@flytedesk/app-kit 0.8.0 → 2.0.0

package/README.md

@@ -25,6 +25,33 @@ own domain work resumes.
 pnpm add @flytedesk/app-kit
 ```
 
+## Auth (`@flytedesk/app-kit/auth`)
+
+`idpRequestTimeoutMs` (`FlytedeskAuthOptions`/`OidcClientOptions`, default 5s) bounds
+**every** call this package makes to flytedesk-id — token, userinfo, the per-app
+authorization check, `/me/apps`, discovery and revocation — not just `/token`. A hung
+flytedesk-id endpoint fails loudly with the typed `IdpTimeoutError` instead of hanging
+the request indefinitely; this matters most for the authorization check, which runs on
+every authenticated request to every consumer of this package. Sign-out still completes
+locally (cookies cleared, refresh-token family revoked) even when the IdP-side
+revocation call itself times out.
+
+**Residual risk in the refresh-token grace window (RFC 9700 §4.14.2).** `POST
+{routePrefix}/refresh` rotates the presented refresh token on every call and treats a
+second presentation of an already-rotated token as a legitimate concurrent-tab race
+(401, nothing revoked) rather than reuse, as long as it arrives within
+`refreshReuseGraceMs` (default 20s) of the rotation. This is deliberate — two browser
+tabs sharing one cookie jar can otherwise trip false-positive reuse detection — but it
+means that within that same window, an attacker who has obtained a copy of a
+not-yet-presented refresh token and wins the race against the legitimate browser is
+**indistinguishable from a same-device two-tab race**: both look like "a token was
+rotated, then its predecessor was presented again shortly after." A presentation
+**outside** the window, or of a token that was never rotated at all, is always treated
+as reuse and revokes the whole family. Consumers who need a tighter bound can lower
+`refreshReuseGraceMs`, trading some tolerance for slow concurrent-tab requests for a
+narrower attack window; it cannot be set to zero without reintroducing the false-positive
+two-tab problem this window exists to solve.
+
 ## Publishing
 
 Published to the public npm registry under the `@flytedesk` org, access `restricted`.

package/dist/auth/client/httpClient.d.ts

@@ -12,7 +12,9 @@
  */
 import { type ApiErrorBody } from "../shared-types.js";
 /** `expires_in`-free deadline for every call this client makes, unless a caller passes
- *  its own `deadlineMs` — matches media-planner's AUTH_REQUEST_DEADLINE_MS. */
+ *  its own `deadlineMs` — the same `AUTH_REQUEST_DEADLINE_MS` (`../shared-types.js`) the
+ *  server plugin's default `refreshReuseGraceMs` is sized around (2x this), so the two
+ *  can never drift apart — see that option's doc comment in `../types.ts`. */
 export declare const DEFAULT_REQUEST_DEADLINE_MS = 10000;
 export declare class ApiRequestError extends Error {
     code: string;

package/dist/auth/client/httpClient.js

@@ -10,10 +10,12 @@
  * future change here ever needs one, it belongs in the server (`../plugin.js`) or in a
  * new Node-only module instead.
  */
-import { AUTH_ROUTE_PREFIX, authRoutePath } from "../shared-types.js";
+import { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, authRoutePath } from "../shared-types.js";
 /** `expires_in`-free deadline for every call this client makes, unless a caller passes
- *  its own `deadlineMs` — matches media-planner's AUTH_REQUEST_DEADLINE_MS. */
-export const DEFAULT_REQUEST_DEADLINE_MS = 10_000;
+ *  its own `deadlineMs` — the same `AUTH_REQUEST_DEADLINE_MS` (`../shared-types.js`) the
+ *  server plugin's default `refreshReuseGraceMs` is sized around (2x this), so the two
+ *  can never drift apart — see that option's doc comment in `../types.ts`. */
+export const DEFAULT_REQUEST_DEADLINE_MS = AUTH_REQUEST_DEADLINE_MS;
 export class ApiRequestError extends Error {
     code;
     field;

package/dist/auth/client/httpClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../../src/auth/client/httpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AAUzF;+EAC+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IACf,MAAM,CAAS;IACf;;qDAEiD;IACjD,IAAI,CAAyC;IAC7C,YAAY,MAAc,EAAE,IAA4C;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,EAAU;QAClC,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,cAAc,GAAkC,IAAI,CAAC;AACzD,IAAI,OAAO,GAAG,SAAS,CAAC;AAExB,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;sBACsB;AACtB,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C;;;;;;+EAM+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,YAAY,GAAG,QAAQ,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,IAAI,YAAY,KAAK,QAAQ;YAAE,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;;4DAG4D;AAC5D,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,EAAU,EACV,GAAwC;IAExC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;2DAG2D;AAC3D,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAChE,cAAc,GAAG,YAAY,CAC3B,QAAQ,WAAW,EAAE,EACrB,2BAA2B,EAC3B,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC,CACF;aACE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACjB,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AA0BD;gFACgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA+B;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,GAAG,IAAI,EACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAC5E,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oFAAoF;IACpF,oFAAoF;IACpF,4CAA4C;IAC5C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAID;;;;;kFAKkF;AAClF,KAAK,UAAU,aAAa,CAAI,KAAa,EAAE,OAAgB,EAAE,OAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAI,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAI,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