@bytescale/sdk 3.55.0 → 3.56.0

package/dist/browser/cjs/main.js

@@ -3196,6 +3196,12 @@ function AuthManagerBrowser_awaitIgnored(value, direct) {
     return value && value.then ? value.then(AuthManagerBrowser_empty) : Promise.resolve();
   }
 }
+function AuthManagerBrowser_invokeIgnored(body) {
+  var result = body();
+  if (result && result.then) {
+    return result.then(AuthManagerBrowser_empty);
+  }
+}
 function AuthManagerBrowser_await(value, then, direct) {
   if (direct) {
     return then ? then(value) : value;
@@ -3217,12 +3223,6 @@ function AuthManagerBrowser_async(f) {
     }
   };
 }
-function AuthManagerBrowser_invokeIgnored(body) {
-  var result = body();
-  if (result && result.then) {
-    return result.then(AuthManagerBrowser_empty);
-  }
-}
 function AuthManagerBrowser_invoke(body, then) {
   var result = body();
   if (result && result.then) {
@@ -3261,8 +3261,14 @@ function AuthManagerBrowser_continueIgnored(value) {
     return value.then(AuthManagerBrowser_empty);
   }
 }
+function AuthManagerBrowser_continue(value, then) {
+  return value && value.then ? value.then(then) : then(value);
+}
 function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
 function AuthManagerBrowser_defineProperty(e, r, t) { return (r = AuthManagerBrowser_toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = AuthManagerBrowser_unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function AuthManagerBrowser_unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return AuthManagerBrowser_arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? AuthManagerBrowser_arrayLikeToArray(r, a) : void 0; } }
+function AuthManagerBrowser_arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 function AuthManagerBrowser_classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
 function AuthManagerBrowser_defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, AuthManagerBrowser_toPropertyKey(o.key), o); } }
 function AuthManagerBrowser_createClass(e, r, t) { return r && AuthManagerBrowser_defineProperties(e.prototype, r), t && AuthManagerBrowser_defineProperties(e, t), Object.defineProperty(e, "prototype", { writable: !1 }), e; }
@@ -3296,8 +3302,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
   }, {
     key: "isAuthSessionReady",
     value: function isAuthSessionReady() {
-      var _a;
-      return ((_a = AuthSessionState.getSession()) === null || _a === void 0 ? void 0 : _a.accessToken) !== undefined;
+      var session = AuthSessionState.getSession();
+      return (session === null || session === void 0 ? void 0 : session.isReady) === true || (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
     }
   }, {
     key: "beginAuthSession",
@@ -3309,12 +3315,17 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (_this.isAuthSessionActive()) {
             throw new Error("Auth session already active. Please call 'await endAuthSession()' and then call 'await beginAuthSession(...)' to start a new auth session.");
           }
+          var canUseServiceWorkers = _this.serviceWorkerUtils.canUseServiceWorkers();
+          if (_this.isV2(params) && !canUseServiceWorkers) {
+            throw new Error("This auth session requires service workers, but this browser does not support them.");
+          }
           var newSession = {
             accessToken: undefined,
             accessTokenRefreshHandle: undefined,
             params: params,
             isActive: true,
-            authServiceWorker: params.serviceWorkerScript !== undefined && _this.serviceWorkerUtils.canUseServiceWorkers() ? {
+            isReady: false,
+            authServiceWorker: params.serviceWorkerScript !== undefined && canUseServiceWorkers ? {
               serviceWorkerScript: params.serviceWorkerScript,
               type: "Uninitialized"
             } : undefined
@@ -3323,7 +3334,13 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           return newSession;
         })), function (session) {
           // IMPORTANT: must be called outside the above, else re-entrant deadlock will occur.
-          return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session));
+          return AuthManagerBrowser_invokeIgnored(function () {
+            if (_this.isV2(session.params)) {
+              return AuthManagerBrowser_awaitIgnored(_this.refreshServiceWorkerConfig(session, session.params));
+            } else {
+              return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
+            }
+          });
         });
       } catch (e) {
         return Promise.reject(e);
@@ -3344,14 +3361,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (session.accessTokenRefreshHandle !== undefined) {
             _this2.scheduler.unschedule(session.accessTokenRefreshHandle);
           }
-          return AuthManagerBrowser_await(_this2.deleteAccessToken(session.params), function () {
+          return AuthManagerBrowser_invoke(function () {
+            if (!_this2.isV2(session.params)) {
+              return AuthManagerBrowser_awaitIgnored(_this2.deleteAccessToken(session.params));
+            }
+          }, function () {
             return AuthManagerBrowser_invokeIgnored(function () {
               if (session.authServiceWorker !== undefined) {
                 // Prevent service worker from authorizing subsequent requests.
-                return AuthManagerBrowser_awaitIgnored(_this2.serviceWorkerUtils.sendMessage({
-                  type: "SET_BYTESCALE_AUTH_CONFIG",
-                  config: []
-                }, session.authServiceWorker, _this2.serviceWorkerScriptFieldName));
+                return AuthManagerBrowser_awaitIgnored(_this2.sendServiceWorkerConfig(session, []));
               }
             });
           });
@@ -3362,7 +3380,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "refreshAccessToken",
-    value: function refreshAccessToken(session) {
+    value: function refreshAccessToken(session, params) {
