@flytedesk/app-kit 0.7.1 → 1.0.0

package/dist/auth/client/httpClient.d.ts

@@ -10,9 +10,11 @@
  * future change here ever needs one, it belongs in the server (`../plugin.js`) or in a
  * new Node-only module instead.
  */
-import type { ApiErrorBody } from "../shared-types.js";
+import { type ApiErrorBody } from "../shared-types.js";
 /** `expires_in`-free deadline for every call this client makes, unless a caller passes
- *  its own `deadlineMs` — matches media-planner's AUTH_REQUEST_DEADLINE_MS. */
+ *  its own `deadlineMs` — the same `AUTH_REQUEST_DEADLINE_MS` (`../shared-types.js`) the
+ *  server plugin's default `refreshReuseGraceMs` is sized around (2x this), so the two
+ *  can never drift apart — see that option's doc comment in `../types.ts`. */
 export declare const DEFAULT_REQUEST_DEADLINE_MS = 10000;
 export declare class ApiRequestError extends Error {
     code: string;

package/dist/auth/client/httpClient.js

@@ -1,6 +1,21 @@
+/**
+ * Browser-safe BFF session client for `@flytedesk/app-kit/auth`'s cookie/bearer
+ * pattern (POST {api}/auth/refresh -> Bearer on every call, transparent 401 -> refresh
+ * -> retry-once). Extracted (AK-16) from media-planner's
+ * packages/design-system/src/apiClient.ts, which every @flytedesk/app-kit/auth
+ * consumer was otherwise on track to re-implement by hand (see sms-app's
+ * apps/web/src/api/client.ts before this card: no 401-retry, no deadline, a different
+ * single-flight mechanism). This module has ZERO Node imports — no `node:*`, no
+ * Fastify, nothing server-only — so it is safe to import from a browser bundle. If a
+ * future change here ever needs one, it belongs in the server (`../plugin.js`) or in a
+ * new Node-only module instead.
+ */
+import { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, authRoutePath } from "../shared-types.js";
 /** `expires_in`-free deadline for every call this client makes, unless a caller passes
- *  its own `deadlineMs` — matches media-planner's AUTH_REQUEST_DEADLINE_MS. */
-export const DEFAULT_REQUEST_DEADLINE_MS = 10_000;
+ *  its own `deadlineMs` — the same `AUTH_REQUEST_DEADLINE_MS` (`../shared-types.js`) the
+ *  server plugin's default `refreshReuseGraceMs` is sized around (2x this), so the two
+ *  can never drift apart — see that option's doc comment in `../types.ts`. */
+export const DEFAULT_REQUEST_DEADLINE_MS = AUTH_REQUEST_DEADLINE_MS;
 export class ApiRequestError extends Error {
     code;
     field;
@@ -84,8 +99,9 @@ async function withDeadline(what, ms, run) {
  *  sendAndDecode treats exactly like a refused refresh. */
 async function refreshAccessToken() {
     if (!refreshPromise) {
-        refreshPromise = withDeadline("POST /auth/refresh", DEFAULT_REQUEST_DEADLINE_MS, async (signal) => {
-            const res = await fetch(`${baseUrl}/auth/refresh`, {
+        const refreshPath = authRoutePath(AUTH_ROUTE_PREFIX, "refresh");
+        refreshPromise = withDeadline(`POST ${refreshPath}`, DEFAULT_REQUEST_DEADLINE_MS, async (signal) => {
+            const res = await fetch(`${baseUrl}${refreshPath}`, {
                 method: "POST",
                 credentials: "include",
                 signal,