,EAAE,aAAa,EAAE,gBAAgB,EAAe,EAChD,MAAoB;IAEpB,sFAAsF;IACtF,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,iFAAiF;QACjF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS;YAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,4EAA4E;YAC5E,6EAA6E;YAC7E,6DAA6D;YAC7D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACjC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,6EAA6E;gBAC7E,kDAAkD;gBAClD,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,MAAM;oBAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG;aACzB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAA2C,CAAC;QACxG,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;iEAEiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,UAA0B,EAAE;IAC5E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAExG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAqB,EAAE,CAChE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM;QACN,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;0CAI0C;AAC1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../../src/auth/client/httpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AAUnH;;;8EAG8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IACf,MAAM,CAAS;IACf;;qDAEiD;IACjD,IAAI,CAAyC;IAC7C,YAAY,MAAc,EAAE,IAA4C;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,EAAU;QAClC,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,cAAc,GAAkC,IAAI,CAAC;AACzD,IAAI,OAAO,GAAG,SAAS,CAAC;AAExB,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;sBACsB;AACtB,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C;;;;;;+EAM+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,YAAY,GAAG,QAAQ,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,IAAI,YAAY,KAAK,QAAQ;YAAE,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;;4DAG4D;AAC5D,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,EAAU,EACV,GAAwC;IAExC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;2DAG2D;AAC3D,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAChE,cAAc,GAAG,YAAY,CAC3B,QAAQ,WAAW,EAAE,EACrB,2BAA2B,EAC3B,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC,CACF;aACE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACjB,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AA0BD;gFACgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA+B;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,GAAG,IAAI,EACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAC5E,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oFAAoF;IACpF,oFAAoF;IACpF,4CAA4C;IAC5C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAID;;;;;kFAKkF;AAClF,KAAK,UAAU,aAAa,CAAI,KAAa,EAAE,OAAgB,EAAE,OAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAI,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAI,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,EAAE,aAAa,EAAE,gBAAgB,EAAe,EAChD,MAAoB;IAEpB,sFAAsF;IACtF,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,iFAAiF;QACjF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS;YAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,4EAA4E;YAC5E,6EAA6E;YAC7E,6DAA6D;YAC7D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACjC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,6EAA6E;gBAC7E,kDAAkD;gBAClD,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,MAAM;oBAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG;aACzB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAA2C,CAAC;QACxG,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;iEAEiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,UAA0B,EAAE;IAC5E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAExG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAqB,EAAE,CAChE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM;QACN,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;0CAI0C;AAC1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/auth/client/index.d.ts

@@ -6,5 +6,6 @@
  */
 export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, type AuthRecovery, type RequestOptions, } from "./httpClient.js";
 export { useAuthSession, type AuthStatus, type AuthSessionState, type LoadingSessionState, type AuthenticatedSessionState, type UnauthenticatedSessionState, type ErrorSessionState, } from "./useAuthSession.js";
-export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody } from "../shared-types.js";
+export { attemptSilentResume, type SilentResumeResult, type AttemptSilentResumeOptions, } from "./silentAuth.js";
+export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody, SilentAuthMessage } from "../shared-types.js";
 export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, type AuthRouteSegment } from "../shared-types.js";

package/dist/auth/client/index.js

@@ -6,5 +6,6 @@
  */
 export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, } from "./httpClient.js";
 export { useAuthSession, } from "./useAuthSession.js";
+export { attemptSilentResume, } from "./silentAuth.js";
 export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath } from "../shared-types.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,GAOf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,GAOf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAC"}

package/dist/auth/client/silentAuth.d.ts

@@ -0,0 +1,17 @@
+export type SilentResumeResult = "success" | "login_required" | "error";
+export interface AttemptSilentResumeOptions {
+    /** Well past the typical case (a same-datacenter redirect chain — under a second) but
+     *  short enough that a genuinely hung network doesn't leave the caller waiting
+     *  forever. Default 8000ms, matching media-planner's `SILENT_RESUME_TIMEOUT_MS`.