       try {
         var _this3 = this;
         return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this3.authSessionMutex.safe(AuthManagerBrowser_async(function () {
@@ -3375,30 +3393,26 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           var expires = secondsFromNow(_this3.retryAuthAfterErrorSeconds);
           return AuthManagerBrowser_continueIgnored(AuthManagerBrowser_finallyRethrows(function () {
             return AuthManagerBrowser_catch(function () {
-              var _getAccessToken = _this3.getAccessToken,
-                _session$params = session.params;
-              return AuthManagerBrowser_await(session.params.authHeaders(), function (_session$params$authH) {
-                return AuthManagerBrowser_await(_getAccessToken.call(_this3, _session$params, _session$params$authH), function (jwt) {
+              var _getAccessToken = _this3.getAccessToken;
+              return AuthManagerBrowser_await(params.authHeaders(), function (_params$authHeaders) {
+                return AuthManagerBrowser_await(_getAccessToken.call(_this3, params, _params$authHeaders), function (jwt) {
                   // We don't use cookie-based auth if the browser supports service worker-based auth, as using both will cause
                   // confusion for us in the future (i.e. we may question "do we need to use both together? was there a reason?").
                   // Also: if the user has omitted "allowedOrigins" from their JWT, then service worker-based auth is more secure
                   // than cookie-based auth, which is another reason to prevent these cookies from being set unless required.
                   var setCookie = session.authServiceWorker === undefined;
-                  return AuthManagerBrowser_await(_this3.setAccessToken(session.params, jwt, setCookie), function (setTokenResult) {
+                  return AuthManagerBrowser_await(_this3.setAccessToken(params, jwt, setCookie), function (setTokenResult) {
                     return AuthManagerBrowser_invoke(function () {
                       if (session.authServiceWorker !== undefined) {
-                        return AuthManagerBrowser_await(_this3.serviceWorkerUtils.sendMessage({
-                          type: "SET_BYTESCALE_AUTH_CONFIG",
-                          config: [{
-                            headers: [{
-                              key: "Authorization",
-                              value: "Bearer ".concat(jwt)
-                            }],
-                            expires: secondsFromNow(setTokenResult.ttlSeconds),
-                            sourceUrlPrefixes: session.params.sourceUrlPrefixes,
-                            urlPrefix: "".concat(session.params.sourceUrlPrefixes === undefined ? "" : _this3.sourceScopedUrlPrefixMarker).concat(_this3.getCdnUrl(session.params), "/").concat(session.params.accountId, "/")
-                          }]
-                        }, session.authServiceWorker, _this3.serviceWorkerScriptFieldName), function () {
+                        return AuthManagerBrowser_await(_this3.sendServiceWorkerConfig(session, [{
+                          headers: [{
+                            key: "Authorization",
+                            value: "Bearer ".concat(jwt)
+                          }],
+                          expires: secondsFromNow(setTokenResult.ttlSeconds),
+                          sourceUrlPrefixes: params.sourceUrlPrefixes,
+                          urlPrefix: "".concat(_this3.getCdnUrl(params), "/").concat(params.accountId, "/")
+                        }]), function () {
                           // Allow time for the service worker to receive and process the message. Since this is asynchronous and not
                           // synchronized, we need to wait for a sufficient amount of time to ensure the service worker is ready to
                           // authenticate requests, so that after 'beginAuthSession' completes, users can start making requests.
@@ -3416,6 +3430,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                       expires = secondsFromNow(actualTtl);
                       // Set this at the end, as it's also used to signal 'isAuthSessionReady', so must be set after configuring the Service Worker, etc.
                       session.accessToken = setTokenResult.accessToken;
+                      session.isReady = true;
                     });
                   });
                 });
@@ -3428,7 +3443,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
             // 'setTimeout' can be paused (e.g., during hibernation), risking JWT expiration before it triggers. We use a
             // scheduler to check wall-clock time every second and execute the callback at the scheduled time (below).
             session.accessTokenRefreshHandle = _this3.scheduler.schedule(expires, function () {
-              _this3.refreshAccessToken(session).then(function () {},
+              _this3.refreshAccessToken(session, params).then(function () {},
               // Should not occur, as this method shouldn't throw errors.
               function (e) {
                 return ConsoleUtils.error("Unexpected error when refreshing JWT access token: ".concat(e));
@@ -3441,6 +3456,91 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "refreshServiceWorkerConfig",
+    value: function refreshServiceWorkerConfig(session, params) {
+      try {
+        var _this4 = this;
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this4.authSessionMutex.safe(AuthManagerBrowser_async(function () {
+          var _exit = false;
+          if (!session.isActive) {
+            return;
+          }
+          var refreshAt;
+          return AuthManagerBrowser_continue(AuthManagerBrowser_catch(function () {
+            return AuthManagerBrowser_await(params.getServiceWorkerConfig(), function (config) {