package/dist/auth/client/httpClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../../src/auth/client/httpClient.ts"],"names":[],"mappings":"AAsBA;+EAC+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IACf,MAAM,CAAS;IACf;;qDAEiD;IACjD,IAAI,CAAyC;IAC7C,YAAY,MAAc,EAAE,IAA4C;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,EAAU;QAClC,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,cAAc,GAAkC,IAAI,CAAC;AACzD,IAAI,OAAO,GAAG,SAAS,CAAC;AAExB,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;sBACsB;AACtB,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C;;;;;;+EAM+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,YAAY,GAAG,QAAQ,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,IAAI,YAAY,KAAK,QAAQ;YAAE,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;;4DAG4D;AAC5D,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,EAAU,EACV,GAAwC;IAExC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;2DAG2D;AAC3D,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,YAAY,CAC3B,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,eAAe,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC,CACF;aACE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACjB,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AA0BD;gFACgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA+B;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,GAAG,IAAI,EACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAC5E,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oFAAoF;IACpF,oFAAoF;IACpF,4CAA4C;IAC5C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAID;;;;;kFAKkF;AAClF,KAAK,UAAU,aAAa,CAAI,KAAa,EAAE,OAAgB,EAAE,OAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAI,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAI,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,EAAE,aAAa,EAAE,gBAAgB,EAAe,EAChD,MAAoB;IAEpB,sFAAsF;IACtF,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,iFAAiF;QACjF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS;YAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,4EAA4E;YAC5E,6EAA6E;YAC7E,6DAA6D;YAC7D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACjC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,6EAA6E;gBAC7E,kDAAkD;gBAClD,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,MAAM;oBAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG;aACzB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAA2C,CAAC;QACxG,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;iEAEiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,UAA0B,EAAE;IAC5E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAExG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAqB,EAAE,CAChE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM;QACN,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;0CAI0C;AAC1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../../src/auth/client/httpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AAUnH;;;8EAG8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IACf,MAAM,CAAS;IACf;;qDAEiD;IACjD,IAAI,CAAyC;IAC7C,YAAY,MAAc,EAAE,IAA4C;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,EAAU;QAClC,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,cAAc,GAAkC,IAAI,CAAC;AACzD,IAAI,OAAO,GAAG,SAAS,CAAC;AAExB,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;sBACsB;AACtB,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C;;;;;;+EAM+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,YAAY,GAAG,QAAQ,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,IAAI,YAAY,KAAK,QAAQ;YAAE,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;;4DAG4D;AAC5D,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,EAAU,EACV,GAAwC;IAExC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;2DAG2D;AAC3D,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAChE,cAAc,GAAG,YAAY,CAC3B,QAAQ,WAAW,EAAE,EACrB,2BAA2B,EAC3B,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC,CACF;aACE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACjB,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AA0BD;gFACgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA+B;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,GAAG,IAAI,EACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAC5E,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oFAAoF;IACpF,oFAAoF;IACpF,4CAA4C;IAC5C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAID;;;;;kFAKkF;AAClF,KAAK,UAAU,aAAa,CAAI,KAAa,EAAE,OAAgB,EAAE,OAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAI,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAI,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,EAAE,aAAa,EAAE,gBAAgB,EAAe,EAChD,MAAoB;IAEpB,sFAAsF;IACtF,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,iFAAiF;QACjF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS;YAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,4EAA4E;YAC5E,6EAA6E;YAC7E,6DAA6D;YAC7D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACjC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,6EAA6E;gBAC7E,kDAAkD;gBAClD,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,MAAM;oBAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG;aACzB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAA2C,CAAC;QACxG,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;iEAEiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,UAA0B,EAAE;IAC5E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAExG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAqB,EAAE,CAChE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM;QACN,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;0CAI0C;AAC1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/auth/client/index.d.ts

@@ -5,5 +5,7 @@
  * was extracted from where and why (AK-16).
  */
 export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, type AuthRecovery, type RequestOptions, } from "./httpClient.js";
-export { useAuthSession, type AuthStatus, type AuthSessionState } from "./useAuthSession.js";
-export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody } from "../shared-types.js";
+export { useAuthSession, type AuthStatus, type AuthSessionState, type LoadingSessionState, type AuthenticatedSessionState, type UnauthenticatedSessionState, type ErrorSessionState, } from "./useAuthSession.js";
+export { attemptSilentResume, type SilentResumeResult, type AttemptSilentResumeOptions, } from "./silentAuth.js";
+export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody, SilentAuthMessage } from "../shared-types.js";
+export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, type AuthRouteSegment } from "../shared-types.js";

package/dist/auth/client/index.js

@@ -5,5 +5,7 @@
  * was extracted from where and why (AK-16).
  */
 export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, } from "./httpClient.js";
-export { useAuthSession } from "./useAuthSession.js";
+export { useAuthSession, } from "./useAuthSession.js";
+export { attemptSilentResume, } from "./silentAuth.js";
+export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath } from "../shared-types.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAA0C,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,GAOf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAC"}

