@flytedesk/app-kit 1.0.0 → 3.0.0

package/README.md

@@ -25,6 +25,56 @@ own domain work resumes.
 pnpm add @flytedesk/app-kit
 ```
 
+## Auth (`@flytedesk/app-kit/auth`)
+
+`idpRequestTimeoutMs` (`FlytedeskAuthOptions`/`OidcClientOptions`, default 5s) bounds
+**every** call this package makes to flytedesk-id — token, userinfo, the per-app
+authorization check, `/me/apps`, discovery and revocation — not just `/token`. A hung
+flytedesk-id endpoint fails loudly with the typed `IdpTimeoutError` instead of hanging
+the request indefinitely; this matters most for the authorization check, which runs on
+every authenticated request to every consumer of this package. Sign-out still completes
+locally (cookies cleared, refresh-token family revoked) even when the IdP-side
+revocation call itself times out.
+
+**Residual risk in the refresh-token grace window (RFC 9700 §4.14.2).** `POST
+{routePrefix}/refresh` rotates the presented refresh token on every call and treats a
+second presentation of an already-rotated token as a legitimate concurrent-tab race
+(401, nothing revoked) rather than reuse, as long as it arrives within
+`refreshReuseGraceMs` (default 20s) of the rotation. This is deliberate — two browser
+tabs sharing one cookie jar can otherwise trip false-positive reuse detection — but it
+means that within that same window, an attacker who has obtained a copy of a
+not-yet-presented refresh token and wins the race against the legitimate browser is
+**indistinguishable from a same-device two-tab race**: both look like "a token was
+rotated, then its predecessor was presented again shortly after." A presentation
+**outside** the window, or of a token that was never rotated at all, is always treated
+as reuse and revokes the whole family. Consumers who need a tighter bound can lower
+`refreshReuseGraceMs`, trading some tolerance for slow concurrent-tab requests for a
+narrower attack window; it cannot be set to zero without reintroducing the false-positive
+two-tab problem this window exists to solve.
+
+**Failed interactive sign-ins land back in the app, not on a raw JSON error page.**
+`signInUrl` (`FlytedeskAuthOptions`, required) is where `GET {routePrefix}/callback`
+redirects an INTERACTIVE (not `prompt=none`) sign-in failure — idp_error (including
+`access_denied` and `login_required`), an invalid/expired login-attempt cookie, a state
+mismatch, or a token exchange/verification failure — with `?signin_error=<code>`
+appended, `<code>` being one of `"expired"`, `"cancelled"`, or `"other"` (never the raw
+internal failure reason, which is logged server-side only). A **silent** (`prompt=none`)
+callback failure is unaffected: it still answers through the existing postMessage
+contract (`SilentAuthMessage`), consumed only inside `./client/silentAuth.js`'s hidden
+iframe. When the login-attempt cookie is missing entirely (its 10-minute
+`loginAttemptTtlSeconds` already elapsed), the `silent` flag can't be recovered — this is
+deliberately always treated as interactive (`signin_error=expired`): a genuinely silent
+attempt runs in a hidden iframe and resolves within seconds, so an expired cookie in
+practice only ever means an interactive one, and a redirect delivered inside a hidden
+iframe is harmless (invisible to the user; the parent page's own listener just times out
+as it would have anyway).
+
+`./client/signInError.js`'s `consumeSignInError()` reads and clears `signin_error` from
+the current page's URL and returns the plain message to render (or `null` when there
+isn't one) — e.g. `error={consumeSignInError()}` straight into
+`@flytedan/flytebot-design-system`'s `SignInPage` (0.21.0+). `@flytedesk/app-kit` itself
+never depends on the design system; this returns a plain string.
+
 ## Publishing
 
 Published to the public npm registry under the `@flytedesk` org, access `restricted`.