+              if (!Array.isArray(config)) {
+                throw new Error("The 'getServiceWorkerConfig' callback must return an array.");
+              }
+              return AuthManagerBrowser_await(_this4.sendServiceWorkerConfig(session, config), function () {
+                return AuthManagerBrowser_await(new Promise(function (resolve) {
+                  return setTimeout(resolve, 100);
+                }), function () {
+                  session.isReady = true;
+                  refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config);
+                });
+              });
+            });
+          }, function (e) {
+            ConsoleUtils.warn("Unable to refresh service worker auth config: ".concat(e));
+            refreshAt = Date.now() + _this4.retryAuthAfterErrorSeconds * 1000;
+          }), function (_result2) {
+            if (_exit) return _result2;
+            if (refreshAt !== undefined) {
+              session.accessTokenRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
+                _this4.refreshServiceWorkerConfig(session, params).then(function () {}, function (e) {
+                  return ConsoleUtils.error("Unexpected error when refreshing service worker auth config: ".concat(e));
+                });
+              });
+            }
+          });
+        }))));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
+  }, {
+    key: "getServiceWorkerConfigRefreshEpoch",
+    value: function getServiceWorkerConfigRefreshEpoch(config) {
+      var earliestExpiry;
+      var _iterator = _createForOfIteratorHelper(config),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var entry = _step.value;
+          if (entry.expires !== undefined && (earliestExpiry === undefined || entry.expires < earliestExpiry)) {
+            earliestExpiry = entry.expires;
+          }
+        }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
+      }
+      return earliestExpiry === undefined ? undefined : earliestExpiry - this.refreshBeforeExpirySeconds * 1000;
+    }
+  }, {
+    key: "sendServiceWorkerConfig",
+    value: function sendServiceWorkerConfig(session, config) {
+      try {
+        var _this5 = this;
+        if (session.authServiceWorker === undefined) {
+          throw new Error("Service worker configuration cannot be applied because service workers are unavailable.");
+        }
+        return AuthManagerBrowser_await(_this5.serviceWorkerUtils.sendMessage({
+          type: "SET_BYTESCALE_AUTH_CONFIG",
+          config: config.map(function (entry) {
+            return Object.assign(Object.assign({}, entry), {
+              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this5.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
+            });
+          })
+        }, session.authServiceWorker, _this5.serviceWorkerScriptFieldName), function (_this5$serviceWorkerU) {
+          session.authServiceWorker = _this5$serviceWorkerU;
+        });
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "getAccessTokenUrl",
     value: function getAccessTokenUrl(params, setCookie) {
@@ -3456,9 +3556,9 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "deleteAccessToken",
     value: function deleteAccessToken(params) {
       try {
-        var _this4 = this;
+        var _this6 = this;
         var _a;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this4.getAccessTokenUrl(params, true), {
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this6.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -3474,15 +3574,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "setAccessToken",
     value: function setAccessToken(params, jwt, setCookie) {
       try {
-        var _this5 = this;
+        var _this7 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this5.getAccessTokenUrl(params, setCookie), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this7.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
-          headers: AuthManagerBrowser_defineProperty({}, _this5.contentType, _this5.contentTypeJson),
+          headers: AuthManagerBrowser_defineProperty({}, _this7.contentType, _this7.contentTypeJson),
           body: JSON.stringify(request)
         }, {
           isBytescaleApi: true,
@@ -3498,10 +3598,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "getAccessToken",
     value: function getAccessToken(params, headers) {
       try {
-        var _this6 = this;
+        var _this8 = this;
         var _a, _b;
         var endpointName = "Your auth API endpoint";
-        var requiredContentType = _this6.contentTypeText;
+        var requiredContentType = _this8.contentTypeText;
         return AuthManagerBrowser_await(BaseAPI.fetch(params.authUrl, {
           method: "GET",
           headers: headers
@@ -3509,10 +3609,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           isBytescaleApi: false,
           fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
         }), function (result) {
-          var actualContentType = (_b = result.headers.get(_this6.contentType)) !== null && _b !== void 0 ? _b : "";
+          var actualContentType = (_b = result.headers.get(_this8.contentType)) !== null && _b !== void 0 ? _b : "";
           // Support content types like "text/plain; charset=utf-8" and "text/plain"
           if (actualContentType.split(";")[0] !== requiredContentType) {
-            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this6.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
+            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this8.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
           }
           return AuthManagerBrowser_await(result.text(), function (jwt) {
             if (jwt.length === 0) {
@@ -3529,6 +3629,11 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "isV2",
+    value: function isV2(params) {
+      return "getServiceWorkerConfig" in params;
+    }
   }]);
 }();
 /**