+     *  Treated as `"error"` (not `"login_required"`) — a timeout means we don't actually
+     *  know whether the IdP-side session is alive or dead. */
+    timeoutMs?: number;
+}
+/**
+ * Single-flighted: a second call while one attempt is already running reuses that same
+ * attempt (and its eventual result) instead of opening a second hidden iframe — a
+ * session layer's reactive path (a request 401ed) and its own cold-start bootstrap can
+ * both end up calling this for the same underlying condition, and this keeps them from
+ * racing two independent iframes/silent-auth attempts against flytedesk-id.
+ */
+export declare function attemptSilentResume(options?: AttemptSilentResumeOptions): Promise<SilentResumeResult>;

package/dist/auth/client/silentAuth.js

@@ -0,0 +1,106 @@
+/**
+ * Browser-safe silent (`prompt=none`) re-auth for `@flytedesk/app-kit/auth`'s BFF
+ * pattern (AK-14, gap 2) — generalized from media-planner's
+ * `packages/design-system/src/silentAuth.ts`. ZERO Node imports, same rule as
+ * `./httpClient.ts`: this is a browser bundle, not a server module.
+ *
+ * `prompt=none` (OIDC Core 3.1.2.1) is a silent authorization request that answers from
+ * flytedesk-id's own existing end-user session cookie with no visible UI at all — the
+ * architectural equivalent of a "Continue as {name}" Google One Tap for an app whose IdP
+ * is flytedesk-id, not Google, so there's nothing for a literal One Tap widget to attach
+ * to. See `../plugin.ts`'s `GET {routePrefix}/login` (`?prompt=none`) and its
+ * `{routePrefix}/callback`'s silent branch for the server half this drives.
+ *
+ * Driven from a hidden iframe rather than a top-level navigation so the running app is
+ * never unmounted/reloaded for an attempt that, most of the time, resolves in well under
+ * a second: the iframe navigates login -> flytedesk-id -> callback entirely on its own,
+ * and the callback's silent branch answers with a tiny page whose only job is a single
+ * `window.parent.postMessage(...)` this module listens for (the `SilentAuthMessage`
+ * contract, `../shared-types.js` — shared with the server so the two sides can never
+ * disagree on its shape).
+ */
+import { getBaseUrl } from "./httpClient.js";
+import { AUTH_ROUTE_PREFIX, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, } from "../shared-types.js";
+const DEFAULT_SILENT_RESUME_TIMEOUT_MS = 8_000;
+function isSilentAuthMessage(data) {
+    return (typeof data === "object" &&
+        data !== null &&
+        data.source === SILENT_AUTH_MESSAGE_SOURCE);
+}
+function resolveLoginUrl() {
+    const base = getBaseUrl();
+    const absolute = /^[a-z][a-z\d+.-]*:\/\//i.test(base) ? base : `${window.location.origin}${base}`;
+    const origin = new URL(absolute).origin;
+    return { url: `${absolute}${authRoutePath(AUTH_ROUTE_PREFIX, "login")}?prompt=none`, origin };
+}
+let inFlight = null;
+/**
+ * Single-flighted: a second call while one attempt is already running reuses that same
+ * attempt (and its eventual result) instead of opening a second hidden iframe — a
+ * session layer's reactive path (a request 401ed) and its own cold-start bootstrap can
+ * both end up calling this for the same underlying condition, and this keeps them from
+ * racing two independent iframes/silent-auth attempts against flytedesk-id.
+ */
+export function attemptSilentResume(options = {}) {
+    if (typeof window === "undefined" || typeof document === "undefined") {
+        return Promise.resolve("error");
+    }
+    if (!inFlight) {
+        inFlight = runSilentResume(options).finally(() => {
+            inFlight = null;
+        });
+    }
+    return inFlight;
+}
+function runSilentResume(options) {
+    return new Promise((resolve) => {
+        const { url, origin } = resolveLoginUrl();
+        const timeoutMs = options.timeoutMs ?? DEFAULT_SILENT_RESUME_TIMEOUT_MS;
+        const iframe = document.createElement("iframe");
+        iframe.style.display = "none";
+        iframe.setAttribute("aria-hidden", "true");
+        iframe.setAttribute("tabindex", "-1");
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            window.removeEventListener("message", onMessage);
+            clearTimeout(timer);
+            iframe.remove();
+            resolve(result);
+        };
+        const onMessage = (event) => {
+            // Both checks matter: `source` confirms the message came from THIS iframe (not
+            // some other frame/extension), `origin` confirms it came from this app's own API
+            // origin specifically — the only origin GET {routePrefix}/login?prompt=none's
+            // callback ever posts from.
