@flytedesk/app-kit 6.0.0 → 7.1.0

package/dist/auth/client/testing.js

@@ -0,0 +1,20 @@
+/**
+ * `@flytedesk/app-kit/auth/client/testing` — seams for an app's OWN unit tests (AK-35),
+ * never for app code. The session's access token and lifecycle are private to
+ * `@flytedesk/app-kit/auth/client`; a test that exercises `apiRequest` against a mocked
+ * `fetch`, or renders a component under `useAuthSession`, sets them up through here.
+ */
+import { setAccessToken } from "./httpClient.js";
+import { resetAuthSession } from "./browserEnvironment.js";
+/** Makes every following `apiRequest`/`apiUpload`/`apiDownload` send `token` as its
+ *  Bearer — as if the session had just refreshed. `null` clears it. */
+export function setTestAccessToken(token) {
+    setAccessToken(token);
+}
+/** Stops the tab's session lifecycle, forgets its state and clears the access token, so
+ *  the next test starts from a fresh boot. */
+export function resetAuthSessionForTests() {
+    resetAuthSession();
+    setAccessToken(null);
+}
+//# sourceMappingURL=testing.js.map

package/dist/auth/client/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../../src/auth/client/testing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D;uEACuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,KAAoB;IACrD,cAAc,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,wBAAwB;IACtC,gBAAgB,EAAE,CAAC;IACnB,cAAc,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC"}

package/dist/auth/client/useAuthSession.d.ts

@@ -1,100 +1,63 @@
-import { AuthUnavailableError } from "./httpClient.js";
-import { type AppSwitcherEntry } from "../shared-types.js";
-export type AuthStatus = "loading" | "authenticated" | "unauthenticated" | "unavailable" | "error";
-/** First delay before re-verifying a session the server could not verify (AK-23). */
-export declare const UNAVAILABLE_RETRY_BASE_MS = 1000;
-/** The backoff's ceiling: an outage is retried every this-many ms at most. */
-export declare const UNAVAILABLE_RETRY_MAX_MS = 30000;
 /**
- * Jittered exponential backoff for the `"unavailable"` state's automatic retries: the
- * ceiling doubles per attempt (1s, 2s, 4s, … capped at UNAVAILABLE_RETRY_MAX_MS) and the
- * delay is drawn uniformly from its upper half ("equal jitter", AK-23 L-c) — so every
- * tab that saw the same outage does not retry in the same instant when it ends, while a
- * retry never comes sooner than half the ceiling. `attempt` counts from 0; `random` is
- * `Math.random` (a seam for tests).
+ * The React face of the flytedesk ID session lifecycle (AK-35) — a view of the ONE
+ * per-tab `authSession` (`./browserEnvironment.ts`), never a lifecycle of its own: any
+ * number of components can call `useAuthSession()` and there is still exactly one
+ * bootstrap, one check timer, one sign-in. Everything it shows, and when, is decided in
+ * `./authSession.ts`; an app only renders.
+ *
+ * The app's one piece of wiring is `SessionBoundary`: its shell for a usable session,
+ * the design system's `SessionScreen` for everything else —
+ *
+ *   <SessionBoundary<AuthedUserDto>
+ *     screen={(state) => <SessionScreen {...state} productName="SMS" />}
+ *   >
+ *     {(session) => <Shell session={session} />}
+ *   </SessionBoundary>
+ *
+ * `@flytedesk/app-kit` never imports the design system, and the design system never
+ * imports this package: `SessionScreenState` is a plain shape `SessionScreen` accepts,
+ * checked structurally at the app's call site.
  */
-export declare function unavailableRetryDelayMs(attempt: number, random?: () => number): number;
-interface AuthSessionActions {
-    /** Surfaces a failed sign-out as a rejection (fail loudly, AK-16) — local state is
-     *  cleared once the api confirms it, OR once a `logout_store_failed` response proves
-     *  the server already revoked this session regardless (see the doc comment on the
-     *  `logout_store_failed` branch below). A caller showing a pending state on this
-     *  promise (as a design system's AccountMenu typically does) gets an honest failure
-     *  instead of silence. */
+import * as React from "react";
+import type { AuthenticatedState, AuthSessionState, UnavailableState } from "./authSession.js";
+export interface AuthSessionActions {
+    /** Explicit sign-out — see `AuthSessionController.signOut`. Navigates away on
+     *  success; rejects when the server did not end the session. */
     signOut: () => Promise<void>;
-    /** Starts a new bootstrap load from scratch — e.g. a Retry action on the error state.