package/dist/auth/client/silentAuth.d.ts

@@ -0,0 +1,17 @@
+export type SilentResumeResult = "success" | "login_required" | "error";
+export interface AttemptSilentResumeOptions {
+    /** Well past the typical case (a same-datacenter redirect chain — under a second) but
+     *  short enough that a genuinely hung network doesn't leave the caller waiting
+     *  forever. Default 8000ms, matching media-planner's `SILENT_RESUME_TIMEOUT_MS`.
+     *  Treated as `"error"` (not `"login_required"`) — a timeout means we don't actually
+     *  know whether the IdP-side session is alive or dead. */
+    timeoutMs?: number;
+}
+/**
+ * Single-flighted: a second call while one attempt is already running reuses that same
+ * attempt (and its eventual result) instead of opening a second hidden iframe — a
+ * session layer's reactive path (a request 401ed) and its own cold-start bootstrap can
+ * both end up calling this for the same underlying condition, and this keeps them from
+ * racing two independent iframes/silent-auth attempts against flytedesk-id.
+ */
+export declare function attemptSilentResume(options?: AttemptSilentResumeOptions): Promise<SilentResumeResult>;

package/dist/auth/client/silentAuth.js

@@ -0,0 +1,106 @@
+/**
+ * Browser-safe silent (`prompt=none`) re-auth for `@flytedesk/app-kit/auth`'s BFF
+ * pattern (AK-14, gap 2) — generalized from media-planner's
+ * `packages/design-system/src/silentAuth.ts`. ZERO Node imports, same rule as
+ * `./httpClient.ts`: this is a browser bundle, not a server module.
+ *
+ * `prompt=none` (OIDC Core 3.1.2.1) is a silent authorization request that answers from
+ * flytedesk-id's own existing end-user session cookie with no visible UI at all — the
+ * architectural equivalent of a "Continue as {name}" Google One Tap for an app whose IdP
+ * is flytedesk-id, not Google, so there's nothing for a literal One Tap widget to attach
+ * to. See `../plugin.ts`'s `GET {routePrefix}/login` (`?prompt=none`) and its
+ * `{routePrefix}/callback`'s silent branch for the server half this drives.
+ *
+ * Driven from a hidden iframe rather than a top-level navigation so the running app is
+ * never unmounted/reloaded for an attempt that, most of the time, resolves in well under
+ * a second: the iframe navigates login -> flytedesk-id -> callback entirely on its own,
+ * and the callback's silent branch answers with a tiny page whose only job is a single
+ * `window.parent.postMessage(...)` this module listens for (the `SilentAuthMessage`
+ * contract, `../shared-types.js` — shared with the server so the two sides can never
+ * disagree on its shape).
+ */
+import { getBaseUrl } from "./httpClient.js";
+import { AUTH_ROUTE_PREFIX, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, } from "../shared-types.js";
+const DEFAULT_SILENT_RESUME_TIMEOUT_MS = 8_000;
+function isSilentAuthMessage(data) {
+    return (typeof data === "object" &&
+        data !== null &&
+        data.source === SILENT_AUTH_MESSAGE_SOURCE);
+}
+function resolveLoginUrl() {
+    const base = getBaseUrl();
+    const absolute = /^[a-z][a-z\d+.-]*:\/\//i.test(base) ? base : `${window.location.origin}${base}`;
+    const origin = new URL(absolute).origin;
+    return { url: `${absolute}${authRoutePath(AUTH_ROUTE_PREFIX, "login")}?prompt=none`, origin };
+}
+let inFlight = null;
+/**
+ * Single-flighted: a second call while one attempt is already running reuses that same
+ * attempt (and its eventual result) instead of opening a second hidden iframe — a
+ * session layer's reactive path (a request 401ed) and its own cold-start bootstrap can
+ * both end up calling this for the same underlying condition, and this keeps them from
+ * racing two independent iframes/silent-auth attempts against flytedesk-id.
+ */
+export function attemptSilentResume(options = {}) {
+    if (typeof window === "undefined" || typeof document === "undefined") {
+        return Promise.resolve("error");
+    }
+    if (!inFlight) {
+        inFlight = runSilentResume(options).finally(() => {
+            inFlight = null;
+        });
+    }
+    return inFlight;
+}
+function runSilentResume(options) {
+    return new Promise((resolve) => {
+        const { url, origin } = resolveLoginUrl();
+        const timeoutMs = options.timeoutMs ?? DEFAULT_SILENT_RESUME_TIMEOUT_MS;
+        const iframe = document.createElement("iframe");
+        iframe.style.display = "none";
+        iframe.setAttribute("aria-hidden", "true");
+        iframe.setAttribute("tabindex", "-1");
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            window.removeEventListener("message", onMessage);
+            clearTimeout(timer);
+            iframe.remove();
+            resolve(result);
+        };
+        const onMessage = (event) => {
+            // Both checks matter: `source` confirms the message came from THIS iframe (not
+            // some other frame/extension), `origin` confirms it came from this app's own API
+            // origin specifically — the only origin GET {routePrefix}/login?prompt=none's
+            // callback ever posts from.
+            if (event.source !== iframe.contentWindow)
+                return;
+            if (!isSilentAuthMessage(event.data))
+                return;
+            if (event.origin !== origin) {
+                // Our own iframe answered, but from an origin other than the API base URL's:
+                // the OIDC redirect_uri is not on that origin. The message is still rejected —
+                // never trusted — but as a failure now, loudly, rather than ignored until the
+                // timeout: this can never succeed, and waiting on it only holds the app on its
+                // spinner.
+                console.error(`Silent sign-in callback posted from ${event.origin}, expected ${origin}: the OIDC ` +
+                    `redirect_uri must be on the API base URL's origin.`);
+                finish("error");
+                return;
+            }
+            if (event.data.status === "success") {
+                finish("success");
+            }
+            else {
+                finish(event.data.detail === "login_required" ? "login_required" : "error");
+            }
+        };
+        window.addEventListener("message", onMessage);
+        const timer = setTimeout(() => finish("error"), timeoutMs);
+        iframe.src = url;
+        document.body.appendChild(iframe);
+    });
+}
+//# sourceMappingURL=silentAuth.js.map