+            if (event.source !== iframe.contentWindow)
+                return;
+            if (!isSilentAuthMessage(event.data))
+                return;
+            if (event.origin !== origin) {
+                // Our own iframe answered, but from an origin other than the API base URL's:
+                // the OIDC redirect_uri is not on that origin. The message is still rejected —
+                // never trusted — but as a failure now, loudly, rather than ignored until the
+                // timeout: this can never succeed, and waiting on it only holds the app on its
+                // spinner.
+                console.error(`Silent sign-in callback posted from ${event.origin}, expected ${origin}: the OIDC ` +
+                    `redirect_uri must be on the API base URL's origin.`);
+                finish("error");
+                return;
+            }
+            if (event.data.status === "success") {
+                finish("success");
+            }
+            else {
+                finish(event.data.detail === "login_required" ? "login_required" : "error");
+            }
+        };
+        window.addEventListener("message", onMessage);
+        const timer = setTimeout(() => finish("error"), timeoutMs);
+        iframe.src = url;
+        document.body.appendChild(iframe);
+    });
+}
+//# sourceMappingURL=silentAuth.js.map

package/dist/auth/client/silentAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"silentAuth.js","sourceRoot":"","sources":["../../../src/auth/client/silentAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,0BAA0B,GAE3B,MAAM,oBAAoB,CAAC;AAa5B,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAmC/C,SAAS,mBAAmB,CAAC,IAAa;IACxC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA6B,CAAC,MAAM,KAAK,0BAA0B,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,GAAG,aAAa,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;AAChG,CAAC;AAED,IAAI,QAAQ,GAAuC,IAAI,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAsC,EAAE;IAC1E,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/C,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,OAAmC;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gCAAgC,CAAC;QAExE,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;QAC9B,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAEtC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAE,EAAE;YAC5C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,CAAC,KAA6B,EAAE,EAAE;YAClD,+EAA+E;YAC/E,iFAAiF;YACjF,8EAA8E;YAC9E,4BAA4B;YAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa;gBAAE,OAAO;YAClD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,6EAA6E;gBAC7E,+EAA+E;gBAC/E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,WAAW;gBACX,OAAO,CAAC,KAAK,CACX,uCAAuC,KAAK,CAAC,MAAM,cAAc,MAAM,aAAa;oBAClF,oDAAoD,CACvD,CAAC;gBACF,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/errors.d.ts

@@ -16,6 +16,18 @@ export declare class IdpError extends Error {
 export declare class IdpUnavailableError extends IdpError {
     constructor(message: string, cause?: unknown);
 }
+/**
+ * A call to flytedesk-id's `/token` endpoint missed its `tokenRequestTimeoutMs` deadline
+ * (AK-14, gap 5) — distinct from a generic `IdpUnavailableError` so a caller can tell "the
+ * IdP hung" apart from "the IdP answered with an error" without inspecting a message
+ * string. A subclass of `IdpUnavailableError`, not a sibling: every existing
+ * `classifyIdpError`/`instanceof IdpUnavailableError` call site already treats a timeout
+ * exactly like any other outage (safe to retry, not a reason to force re-login) — this
+ * only adds a more specific type for a caller that wants to distinguish the two.
+ */
+export declare class IdpTimeoutError extends IdpUnavailableError {
+    constructor(message: string, cause?: unknown);
+}
 /** flytedesk-id answered and said no: the access/refresh token it was given is no
  *  longer valid — revoked, expired past recovery, or the account's access to this app
  *  was pulled. The caller should force re-login, not retry. */

package/dist/auth/errors.js

@@ -23,6 +23,21 @@ export class IdpUnavailableError extends IdpError {
         this.name = "IdpUnavailableError";
     }
 }
+/**
+ * A call to flytedesk-id's `/token` endpoint missed its `tokenRequestTimeoutMs` deadline
+ * (AK-14, gap 5) — distinct from a generic `IdpUnavailableError` so a caller can tell "the
+ * IdP hung" apart from "the IdP answered with an error" without inspecting a message
+ * string. A subclass of `IdpUnavailableError`, not a sibling: every existing
+ * `classifyIdpError`/`instanceof IdpUnavailableError` call site already treats a timeout
+ * exactly like any other outage (safe to retry, not a reason to force re-login) — this
+ * only adds a more specific type for a caller that wants to distinguish the two.