-     *  It supersedes any load (or pending retry) already in flight: that load's answer is
-     *  ignored, and the one `POST /refresh` it may be waiting on is joined, not repeated. */
-    refetch: () => void;
-}
-/**
- * The "All flytedesk apps" switcher feed is decoration, not the session (AK-23, N2): it
- * never decides the status. When `GET {routePrefix}/apps` fails, `apps` is `[]` and
- * `appsError` carries the failure (for an optional "couldn't load apps" hint); the session
- * still becomes "authenticated". The next successful load clears it.
- */
-interface AppsFeed {
-    apps: AppSwitcherEntry[];
-    appsError: Error | null;
+    /** The failure states' "Try again" — see `AuthSessionController.retry`. */
+    retry: () => void;
+    /** Re-reads the signed-in user after the app changed it server-side. */
+    refreshUser: () => Promise<void>;
 }
-export interface LoadingSessionState extends AuthSessionActions, AppsFeed {
-    status: "loading";
-    user: null;
-    appsError: null;
-    error: null;
-}
-/** "authenticated" always carries a user — there is no way to construct this variant
- *  without one, unlike the pre-AK-18 `{ status: AuthStatus; user: TUser | null }` shape
- *  that forced every consumer to handle an impossible `authenticated && !user` state by
- *  hand (sms-app's App.tsx, before this card). */
-export interface AuthenticatedSessionState<TUser> extends AuthSessionActions, AppsFeed {
-    status: "authenticated";
+export type AuthSession<TUser> = AuthSessionState<TUser> & AuthSessionActions;
+/** A session an app can render its shell for: signed in, or an outage that still has a
+ *  last-known user to show (display-only — see `UnavailableState`). */
+export type UsableSession<TUser> = (AuthenticatedState<TUser> | (UnavailableState<TUser> & {
     user: TUser;
-    error: null;
-}
-export interface UnauthenticatedSessionState extends AuthSessionActions, AppsFeed {
-    status: "unauthenticated";
-    user: null;
-    appsError: null;
-    error: null;
-}
-/**
- * AK-23: the server could not verify the session right now — flytedesk-id or the app's
- * AuthStore is down (an `AuthUnavailableError`, a 503). NOT signed out: the session is
- * kept (`user` is the last verified user, or null if none was verified yet) and the hook
- * re-verifies it by itself, with exponential backoff (`retryInMs` until the next try,
- * capped at UNAVAILABLE_RETRY_MAX_MS), until the server answers — then it moves to
- * "authenticated", or to "unauthenticated" only if the server actually says so. Entered
- * from the bootstrap, or from "authenticated" when any request made through this
- * client hits the outage — including the automatic refresh reaching no decision at all
- * (no answer, no answer in time, or an infrastructure 502/503/504: `AUTH_UNREACHABLE_CODE`).
- * Render it as "reconnecting", never as a sign-in screen.
- *
- * `user` is DISPLAY-ONLY (AK-23, L-c): it is who was signed in when the outage began, kept
- * so the page can keep showing them while it reconnects. It is not a verified identity
- * right now — no authorization decision (showing an admin-only control, enabling a
- * destructive action) may be based on it; the server re-checks every request anyway.
