@bytescale/sdk 3.55.0 → 3.57.0

package/dist/browser/esm/main.mjs

@@ -3156,6 +3156,13 @@ function AuthManagerBrowser_awaitIgnored(value, direct) {
     return value && value.then ? value.then(AuthManagerBrowser_empty) : Promise.resolve();
   }
 }
+function AuthManagerBrowser_invoke(body, then) {
+  var result = body();
+  if (result && result.then) {
+    return result.then(then);
+  }
+  return then(result);
+}
 function AuthManagerBrowser_await(value, then, direct) {
   if (direct) {
     return then ? then(value) : value;
@@ -3183,13 +3190,6 @@ function AuthManagerBrowser_invokeIgnored(body) {
     return result.then(AuthManagerBrowser_empty);
   }
 }
-function AuthManagerBrowser_invoke(body, then) {
-  var result = body();
-  if (result && result.then) {
-    return result.then(then);
-  }
-  return then(result);
-}
 function AuthManagerBrowser_catch(body, recover) {
   try {
     var result = body();
@@ -3221,8 +3221,29 @@ function AuthManagerBrowser_continueIgnored(value) {
     return value.then(AuthManagerBrowser_empty);
   }
 }
-function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
+function AuthManagerBrowser_call(body, then, direct) {
+  if (direct) {
+    return then ? then(body()) : body();
+  }
+  try {
+    var result = Promise.resolve(body());
+    return then ? result.then(then) : result;
+  } catch (e) {
+    return Promise.reject(e);
+  }
+}
+function AuthManagerBrowser_continue(value, then) {
+  return value && value.then ? value.then(then) : then(value);
+}
 function AuthManagerBrowser_defineProperty(e, r, t) { return (r = AuthManagerBrowser_toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = AuthManagerBrowser_unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function AuthManagerBrowser_toConsumableArray(r) { return AuthManagerBrowser_arrayWithoutHoles(r) || AuthManagerBrowser_iterableToArray(r) || AuthManagerBrowser_unsupportedIterableToArray(r) || AuthManagerBrowser_nonIterableSpread(); }
+function AuthManagerBrowser_nonIterableSpread() { throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
+function AuthManagerBrowser_unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return AuthManagerBrowser_arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? AuthManagerBrowser_arrayLikeToArray(r, a) : void 0; } }
+function AuthManagerBrowser_iterableToArray(r) { if ("undefined" != typeof Symbol && null != r[Symbol.iterator] || null != r["@@iterator"]) return Array.from(r); }
+function AuthManagerBrowser_arrayWithoutHoles(r) { if (Array.isArray(r)) return AuthManagerBrowser_arrayLikeToArray(r); }
+function AuthManagerBrowser_arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
 function AuthManagerBrowser_classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
 function AuthManagerBrowser_defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, AuthManagerBrowser_toPropertyKey(o.key), o); } }
 function AuthManagerBrowser_createClass(e, r, t) { return r && AuthManagerBrowser_defineProperties(e.prototype, r), t && AuthManagerBrowser_defineProperties(e, t), Object.defineProperty(e, "prototype", { writable: !1 }), e; }
@@ -3257,7 +3278,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "isAuthSessionReady",
     value: function isAuthSessionReady() {
       var _a;
-      return ((_a = AuthSessionState.getSession()) === null || _a === void 0 ? void 0 : _a.accessToken) !== undefined;
+      var session = AuthSessionState.getSession();
+      return (_a = session === null || session === void 0 ? void 0 : session.isReady) !== null && _a !== void 0 ? _a : (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
     }
   }, {
     key: "beginAuthSession",
@@ -3269,21 +3291,40 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (_this.isAuthSessionActive()) {
             throw new Error("Auth session already active. Please call 'await endAuthSession()' and then call 'await beginAuthSession(...)' to start a new auth session.");
           }
+          var canUseServiceWorkers = _this.serviceWorkerUtils.canUseServiceWorkers();
+          if (params.serviceWorkerConfig !== undefined) {
+            if (params.serviceWorkerScript === undefined) {
+              throw new Error("The 'serviceWorkerScript' field is required when 'serviceWorkerConfig' is provided.");
+            }
+            if (!canUseServiceWorkers) {
+              throw new Error("The 'serviceWorkerConfig' field requires service workers, but this browser does not support them.");
+            }
+          }
           var newSession = {
             accessToken: undefined,