+ */
+export class IdpTimeoutError extends IdpUnavailableError {
+    constructor(message, cause) {
+        super(message, cause);
+        this.name = "IdpTimeoutError";
+    }
+}
 /** flytedesk-id answered and said no: the access/refresh token it was given is no
  *  longer valid — revoked, expired past recovery, or the account's access to this app
  *  was pulled. The caller should force re-login, not retry. */

package/dist/auth/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mFAAmF;AACnF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;sBAEsB;AACtB,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;+DAE+D;AAC/D,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACjD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;uFAEuF;AACvF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;gFAEgF;AAChF,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGpB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC;IAE3F,IAAI,GAAG,YAAY,aAAa,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mFAAmF;AACnF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;sBAEsB;AACtB,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACtD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;+DAE+D;AAC/D,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACjD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;uFAEuF;AACvF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;gFAEgF;AAChF,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGpB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC;IAE3F,IAAI,GAAG,YAAY,aAAa,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/auth/index.d.ts

@@ -5,10 +5,26 @@
  * src/{routes/auth.ts,lib/flytedeskId.ts,plugins/auth.ts} so client id/secret, issuer,
  * redirect URI, and app id are config instead of hardcoded to one app.
  *
+ * This module (`@flytedesk/app-kit/auth`) is the standalone surface: types, the OIDC
+ * client, PKCE/token/error helpers, and the `requireAuth`/`requirePermission` guards —
+ * everything that does NOT need Fastify's `FastifyRequest` ambient-augmented with
+ * `authUser`. The plugin itself (`flytedeskAuth`, and the `declare module "fastify"`
+ * augmentation that comes with registering it) lives at the separate subpath
+ * `@flytedesk/app-kit/auth/plugin` (AK-14, gap 6): TypeScript applies a `declare module`
+ * augmentation program-wide the instant ANY file importing it is part of the
+ * compilation, even transitively — so as long as `flytedeskAuth` was re-exported from
+ * here too, importing just `generatePkce`/`randomState`/`signAccessToken` from this
+ * module forced the augmentation (and its `AuthedUser` shape) onto a consumer's WHOLE
+ * program, with no way to opt out — including a consumer with its own, differently
+ * shaped `request.authUser` who never even registers this plugin (`TS2717: Subsequent
+ * property declarations must have the same type`). Splitting the plugin into its own
+ * subpath means the augmentation only applies to a program that actually imports it.
+ *
  * Usage:
  *
  *   import Fastify from "fastify";
- *   import { flytedeskAuth, requireAuth, requirePermission } from "@flytedesk/app-kit/auth";
+ *   import { flytedeskAuth } from "@flytedesk/app-kit/auth/plugin";
+ *   import { requireAuth, requirePermission } from "@flytedesk/app-kit/auth";
  *
  *   const app = Fastify();
  *   await app.register(flytedeskAuth, {
@@ -26,13 +42,12 @@
  *
  *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
-export { flytedeskAuth } from "./plugin.js";
 export { requireAuth, requirePermission } from "./guards.js";
-export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionRow, RefreshTokenRow, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
-export type { AppSwitcherEntry, IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient, } from "./oidc-client.js";
-export { createOidcClient } from "./oidc-client.js";
-export type { ApiErrorBody } from "./shared-types.js";
-export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, type AuthRouteSegment, } from "./shared-types.js";
-export { IdpError, IdpUnavailableError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
+export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionRow, RefreshTokenRow, RevokeFamilyReason, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
+export type { AppSwitcherEntry, IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient, OidcClientOptions, } from "./oidc-client.js";
+export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_IDP_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
+export type { ApiErrorBody, SilentAuthMessage } from "./shared-types.js";
+export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, type AuthRouteSegment, } from "./shared-types.js";
+export { IdpError, IdpUnavailableError, IdpTimeoutError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState, type PkcePair } from "./pkce.js";
 export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, type AccessTokenClaims, } from "./tokens.js";

package/dist/auth/index.js

@@ -5,10 +5,26 @@
  * src/{routes/auth.ts,lib/flytedeskId.ts,plugins/auth.ts} so client id/secret, issuer,
  * redirect URI, and app id are config instead of hardcoded to one app.
  *
+ * This module (`@flytedesk/app-kit/auth`) is the standalone surface: types, the OIDC
+ * client, PKCE/token/error helpers, and the `requireAuth`/`requirePermission` guards —
+ * everything that does NOT need Fastify's `FastifyRequest` ambient-augmented with
+ * `authUser`. The plugin itself (`flytedeskAuth`, and the `declare module "fastify"`
+ * augmentation that comes with registering it) lives at the separate subpath
+ * `@flytedesk/app-kit/auth/plugin` (AK-14, gap 6): TypeScript applies a `declare module`
+ * augmentation program-wide the instant ANY file importing it is part of the
+ * compilation, even transitively — so as long as `flytedeskAuth` was re-exported from
+ * here too, importing just `generatePkce`/`randomState`/`signAccessToken` from this
+ * module forced the augmentation (and its `AuthedUser` shape) onto a consumer's WHOLE
+ * program, with no way to opt out — including a consumer with its own, differently
+ * shaped `request.authUser` who never even registers this plugin (`TS2717: Subsequent
+ * property declarations must have the same type`). Splitting the plugin into its own
+ * subpath means the augmentation only applies to a program that actually imports it.