package/dist/browser/esm/main.mjs

@@ -3156,6 +3156,12 @@ function AuthManagerBrowser_awaitIgnored(value, direct) {
     return value && value.then ? value.then(AuthManagerBrowser_empty) : Promise.resolve();
   }
 }
+function AuthManagerBrowser_invokeIgnored(body) {
+  var result = body();
+  if (result && result.then) {
+    return result.then(AuthManagerBrowser_empty);
+  }
+}
 function AuthManagerBrowser_await(value, then, direct) {
   if (direct) {
     return then ? then(value) : value;
@@ -3177,12 +3183,6 @@ function AuthManagerBrowser_async(f) {
     }
   };
 }
-function AuthManagerBrowser_invokeIgnored(body) {
-  var result = body();
-  if (result && result.then) {
-    return result.then(AuthManagerBrowser_empty);
-  }
-}
 function AuthManagerBrowser_invoke(body, then) {
   var result = body();
   if (result && result.then) {
@@ -3221,8 +3221,14 @@ function AuthManagerBrowser_continueIgnored(value) {
     return value.then(AuthManagerBrowser_empty);
   }
 }
+function AuthManagerBrowser_continue(value, then) {
+  return value && value.then ? value.then(then) : then(value);
+}
 function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
 function AuthManagerBrowser_defineProperty(e, r, t) { return (r = AuthManagerBrowser_toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = AuthManagerBrowser_unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function AuthManagerBrowser_unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return AuthManagerBrowser_arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? AuthManagerBrowser_arrayLikeToArray(r, a) : void 0; } }
+function AuthManagerBrowser_arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 function AuthManagerBrowser_classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
 function AuthManagerBrowser_defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, AuthManagerBrowser_toPropertyKey(o.key), o); } }
 function AuthManagerBrowser_createClass(e, r, t) { return r && AuthManagerBrowser_defineProperties(e.prototype, r), t && AuthManagerBrowser_defineProperties(e, t), Object.defineProperty(e, "prototype", { writable: !1 }), e; }
@@ -3256,8 +3262,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
   }, {
     key: "isAuthSessionReady",
     value: function isAuthSessionReady() {
-      var _a;
-      return ((_a = AuthSessionState.getSession()) === null || _a === void 0 ? void 0 : _a.accessToken) !== undefined;
+      var session = AuthSessionState.getSession();
+      return (session === null || session === void 0 ? void 0 : session.isReady) === true || (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
     }
   }, {
     key: "beginAuthSession",
@@ -3269,12 +3275,17 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (_this.isAuthSessionActive()) {
             throw new Error("Auth session already active. Please call 'await endAuthSession()' and then call 'await beginAuthSession(...)' to start a new auth session.");
           }
+          var canUseServiceWorkers = _this.serviceWorkerUtils.canUseServiceWorkers();
+          if (_this.isV2(params) && !canUseServiceWorkers) {
+            throw new Error("This auth session requires service workers, but this browser does not support them.");
+          }
           var newSession = {
             accessToken: undefined,
             accessTokenRefreshHandle: undefined,
             params: params,
             isActive: true,
-            authServiceWorker: params.serviceWorkerScript !== undefined && _this.serviceWorkerUtils.canUseServiceWorkers() ? {
+            isReady: false,
+            authServiceWorker: params.serviceWorkerScript !== undefined && canUseServiceWorkers ? {
               serviceWorkerScript: params.serviceWorkerScript,
               type: "Uninitialized"
             } : undefined
@@ -3283,7 +3294,13 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           return newSession;
         })), function (session) {
           // IMPORTANT: must be called outside the above, else re-entrant deadlock will occur.
-          return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session));
+          return AuthManagerBrowser_invokeIgnored(function () {
+            if (_this.isV2(session.params)) {
+              return AuthManagerBrowser_awaitIgnored(_this.refreshServiceWorkerConfig(session, session.params));
+            } else {
+              return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
+            }
+          });
         });
       } catch (e) {
         return Promise.reject(e);
@@ -3304,14 +3321,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (session.accessTokenRefreshHandle !== undefined) {
             _this2.scheduler.unschedule(session.accessTokenRefreshHandle);
           }
-          return AuthManagerBrowser_await(_this2.deleteAccessToken(session.params), function () {
+          return AuthManagerBrowser_invoke(function () {
+            if (!_this2.isV2(session.params)) {
+              return AuthManagerBrowser_awaitIgnored(_this2.deleteAccessToken(session.params));
+            }
+          }, function () {
             return AuthManagerBrowser_invokeIgnored(function () {
               if (session.authServiceWorker !== undefined) {
                 // Prevent service worker from authorizing subsequent requests.
-                return AuthManagerBrowser_awaitIgnored(_this2.serviceWorkerUtils.sendMessage({
-                  type: "SET_BYTESCALE_AUTH_CONFIG",
-                  config: []
-                }, session.authServiceWorker, _this2.serviceWorkerScriptFieldName));
+                return AuthManagerBrowser_awaitIgnored(_this2.sendServiceWorkerConfig(session, []));
               }
             });
           });
@@ -3322,7 +3340,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "refreshAccessToken",
-    value: function refreshAccessToken(session) {
+    value: function refreshAccessToken(session, params) {
       try {
         var _this3 = this;
         return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this3.authSessionMutex.safe(AuthManagerBrowser_async(function () {
@@ -3335,30 +3353,26 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           var expires = secondsFromNow(_this3.retryAuthAfterErrorSeconds);
           return AuthManagerBrowser_continueIgnored(AuthManagerBrowser_finallyRethrows(function () {
             return AuthManagerBrowser_catch(function () {
-              var _getAccessToken = _this3.getAccessToken,
-                _session$params = session.params;
-              return AuthManagerBrowser_await(session.params.authHeaders(), function (_session$params$authH) {
-                return AuthManagerBrowser_await(_getAccessToken.call(_this3, _session$params, _session$params$authH), function (jwt) {
+              var _getAccessToken = _this3.getAccessToken;
+              return AuthManagerBrowser_await(params.authHeaders(), function (_params$authHeaders) {
+                return AuthManagerBrowser_await(_getAccessToken.call(_this3, params, _params$authHeaders), function (jwt) {
                   // We don't use cookie-based auth if the browser supports service worker-based auth, as using both will cause
                   // confusion for us in the future (i.e. we may question "do we need to use both together? was there a reason?").
                   // Also: if the user has omitted "allowedOrigins" from their JWT, then service worker-based auth is more secure
                   // than cookie-based auth, which is another reason to prevent these cookies from being set unless required.
                   var setCookie = session.authServiceWorker === undefined;
-                  return AuthManagerBrowser_await(_this3.setAccessToken(session.params, jwt, setCookie), function (setTokenResult) {
+                  return AuthManagerBrowser_await(_this3.setAccessToken(params, jwt, setCookie), function (setTokenResult) {
                     return AuthManagerBrowser_invoke(function () {
                       if (session.authServiceWorker !== undefined) {
-                        return AuthManagerBrowser_await(_this3.serviceWorkerUtils.sendMessage({
-                          type: "SET_BYTESCALE_AUTH_CONFIG",
-                          config: [{
-                            headers: [{
-                              key: "Authorization",
-                              value: "Bearer ".concat(jwt)
-                            }],
-                            expires: secondsFromNow(setTokenResult.ttlSeconds),
-                            sourceUrlPrefixes: session.params.sourceUrlPrefixes,
-                            urlPrefix: "".concat(session.params.sourceUrlPrefixes === undefined ? "" : _this3.sourceScopedUrlPrefixMarker).concat(_this3.getCdnUrl(session.params), "/").concat(session.params.accountId, "/")
-                          }]