package/dist/auth/client/silentAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"silentAuth.js","sourceRoot":"","sources":["../../../src/auth/client/silentAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,0BAA0B,GAE3B,MAAM,oBAAoB,CAAC;AAa5B,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAmC/C,SAAS,mBAAmB,CAAC,IAAa;IACxC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA6B,CAAC,MAAM,KAAK,0BAA0B,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,GAAG,aAAa,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;AAChG,CAAC;AAED,IAAI,QAAQ,GAAuC,IAAI,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAsC,EAAE;IAC1E,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/C,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,OAAmC;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gCAAgC,CAAC;QAExE,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;QAC9B,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAEtC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAE,EAAE;YAC5C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,CAAC,KAA6B,EAAE,EAAE;YAClD,+EAA+E;YAC/E,iFAAiF;YACjF,8EAA8E;YAC9E,4BAA4B;YAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa;gBAAE,OAAO;YAClD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,6EAA6E;gBAC7E,+EAA+E;gBAC/E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,WAAW;gBACX,OAAO,CAAC,KAAK,CACX,uCAAuC,KAAK,CAAC,MAAM,cAAc,MAAM,aAAa;oBAClF,oDAAoD,CACvD,CAAC;gBACF,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/client/useAuthSession.d.ts

@@ -1,25 +1,52 @@
-import type { AppSwitcherEntry } from "../shared-types.js";
+import { type AppSwitcherEntry } from "../shared-types.js";
 export type AuthStatus = "loading" | "authenticated" | "unauthenticated" | "error";
-export interface AuthSessionState<TUser> {
-    status: AuthStatus;
-    user: TUser | null;
-    apps: AppSwitcherEntry[];
-    /** Set only when loading the session failed for a reason OTHER than being signed
-     *  out — the api errored, or a request it depends on missed its deadline. */
-    error: Error | null;
+interface AuthSessionActions {
     /** Surfaces a failed sign-out as a rejection (fail loudly, AK-16) — local state is
-     *  cleared ONLY once the api confirms it, never optimistically. A caller showing a
-     *  pending state on this promise (as a design system's AccountMenu typically does)
-     *  gets an honest failure instead of a UI that claims "signed out" while the refresh
-     *  cookie and its token family are still valid server-side. */
+     *  cleared once the api confirms it, OR once a `logout_store_failed` response proves
+     *  the server already revoked this session regardless (see the doc comment on the
+     *  `logout_store_failed` branch below). A caller showing a pending state on this
+     *  promise (as a design system's AccountMenu typically does) gets an honest failure
+     *  instead of silence. */
     signOut: () => Promise<void>;
     /** Starts a new bootstrap load from scratch — e.g. a Retry action on the error state. */
     refetch: () => void;
 }
+export interface LoadingSessionState extends AuthSessionActions {
+    status: "loading";
+    user: null;
+    apps: AppSwitcherEntry[];
+    error: null;
+}
+/** "authenticated" always carries a user — there is no way to construct this variant
+ *  without one, unlike the pre-AK-18 `{ status: AuthStatus; user: TUser | null }` shape
+ *  that forced every consumer to handle an impossible `authenticated && !user` state by
+ *  hand (sms-app's App.tsx, before this card). */
+export interface AuthenticatedSessionState<TUser> extends AuthSessionActions {
+    status: "authenticated";
+    user: TUser;
+    apps: AppSwitcherEntry[];
+    error: null;
+}
+export interface UnauthenticatedSessionState extends AuthSessionActions {
+    status: "unauthenticated";
+    user: null;
+    apps: AppSwitcherEntry[];
+    error: null;
+}
+/** Set only when loading the session failed for a reason OTHER than being signed out —
+ *  the api errored, or a request it depends on missed its deadline. */
+export interface ErrorSessionState extends AuthSessionActions {
+    status: "error";
+    user: null;
+    apps: AppSwitcherEntry[];
+    error: Error;
+}
+export type AuthSessionState<TUser> = LoadingSessionState | AuthenticatedSessionState<TUser> | UnauthenticatedSessionState | ErrorSessionState;
 /**
  * `TUser` defaults to `unknown` deliberately: a consuming app almost always has its
  * own richer local type (or the exact shape @flytedesk/app-kit/auth's AuthedUser
- * describes) it wants `GET {api}/me`'s `user` decoded as, and should pass it
- * explicitly (`useAuthSession<MyUser>(...)`) rather than this module guessing.
+ * describes) it wants `GET {api}{routePrefix}/me`'s `user` decoded as, and should pass
+ * it explicitly (`useAuthSession<MyUser>(...)`) rather than this module guessing.
  */
 export declare function useAuthSession<TUser = unknown>(): AuthSessionState<TUser>;
+export {};