+ *
  * Usage:
  *
  *   import Fastify from "fastify";
- *   import { flytedeskAuth, requireAuth, requirePermission } from "@flytedesk/app-kit/auth";
+ *   import { flytedeskAuth } from "@flytedesk/app-kit/auth/plugin";
+ *   import { requireAuth, requirePermission } from "@flytedesk/app-kit/auth";
  *
  *   const app = Fastify();
  *   await app.register(flytedeskAuth, {
@@ -26,11 +42,10 @@
  *
  *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
-export { flytedeskAuth } from "./plugin.js";
 export { requireAuth, requirePermission } from "./guards.js";
-export { createOidcClient } from "./oidc-client.js";
-export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, } from "./shared-types.js";
-export { IdpError, IdpUnavailableError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
+export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_IDP_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
+export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, } from "./shared-types.js";
+export { IdpError, IdpUnavailableError, IdpTimeoutError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState } from "./pkce.js";
 export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, } from "./tokens.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAsB7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGpD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,GAEd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAwB7D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAGzG,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}

package/dist/auth/oidc-client.d.ts

@@ -1,10 +1,45 @@
 import type { AppSwitcherEntry } from "./shared-types.js";
 import type { UserinfoClaims } from "./types.js";
+/**
+ * Requested by default (AK-14, gap 1): without `offline_access`, flytedesk-id's
+ * oidc-provider never issues a refresh token, and every session dies the moment its
+ * ~1h IdP-side access token expires — a previously-shipped production bug (see
+ * media-planner's now-superseded `lib/flytedeskId.ts` doc comment on `buildAuthorizeUrl`).
+ * `offline_access` is ON by default here because a session that dies after an hour is
+ * almost never what a consuming app actually wants; a consumer that genuinely needs a
+ * narrower grant can override via `FlytedeskAuthOptions.scopes`/`OidcClientOptions.scopes`.
+ */
+export declare const DEFAULT_OIDC_SCOPES: readonly ["openid", "email", "profile", "offline_access"];
+/** Sane default for EVERY flytedesk-id call this client makes (AK-20, gap 1 —
+ *  generalized from AK-14 gap 5's `/token`-only timeout) — matches media-planner's
+ *  `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a DB transaction +
+ *  advisory lock around specifically so it can never be held open while a flytedesk-id
+ *  call is still in flight. Configurable via `OidcClientOptions.idpRequestTimeoutMs`. */
+export declare const DEFAULT_IDP_REQUEST_TIMEOUT_MS = 5000;
 export interface OidcClientOptions {
     issuer: string;
     clientId: string;
     clientSecret: string;
     redirectUri: string;
+    /** OAuth scopes requested by `buildAuthorizeUrl`. Default `DEFAULT_OIDC_SCOPES`
+     *  (includes `offline_access` — see that constant's doc comment). */
+    scopes?: string[];
+    /**
+     * Bounds EVERY flytedesk-id call this client makes — `/token` (`exchangeCodeForTokens`,
+     * `refreshIdpTokens`), `/me` (`fetchUserinfo`), `/apps/{id}/authorization`
+     * (`fetchAuthorization`), `/me/apps` (`fetchMyApps`), discovery and revocation
+     * (`revokeIdpToken`) — via `AbortSignal.timeout`, through the one bounded-request
+     * helper every one of those methods goes through (AK-20, gap 1; generalized from
+     * AK-14 gap 5, which only bounded `/token`). Default `DEFAULT_IDP_REQUEST_TIMEOUT_MS`.
+     * A hung flytedesk-id response rejects with the typed `IdpTimeoutError` instead of
+     * hanging the caller (and, transitively, whatever lock/transaction/request it's
+     * inside) indefinitely. `fetchAuthorization` runs on every authenticated request
+     * (see `../plugin.ts`'s `loadAuthedUser`), so a hang there previously hung every
+     * signed-in request to every consumer of this package — this option is what closes
+     * that gap. No alias or deprecated name is kept for the old, narrower
+     * `tokenRequestTimeoutMs`.