-                        }, session.authServiceWorker, _this3.serviceWorkerScriptFieldName), function () {
+                        return AuthManagerBrowser_await(_this3.sendServiceWorkerConfig(session, [{
+                          headers: [{
+                            key: "Authorization",
+                            value: "Bearer ".concat(jwt)
+                          }],
+                          expires: secondsFromNow(setTokenResult.ttlSeconds),
+                          sourceUrlPrefixes: params.sourceUrlPrefixes,
+                          urlPrefix: "".concat(_this3.getCdnUrl(params), "/").concat(params.accountId, "/")
+                        }]), function () {
                           // Allow time for the service worker to receive and process the message. Since this is asynchronous and not
                           // synchronized, we need to wait for a sufficient amount of time to ensure the service worker is ready to
                           // authenticate requests, so that after 'beginAuthSession' completes, users can start making requests.
@@ -3376,6 +3390,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                       expires = secondsFromNow(actualTtl);
                       // Set this at the end, as it's also used to signal 'isAuthSessionReady', so must be set after configuring the Service Worker, etc.
                       session.accessToken = setTokenResult.accessToken;
+                      session.isReady = true;
                     });
                   });
                 });
@@ -3388,7 +3403,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
             // 'setTimeout' can be paused (e.g., during hibernation), risking JWT expiration before it triggers. We use a
             // scheduler to check wall-clock time every second and execute the callback at the scheduled time (below).
             session.accessTokenRefreshHandle = _this3.scheduler.schedule(expires, function () {
-              _this3.refreshAccessToken(session).then(function () {},
+              _this3.refreshAccessToken(session, params).then(function () {},
               // Should not occur, as this method shouldn't throw errors.
               function (e) {
                 return ConsoleUtils.error("Unexpected error when refreshing JWT access token: ".concat(e));
@@ -3401,6 +3416,91 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "refreshServiceWorkerConfig",
+    value: function refreshServiceWorkerConfig(session, params) {
+      try {
+        var _this4 = this;
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this4.authSessionMutex.safe(AuthManagerBrowser_async(function () {
+          var _exit = false;
+          if (!session.isActive) {
+            return;
+          }
+          var refreshAt;
+          return AuthManagerBrowser_continue(AuthManagerBrowser_catch(function () {
+            return AuthManagerBrowser_await(params.getServiceWorkerConfig(), function (config) {
+              if (!Array.isArray(config)) {
+                throw new Error("The 'getServiceWorkerConfig' callback must return an array.");
+              }
+              return AuthManagerBrowser_await(_this4.sendServiceWorkerConfig(session, config), function () {
+                return AuthManagerBrowser_await(new Promise(function (resolve) {
+                  return setTimeout(resolve, 100);
+                }), function () {
+                  session.isReady = true;
+                  refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config);
+                });
+              });
+            });
+          }, function (e) {
+            ConsoleUtils.warn("Unable to refresh service worker auth config: ".concat(e));
+            refreshAt = Date.now() + _this4.retryAuthAfterErrorSeconds * 1000;
+          }), function (_result2) {
+            if (_exit) return _result2;
+            if (refreshAt !== undefined) {
+              session.accessTokenRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
+                _this4.refreshServiceWorkerConfig(session, params).then(function () {}, function (e) {
+                  return ConsoleUtils.error("Unexpected error when refreshing service worker auth config: ".concat(e));
+                });
+              });
+            }
+          });
+        }))));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
+  }, {
+    key: "getServiceWorkerConfigRefreshEpoch",
+    value: function getServiceWorkerConfigRefreshEpoch(config) {
+      var earliestExpiry;
+      var _iterator = _createForOfIteratorHelper(config),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var entry = _step.value;
+          if (entry.expires !== undefined && (earliestExpiry === undefined || entry.expires < earliestExpiry)) {
+            earliestExpiry = entry.expires;
+          }
+        }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
+      }
+      return earliestExpiry === undefined ? undefined : earliestExpiry - this.refreshBeforeExpirySeconds * 1000;
+    }
+  }, {
+    key: "sendServiceWorkerConfig",
+    value: function sendServiceWorkerConfig(session, config) {
+      try {
+        var _this5 = this;
+        if (session.authServiceWorker === undefined) {
+          throw new Error("Service worker configuration cannot be applied because service workers are unavailable.");
+        }
+        return AuthManagerBrowser_await(_this5.serviceWorkerUtils.sendMessage({
+          type: "SET_BYTESCALE_AUTH_CONFIG",
+          config: config.map(function (entry) {
+            return Object.assign(Object.assign({}, entry), {
+              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this5.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
+            });
+          })
+        }, session.authServiceWorker, _this5.serviceWorkerScriptFieldName), function (_this5$serviceWorkerU) {
+          session.authServiceWorker = _this5$serviceWorkerU;
+        });
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "getAccessTokenUrl",
     value: function getAccessTokenUrl(params, setCookie) {
@@ -3416,9 +3516,9 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "deleteAccessToken",
     value: function deleteAccessToken(params) {
       try {
-        var _this4 = this;
+        var _this6 = this;
         var _a;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this4.getAccessTokenUrl(params, true), {
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this6.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -3434,15 +3534,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "setAccessToken",
     value: function setAccessToken(params, jwt, setCookie) {
       try {
-        var _this5 = this;
+        var _this7 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this5.getAccessTokenUrl(params, setCookie), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this7.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
-          headers: AuthManagerBrowser_defineProperty({}, _this5.contentType, _this5.contentTypeJson),
+          headers: AuthManagerBrowser_defineProperty({}, _this7.contentType, _this7.contentTypeJson),
           body: JSON.stringify(request)
         }, {
           isBytescaleApi: true,
@@ -3458,10 +3558,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "getAccessToken",
     value: function getAccessToken(params, headers) {
       try {
-        var _this6 = this;
+        var _this8 = this;
         var _a, _b;
         var endpointName = "Your auth API endpoint";
-        var requiredContentType = _this6.contentTypeText;
+        var requiredContentType = _this8.contentTypeText;
         return AuthManagerBrowser_await(BaseAPI.fetch(params.authUrl, {
           method: "GET",
           headers: headers
@@ -3469,10 +3569,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           isBytescaleApi: false,
           fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
         }), function (result) {
-          var actualContentType = (_b = result.headers.get(_this6.contentType)) !== null && _b !== void 0 ? _b : "";
+          var actualContentType = (_b = result.headers.get(_this8.contentType)) !== null && _b !== void 0 ? _b : "";
           // Support content types like "text/plain; charset=utf-8" and "text/plain"
           if (actualContentType.split(";")[0] !== requiredContentType) {
-            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this6.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
+            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this8.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
           }
           return AuthManagerBrowser_await(result.text(), function (jwt) {
             if (jwt.length === 0) {
@@ -3489,6 +3589,11 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "isV2",
+    value: function isV2(params) {
+      return "getServiceWorkerConfig" in params;
+    }
   }]);
 }();
 /**