- */
-export interface UnavailableSessionState<TUser> extends AuthSessionActions, AppsFeed {
-    status: "unavailable";
-    user: TUser | null;
-    error: AuthUnavailableError;
-    retryInMs: number;
+})) & AuthSessionActions;
+export type SessionScreenKind = "signing-in" | "session-expired" | "signing-out" | "reconnecting" | "sign-in-failed" | "load-failed";
+/** What the design system's `SessionScreen` renders for every non-usable state. `error`
+ *  and `onRetry` are set exactly for the two failure kinds. */
+export interface SessionScreenState {
+    kind: SessionScreenKind;
+    error: string | null;
+    onRetry: (() => void) | null;
 }
-/** Set only when loading the session failed for a reason OTHER than being signed out or
- *  an auth outage — the api errored, or a request it depends on missed its deadline. */
-export interface ErrorSessionState extends AuthSessionActions, AppsFeed {
-    status: "error";
-    user: null;
-    appsError: null;
-    error: Error;
+/** The tab's session, re-rendering on every change. `TUser` is the shape `GET
+ *  {routePrefix}/me` answers for this app (e.g. `AuthedUserDto`). */
+export declare function useAuthSession<TUser>(): AuthSession<TUser>;
+/** The screen for a state the app does not render itself, or `null` when the session is
+ *  usable. The one mapping from lifecycle state to what the user sees. */
+export declare function sessionScreenFor<TUser>(state: AuthSessionState<TUser>): SessionScreenState | null;
+export interface SessionBoundaryProps<TUser> {
+    /** The app, for a usable session. */
+    children: (session: UsableSession<TUser>) => React.ReactNode;
+    /** Everything else — pass the design system's `SessionScreen`. */
+    screen: (state: SessionScreenState) => React.ReactNode;
 }
-export type AuthSessionState<TUser> = LoadingSessionState | AuthenticatedSessionState<TUser> | UnauthenticatedSessionState | UnavailableSessionState<TUser> | ErrorSessionState;
 /**
- * `TUser` defaults to `unknown` deliberately: a consuming app almost always has its
- * own richer local type (or the exact shape @flytedesk/app-kit/auth's AuthedUser
- * describes) it wants `GET {api}{routePrefix}/me`'s `user` decoded as, and should pass
- * it explicitly (`useAuthSession<MyUser>(...)`) rather than this module guessing.
+ * Renders the app only while the session is usable. In every other state the app is
+ * UNMOUNTED — no data panel can fail on its own with an auth error, and nothing it runs
+ * (a poll, a timer) keeps calling the api for a session that is over.
  */
-export declare function useAuthSession<TUser = unknown>(): AuthSessionState<TUser>;
-export {};
+export declare function SessionBoundary<TUser>({ children, screen, }: SessionBoundaryProps<TUser>): React.ReactNode;

package/dist/auth/client/useAuthSession.js

@@ -1,261 +1,74 @@
 /**
- * Generic browser session hook for `@flytedesk/app-kit/auth`'s BFF pattern: bootstraps
- * via POST {api}{routePrefix}/refresh (the httpOnly refresh cookie) -> GET
- * {api}{routePrefix}/me -> GET {api}{routePrefix}/apps (the "All flytedesk apps"
- * switcher feed) — all three routes served by the plugin itself (see ../plugin.js) at
- * the paths ../shared-types.js's route contract names, never a hand-typed string on
- * either side. Every consuming app was on track to re-implement this by hand (sms-app's
- * apps/web/src/session/useAuthSession.ts, before this card) — extracting it here (AK-16)
- * means every one gets the StrictMode-safe single-flight bootstrap and the fail-loudly
- * sign-out for free, instead of each app getting a slightly different (and possibly
- * wrong) version of the same ~80 lines.
+ * The React face of the flytedesk ID session lifecycle (AK-35) — a view of the ONE
+ * per-tab `authSession` (`./browserEnvironment.ts`), never a lifecycle of its own: any
+ * number of components can call `useAuthSession()` and there is still exactly one
+ * bootstrap, one check timer, one sign-in. Everything it shows, and when, is decided in
+ * `./authSession.ts`; an app only renders.
  *
- * Deliberately narrower than media-planner's SessionKit (packages/design-system/src/
- * session.ts): no silent OIDC resume, no cross-tab identity-switch reload, no RBAC
- * flag helpers. Those stay app-specific policy layered on top of this shared
- * mechanism — media-planner's own switch-over (the PLN-1 card this AK-18 card files)
- * keeps SessionKit, just pointed at this module's apiRequest instead of its local copy.
+ * The app's one piece of wiring is `SessionBoundary`: its shell for a usable session,
+ * the design system's `SessionScreen` for everything else —
+ *
+ *   <SessionBoundary<AuthedUserDto>
+ *     screen={(state) => <SessionScreen {...state} productName="SMS" />}
+ *   >
+ *     {(session) => <Shell session={session} />}
+ *   </SessionBoundary>
+ *
+ * `@flytedesk/app-kit` never imports the design system, and the design system never
+ * imports this package: `SessionScreenState` is a plain shape `SessionScreen` accepts,
+ * checked structurally at the app's call site.