package/dist/auth/client/index.d.ts

@@ -7,5 +7,6 @@
 export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, type AuthRecovery, type RequestOptions, } from "./httpClient.js";
 export { useAuthSession, type AuthStatus, type AuthSessionState, type LoadingSessionState, type AuthenticatedSessionState, type UnauthenticatedSessionState, type ErrorSessionState, } from "./useAuthSession.js";
 export { attemptSilentResume, type SilentResumeResult, type AttemptSilentResumeOptions, } from "./silentAuth.js";
+export { consumeSignInError } from "./signInError.js";
 export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody, SilentAuthMessage } from "../shared-types.js";
-export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, type AuthRouteSegment } from "../shared-types.js";
+export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, type AuthRouteSegment, type SignInErrorCode, } from "../shared-types.js";

package/dist/auth/client/index.js

@@ -7,5 +7,6 @@
 export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, } from "./httpClient.js";
 export { useAuthSession, } from "./useAuthSession.js";
 export { attemptSilentResume, } from "./silentAuth.js";
-export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath } from "../shared-types.js";
+export { consumeSignInError } from "./signInError.js";
+export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, } from "../shared-types.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,GAOf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,GAOf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC"}

package/dist/auth/client/signInError.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Reads `?signin_error=<code>` off the current page's URL and returns the plain message
+ * to render, or `null` when the URL carries no `signin_error` at all (the ordinary case
+ * — a fresh visit to the sign-in page, or a successful sign-in that never came back
+ * through this failure path). An unrecognized code (a future server version this client
+ * hasn't caught up to yet, or anything else malformed) renders the same generic message
+ * as `"other"` rather than `null` — the app's callback DID fail, and that's still worth
+ * saying even if this particular code is unknown.
+ *
+ * Removes the param from the URL via `history.replaceState` (never a navigation) before
+ * returning, so a page refresh or a copied/shared link never re-shows a stale error and
+ * the code never lingers in browser history. A caller on the server, or a test with no
+ * `window` at all, gets `null` — there is nothing to read or clear.
+ */
+export declare function consumeSignInError(): string | null;

package/dist/auth/client/signInError.js

@@ -0,0 +1,48 @@
+/**
+ * AK-19: reads (and clears) the `signin_error` query param `../plugin.ts`'s callback
+ * redirects with on every INTERACTIVE sign-in failure, and maps it to a plain, specific
+ * message — so a consuming app's sign-in page can pass ONE string straight to
+ * `@flytedan/flytebot-design-system`'s `SignInPage` `error` prop (0.21.0+) instead of
+ * every app re-parsing the query and re-declaring the same three messages by hand. This
+ * package deliberately never depends on the design system (see package.json's
+ * dependencies — a browser-safe Node package has no business importing a React UI
+ * library), so this returns a plain string or `null`, nothing design-system-shaped; the
+ * consuming app is what wires the string into `SignInPage`.
+ */
+import { SIGNIN_ERROR_CODES, SIGNIN_ERROR_QUERY_PARAM } from "../shared-types.js";
+/** The plain message every app's sign-in page renders for one `SignInErrorCode` —
+ *  see that type's doc comment (`../shared-types.js`) for what collapses into "other". */
+const SIGNIN_ERROR_MESSAGES = {
+    expired: "Your sign-in took too long. Please try again.",
+    cancelled: "Sign-in was cancelled.",
+    other: "Sign-in didn't complete. Please try again.",
+};
+function isSignInErrorCode(value) {
+    return SIGNIN_ERROR_CODES.includes(value);
+}
+/**
+ * Reads `?signin_error=<code>` off the current page's URL and returns the plain message
+ * to render, or `null` when the URL carries no `signin_error` at all (the ordinary case
+ * — a fresh visit to the sign-in page, or a successful sign-in that never came back
+ * through this failure path). An unrecognized code (a future server version this client
+ * hasn't caught up to yet, or anything else malformed) renders the same generic message
+ * as `"other"` rather than `null` — the app's callback DID fail, and that's still worth
+ * saying even if this particular code is unknown.