             accessTokenRefreshHandle: undefined,
             params: params,
             isActive: true,
-            authServiceWorker: params.serviceWorkerScript !== undefined && _this.serviceWorkerUtils.canUseServiceWorkers() ? {
+            isReady: false,
+            authServiceWorker: params.serviceWorkerScript !== undefined && canUseServiceWorkers ? {
               serviceWorkerScript: params.serviceWorkerScript,
               type: "Uninitialized"
-            } : undefined
+            } : undefined,
+            primaryAuthSwConfig: undefined,
+            serviceWorkerConfig: undefined,
+            serviceWorkerConfigRefreshHandle: undefined
           };
           AuthSessionState.setSession(newSession);
           return newSession;
         })), function (session) {
           // IMPORTANT: must be called outside the above, else re-entrant deadlock will occur.
-          return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session));
+          return AuthManagerBrowser_invoke(function () {
+            if (session.params.serviceWorkerConfig !== undefined) {
+              return AuthManagerBrowser_awaitIgnored(_this.refreshServiceWorkerConfig(session, session.params));
+            }
+          }, function () {
+            return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
+          });
         });
       } catch (e) {
         return Promise.reject(e);
@@ -3304,14 +3345,20 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (session.accessTokenRefreshHandle !== undefined) {
             _this2.scheduler.unschedule(session.accessTokenRefreshHandle);
           }
-          return AuthManagerBrowser_await(_this2.deleteAccessToken(session.params), function () {
+          if (session.serviceWorkerConfigRefreshHandle !== undefined) {
+            _this2.scheduler.unschedule(session.serviceWorkerConfigRefreshHandle);
+          }
+          // AuthSessionState is shared between bundled SDK versions. Service-worker-only sessions from 3.56.0 did not
+          // contain an accountId, so allow a newer SDK instance to tear those sessions down without calling this endpoint.
+          return AuthManagerBrowser_invoke(function () {
+            if (typeof session.params.accountId === "string") {
+              return AuthManagerBrowser_awaitIgnored(_this2.deleteAccessToken(session.params));
+            }
+          }, function () {
             return AuthManagerBrowser_invokeIgnored(function () {
               if (session.authServiceWorker !== undefined) {
                 // Prevent service worker from authorizing subsequent requests.
-                return AuthManagerBrowser_awaitIgnored(_this2.serviceWorkerUtils.sendMessage({
-                  type: "SET_BYTESCALE_AUTH_CONFIG",
-                  config: []
-                }, session.authServiceWorker, _this2.serviceWorkerScriptFieldName));
+                return AuthManagerBrowser_awaitIgnored(_this2.sendServiceWorkerConfig(session, []));
               }
             });
           });
@@ -3322,7 +3369,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "refreshAccessToken",
-    value: function refreshAccessToken(session) {
+    value: function refreshAccessToken(session, params) {
       try {
         var _this3 = this;
         return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this3.authSessionMutex.safe(AuthManagerBrowser_async(function () {
@@ -3335,36 +3382,35 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           var expires = secondsFromNow(_this3.retryAuthAfterErrorSeconds);
           return AuthManagerBrowser_continueIgnored(AuthManagerBrowser_finallyRethrows(function () {
             return AuthManagerBrowser_catch(function () {
-              var _getAccessToken = _this3.getAccessToken,
-                _session$params = session.params;
-              return AuthManagerBrowser_await(session.params.authHeaders(), function (_session$params$authH) {
-                return AuthManagerBrowser_await(_getAccessToken.call(_this3, _session$params, _session$params$authH), function (jwt) {
+              var _getAccessToken = _this3.getAccessToken;
+              return AuthManagerBrowser_await(params.authHeaders(), function (_params$authHeaders) {
+                return AuthManagerBrowser_await(_getAccessToken.call(_this3, params, _params$authHeaders), function (jwt) {
                   // We don't use cookie-based auth if the browser supports service worker-based auth, as using both will cause
                   // confusion for us in the future (i.e. we may question "do we need to use both together? was there a reason?").