  */
 import * as React from "react";
-import { apiRequest, ApiRequestError, AuthUnavailableError, onAuthUnavailable, refreshAccessToken, setAccessToken, } from "./httpClient.js";
-import { AUTH_ROUTE_PREFIX, authRoutePath } from "../shared-types.js";
-/** First delay before re-verifying a session the server could not verify (AK-23). */
-export const UNAVAILABLE_RETRY_BASE_MS = 1_000;
-/** The backoff's ceiling: an outage is retried every this-many ms at most. */
-export const UNAVAILABLE_RETRY_MAX_MS = 30_000;
-/**
- * Jittered exponential backoff for the `"unavailable"` state's automatic retries: the
- * ceiling doubles per attempt (1s, 2s, 4s, … capped at UNAVAILABLE_RETRY_MAX_MS) and the
- * delay is drawn uniformly from its upper half ("equal jitter", AK-23 L-c) — so every
- * tab that saw the same outage does not retry in the same instant when it ends, while a
- * retry never comes sooner than half the ceiling. `attempt` counts from 0; `random` is
- * `Math.random` (a seam for tests).
- */
-export function unavailableRetryDelayMs(attempt, random = Math.random) {
-    const ceiling = Math.min(UNAVAILABLE_RETRY_BASE_MS * 2 ** attempt, UNAVAILABLE_RETRY_MAX_MS);
-    return Math.round(ceiling / 2 + random() * (ceiling / 2));
+import { authSession } from "./browserEnvironment.js";
+const actions = {
+    signOut: () => authSession.signOut(),
+    retry: () => authSession.retry(),
+    refreshUser: () => authSession.refreshUser(),
+};
+/** The tab's session, re-rendering on every change. `TUser` is the shape `GET
+ *  {routePrefix}/me` answers for this app (e.g. `AuthedUserDto`). */
+export function useAuthSession() {
+    const state = React.useSyncExternalStore(authSession.subscribe, () => authSession.getSnapshot(), () => authSession.getSnapshot());
+    return React.useMemo(() => ({ ...state, ...actions }), [state]);
+}
+/** The screen for a state the app does not render itself, or `null` when the session is
+ *  usable. The one mapping from lifecycle state to what the user sees. */
+export function sessionScreenFor(state) {
+    switch (state.status) {
+        case "authenticated":
+            return null;
+        case "unavailable":
+            return state.user === null
+                ? { kind: "reconnecting", error: null, onRetry: null }
+                : null;
+        case "checking":
+            return { kind: "signing-in", error: null, onRetry: null };
+        case "signing-in":
+            return {
+                kind: state.reason === "expired" ? "session-expired" : "signing-in",
+                error: null,
+                onRetry: null,
+            };
+        case "signing-out":
+            return { kind: "signing-out", error: null, onRetry: null };
+        case "error":
+            return {
+                kind: state.kind,
+                error: state.error.message,
+                onRetry: actions.retry,
+            };
+    }
 }
-const ME_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "me");
-const APPS_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "apps");
-const LOGOUT_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "logout");
 /**
- * `TUser` defaults to `unknown` deliberately: a consuming app almost always has its
- * own richer local type (or the exact shape @flytedesk/app-kit/auth's AuthedUser
- * describes) it wants `GET {api}{routePrefix}/me`'s `user` decoded as, and should pass
- * it explicitly (`useAuthSession<MyUser>(...)`) rather than this module guessing.
+ * Renders the app only while the session is usable. In every other state the app is
+ * UNMOUNTED — no data panel can fail on its own with an auth error, and nothing it runs
+ * (a poll, a timer) keeps calling the api for a session that is over.