package/dist/types/private/dtos/AuthSwConfigEntryDto.d.ts

@@ -1,7 +1,11 @@
 import { AuthSwHeaderDto } from "./AuthSwHeaderDto";
 export interface AuthSwConfigEntryDto {
+    /** Epoch time in milliseconds. Omit the value to keep the entry until the config is replaced. */
     expires: number | undefined;
+    /** Headers to add to matching requests. */
     headers: AuthSwHeaderDto[];
+    /** Optional page or iframe URL prefixes. An empty array matches no clients. */
     sourceUrlPrefixes?: string[];
+    /** Request URL prefix. Use the actual URL; AuthManager applies any internal compatibility marker. */
     urlPrefix: string;
 }

package/dist/types/private/model/AuthManagerInterface.d.ts

@@ -1,5 +1,7 @@
 import { BytescaleApiClientConfig } from "../../public/shared";
-export interface BeginAuthSessionParams {
+import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
+export type BeginAuthSessionParams = BeginAuthSessionParamsV1 | BeginAuthSessionParamsV2;
+export interface BeginAuthSessionParamsV1 {
     /**
      * The account ID to authorize requests for.
      */
@@ -71,10 +73,29 @@ export interface BeginAuthSessionParams {
      */
     sourceUrlPrefixes?: string[];
 }
+export interface BeginAuthSessionParamsV2 {
+    /**
+     * Returns the complete replacement service-worker authorization config. Called when the session begins and again
+     * 20 seconds before the earliest configured expiry. Entries without an expiry do not trigger a refresh.
+     *
+     * IMPORTANT: do not call 'AuthManager.beginAuthSession' or 'AuthManager.endAuthSession' inside this callback, as this will cause a deadlock.
+     */
+    getServiceWorkerConfig: () => Promise<AuthSwConfigEntryDto[]>;
+    /**
+     * The path to the service worker JavaScript file hosted at the root of your website.
+     *
+     * Unlike V1 sessions, V2 sessions require service-worker support and do not create an SDK API access token or use
+     * CDN cookies as a fallback.
+     */
+    serviceWorkerScript: string;
+}
 export interface AuthManagerInterface {
     /**
      * Begins a JWT auth session with the Bytescale API and Bytescale CDN.
      *
+     * V1 sessions fetch and refresh a JWT using the supplied auth endpoint. V2 sessions instead refresh the complete
+     * service-worker configuration using `getServiceWorkerConfig`.
+     *
      * Specifically, calling this method will cause the SDK to periodically acquire a JWT from your JWT endpoint. The SDK will then automatically include this JWT in all subsequent Bytescale API requests (via the 'authorization-token' request header) and also in all Bytescale CDN download requests (via a session cookie, or an 'authorization' header if service workers are being used).
      *
      * You can only call this method if 'isAuthSessionActive() === false', else an error will be returned.

package/dist/types/private/model/AuthSession.d.ts

@@ -5,5 +5,6 @@ export interface AuthSession {
     accessTokenRefreshHandle: number | undefined;
     authServiceWorker: ServiceWorkerConfig | undefined;
     isActive: boolean;
+    isReady?: boolean;
     params: BeginAuthSessionParams;
 }

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -1,6 +1,9 @@
 import { AuthManagerInterface, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 import { AuthSwSetConfigDto } from "../../private/dtos/AuthSwSetConfigDto";
 import { ServiceWorkerUtils } from "../../private/ServiceWorkerUtils";
+export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
+export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
+export type { BeginAuthSessionParams, BeginAuthSessionParamsV1, BeginAuthSessionParamsV2 } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     private readonly serviceWorkerUtils;
     private readonly authSessionMutex;
@@ -19,14 +22,17 @@ declare class AuthManagerImpl implements AuthManagerInterface {
     beginAuthSession(params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;
     private refreshAccessToken;
+    private refreshServiceWorkerConfig;
+    private getServiceWorkerConfigRefreshEpoch;
+    private sendServiceWorkerConfig;
     private getAccessTokenUrl;
     private getCdnUrl;
     private deleteAccessToken;
     private setAccessToken;
     private getAccessToken;
+    private isV2;
 }
 /**
  * Alternative way of implementing a static class (i.e. all methods static). We do this so we can use a interface on the class (interfaces can't define static methods).
  */
 export declare const AuthManager: AuthManagerImpl;
-export {};