                   // Also: if the user has omitted "allowedOrigins" from their JWT, then service worker-based auth is more secure
                   // than cookie-based auth, which is another reason to prevent these cookies from being set unless required.
                   var setCookie = session.authServiceWorker === undefined;
-                  return AuthManagerBrowser_await(_this3.setAccessToken(session.params, jwt, setCookie), function (setTokenResult) {
+                  return AuthManagerBrowser_await(_this3.setAccessToken(params, jwt, setCookie), function (setTokenResult) {
                     return AuthManagerBrowser_invoke(function () {
                       if (session.authServiceWorker !== undefined) {
-                        return AuthManagerBrowser_await(_this3.serviceWorkerUtils.sendMessage({
-                          type: "SET_BYTESCALE_AUTH_CONFIG",
-                          config: [{
-                            headers: [{
-                              key: "Authorization",
-                              value: "Bearer ".concat(jwt)
-                            }],
-                            expires: secondsFromNow(setTokenResult.ttlSeconds),
-                            sourceUrlPrefixes: session.params.sourceUrlPrefixes,
-                            urlPrefix: "".concat(session.params.sourceUrlPrefixes === undefined ? "" : _this3.sourceScopedUrlPrefixMarker).concat(_this3.getCdnUrl(session.params), "/").concat(session.params.accountId, "/")
-                          }]
-                        }, session.authServiceWorker, _this3.serviceWorkerScriptFieldName), function () {
-                          // Allow time for the service worker to receive and process the message. Since this is asynchronous and not
-                          // synchronized, we need to wait for a sufficient amount of time to ensure the service worker is ready to
-                          // authenticate requests, so that after 'beginAuthSession' completes, users can start making requests.
-                          return AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
-                            return setTimeout(resolve, 100);
-                          }));
+                        var primaryAuthSwConfig = {
+                          headers: [{
+                            key: "Authorization",
+                            value: "Bearer ".concat(jwt)
+                          }],
+                          expires: secondsFromNow(setTokenResult.ttlSeconds),
+                          urlPrefix: "".concat(_this3.getCdnUrl(params), "/").concat(params.accountId, "/")
+                        };
+                        // Fail closed until the initial serviceWorkerConfig callback succeeds: without its result, we do not know
+                        // the source-page restrictions intended for the primary JWT.
+                        return AuthManagerBrowser_invoke(function () {
+                          if (params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined) {
+                            return AuthManagerBrowser_await(_this3.sendMergedServiceWorkerConfig(session, primaryAuthSwConfig, session.serviceWorkerConfig), function () {
+                              return AuthManagerBrowser_awaitIgnored(_this3.waitForServiceWorker());
+                            });
+                          }
+                        }, function () {
+                          session.primaryAuthSwConfig = primaryAuthSwConfig;
                         });
                       }
                     }, function () {
@@ -3376,6 +3422,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                       expires = secondsFromNow(actualTtl);
                       // Set this at the end, as it's also used to signal 'isAuthSessionReady', so must be set after configuring the Service Worker, etc.
                       session.accessToken = setTokenResult.accessToken;
+                      _this3.updateSessionReadiness(session);
                     });
                   });
                 });
@@ -3388,7 +3435,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
             // 'setTimeout' can be paused (e.g., during hibernation), risking JWT expiration before it triggers. We use a
             // scheduler to check wall-clock time every second and execute the callback at the scheduled time (below).
             session.accessTokenRefreshHandle = _this3.scheduler.schedule(expires, function () {