  */
-export function useAuthSession() {
-    const [status, setStatus] = React.useState("loading");
-    const [user, setUser] = React.useState(null);
-    const [apps, setApps] = React.useState([]);
-    const [appsError, setAppsError] = React.useState(null);
-    const [error, setError] = React.useState(null);
-    const [unavailable, setUnavailable] = React.useState(null);
-    const [generation, setGeneration] = React.useState(0);
-    // POST {routePrefix}/refresh ROTATES the refresh cookie on every call (reuse detection
-    // — see @flytedesk/app-kit/auth's plugin.ts) — a second call presenting the same,
-    // now-already-consumed cookie is treated as token replay and revokes the whole
-    // session. React 18+'s <StrictMode> intentionally double-invokes this effect in dev
-    // (mount -> cleanup -> mount, on the SAME fiber, so this ref survives it) with the
-    // SAME `generation`, which without a guard fires two concurrent refresh calls
-    // against that one cookie: the loser gets "token_reuse_detected" and this hook
-    // bounces to "unauthenticated" for no signed-out reason at all. Tracking which
-    // generation has already started a load — rather than an unconditional `cancelled`
-    // flag — is what makes the second StrictMode invocation a no-op while still letting
-    // `refetch()` (which bumps `generation`) start a genuinely new load.
-    const startedGenerationRef = React.useRef(null);
-    // The load/retry machinery, created once per mounted hook (lazy useState initializer:
-    // guaranteed stable, unlike useMemo). It only touches state setters, which React keeps
-    // stable, and its own mutable fields.
-    const [session] = React.useState(() => {
-        const engine = {
-            /** Mirrors `status`, readable from outside a render (the outage listener). */
-            status: "loading",
-            /** Whether the hook is mounted — a retry never fires into an unmounted one. */
-            active: false,
-            retryTimer: null,
-            retryAttempt: 0,
-            /**
-             * AK-23 (L-a): which load may still change state. `signOut` and every fresh load
-             * (the bootstrap, `refetch`) bump it; a load that finds the epoch moved on since it
-             * started is stale and drops its answer — so a retry still in flight can neither
-             * put a signed-out session back into "unavailable" nor overwrite a newer load.
-             */
-            epoch: 0,
-            setStatus(next) {
-                engine.status = next;
-                setStatus(next);
-            },
-            clearRetry() {
-                if (engine.retryTimer !== null)
-                    clearTimeout(engine.retryTimer);
-                engine.retryTimer = null;
-            },
-            /** Ends every load in flight and any pending retry — their answers are ignored —
-             *  and returns the new epoch. */
-            supersede() {
-                engine.clearRetry();
-                engine.epoch += 1;
-                return engine.epoch;
-            },
-            /**
-             * Refresh -> me -> apps. `fresh` (a new bootstrap) supersedes any load in flight and
-             * shows "loading"; a retry keeps whatever the user is looking at until it has an
-             * answer.
-             *
-             * The refresh is httpClient's shared, single-flighted `refreshAccessToken`, so a
-             * load started while another one (or any 401-triggered refresh) is waiting on
-             * `POST /refresh` JOINS that request instead of presenting the same rotating cookie
-             * a second time. `/me` and `/apps` skip the 401 -> refresh -> recovery dance: right
-             * after a refresh, a 401 is the answer itself, and a load must never start the
-             * app's auth recovery (which could sign a user back in after `signOut`).
-             */
-            async load(fresh) {
-                const epoch = fresh ? engine.supersede() : engine.epoch;
-                const current = () => epoch === engine.epoch;
-                if (fresh) {
-                    engine.retryAttempt = 0;
-                    setError(null);
-                    setUnavailable(null);
-                    engine.setStatus("loading");
-                }
-                try {
-                    const accessToken = await refreshAccessToken();
-                    if (!current())
-                        return;
-                    if (accessToken === null) {
-                        engine.settleSignedOut();
-                        return;
-                    }
-                    const me = await apiRequest(ME_PATH, { skipAuthRetry: true });
-                    if (!current())
-                        return;
-                    const feed = await engine.loadApps();
-                    if (!current())
-                        return;
-                    setUser(me.user);
-                    setApps(feed.apps);
-                    setAppsError(feed.error);
-                    engine.retryAttempt = 0;
-                    setUnavailable(null);
-                    engine.setStatus("authenticated");
-                }
-                catch (err) {
-                    if (!current())
-                        return;
-                    if (err instanceof AuthUnavailableError) {
-                        engine.scheduleRetry(err);
-                        return;
-                    }
-                    if (err instanceof ApiRequestError && err.status === 401) {
-                        engine.settleSignedOut();
-                        return;
-                    }
-                    engine.retryAttempt = 0;
-                    setUnavailable(null);
-                    setError(err instanceof Error ? err : new Error(String(err)));
-                    engine.setStatus("error");
-                }
-            },
-            /** The switcher feed, non-blocking (AK-23, N2): a failure is `apps: []` plus the
-             *  error, never a failed load. */
-            async loadApps() {
-                try {
-                    const res = await apiRequest(APPS_PATH, { skipAuthRetry: true });
-                    return { apps: res.apps, error: null };
-                }
-                catch (err) {
-                    return { apps: [], error: err instanceof Error ? err : new Error(String(err)) };
-                }
-            },
-            /** The server said this browser has no session: local state follows. */
-            settleSignedOut() {
-                engine.clearRetry();
-                engine.retryAttempt = 0;
-                setAccessToken(null);
-                setUser(null);
-                setApps([]);
-                setAppsError(null);
-                setUnavailable(null);
-                engine.setStatus("unauthenticated");
-            },
-            /** Enters (or stays in) "unavailable" and re-verifies after the next backoff delay.