+     */
+    idpRequestTimeoutMs?: number;
 }
 export interface IdpTokenResponse {
     access_token: string;
@@ -28,9 +63,14 @@ export interface IdpAuthorization {
 }
 export type { AppSwitcherEntry };
 export interface OidcClient {
+    /** `prompt` is passed straight through to flytedesk-id's `/auth` endpoint —
+     *  `"none"` (OIDC Core 3.1.2.1) is what drives silent (hidden-iframe) re-auth; see
+     *  `../plugin.ts`'s `GET {routePrefix}/login` and `./client/silentAuth.ts`. Omitted
+     *  entirely (not sent as an empty string) when not given. */
     buildAuthorizeUrl(opts: {
         state: string;
         challenge: string;
+        prompt?: string;
     }): string;
     exchangeCodeForTokens(code: string, verifier: string): Promise<IdpTokenResponse>;
     refreshIdpTokens(refreshToken: string): Promise<IdpTokenResponse>;

package/dist/auth/oidc-client.js

@@ -1,5 +1,21 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
-import { OidcHttpError } from "./errors.js";
+import { IdpTimeoutError, IdpUnavailableError, OidcHttpError } from "./errors.js";
+/**
+ * Requested by default (AK-14, gap 1): without `offline_access`, flytedesk-id's
+ * oidc-provider never issues a refresh token, and every session dies the moment its
+ * ~1h IdP-side access token expires — a previously-shipped production bug (see
+ * media-planner's now-superseded `lib/flytedeskId.ts` doc comment on `buildAuthorizeUrl`).
+ * `offline_access` is ON by default here because a session that dies after an hour is
+ * almost never what a consuming app actually wants; a consumer that genuinely needs a
+ * narrower grant can override via `FlytedeskAuthOptions.scopes`/`OidcClientOptions.scopes`.
+ */
+export const DEFAULT_OIDC_SCOPES = ["openid", "email", "profile", "offline_access"];
+/** Sane default for EVERY flytedesk-id call this client makes (AK-20, gap 1 —
+ *  generalized from AK-14 gap 5's `/token`-only timeout) — matches media-planner's
+ *  `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a DB transaction +
+ *  advisory lock around specifically so it can never be held open while a flytedesk-id
+ *  call is still in flight. Configurable via `OidcClientOptions.idpRequestTimeoutMs`. */
+export const DEFAULT_IDP_REQUEST_TIMEOUT_MS = 5_000;
 /**
  * One instance per FlytedeskAuthOptions (i.e. per plugin registration), not a module
  * singleton — keeps the JWKS/discovery caches below scoped to one issuer/client pair
@@ -23,15 +39,42 @@ export function createOidcClient(opts) {
         const clientSecret = encodeURIComponent(opts.clientSecret);
         return "Basic " + Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
     }
+    const idpRequestTimeoutMs = opts.idpRequestTimeoutMs ?? DEFAULT_IDP_REQUEST_TIMEOUT_MS;
+    /**
+     * The ONE bounded-request helper every flytedesk-id call in this client goes through
+     * (AK-20, gap 1) — `tokenRequest` below, `fetchUserinfo`, `fetchAuthorization`,
+     * `fetchMyApps`, `getDiscovery` and `revokeIdpToken`'s own POST all call this instead
+     * of `fetch` directly. Bounded by `AbortSignal.timeout`: unbounded before this card, a
+     * hung flytedesk-id response on ANY of these — most importantly `fetchAuthorization`,
+     * which runs on every authenticated request via `../plugin.ts`'s `loadAuthedUser` —
+     * could hold open whatever the caller wraps it in (for a consumer following
+     * media-planner's model, a Postgres transaction + advisory lock). A timeout throws the
+     * more specific `IdpTimeoutError`; any other network failure (DNS, refused connection,
+     * ...) is classified as `IdpUnavailableError` rather than propagating an unclassified
+     * error — both are typed, neither is swallowed. Deliberately does NOT inspect
+     * `res.ok`: a non-2xx response is still a normal, successfully-received `Response`,
+     * and each call site classifies it into its own message/error shape.