-              _this3.refreshAccessToken(session).then(function () {},
+              _this3.refreshAccessToken(session, params).then(function () {},
               // Should not occur, as this method shouldn't throw errors.
               function (e) {
                 return ConsoleUtils.error("Unexpected error when refreshing JWT access token: ".concat(e));
@@ -3401,6 +3448,138 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "refreshServiceWorkerConfig",
+    value: function refreshServiceWorkerConfig(session, params) {
+      try {
+        var _this4 = this;
+        var getServiceWorkerConfig = params.serviceWorkerConfig;
+        if (getServiceWorkerConfig === undefined) {
+          return AuthManagerBrowser_await();
+        }
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this4.authSessionMutex.safe(AuthManagerBrowser_async(function () {
+          var _exit = false;
+          if (!session.isActive) {
+            return;
+          }
+          var refreshAt;
+          return AuthManagerBrowser_continue(AuthManagerBrowser_catch(function () {
+            return AuthManagerBrowser_call(getServiceWorkerConfig, function (result) {
+              if (result === null || AuthManagerBrowser_typeof(result) !== "object" || !Array.isArray(result.additionalConfig)) {
+                throw new Error("The 'serviceWorkerConfig' callback must return an object containing 'additionalConfig'.");
+              }
+              if (result.sourceUrlPrefixes !== undefined && (!Array.isArray(result.sourceUrlPrefixes) || !result.sourceUrlPrefixes.every(function (prefix) {
+                return typeof prefix === "string";
+              }))) {
+                throw new Error("The 'sourceUrlPrefixes' field returned by 'serviceWorkerConfig' must be an array of strings.");
+              }
+              var config = {
+                additionalConfig: result.additionalConfig,
+                sourceUrlPrefixes: result.sourceUrlPrefixes
+              };
+              return AuthManagerBrowser_invoke(function () {
+                if (session.primaryAuthSwConfig !== undefined) {
+                  return AuthManagerBrowser_await(_this4.sendMergedServiceWorkerConfig(session, session.primaryAuthSwConfig, config), function () {
+                    return AuthManagerBrowser_awaitIgnored(_this4.waitForServiceWorker());
+                  });
+                }
+              }, function () {
+                session.serviceWorkerConfig = config;
+                _this4.updateSessionReadiness(session);
+                refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config.additionalConfig);
+              });
+            });
+          }, function (e) {
+            ConsoleUtils.warn("Unable to refresh service worker auth config: ".concat(e));
+            refreshAt = Date.now() + _this4.retryAuthAfterErrorSeconds * 1000;
+          }), function (_result2) {
+            if (_exit) return _result2;
+            if (refreshAt !== undefined) {
+              session.serviceWorkerConfigRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
+                _this4.refreshServiceWorkerConfig(session, params).then(function () {}, function (e) {
+                  return ConsoleUtils.error("Unexpected error when refreshing service worker auth config: ".concat(e));
+                });
+              });
+            }
+          });
+        }))));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
+  }, {
+    key: "sendMergedServiceWorkerConfig",
+    value: function sendMergedServiceWorkerConfig(session, primaryConfig, serviceWorkerConfig) {
+      try {
+        var _this5 = this;
+        var _a;
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this5.sendServiceWorkerConfig(session, [Object.assign(Object.assign({}, primaryConfig), {
+          sourceUrlPrefixes: serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.sourceUrlPrefixes
+        })].concat(AuthManagerBrowser_toConsumableArray((_a = serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.additionalConfig) !== null && _a !== void 0 ? _a : [])))));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
+  }, {
+    key: "getServiceWorkerConfigRefreshEpoch",
+    value: function getServiceWorkerConfigRefreshEpoch(config) {
+      var earliestExpiry;
+      var _iterator = _createForOfIteratorHelper(config),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var entry = _step.value;
+          if (entry.expires !== undefined && (earliestExpiry === undefined || entry.expires < earliestExpiry)) {
+            earliestExpiry = entry.expires;