-             *  One pending retry at a time: a burst of failing requests schedules one. */
-            scheduleRetry(err) {
-                if (!engine.active || engine.retryTimer !== null)
-                    return;
-                const retryInMs = unavailableRetryDelayMs(engine.retryAttempt);
-                engine.retryAttempt += 1;
-                setUnavailable({ error: err, retryInMs });
-                engine.setStatus("unavailable");
-                engine.retryTimer = setTimeout(() => {
-                    engine.retryTimer = null;
-                    void engine.load(false);
-                }, retryInMs);
-            },
-        };
-        return engine;
-    });
-    React.useEffect(() => {
-        session.active = true;
-        // An ordinary request (anywhere in the app) hitting an outage while signed in: keep
-        // the user, show "unavailable", and re-verify — never treat it as a sign-out.
-        const unsubscribe = onAuthUnavailable((err) => {
-            if (session.status === "authenticated")
-                session.scheduleRetry(err);
-        });
-        return () => {
-            session.active = false;
-            session.clearRetry();
-            unsubscribe();
-        };
-    }, [session]);
-    React.useEffect(() => {
-        if (startedGenerationRef.current === generation)
-            return;
-        startedGenerationRef.current = generation;
-        void session.load(true);
-    }, [generation, session]);
-    const signOut = React.useCallback(async () => {
-        // Whatever load or retry is in flight belongs to the session being ended: its answer
-        // must never land after this one (AK-23, L-a).
-        session.supersede();
-        try {
-            await apiRequest(LOGOUT_PATH, { method: "POST" });
-        }
-        catch (err) {
-            if (err instanceof ApiRequestError && err.code === "logout_store_failed") {
-                // The plugin clears the refresh cookie on EVERY logout outcome (AK-23, in a
-                // `finally`) and attempts each AuthStore step independently, so this browser
-                // no longer holds a usable session no matter which step failed here (plugin.ts's
-                // POST {routePrefix}/logout). Leaving local state at
-                // "authenticated" here would be exactly the bug the SMS-5 gate found (the design
-                // system's AccountMenu swallowing this rejection and showing nothing): a UI
-                // claiming a live session the server has already revoked. Clearing local state
-                // mirrors the server's actual state; re-throwing still fails loudly so a caller
-                // can surface "sign-out did not fully complete" rather than reporting a clean one.
-                session.settleSignedOut();
-            }
-            throw err;
-        }
-        session.settleSignedOut();
-    }, [session]);
-    const refetch = React.useCallback(() => setGeneration((g) => g + 1), []);
-    const actions = { signOut, refetch };
-    if (status === "authenticated") {
-        // Invariant: the only place status flips to "authenticated" is the line right after
-        // setUser(me.user) above, in the same synchronous pass — so by the time a render
-        // observes status === "authenticated", `user` is never null.