+ *
+ * Removes the param from the URL via `history.replaceState` (never a navigation) before
+ * returning, so a page refresh or a copied/shared link never re-shows a stale error and
+ * the code never lingers in browser history. A caller on the server, or a test with no
+ * `window` at all, gets `null` — there is nothing to read or clear.
+ */
+export function consumeSignInError() {
+    if (typeof window === "undefined")
+        return null;
+    const url = new URL(window.location.href);
+    const raw = url.searchParams.get(SIGNIN_ERROR_QUERY_PARAM);
+    if (raw === null)
+        return null;
+    url.searchParams.delete(SIGNIN_ERROR_QUERY_PARAM);
+    window.history.replaceState(null, "", url.toString());
+    return SIGNIN_ERROR_MESSAGES[isSignInErrorCode(raw) ? raw : "other"];
+}
+//# sourceMappingURL=signInError.js.map

package/dist/auth/client/signInError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInError.js","sourceRoot":"","sources":["../../../src/auth/client/signInError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAwB,MAAM,oBAAoB,CAAC;AAexG;0FAC0F;AAC1F,MAAM,qBAAqB,GAAoC;IAC7D,OAAO,EAAE,+CAA+C;IACxD,SAAS,EAAE,wBAAwB;IACnC,KAAK,EAAE,4CAA4C;CACpD,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC3D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9B,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAClD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEtD,OAAO,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACvE,CAAC"}

package/dist/auth/index.d.ts

@@ -34,6 +34,7 @@
  *     redirectUri: "https://my-app.flytedesk.com/api/v1/auth/callback",
  *     appId: "my-app",
  *     postLoginRedirect: "https://my-app.flytedesk.com/",
+ *     signInUrl: "https://my-app.flytedesk.com/sign-in",
  *     cookieSecret: process.env.COOKIE_SECRET!,
  *     secureCookies: process.env.NODE_ENV === "production",
  *     accessTokenSecret: process.env.JWT_SECRET!,
@@ -43,11 +44,11 @@
  *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
 export { requireAuth, requirePermission } from "./guards.js";
-export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionRow, RefreshTokenRow, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
+export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionRow, RefreshTokenRow, RevokeFamilyReason, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
 export type { AppSwitcherEntry, IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient, OidcClientOptions, } from "./oidc-client.js";
-export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_TOKEN_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
-export type { ApiErrorBody, SilentAuthMessage } from "./shared-types.js";
-export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, type AuthRouteSegment, } from "./shared-types.js";
+export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_IDP_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
+export type { ApiErrorBody, SilentAuthMessage, SignInErrorCode } from "./shared-types.js";
+export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, type AuthRouteSegment, } from "./shared-types.js";
 export { IdpError, IdpUnavailableError, IdpTimeoutError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState, type PkcePair } from "./pkce.js";
 export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, type AccessTokenClaims, } from "./tokens.js";

package/dist/auth/index.js

@@ -34,6 +34,7 @@
  *     redirectUri: "https://my-app.flytedesk.com/api/v1/auth/callback",
  *     appId: "my-app",
  *     postLoginRedirect: "https://my-app.flytedesk.com/",
+ *     signInUrl: "https://my-app.flytedesk.com/sign-in",
  *     cookieSecret: process.env.COOKIE_SECRET!,
  *     secureCookies: process.env.NODE_ENV === "production",
  *     accessTokenSecret: process.env.JWT_SECRET!,
@@ -43,8 +44,8 @@
  *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
 export { requireAuth, requirePermission } from "./guards.js";
-export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_TOKEN_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
-export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, } from "./shared-types.js";
+export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_IDP_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
+export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, } from "./shared-types.js";
 export { IdpError, IdpUnavailableError, IdpTimeoutError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState } from "./pkce.js";
 export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, } from "./tokens.js";

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAuB7D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gCAAgC,EAAE,MAAM,kBAAkB,CAAC;AAG3G,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAwB7D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAGzG,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}

package/dist/auth/oidc-client.d.ts

@@ -10,12 +10,12 @@ import type { UserinfoClaims } from "./types.js";
  * narrower grant can override via `FlytedeskAuthOptions.scopes`/`OidcClientOptions.scopes`.