package/dist/auth/client/useAuthSession.js

@@ -1,26 +1,33 @@
 /**
  * Generic browser session hook for `@flytedesk/app-kit/auth`'s BFF pattern: bootstraps
- * via POST {api}/auth/refresh (the httpOnly refresh cookie) -> GET {api}/me -> GET
- * {api}/apps (the "All flytedesk apps" switcher feed, now served by the plugin itself —
- * see ../plugin.js's GET {routePrefix}/apps). Every consuming app was on track to
- * re-implement this by hand (sms-app's apps/web/src/session/useAuthSession.ts, before
- * this card) — extracting it here (AK-16) means every one gets the StrictMode-safe
- * single-flight bootstrap and the fail-loudly sign-out for free, instead of each app
- * getting a slightly different (and possibly wrong) version of the same ~80 lines.
+ * via POST {api}{routePrefix}/refresh (the httpOnly refresh cookie) -> GET
+ * {api}{routePrefix}/me -> GET {api}{routePrefix}/apps (the "All flytedesk apps"
+ * switcher feed) — all three routes served by the plugin itself (see ../plugin.js) at
+ * the paths ../shared-types.js's route contract names, never a hand-typed string on
+ * either side. Every consuming app was on track to re-implement this by hand (sms-app's
+ * apps/web/src/session/useAuthSession.ts, before this card) — extracting it here (AK-16)
+ * means every one gets the StrictMode-safe single-flight bootstrap and the fail-loudly
+ * sign-out for free, instead of each app getting a slightly different (and possibly
+ * wrong) version of the same ~80 lines.
  *
  * Deliberately narrower than media-planner's SessionKit (packages/design-system/src/
  * session.ts): no silent OIDC resume, no cross-tab identity-switch reload, no RBAC
  * flag helpers. Those stay app-specific policy layered on top of this shared
- * mechanism — media-planner's own switch-over (the PLN-1 card this AK-16 card files)
+ * mechanism — media-planner's own switch-over (the PLN-1 card this AK-18 card files)
  * keeps SessionKit, just pointed at this module's apiRequest instead of its local copy.
  */
 import * as React from "react";
 import { apiRequest, ApiRequestError, setAccessToken } from "./httpClient.js";
+import { AUTH_ROUTE_PREFIX, authRoutePath } from "../shared-types.js";
+const REFRESH_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "refresh");
+const ME_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "me");
+const APPS_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "apps");
+const LOGOUT_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "logout");
 /**
  * `TUser` defaults to `unknown` deliberately: a consuming app almost always has its
  * own richer local type (or the exact shape @flytedesk/app-kit/auth's AuthedUser
- * describes) it wants `GET {api}/me`'s `user` decoded as, and should pass it
- * explicitly (`useAuthSession<MyUser>(...)`) rather than this module guessing.
+ * describes) it wants `GET {api}{routePrefix}/me`'s `user` decoded as, and should pass
+ * it explicitly (`useAuthSession<MyUser>(...)`) rather than this module guessing.
  */
 export function useAuthSession() {
     const [status, setStatus] = React.useState("loading");
@@ -28,12 +35,12 @@ export function useAuthSession() {
     const [apps, setApps] = React.useState([]);
     const [error, setError] = React.useState(null);
     const [generation, setGeneration] = React.useState(0);
-    // POST /auth/refresh ROTATES the refresh cookie on every call (reuse detection — see
-    // @flytedesk/app-kit/auth's plugin.ts) — a second call presenting the same,
+    // POST {routePrefix}/refresh ROTATES the refresh cookie on every call (reuse detection
+    // — see @flytedesk/app-kit/auth's plugin.ts) — a second call presenting the same,
     // now-already-consumed cookie is treated as token replay and revokes the whole
     // session. React 18+'s <StrictMode> intentionally double-invokes this effect in dev
     // (mount -> cleanup -> mount, on the SAME fiber, so this ref survives it) with the
-    // SAME `generation`, which without a guard fires two concurrent /auth/refresh calls
+    // SAME `generation`, which without a guard fires two concurrent refresh calls
     // against that one cookie: the loser gets "token_reuse_detected" and this hook
     // bounces to "unauthenticated" for no signed-out reason at all. Tracking which
     // generation has already started a load — rather than an unconditional `cancelled`
@@ -48,29 +55,12 @@ export function useAuthSession() {
             setStatus("loading");
             setError(null);