-        return { ...actions, status, user: user, apps, appsError, error: null };
-    }
-    if (status === "unavailable" && unavailable) {
-        return { ...actions, status, user, apps, appsError, error: unavailable.error, retryInMs: unavailable.retryInMs };
-    }
-    if (status === "error") {
-        return { ...actions, status, user: null, apps, appsError: null, error: error ?? new Error("unknown error") };
-    }
-    if (status === "loading")
-        return { ...actions, status, user: null, apps, appsError: null, error: null };
-    return { ...actions, status: "unauthenticated", user: null, apps, appsError: null, error: null };
+export function SessionBoundary({ children, screen, }) {
+    const session = useAuthSession();
+    const shown = sessionScreenFor(session);
+    if (shown !== null)
+        return screen(shown);
+    return children(session);
 }
 //# sourceMappingURL=useAuthSession.js.map

package/dist/auth/client/useAuthSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../src/auth/client/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EACL,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAC;AAI7F,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,SAAuB,IAAI,CAAC,MAAM;IACzF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AA2FD,MAAM,OAAO,GAAG,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAa,SAAS,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAqB,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,QAAQ,CAClD,IAAI,CACL,CAAC;IACF,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtD,uFAAuF;IACvF,kFAAkF;IAClF,+EAA+E;IAC/E,oFAAoF;IACpF,mFAAmF;IACnF,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAgB,IAAI,CAAC,CAAC;IAE/D,sFAAsF;IACtF,uFAAuF;IACvF,sCAAsC;IACtC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG;YACb,8EAA8E;YAC9E,MAAM,EAAE,SAAuB;YAC/B,+EAA+E;YAC/E,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAA4C;YACxD,YAAY,EAAE,CAAC;YACf;;;;;eAKG;YACH,KAAK,EAAE,CAAC;YAER,SAAS,CAAC,IAAgB;gBACxB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;gBACrB,SAAS,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YAED,UAAU;gBACR,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;oBAAE,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAChE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;YAC3B,CAAC;YAED;6CACiC;YACjC,SAAS;gBACP,MAAM,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;gBAClB,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YAED;;;;;;;;;;;eAWG;YACH,KAAK,CAAC,IAAI,CAAC,KAAc;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACxD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;gBAC7C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACf,cAAc,CAAC,IAAI,CAAC,CAAC;oBACrB,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC9B,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;oBAC/C,IAAI,CAAC,OAAO,EAAE;wBAAE,OAAO;oBACvB,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;wBACzB,MAAM,CAAC,eAAe,EAAE,CAAC;wBACzB,OAAO;oBACT,CAAC;oBACD,MAAM,EAAE,GAAG,MAAM,UAAU,CAAkB,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/E,IAAI,CAAC,OAAO,EAAE;wBAAE,OAAO;oBACvB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACrC,IAAI,CAAC,OAAO,EAAE;wBAAE,OAAO;oBACvB,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;oBACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;oBACxB,cAAc,CAAC,IAAI,CAAC,CAAC;oBACrB,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;gBACpC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,OAAO,EAAE;wBAAE,OAAO;oBACvB,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;wBACxC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;wBAC1B,OAAO;oBACT,CAAC;oBACD,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBACzD,MAAM,CAAC,eAAe,EAAE,CAAC;wBACzB,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;oBACxB,cAAc,CAAC,IAAI,CAAC,CAAC;oBACrB,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9D,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED;8CACkC;YAClC,KAAK,CAAC,QAAQ;gBACZ,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAA+B,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/F,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACzC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,eAAe;gBACb,MAAM,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;gBACxB,cAAc,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnB,cAAc,CAAC,IAAI,CAAC,CAAC;gBACrB,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACtC,CAAC;YAED;0FAC8E;YAC9E,aAAa,CAAC,GAAyB;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;oBAAE,OAAO;gBACzD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC/D,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;gBACzB,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1C,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBAChC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBAClC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;oBACzB,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;SACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;QACtB,oFAAoF;QACpF,8EAA8E;QAC9E,MAAM,WAAW,GAAG,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;gBAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE;YACV,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;YACvB,OAAO,CAAC,UAAU,EAAE,CAAC;YACrB,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,oBAAoB,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO;QACxD,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;QAC1C,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAE1B,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,qFAAqF;QACrF,+CAA+C;QAC/C,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACzE,4EAA4E;gBAC5E,6EAA6E;gBAC7E,iFAAiF;gBACjF,qDAAqD;gBACrD,iFAAiF;gBACjF,4EAA4E;gBAC5E,+EAA+E;gBAC/E,gFAAgF;gBAChF,mFAAmF;gBACnF,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,eAAe,EAAE,CAAC;IAC5B,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,oFAAoF;QACpF,iFAAiF;QACjF,6DAA6D;QAC7D,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAa,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,IAAI,WAAW,EAAE,CAAC;QAC5C,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxG,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACnG,CAAC"}