+          }
+        }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
+      }
+      return earliestExpiry === undefined ? undefined : earliestExpiry - this.refreshBeforeExpirySeconds * 1000;
+    }
+  }, {
+    key: "sendServiceWorkerConfig",
+    value: function sendServiceWorkerConfig(session, config) {
+      try {
+        var _this6 = this;
+        if (session.authServiceWorker === undefined) {
+          throw new Error("Service worker configuration cannot be applied because service workers are unavailable.");
+        }
+        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage({
+          type: "SET_BYTESCALE_AUTH_CONFIG",
+          config: config.map(function (entry) {
+            return Object.assign(Object.assign({}, entry), {
+              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this6.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
+            });
+          })
+        }, session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
+          session.authServiceWorker = _this6$serviceWorkerU;
+        });
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
+  }, {
+    key: "updateSessionReadiness",
+    value: function updateSessionReadiness(session) {
+      session.isReady = session.accessToken !== undefined && (session.params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined);
+    }
+  }, {
+    key: "waitForServiceWorker",
+    value: function waitForServiceWorker() {
+      try {
+        // Message delivery is asynchronous and has no acknowledgement, so allow the worker time to apply the config before
+        // beginAuthSession reports that authenticated requests are ready.
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
+          return setTimeout(resolve, 100);
+        })));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "getAccessTokenUrl",
     value: function getAccessTokenUrl(params, setCookie) {
@@ -3416,9 +3595,9 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "deleteAccessToken",
     value: function deleteAccessToken(params) {
       try {
-        var _this4 = this;
+        var _this7 = this;
         var _a;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this4.getAccessTokenUrl(params, true), {
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this7.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -3434,15 +3613,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "setAccessToken",
     value: function setAccessToken(params, jwt, setCookie) {
       try {
-        var _this5 = this;
+        var _this8 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this5.getAccessTokenUrl(params, setCookie), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this8.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
-          headers: AuthManagerBrowser_defineProperty({}, _this5.contentType, _this5.contentTypeJson),
+          headers: AuthManagerBrowser_defineProperty({}, _this8.contentType, _this8.contentTypeJson),
           body: JSON.stringify(request)
         }, {
           isBytescaleApi: true,
@@ -3458,10 +3637,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "getAccessToken",
     value: function getAccessToken(params, headers) {
       try {
-        var _this6 = this;
+        var _this9 = this;
         var _a, _b;
         var endpointName = "Your auth API endpoint";
-        var requiredContentType = _this6.contentTypeText;
+        var requiredContentType = _this9.contentTypeText;
         return AuthManagerBrowser_await(BaseAPI.fetch(params.authUrl, {
           method: "GET",
           headers: headers
@@ -3469,10 +3648,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           isBytescaleApi: false,
           fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
         }), function (result) {
-          var actualContentType = (_b = result.headers.get(_this6.contentType)) !== null && _b !== void 0 ? _b : "";
+          var actualContentType = (_b = result.headers.get(_this9.contentType)) !== null && _b !== void 0 ? _b : "";
           // Support content types like "text/plain; charset=utf-8" and "text/plain"
           if (actualContentType.split(";")[0] !== requiredContentType) {
-            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this6.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
+            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this9.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
           }
           return AuthManagerBrowser_await(result.text(), function (jwt) {
             if (jwt.length === 0) {