  */
 export declare const DEFAULT_OIDC_SCOPES: readonly ["openid", "email", "profile", "offline_access"];
-/** Sane default for every flytedesk-id `/token` call (AK-14, gap 5) — matches
- *  media-planner's `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a
- *  DB transaction + advisory lock around specifically so it can never be held open while
- *  a `/token` call is still in flight. Configurable via
- *  `OidcClientOptions.tokenRequestTimeoutMs`. */
-export declare const DEFAULT_TOKEN_REQUEST_TIMEOUT_MS = 5000;
+/** Sane default for EVERY flytedesk-id call this client makes (AK-20, gap 1 —
+ *  generalized from AK-14 gap 5's `/token`-only timeout) — matches media-planner's
+ *  `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a DB transaction +
+ *  advisory lock around specifically so it can never be held open while a flytedesk-id
+ *  call is still in flight. Configurable via `OidcClientOptions.idpRequestTimeoutMs`. */
+export declare const DEFAULT_IDP_REQUEST_TIMEOUT_MS = 5000;
 export interface OidcClientOptions {
     issuer: string;
     clientId: string;
@@ -24,11 +24,22 @@ export interface OidcClientOptions {
     /** OAuth scopes requested by `buildAuthorizeUrl`. Default `DEFAULT_OIDC_SCOPES`
      *  (includes `offline_access` — see that constant's doc comment). */
     scopes?: string[];
-    /** Bounds every `/token` call (`exchangeCodeForTokens`, `refreshIdpTokens`) via
-     *  `AbortSignal.timeout`. Default `DEFAULT_TOKEN_REQUEST_TIMEOUT_MS`. A hung
-     *  flytedesk-id response rejects with `IdpTimeoutError` instead of hanging the
-     *  caller (and, transitively, whatever lock/transaction it's inside) indefinitely. */
-    tokenRequestTimeoutMs?: number;
+    /**
+     * Bounds EVERY flytedesk-id call this client makes — `/token` (`exchangeCodeForTokens`,
+     * `refreshIdpTokens`), `/me` (`fetchUserinfo`), `/apps/{id}/authorization`
+     * (`fetchAuthorization`), `/me/apps` (`fetchMyApps`), discovery and revocation
+     * (`revokeIdpToken`) — via `AbortSignal.timeout`, through the one bounded-request
+     * helper every one of those methods goes through (AK-20, gap 1; generalized from
+     * AK-14 gap 5, which only bounded `/token`). Default `DEFAULT_IDP_REQUEST_TIMEOUT_MS`.
+     * A hung flytedesk-id response rejects with the typed `IdpTimeoutError` instead of
+     * hanging the caller (and, transitively, whatever lock/transaction/request it's
+     * inside) indefinitely. `fetchAuthorization` runs on every authenticated request
+     * (see `../plugin.ts`'s `loadAuthedUser`), so a hang there previously hung every
+     * signed-in request to every consumer of this package — this option is what closes
+     * that gap. No alias or deprecated name is kept for the old, narrower
+     * `tokenRequestTimeoutMs`.
+     */
+    idpRequestTimeoutMs?: number;
 }
 export interface IdpTokenResponse {
     access_token: string;

package/dist/auth/oidc-client.js

@@ -10,12 +10,12 @@ import { IdpTimeoutError, IdpUnavailableError, OidcHttpError } from "./errors.js
  * narrower grant can override via `FlytedeskAuthOptions.scopes`/`OidcClientOptions.scopes`.