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../src/auth/client/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAM/B,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAqCtD,MAAM,OAAO,GAAuB;IAClC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE;IAChC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE;CAC7C,CAAC;AAEF;qEACqE;AACrE,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,oBAAoB,CACtC,WAAW,CAAC,SAAS,EACrB,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAS,EACtC,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAS,CACvC,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,KAA8B;IAE9B,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;gBACtD,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5D,KAAK,YAAY;YACf,OAAO;gBACL,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY;gBACnE,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7D,KAAK,OAAO;YACV,OAAO;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC1B,OAAO,EAAE,OAAO,CAAC,KAAK;aACvB,CAAC;IACN,CAAC;AACH,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAQ,EACrC,QAAQ,EACR,MAAM,GACsB;IAC5B,MAAM,OAAO,GAAG,cAAc,EAAS,CAAC;IACxC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,OAA+B,CAAC,CAAC;AACnD,CAAC"}

package/dist/auth/index.d.ts

@@ -34,7 +34,6 @@
  *     redirectUri: "https://my-app.flytedesk.com/api/v1/auth/callback",
  *     appId: "my-app",
  *     postLoginRedirect: "https://my-app.flytedesk.com/",
- *     signInUrl: "https://my-app.flytedesk.com/sign-in",
  *     cookieSecret: process.env.COOKIE_SECRET!,
  *     secureCookies: process.env.NODE_ENV === "production",
  *     accessTokenSecret: process.env.JWT_SECRET!,
@@ -44,11 +43,11 @@
  *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
 export { requireAuth, requirePermission } from "./guards.js";
-export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionLockedStore, IdpSessionRow, RefreshTokenRevocation, RefreshTokenRevocationReason, RefreshTokenRow, RevokeFamilyReason, SignInContext, SignInMode, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
+export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionLockedStore, IdpSessionRow, RefreshTokenRevocation, RefreshTokenRevocationReason, RefreshTokenRow, RevokeFamilyReason, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
 export type { AppSwitcherEntry, IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient, OidcClientOptions, } from "./oidc-client.js";
 export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_IDP_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
-export type { ApiErrorBody, AuthUnavailableCode, SilentAuthDetailCode, SilentAuthMessage, SignInErrorCode, } from "./shared-types.js";
-export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, SILENT_AUTH_DETAIL_CODES, SILENT_AUTH_MESSAGE_SOURCE, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, type AuthRouteSegment, } from "./shared-types.js";
+export type { ApiErrorBody, AuthUnavailableCode, SignInErrorCode, } from "./shared-types.js";
+export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, type AuthRouteSegment, } from "./shared-types.js";
 export { IdpError, IdpUnavailableError, IdpTimeoutError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, OidcTokenError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState, type PkcePair } from "./pkce.js";
 export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, type AccessTokenClaims, } from "./tokens.js";

package/dist/auth/index.js

@@ -34,7 +34,6 @@
  *     redirectUri: "https://my-app.flytedesk.com/api/v1/auth/callback",
  *     appId: "my-app",
  *     postLoginRedirect: "https://my-app.flytedesk.com/",
- *     signInUrl: "https://my-app.flytedesk.com/sign-in",
  *     cookieSecret: process.env.COOKIE_SECRET!,
  *     secureCookies: process.env.NODE_ENV === "production",
  *     accessTokenSecret: process.env.JWT_SECRET!,
@@ -45,7 +44,7 @@
  */
 export { requireAuth, requirePermission } from "./guards.js";
 export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_IDP_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
-export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, SILENT_AUTH_DETAIL_CODES, SILENT_AUTH_MESSAGE_SOURCE, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, } from "./shared-types.js";
+export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, } from "./shared-types.js";
 export { IdpError, IdpUnavailableError, IdpTimeoutError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, OidcTokenError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState } from "./pkce.js";
 export { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken, } from "./tokens.js";

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA6B7D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AASzG,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA2B7D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAOzG,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}