package/dist/types/private/dtos/AuthSwConfigEntryDto.d.ts

@@ -1,7 +1,11 @@
 import { AuthSwHeaderDto } from "./AuthSwHeaderDto";
 export interface AuthSwConfigEntryDto {
+    /** Epoch time in milliseconds. Omit the value to keep the entry until the config is replaced. */
     expires: number | undefined;
+    /** Headers to add to matching requests. */
     headers: AuthSwHeaderDto[];
+    /** Optional page or iframe URL prefixes. An empty array matches no clients. */
     sourceUrlPrefixes?: string[];
+    /** Request URL prefix. Use the actual URL; AuthManager applies any internal compatibility marker. */
     urlPrefix: string;
 }

package/dist/types/private/model/AuthManagerInterface.d.ts

@@ -1,4 +1,18 @@
 import { BytescaleApiClientConfig } from "../../public/shared";
+import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
+export interface AuthManagerServiceWorkerConfig {
+    /**
+     * Additional download-only service-worker authorization rules.
+     * An empty array clears all additional rules.
+     */
+    additionalConfig: AuthSwConfigEntryDto[];
+    /**
+     * Restricts the primary JWT to pages and iframes whose URL starts with one of these prefixes.
+     * An empty array matches no clients. Omit this field to preserve the existing service-worker behavior.
+     * History API changes do not update the matched client URL.
+     */
+    sourceUrlPrefixes?: string[];
+}
 export interface BeginAuthSessionParams {
     /**
      * The account ID to authorize requests for.
@@ -18,6 +32,18 @@ export interface BeginAuthSessionParams {
      * Optional configuration.
      */
     options?: Pick<BytescaleApiClientConfig, "fetchApi" | "cdnUrl">;
+    /**
+     * Returns configuration for service-worker authorization. The primary JWT returned by `authUrl` is restricted using
+     * `sourceUrlPrefixes`; `additionalConfig` contains download-only rules and never authenticates SDK API operations.
+     * Called when the session begins and again 20 seconds before the earliest additional entry expires. Entries without
+     * an expiry do not trigger a refresh.
+     *
+     * Requires `serviceWorkerScript` and browser service-worker support. Additional rules cannot use the CDN cookie
+     * fallback.
+     *
+     * IMPORTANT: do not call 'AuthManager.beginAuthSession' or 'AuthManager.endAuthSession' inside this callback, as this will cause a deadlock.
+     */
+    serviceWorkerConfig?: () => Promise<AuthManagerServiceWorkerConfig>;
     /**
      * Enables support for modern browsers that block third-party cookies (like Safari).
      *
@@ -64,17 +90,14 @@ export interface BeginAuthSessionParams {
      * script must be hosted on your website's domain in the root directory.
      */
     serviceWorkerScript?: string;
-    /**
-     * Restricts service-worker authorization to pages and iframes whose URL starts with one of these prefixes.
-     * An empty array matches no clients. Omit this field to preserve the existing service-worker behavior.
-     * Applies only with `serviceWorkerScript`; History API changes do not update the matched client URL.
-     */
-    sourceUrlPrefixes?: string[];
 }
 export interface AuthManagerInterface {
     /**
      * Begins a JWT auth session with the Bytescale API and Bytescale CDN.
      *
+     * The primary JWT authenticates Bytescale API operations and downloads for `accountId`. Optional additional
+     * service-worker rules authenticate downloads only.
+     *
      * Specifically, calling this method will cause the SDK to periodically acquire a JWT from your JWT endpoint. The SDK will then automatically include this JWT in all subsequent Bytescale API requests (via the 'authorization-token' request header) and also in all Bytescale CDN download requests (via a session cookie, or an 'authorization' header if service workers are being used).
      *
      * You can only call this method if 'isAuthSessionActive() === false', else an error will be returned.

package/dist/types/private/model/AuthSession.d.ts

@@ -1,9 +1,14 @@
-import { BeginAuthSessionParams } from "./AuthManagerInterface";
+import { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "./AuthManagerInterface";
+import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
 import { ServiceWorkerConfig } from "./ServiceWorkerConfig";
 export interface AuthSession {
     accessToken: string | undefined;
     accessTokenRefreshHandle: number | undefined;
     authServiceWorker: ServiceWorkerConfig | undefined;
     isActive: boolean;
+    isReady?: boolean;
     params: BeginAuthSessionParams;
+    primaryAuthSwConfig: AuthSwConfigEntryDto | undefined;
+    serviceWorkerConfig: AuthManagerServiceWorkerConfig | undefined;
+    serviceWorkerConfigRefreshHandle: number | undefined;
 }

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -1,6 +1,9 @@
 import { AuthManagerInterface, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 import { AuthSwSetConfigDto } from "../../private/dtos/AuthSwSetConfigDto";
 import { ServiceWorkerUtils } from "../../private/ServiceWorkerUtils";
+export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
+export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
+export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     private readonly serviceWorkerUtils;
     private readonly authSessionMutex;
@@ -19,6 +22,12 @@ declare class AuthManagerImpl implements AuthManagerInterface {
     beginAuthSession(params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;
     private refreshAccessToken;
+    private refreshServiceWorkerConfig;
+    private sendMergedServiceWorkerConfig;
+    private getServiceWorkerConfigRefreshEpoch;
+    private sendServiceWorkerConfig;
+    private updateSessionReadiness;
+    private waitForServiceWorker;
     private getAccessTokenUrl;
     private getCdnUrl;
     private deleteAccessToken;
@@ -29,4 +38,3 @@ declare class AuthManagerImpl implements AuthManagerInterface {
  * Alternative way of implementing a static class (i.e. all methods static). We do this so we can use a interface on the class (interfaces can't define static methods).
  */
 export declare const AuthManager: AuthManagerImpl;
-export {};

package/dist/types/public/node/AuthManagerNode.d.ts

@@ -1,4 +1,7 @@
 import { AuthManagerInterface, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
+export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
+export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
+export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     beginAuthSession(_params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;
@@ -9,4 +12,3 @@ declare class AuthManagerImpl implements AuthManagerInterface {
  * Alternative way of implementing a static class (i.e. all methods static). We do this so we can use a interface on the class (interfaces can't define static methods).
  */
 export declare const AuthManager: AuthManagerImpl;
-export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.55.0",
+  "version": "3.57.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",