package/dist/types/public/node/AuthManagerNode.d.ts

@@ -1,4 +1,7 @@
 import { AuthManagerInterface, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
+export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
+export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
+export type { BeginAuthSessionParams, BeginAuthSessionParamsV1, BeginAuthSessionParamsV2 } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     beginAuthSession(_params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;
@@ -9,4 +12,3 @@ declare class AuthManagerImpl implements AuthManagerInterface {
  * Alternative way of implementing a static class (i.e. all methods static). We do this so we can use a interface on the class (interfaces can't define static methods).
  */
 export declare const AuthManager: AuthManagerImpl;
-export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.55.0",
+  "version": "3.56.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",

package/tests/AuthManagerBrowser.test.ts

@@ -0,0 +1,234 @@
+import { jest } from "@jest/globals";
+import { Response as NodeFetchResponse } from "node-fetch";
+import type { AuthSwConfigEntryDto, BeginAuthSessionParamsV1, BeginAuthSessionParamsV2 } from "../src/index.browser";
+
+interface AuthManagerApi {
+  beginAuthSession: (params: BeginAuthSessionParamsV1 | BeginAuthSessionParamsV2) => Promise<void>;
+  endAuthSession: () => Promise<void>;
+  isAuthSessionActive: () => boolean;
+  isAuthSessionReady: () => boolean;
+}
+
+describe("AuthManager browser service-worker config", () => {
+  const originalNavigator = Object.getOwnPropertyDescriptor(globalThis, "navigator");
+  const originalFetch = Object.getOwnPropertyDescriptor(globalThis, "fetch");
+  const originalWindow = Object.getOwnPropertyDescriptor(globalThis, "window");
+  const globalFetch = jest.fn(async (): Promise<Response> => {
+    throw new Error("This test must not use the global fetch API.");
+  });
+  const postMessage = jest.fn((_message: unknown): void => {});
+  const activeWorker = { postMessage, state: "activated" } as unknown as ServiceWorker;
+  const registration = {
+    active: activeWorker,
+    installing: null,
+    scope: "https://app.example.com/",
+    waiting: null
+  } as unknown as ServiceWorkerRegistration;
+  const serviceWorkerApi = {
+    controller: activeWorker,
+    getRegistrations: jest.fn(async (): Promise<ServiceWorkerRegistration[]> => [registration]),
+    register: jest.fn(async (): Promise<ServiceWorkerRegistration> => registration)
+  };
+  const navigatorValue: { serviceWorker?: typeof serviceWorkerApi } = { serviceWorker: serviceWorkerApi };
+  let AuthManager: AuthManagerApi;
+
+  beforeAll(async () => {
+    Object.defineProperty(globalThis, "fetch", { configurable: true, value: globalFetch });
+    Object.defineProperty(globalThis, "window", { configurable: true, value: {} });
+    Object.defineProperty(globalThis, "navigator", { configurable: true, value: navigatorValue });
+    AuthManager = (await import("../src/public/browser/AuthManagerBrowser")).AuthManager;
+  });
+
+  beforeEach(() => {
+    navigatorValue.serviceWorker = serviceWorkerApi;
+    globalFetch.mockClear();
+    postMessage.mockClear();
+    serviceWorkerApi.getRegistrations.mockClear();
+    serviceWorkerApi.register.mockClear();
+  });
+
+  afterAll(() => {
+    for (const [key, descriptor] of [
+      ["fetch", originalFetch],
+      ["navigator", originalNavigator],
+      ["window", originalWindow]
+    ] as const) {
+      if (descriptor === undefined) {
+        Reflect.deleteProperty(globalThis, key);
+      } else {
+        Object.defineProperty(globalThis, key, descriptor);
+      }
+    }
+  });
+
+  afterEach(async () => {
+    navigatorValue.serviceWorker = serviceWorkerApi;
+    await AuthManager.endAuthSession();
+    jest.restoreAllMocks();
+  });
+
+  test("V2 applies multiple entries and refreshes before the earliest expiry", async () => {
+    const firstConfig: AuthSwConfigEntryDto[] = [
+      {
+        expires: Date.now() + 21_000,
+        headers: [{ key: "Authorization", value: "Bearer account-a" }],
+        sourceUrlPrefixes: ["https://app.example.com/account-a/"],
+        urlPrefix: "https://upcdn.io/account-a/"
+      },
+      {
+        expires: Date.now() + 60_000,
+        headers: [{ key: "Authorization", value: "Bearer account-b" }],
+        urlPrefix: "https://upcdn.io/account-b/"
+      }
+    ];
+    const refreshedConfig: AuthSwConfigEntryDto[] = [
+      {
+        expires: undefined,
+        headers: [{ key: "Authorization", value: "Bearer refreshed" }],
+        urlPrefix: "https://upcdn.io/account-a/"
+      }
+    ];
+    const getServiceWorkerConfig = jest
+      .fn<BeginAuthSessionParamsV2["getServiceWorkerConfig"]>()
+      .mockResolvedValueOnce(firstConfig)
+      .mockResolvedValueOnce(refreshedConfig);
+
+    await AuthManager.beginAuthSession({
+      getServiceWorkerConfig,
+      serviceWorkerScript: "/bytescale-auth-sw.js"
+    });
+
+    expect(AuthManager.isAuthSessionActive()).toBe(true);
+    expect(AuthManager.isAuthSessionReady()).toBe(true);
+    expect(postMessage.mock.calls[0][0]).toEqual({