             try {
-                const refreshed = await apiRequest("/auth/refresh", { method: "POST" });
+                const refreshed = await apiRequest(REFRESH_PATH, { method: "POST" });
                 setAccessToken(refreshed.accessToken);
-                const me = await apiRequest("/me");
+                const me = await apiRequest(ME_PATH);
                 setUser(me.user);
-                try {
-                    // Matches the plugin's own route (../plugin.js: `GET {routePrefix}/apps`,
-                    // routePrefix default "/auth") — the same "/auth" prefix "/auth/refresh"
-                    // above already uses. A bare "/apps" 404s against the real server (found by
-                    // sms-app's Playwright e2e, the first real consumer to hit this path with an
-                    // unmocked backend — this file's own tests mock fetch and never caught it).
-                    const appsRes = await apiRequest("/auth/apps");
-                    setApps(appsRes.apps);
-                }
-                catch (err) {
-                    // 403 (no permission to see the switcher) is an expected, non-error outcome
-                    // — every other failure is a real error and must propagate.
-                    if (err instanceof ApiRequestError && err.status === 403) {
-                        setApps([]);
-                    }
-                    else {
-                        throw err;
-                    }
-                }
+                const appsRes = await apiRequest(APPS_PATH);
+                setApps(appsRes.apps);
                 setStatus("authenticated");
             }
             catch (err) {
@@ -86,17 +76,43 @@ export function useAuthSession() {
         void load();
     }, [generation]);
     const signOut = React.useCallback(async () => {
-        // Fail loudly: only clear local state once the api actually confirms sign-out —
-        // swallowing this and clearing state regardless would leave the refresh cookie and
-        // its token family valid server-side, silently signing the user back in on the
-        // next load (exactly the SMS-5 code-quality gate finding this hook fixes for good).
-        await apiRequest("/auth/logout", { method: "POST" });
+        try {
+            await apiRequest(LOGOUT_PATH, { method: "POST" });
+        }
+        catch (err) {
+            if (err instanceof ApiRequestError && err.code === "logout_store_failed") {
+                // The plugin revokes the refresh-token family FIRST and unconditionally, before
+                // it ever attempts the AuthStore cleanup that failed here (plugin.ts's POST
+                // {routePrefix}/logout) — so the server already has no valid session for this
+                // browser no matter how this one response is reported. Leaving local state at
+                // "authenticated" here would be exactly the bug the SMS-5 gate found (the design
+                // system's AccountMenu swallowing this rejection and showing nothing): a UI
+                // claiming a live session the server has already revoked. Clearing local state
+                // mirrors the server's actual state; re-throwing still fails loudly so a caller
+                // can surface "sign-out did not fully complete" rather than reporting a clean one.
+                setAccessToken(null);
+                setUser(null);
+                setApps([]);
+                setStatus("unauthenticated");
+            }
+            throw err;
+        }
         setAccessToken(null);
         setUser(null);
         setApps([]);
         setStatus("unauthenticated");
     }, []);
     const refetch = React.useCallback(() => setGeneration((g) => g + 1), []);
-    return { status, user, apps, error, signOut, refetch };
+    const actions = { signOut, refetch };
+    if (status === "authenticated") {
+        // Invariant: the only place status flips to "authenticated" is the line right after
+        // setUser(me.user) above, in the same synchronous pass — so by the time a render
+        // observes status === "authenticated", `user` is never null.
+        return { ...actions, status, user: user, apps, error: null };
+    }
+    if (status === "error") {
+        return { ...actions, status, user: null, apps, error: error ?? new Error("unknown error") };
+    }
+    return { ...actions, status, user: null, apps, error: null };
 }
 //# sourceMappingURL=useAuthSession.js.map