  */
 export const DEFAULT_OIDC_SCOPES = ["openid", "email", "profile", "offline_access"];
-/** Sane default for every flytedesk-id `/token` call (AK-14, gap 5) — matches
- *  media-planner's `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a
- *  DB transaction + advisory lock around specifically so it can never be held open while
- *  a `/token` call is still in flight. Configurable via
- *  `OidcClientOptions.tokenRequestTimeoutMs`. */
-export const DEFAULT_TOKEN_REQUEST_TIMEOUT_MS = 5_000;
+/** Sane default for EVERY flytedesk-id call this client makes (AK-20, gap 1 —
+ *  generalized from AK-14 gap 5's `/token`-only timeout) — matches media-planner's
+ *  `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a DB transaction +
+ *  advisory lock around specifically so it can never be held open while a flytedesk-id
+ *  call is still in flight. Configurable via `OidcClientOptions.idpRequestTimeoutMs`. */
+export const DEFAULT_IDP_REQUEST_TIMEOUT_MS = 5_000;
 /**
  * One instance per FlytedeskAuthOptions (i.e. per plugin registration), not a module
  * singleton — keeps the JWKS/discovery caches below scoped to one issuer/client pair
@@ -39,35 +39,42 @@ export function createOidcClient(opts) {
         const clientSecret = encodeURIComponent(opts.clientSecret);
         return "Basic " + Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
     }
-    const tokenRequestTimeoutMs = opts.tokenRequestTimeoutMs ?? DEFAULT_TOKEN_REQUEST_TIMEOUT_MS;
+    const idpRequestTimeoutMs = opts.idpRequestTimeoutMs ?? DEFAULT_IDP_REQUEST_TIMEOUT_MS;
     /**
-     * Bounded by `AbortSignal.timeout` (AK-14, gap 5): unbounded before this, a hung
-     * flytedesk-id `/token` response could hold open whatever the caller wraps this in —
-     * for a consumer following media-planner's model (`services/idpSession.ts`), a
-     * Postgres transaction + advisory lock sized around exactly this bound. A timeout
-     * throws the more specific `IdpTimeoutError`; any other network failure (DNS, refused
-     * connection, ...) is classified as `IdpUnavailableError` rather than propagating an
-     * unclassified error — both are typed, neither is swallowed.
+     * The ONE bounded-request helper every flytedesk-id call in this client goes through
+     * (AK-20, gap 1) — `tokenRequest` below, `fetchUserinfo`, `fetchAuthorization`,
+     * `fetchMyApps`, `getDiscovery` and `revokeIdpToken`'s own POST all call this instead
+     * of `fetch` directly. Bounded by `AbortSignal.timeout`: unbounded before this card, a
+     * hung flytedesk-id response on ANY of these — most importantly `fetchAuthorization`,
+     * which runs on every authenticated request via `../plugin.ts`'s `loadAuthedUser` —
+     * could hold open whatever the caller wraps it in (for a consumer following
+     * media-planner's model, a Postgres transaction + advisory lock). A timeout throws the
+     * more specific `IdpTimeoutError`; any other network failure (DNS, refused connection,
+     * ...) is classified as `IdpUnavailableError` rather than propagating an unclassified
+     * error — both are typed, neither is swallowed. Deliberately does NOT inspect
+     * `res.ok`: a non-2xx response is still a normal, successfully-received `Response`,
+     * and each call site classifies it into its own message/error shape.