+      config: [
+        {
+          ...firstConfig[0],
+          urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-a/"
+        },
+        firstConfig[1]
+      ],
+      type: "SET_BYTESCALE_AUTH_CONFIG"
+    });
+    expect(firstConfig[0].urlPrefix).toBe("https://upcdn.io/account-a/");
+
+    await new Promise(resolve => setTimeout(resolve, 1_500));
+
+    expect(getServiceWorkerConfig).toHaveBeenCalledTimes(2);
+    expect(postMessage.mock.calls[1][0]).toEqual({
+      config: refreshedConfig,
+      type: "SET_BYTESCALE_AUTH_CONFIG"
+    });
+  });
+
+  test("V2 clears service-worker config without calling access-token endpoints", async () => {
+    await AuthManager.beginAuthSession({
+      getServiceWorkerConfig: async () => [
+        {
+          expires: undefined,
+          headers: [{ key: "Authorization", value: "Bearer account-a" }],
+          urlPrefix: "https://upcdn.io/account-a/"
+        }
+      ],
+      serviceWorkerScript: "/bytescale-auth-sw.js"
+    });
+    await AuthManager.endAuthSession();
+
+    expect(globalFetch).not.toHaveBeenCalled();
+    expect(postMessage.mock.calls[1][0]).toEqual({ config: [], type: "SET_BYTESCALE_AUTH_CONFIG" });
+    expect(AuthManager.isAuthSessionActive()).toBe(false);
+    expect(AuthManager.isAuthSessionReady()).toBe(false);
+  });
+
+  test("V2 rejects instead of falling back to cookies when service workers are unavailable", async () => {
+    delete navigatorValue.serviceWorker;
+    const getServiceWorkerConfig = jest.fn(async (): Promise<AuthSwConfigEntryDto[]> => []);
+
+    await expect(
+      AuthManager.beginAuthSession({ getServiceWorkerConfig, serviceWorkerScript: "/bytescale-auth-sw.js" })
+    ).rejects.toThrow("requires service workers");
+
+    expect(getServiceWorkerConfig).not.toHaveBeenCalled();
+    expect(AuthManager.isAuthSessionActive()).toBe(false);
+  });
+
+  test("V1 retains cookie fallback when service workers are unavailable", async () => {
+    delete navigatorValue.serviceWorker;
+    const fetchApi = jest.fn(async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      switch (init?.method) {
+        case "GET":
+          return new NodeFetchResponse("jwt-a", {
+            headers: { "Content-Type": "text/plain" }
+          }) as unknown as Response;
+        case "PUT":
+          return new NodeFetchResponse(
+            JSON.stringify({ accessToken: "access-a", ttlSeconds: 3600 })
+          ) as unknown as Response;
+        case "DELETE":
+          return new NodeFetchResponse(null, { status: 204 }) as unknown as Response;
+        default:
+          throw new Error(`Unexpected method: ${init?.method ?? "undefined"}`);
+      }
+    });
+
+    await AuthManager.beginAuthSession({
+      accountId: "account-a",
+      authHeaders: async (): Promise<Record<string, string>> => ({}),
+      authUrl: "https://app.example.com/auth",
+      options: { fetchApi },
+      serviceWorkerScript: "/bytescale-auth-sw.js"
+    });
+
+    expect((fetchApi.mock.calls[1][0] as string).endsWith("?set-cookie=true")).toBe(true);
+    expect(postMessage).not.toHaveBeenCalled();
+    expect(AuthManager.isAuthSessionReady()).toBe(true);
+  });
+
+  test("V1 retains the existing JWT, access-token, and single-entry service-worker flow", async () => {
+    const fetchApi = jest.fn(async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      switch (init?.method) {
+        case "GET":
+          return new NodeFetchResponse("jwt-a", {
+            headers: { "Content-Type": "text/plain" }
+          }) as unknown as Response;
+        case "PUT":
+          return new NodeFetchResponse(
+            JSON.stringify({ accessToken: "access-a", ttlSeconds: 3600 })
+          ) as unknown as Response;
+        case "DELETE":
+          return new NodeFetchResponse(null, { status: 204 }) as unknown as Response;
+        default:
+          throw new Error(`Unexpected method: ${init?.method ?? "undefined"}`);
+      }
+    });
+    const params: BeginAuthSessionParamsV1 = {
+      accountId: "account-a",
+      authHeaders: async (): Promise<Record<string, string>> => ({ "X-App-Authorization": "app-token" }),
+      authUrl: "https://app.example.com/auth",
+      options: { fetchApi },
+      serviceWorkerScript: "/bytescale-auth-sw.js",
+      sourceUrlPrefixes: ["https://app.example.com/"]
+    };
+
+    await AuthManager.beginAuthSession(params);
+
+    expect(AuthManager.isAuthSessionReady()).toBe(true);
+    expect(postMessage.mock.calls[0][0]).toEqual({
+      config: [
+        {
+          expires: expect.any(Number),
+          headers: [{ key: "Authorization", value: "Bearer jwt-a" }],
+          sourceUrlPrefixes: params.sourceUrlPrefixes,
+          urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-a/"
+        }
+      ],
+      type: "SET_BYTESCALE_AUTH_CONFIG"
+    });
+    expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT"]);
+
+    await AuthManager.endAuthSession();
+
+    expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT", "DELETE"]);
+    expect(postMessage.mock.calls[1][0]).toEqual({ config: [], type: "SET_BYTESCALE_AUTH_CONFIG" });
+  });
+});