package/dist/auth/client/useAuthSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../src/auth/client/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA2B9E;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAa,SAAS,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAqB,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtD,qFAAqF;IACrF,4EAA4E;IAC5E,+EAA+E;IAC/E,oFAAoF;IACpF,mFAAmF;IACnF,oFAAoF;IACpF,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAgB,IAAI,CAAC,CAAC;IAE/D,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,oBAAoB,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO;QACxD,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;QAE1C,KAAK,UAAU,IAAI;YACjB,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAkB,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzF,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,EAAE,GAAG,MAAM,UAAU,CAAkB,KAAK,CAAC,CAAC;gBACpD,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjB,IAAI,CAAC;oBACH,0EAA0E;oBAC1E,yEAAyE;oBACzE,4EAA4E;oBAC5E,6EAA6E;oBAC7E,4EAA4E;oBAC5E,MAAM,OAAO,GAAG,MAAM,UAAU,CAA+B,YAAY,CAAC,CAAC;oBAC7E,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACxB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,4EAA4E;oBAC5E,4DAA4D;oBAC5D,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBACzD,OAAO,CAAC,EAAE,CAAC,CAAC;oBACd,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,SAAS,CAAC,eAAe,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACzD,SAAS,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9D,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;IACd,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,gFAAgF;QAChF,mFAAmF;QACnF,+EAA+E;QAC/E,oFAAoF;QACpF,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../src/auth/client/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAC;AA6D7F,MAAM,YAAY,GAAG,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAa,SAAS,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAqB,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtD,uFAAuF;IACvF,kFAAkF;IAClF,+EAA+E;IAC/E,oFAAoF;IACpF,mFAAmF;IACnF,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAgB,IAAI,CAAC,CAAC;IAE/D,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,oBAAoB,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO;QACxD,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;QAE1C,KAAK,UAAU,IAAI;YACjB,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAkB,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtF,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,EAAE,GAAG,MAAM,UAAU,CAAkB,OAAO,CAAC,CAAC;gBACtD,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,UAAU,CAA+B,SAAS,CAAC,CAAC;gBAC1E,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtB,SAAS,CAAC,eAAe,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACzD,SAAS,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9D,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;IACd,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACzE,gFAAgF;gBAChF,4EAA4E;gBAC5E,8EAA8E;gBAC9E,8EAA8E;gBAC9E,iFAAiF;gBACjF,4EAA4E;gBAC5E,+EAA+E;gBAC/E,gFAAgF;gBAChF,mFAAmF;gBACnF,cAAc,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,SAAS,CAAC,iBAAiB,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,oFAAoF;QACpF,iFAAiF;QACjF,6DAA6D;QAC7D,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAa,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC"}

package/dist/auth/errors.d.ts

@@ -16,6 +16,18 @@ export declare class IdpError extends Error {
 export declare class IdpUnavailableError extends IdpError {
     constructor(message: string, cause?: unknown);
 }
+/**
+ * A call to flytedesk-id's `/token` endpoint missed its `tokenRequestTimeoutMs` deadline
+ * (AK-14, gap 5) — distinct from a generic `IdpUnavailableError` so a caller can tell "the
+ * IdP hung" apart from "the IdP answered with an error" without inspecting a message
+ * string. A subclass of `IdpUnavailableError`, not a sibling: every existing
+ * `classifyIdpError`/`instanceof IdpUnavailableError` call site already treats a timeout
+ * exactly like any other outage (safe to retry, not a reason to force re-login) — this
+ * only adds a more specific type for a caller that wants to distinguish the two.
+ */
+export declare class IdpTimeoutError extends IdpUnavailableError {
+    constructor(message: string, cause?: unknown);
+}
 /** flytedesk-id answered and said no: the access/refresh token it was given is no
  *  longer valid — revoked, expired past recovery, or the account's access to this app
  *  was pulled. The caller should force re-login, not retry. */