      */
-    async function tokenRequest(body) {
-        let res;
+    async function idpFetch(url, init, label) {
         try {
-            res = await fetch(issuerUrl("/token"), {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                    Authorization: basicAuthHeader(),
-                },
-                body: new URLSearchParams(body).toString(),
-                signal: AbortSignal.timeout(tokenRequestTimeoutMs),
-            });
+            return await fetch(url, { ...init, signal: AbortSignal.timeout(idpRequestTimeoutMs) });
         }
         catch (err) {
             if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
-                throw new IdpTimeoutError(`flytedesk-id /token did not respond within ${tokenRequestTimeoutMs}ms`, err);
+                throw new IdpTimeoutError(`flytedesk-id ${label} did not respond within ${idpRequestTimeoutMs}ms`, err);
             }
-            throw new IdpUnavailableError(`flytedesk-id /token request failed: ${err instanceof Error ? err.message : String(err)}`, err);
+            throw new IdpUnavailableError(`flytedesk-id ${label} request failed: ${err instanceof Error ? err.message : String(err)}`, err);
         }
+    }
+    async function tokenRequest(body) {
+        const res = await idpFetch(issuerUrl("/token"), {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Authorization: basicAuthHeader(),
+            },
+            body: new URLSearchParams(body).toString(),
+        }, "/token");
         if (!res.ok) {
             const text = await res.text().catch(() => "");
             throw new OidcHttpError(`flytedesk-id /token returned ${res.status}: ${text}`, res.status);
@@ -81,7 +88,7 @@ export function createOidcClient(opts) {
     }
     let discoveryCache;
     function getDiscovery() {
-        discoveryCache ??= fetch(issuerUrl("/.well-known/openid-configuration")).then((res) => {
+        discoveryCache ??= idpFetch(issuerUrl("/.well-known/openid-configuration"), {}, "discovery").then((res) => {
             if (!res.ok)
                 throw new Error(`flytedesk-id discovery returned ${res.status}`);
             return res.json();
@@ -144,9 +151,7 @@ export function createOidcClient(opts) {
         /** `GET {issuer}/me` — the profile claims (email/name/email_verified) the id_token
          *  deliberately doesn't carry for the Authorization Code flow. */
         async fetchUserinfo(idpAccessToken) {
-            const res = await fetch(issuerUrl("/me"), {
-                headers: { Authorization: `Bearer ${idpAccessToken}` },
-            });
+            const res = await idpFetch(issuerUrl("/me"), { headers: { Authorization: `Bearer ${idpAccessToken}` } }, "/me");
             if (!res.ok) {
                 throw new OidcHttpError(`flytedesk-id userinfo (/me) returned ${res.status}`, res.status);
             }
@@ -166,9 +171,7 @@ export function createOidcClient(opts) {
          *  by calling this live rather than memoizing the result — see FlytedeskAuthOptions
          *  authorizationCacheTtlMs's doc comment for the one sanctioned exception. */
         async fetchAuthorization(idpAccessToken, appId) {
-            const res = await fetch(issuerUrl(`/apps/${appId}/authorization`), {
-                headers: { Authorization: `Bearer ${idpAccessToken}` },
-            });
+            const res = await idpFetch(issuerUrl(`/apps/${appId}/authorization`), { headers: { Authorization: `Bearer ${idpAccessToken}` } }, "authorization endpoint");
             if (!res.ok) {
                 throw new OidcHttpError(`flytedesk-id authorization endpoint returned ${res.status}`, res.status);
             }
@@ -176,9 +179,7 @@ export function createOidcClient(opts) {
         },
         /** `GET {issuer}/me/apps` — see fetchMyApps's doc comment on OidcClient above. */
         async fetchMyApps(idpAccessToken) {
-            const res = await fetch(issuerUrl("/me/apps"), {
-                headers: { Authorization: `Bearer ${idpAccessToken}` },
-            });
+            const res = await idpFetch(issuerUrl("/me/apps"), { headers: { Authorization: `Bearer ${idpAccessToken}` } }, "/me/apps");
             if (!res.ok) {
                 throw new OidcHttpError(`flytedesk-id /me/apps returned ${res.status}`, res.status);
             }
@@ -194,17 +195,21 @@ export function createOidcClient(opts) {
                 const discovery = await getDiscovery();
                 if (!discovery.revocation_endpoint)
                     return false;
-                const res = await fetch(discovery.revocation_endpoint, {
+                const res = await idpFetch(discovery.revocation_endpoint, {
                     method: "POST",
                     headers: {
                         "Content-Type": "application/x-www-form-urlencoded",
                         Authorization: basicAuthHeader(),
                     },
                     body: new URLSearchParams({ token }).toString(),
-                });
+                }, "revocation");
                 return res.ok;
             }
             catch {
+                // Best-effort by design (see this method's doc comment above) — a timed-out or
+                // otherwise-failed revocation (AK-20, gap 1) must never block local logout, so
+                // an IdpTimeoutError/IdpUnavailableError from idpFetch is swallowed here exactly
+                // like any other failure, not treated specially.
