-a-small-known-set pattern so a caller
+ * (the plugin's own routes, or a consuming app) can branch on WHY an upstream call
+ * failed instead of string-matching flytedesk-id's raw response. Fail loudly (AK-16):
+ * every one of these is meant to be logged with context, never swallowed silently.
+ */
+/** Base class for every typed error this module raises talking to flytedesk-id. */
+export class IdpError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "IdpError";
+    }
+}
+/** flytedesk-id itself is unreachable, erroring, or timed out — a transient outage
+ *  unrelated to this particular user's access. Safe to retry later; not a reason to
+ *  force re-login. */
+export class IdpUnavailableError extends IdpError {
+    constructor(message, cause) {
+        super(message, cause);
+        this.name = "IdpUnavailableError";
+    }
+}
+/** flytedesk-id answered and said no: the access/refresh token it was given is no
+ *  longer valid — revoked, expired past recovery, or the account's access to this app
+ *  was pulled. The caller should force re-login, not retry. */
+export class IdpAccessRevokedError extends IdpError {
+    constructor(message, cause) {
+        super(message, cause);
+        this.name = "IdpAccessRevokedError";
+    }
+}
+/** The injected AuthStore (findIdpSession/updateIdpSession/deleteIdpSession/...) threw —
+ *  a storage-layer failure (DB down, constraint violation, ...), never to be confused
+ *  with "no session found" (which is a legitimate, expected outcome, not an error). */
+export class AuthStoreError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "AuthStoreError";
+    }
+}
+/** Thrown by ./oidc-client.ts for any non-2xx HTTP response from flytedesk-id, carrying
+ *  the real status code so classifyIdpError (below) can tell an outage (5xx, network
+ *  failure) apart from a revocation (401/403) without parsing response text. */
+export class OidcHttpError extends Error {
+    status;
+    cause;
+    constructor(message, status, cause) {
+        super(message);
+        this.status = status;
+        this.cause = cause;
+        this.name = "OidcHttpError";
+    }
+}
+/**
+ * Normalizes anything a flytedesk-id call in ./oidc-client.ts can throw/reject with
+ * into an IdpUnavailableError or IdpAccessRevokedError. 401/403 means flytedesk-id
+ * actively rejected the token (revoked/expired/forbidden); anything else — a 5xx, a
+ * network failure, a timeout — is treated as an outage. Never throws itself; always
+ * returns an Error to `throw`/log at the call site.
+ */
+export function classifyIdpError(err) {
+    if (err instanceof IdpAccessRevokedError || err instanceof IdpUnavailableError)
+        return err;
+    if (err instanceof OidcHttpError && (err.status === 401 || err.status === 403)) {
+        return new IdpAccessRevokedError(err.message, err);
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return new IdpUnavailableError(message, err);
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mFAAmF;AACnF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;sBAEsB;AACtB,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;+DAE+D;AAC/D,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACjD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;uFAEuF;AACvF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;gFAEgF;AAChF,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGpB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC;IAE3F,IAAI,GAAG,YAAY,aAAa,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/auth/index.d.ts

@@ -29,7 +29,9 @@
 export { flytedeskAuth } from "./plugin.js";
 export { requireAuth, requirePermission } from "./guards.js";
 export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionRow, RefreshTokenRow, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
-export type { IdpAppSwitcherEntry, IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient, } from "./oidc-client.js";
+export type { AppSwitcherEntry, IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient, } from "./oidc-client.js";
 export { createOidcClient } from "./oidc-client.js";
+export type { ApiErrorBody } from "./shared-types.js";
+export { IdpError, IdpUnavailableError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState, type PkcePair } from "./pkce.js";
 export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, type AccessTokenClaims, } from "./tokens.js";

package/dist/auth/index.js

@@ -29,6 +29,7 @@
 export { flytedeskAuth } from "./plugin.js";
 export { requireAuth, requirePermission } from "./guards.js";
 export { createOidcClient } from "./oidc-client.js";
+export { IdpError, IdpUnavailableError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState } from "./pkce.js";
 export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, } from "./tokens.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAsB7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAsB7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIpD,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}