+     */
+    async function idpFetch(url, init, label) {
+        try {
+            return await fetch(url, { ...init, signal: AbortSignal.timeout(idpRequestTimeoutMs) });
+        }
+        catch (err) {
+            if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+                throw new IdpTimeoutError(`flytedesk-id ${label} did not respond within ${idpRequestTimeoutMs}ms`, err);
+            }
+            throw new IdpUnavailableError(`flytedesk-id ${label} request failed: ${err instanceof Error ? err.message : String(err)}`, err);
+        }
+    }
     async function tokenRequest(body) {
-        const res = await fetch(issuerUrl("/token"), {
+        const res = await idpFetch(issuerUrl("/token"), {
             method: "POST",
             headers: {
                 "Content-Type": "application/x-www-form-urlencoded",
                 Authorization: basicAuthHeader(),
             },
             body: new URLSearchParams(body).toString(),
-        });
+        }, "/token");
         if (!res.ok) {
             const text = await res.text().catch(() => "");
             throw new OidcHttpError(`flytedesk-id /token returned ${res.status}: ${text}`, res.status);
@@ -45,23 +88,26 @@ export function createOidcClient(opts) {
     }
     let discoveryCache;
     function getDiscovery() {
-        discoveryCache ??= fetch(issuerUrl("/.well-known/openid-configuration")).then((res) => {
+        discoveryCache ??= idpFetch(issuerUrl("/.well-known/openid-configuration"), {}, "discovery").then((res) => {
             if (!res.ok)
                 throw new Error(`flytedesk-id discovery returned ${res.status}`);
             return res.json();
         });
         return discoveryCache;
     }
+    const scope = (opts.scopes ?? DEFAULT_OIDC_SCOPES).join(" ");
     return {
-        buildAuthorizeUrl({ state, challenge }) {
+        buildAuthorizeUrl({ state, challenge, prompt }) {
             const url = new URL(issuerUrl("/auth"));
             url.searchParams.set("client_id", opts.clientId);
             url.searchParams.set("redirect_uri", opts.redirectUri);
             url.searchParams.set("response_type", "code");
-            url.searchParams.set("scope", "openid email profile");
+            url.searchParams.set("scope", scope);
             url.searchParams.set("code_challenge", challenge);
             url.searchParams.set("code_challenge_method", "S256");
             url.searchParams.set("state", state);
+            if (prompt)
+                url.searchParams.set("prompt", prompt);
             return url.toString();
         },
         /** Authorization Code + PKCE exchange — the one moment this app's client_secret is used. */
@@ -105,9 +151,7 @@ export function createOidcClient(opts) {
         /** `GET {issuer}/me` — the profile claims (email/name/email_verified) the id_token
          *  deliberately doesn't carry for the Authorization Code flow. */
         async fetchUserinfo(idpAccessToken) {
-            const res = await fetch(issuerUrl("/me"), {
-                headers: { Authorization: `Bearer ${idpAccessToken}` },
-            });
+            const res = await idpFetch(issuerUrl("/me"), { headers: { Authorization: `Bearer ${idpAccessToken}` } }, "/me");
             if (!res.ok) {
                 throw new OidcHttpError(`flytedesk-id userinfo (/me) returned ${res.status}`, res.status);
             }
@@ -127,9 +171,7 @@ export function createOidcClient(opts) {
          *  by calling this live rather than memoizing the result — see FlytedeskAuthOptions
          *  authorizationCacheTtlMs's doc comment for the one sanctioned exception. */
         async fetchAuthorization(idpAccessToken, appId) {
-            const res = await fetch(issuerUrl(`/apps/${appId}/authorization`), {
-                headers: { Authorization: `Bearer ${idpAccessToken}` },
-            });
+            const res = await idpFetch(issuerUrl(`/apps/${appId}/authorization`), { headers: { Authorization: `Bearer ${idpAccessToken}` } }, "authorization endpoint");
             if (!res.ok) {
                 throw new OidcHttpError(`flytedesk-id authorization endpoint returned ${res.status}`, res.status);
             }
@@ -137,9 +179,7 @@ export function createOidcClient(opts) {
         },
         /** `GET {issuer}/me/apps` — see fetchMyApps's doc comment on OidcClient above. */
         async fetchMyApps(idpAccessToken) {
-            const res = await fetch(issuerUrl("/me/apps"), {
-                headers: { Authorization: `Bearer ${idpAccessToken}` },
-            });
+            const res = await idpFetch(issuerUrl("/me/apps"), { headers: { Authorization: `Bearer ${idpAccessToken}` } }, "/me/apps");
             if (!res.ok) {
                 throw new OidcHttpError(`flytedesk-id /me/apps returned ${res.status}`, res.status);
             }
@@ -155,17 +195,21 @@ export function createOidcClient(opts) {
                 const discovery = await getDiscovery();
                 if (!discovery.revocation_endpoint)
                     return false;
-                const res = await fetch(discovery.revocation_endpoint, {
+                const res = await idpFetch(discovery.revocation_endpoint, {
                     method: "POST",
                     headers: {
                         "Content-Type": "application/x-www-form-urlencoded",
                         Authorization: basicAuthHeader(),
                     },
                     body: new URLSearchParams({ token }).toString(),
-                });
+                }, "revocation");
                 return res.ok;
             }
             catch {
+                // Best-effort by design (see this method's doc comment above) — a timed-out or
+                // otherwise-failed revocation (AK-20, gap 1) must never block local logout, so
+                // an IdpTimeoutError/IdpUnavailableError from idpFetch is swallowed here exactly
+                // like any other failure, not treated specially.
                 return false;
             }
         },