                 return false;
             }
         },

package/dist/auth/oidc-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/auth/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIlF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAU,CAAC;AAE7F;;;;iDAIiD;AACjD,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,CAAC;AA+DtD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,SAAS,SAAS,CAAC,IAAY;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,eAAe;QACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAE7F;;;;;;;;OAQG;IACH,KAAK,UAAU,YAAY,CAAC,IAA4B;QACtD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,eAAe,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;gBAC1C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;gBACvF,MAAM,IAAI,eAAe,CACvB,8CAA8C,qBAAqB,IAAI,EACvE,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,aAAa,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,SAAS,OAAO;QACd,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAsD,CAAC;IAC3D,SAAS,YAAY;QACnB,cAAc,KAAK,KAAK,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7D,OAAO;QACL,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,4FAA4F;QAC5F,qBAAqB,CAAC,IAAI,EAAE,QAAQ;YAClC,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;qCAC6B;QAC7B,gBAAgB,CAAC,YAAY;YAC3B,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED;0EACkE;QAClE,KAAK,CAAC,aAAa,CAAC,cAAc;YAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;gBACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC;QACJ,CAAC;QAED;;;sFAG8E;QAC9E,KAAK,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,gBAAgB,CAAC,EAAE;gBACjE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,gDAAgD,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;QAED,kFAAkF;QAClF,KAAK,CAAC,WAAW,CAAC,cAAc;YAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;gBAC7C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YAChE,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED;;;8FAGsF;QACtF,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE;oBACrD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,eAAe,EAAE;qBACjC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;iBAChD,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/auth/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIlF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAU,CAAC;AAE7F;;;;yFAIyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,KAAK,CAAC;AA0EpD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,SAAS,SAAS,CAAC,IAAY;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,eAAe;QACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,8BAA8B,CAAC;IAEvF;;;;;;;;;;;;;;OAcG;IACH,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,IAAiB,EAAE,KAAa;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;gBACvF,MAAM,IAAI,eAAe,CACvB,gBAAgB,KAAK,2BAA2B,mBAAmB,IAAI,EACvE,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,KAAK,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC3F,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAA4B;QACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,QAAQ,CAAC,EACnB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,eAAe,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,EACD,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,aAAa,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,SAAS,OAAO;QACd,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAsD,CAAC;IAC3D,SAAS,YAAY;QACnB,cAAc,KAAK,QAAQ,CAAC,SAAS,CAAC,mCAAmC,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACxG,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7D,OAAO;QACL,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,4FAA4F;QAC5F,qBAAqB,CAAC,IAAI,EAAE,QAAQ;YAClC,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;qCAC6B;QAC7B,gBAAgB,CAAC,YAAY;YAC3B,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED;0EACkE;QAClE,KAAK,CAAC,aAAa,CAAC,cAAc;YAChC,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,KAAK,CAAC,EAChB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC1D,KAAK,CACN,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC;QACJ,CAAC;QAED;;;sFAG8E;QAC9E,KAAK,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK;YAC5C,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,SAAS,KAAK,gBAAgB,CAAC,EACzC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC1D,wBAAwB,CACzB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,gDAAgD,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;QAED,kFAAkF;QAClF,KAAK,CAAC,WAAW,CAAC,cAAc;YAC9B,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,UAAU,CAAC,EACrB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC1D,UAAU,CACX,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YAChE,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED;;;8FAGsF;QACtF,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,mBAAmB,EAC7B;oBACE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,eAAe,EAAE;qBACjC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;iBAChD,EACD,YAAY,CACb,CAAC;gBACF,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,+EAA+E;gBAC/E,+EAA+E;gBAC/E,iFAAiF;gBACjF,iDAAiD;gBACjD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}