package/dist/auth/errors.js

@@ -23,6 +23,21 @@ export class IdpUnavailableError extends IdpError {
         this.name = "IdpUnavailableError";
     }
 }
+/**
+ * A call to flytedesk-id's `/token` endpoint missed its `tokenRequestTimeoutMs` deadline
+ * (AK-14, gap 5) — distinct from a generic `IdpUnavailableError` so a caller can tell "the
+ * IdP hung" apart from "the IdP answered with an error" without inspecting a message
+ * string. A subclass of `IdpUnavailableError`, not a sibling: every existing
+ * `classifyIdpError`/`instanceof IdpUnavailableError` call site already treats a timeout
+ * exactly like any other outage (safe to retry, not a reason to force re-login) — this
+ * only adds a more specific type for a caller that wants to distinguish the two.
+ */
+export class IdpTimeoutError extends IdpUnavailableError {
+    constructor(message, cause) {
+        super(message, cause);
+        this.name = "IdpTimeoutError";
+    }
+}
 /** flytedesk-id answered and said no: the access/refresh token it was given is no
  *  longer valid — revoked, expired past recovery, or the account's access to this app
  *  was pulled. The caller should force re-login, not retry. */

package/dist/auth/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mFAAmF;AACnF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;sBAEsB;AACtB,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;+DAE+D;AAC/D,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACjD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;uFAEuF;AACvF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;gFAEgF;AAChF,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGpB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC;IAE3F,IAAI,GAAG,YAAY,aAAa,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mFAAmF;AACnF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;sBAEsB;AACtB,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACtD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;+DAE+D;AAC/D,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACjD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;uFAEuF;AACvF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;gFAEgF;AAChF,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGpB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC;IAE3F,IAAI,GAAG,YAAY,aAAa,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/auth/index.d.ts

@@ -5,10 +5,26 @@
  * src/{routes/auth.ts,lib/flytedeskId.ts,plugins/auth.ts} so client id/secret, issuer,
  * redirect URI, and app id are config instead of hardcoded to one app.
  *
+ * This module (`@flytedesk/app-kit/auth`) is the standalone surface: types, the OIDC
+ * client, PKCE/token/error helpers, and the `requireAuth`/`requirePermission` guards —
+ * everything that does NOT need Fastify's `FastifyRequest` ambient-augmented with
+ * `authUser`. The plugin itself (`flytedeskAuth`, and the `declare module "fastify"`
+ * augmentation that comes with registering it) lives at the separate subpath
+ * `@flytedesk/app-kit/auth/plugin` (AK-14, gap 6): TypeScript applies a `declare module`
+ * augmentation program-wide the instant ANY file importing it is part of the
+ * compilation, even transitively — so as long as `flytedeskAuth` was re-exported from
+ * here too, importing just `generatePkce`/`randomState`/`signAccessToken` from this
+ * module forced the augmentation (and its `AuthedUser` shape) onto a consumer's WHOLE
+ * program, with no way to opt out — including a consumer with its own, differently
+ * shaped `request.authUser` who never even registers this plugin (`TS2717: Subsequent
+ * property declarations must have the same type`). Splitting the plugin into its own
+ * subpath means the augmentation only applies to a program that actually imports it.
+ *
  * Usage:
  *
  *   import Fastify from "fastify";
- *   import { flytedeskAuth, requireAuth, requirePermission } from "@flytedesk/app-kit/auth";
+ *   import { flytedeskAuth } from "@flytedesk/app-kit/auth/plugin";
+ *   import { requireAuth, requirePermission } from "@flytedesk/app-kit/auth";
  *
  *   const app = Fastify();
  *   await app.register(flytedeskAuth, {
@@ -26,12 +42,12 @@
  *
  *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
-export { flytedeskAuth } from "./plugin.js";
 export { requireAuth, requirePermission } from "./guards.js";
 export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionRow, RefreshTokenRow, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
-export type { AppSwitcherEntry, IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient, } from "./oidc-client.js";
-export { createOidcClient } from "./oidc-client.js";
-export type { ApiErrorBody } from "./shared-types.js";
-export { IdpError, IdpUnavailableError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
+export type { AppSwitcherEntry, IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient, OidcClientOptions, } from "./oidc-client.js";
+export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_TOKEN_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
+export type { ApiErrorBody, SilentAuthMessage } from "./shared-types.js";
+export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, type AuthRouteSegment, } from "./shared-types.js";
+export { IdpError, IdpUnavailableError, IdpTimeoutError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState, type PkcePair } from "./pkce.js";
 export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, type AccessTokenClaims, } from "./tokens.js";