@bytescale/sdk 3.56.0 → 3.57.0

package/dist/browser/cjs/main.js

@@ -3196,11 +3196,12 @@ function AuthManagerBrowser_awaitIgnored(value, direct) {
     return value && value.then ? value.then(AuthManagerBrowser_empty) : Promise.resolve();
   }
 }
-function AuthManagerBrowser_invokeIgnored(body) {
+function AuthManagerBrowser_invoke(body, then) {
   var result = body();
   if (result && result.then) {
-    return result.then(AuthManagerBrowser_empty);
+    return result.then(then);
   }
+  return then(result);
 }
 function AuthManagerBrowser_await(value, then, direct) {
   if (direct) {
@@ -3223,12 +3224,11 @@ function AuthManagerBrowser_async(f) {
     }
   };
 }
-function AuthManagerBrowser_invoke(body, then) {
+function AuthManagerBrowser_invokeIgnored(body) {
   var result = body();
   if (result && result.then) {
-    return result.then(then);
+    return result.then(AuthManagerBrowser_empty);
   }
-  return then(result);
 }
 function AuthManagerBrowser_catch(body, recover) {
   try {
@@ -3261,14 +3261,29 @@ function AuthManagerBrowser_continueIgnored(value) {
     return value.then(AuthManagerBrowser_empty);
   }
 }
+function AuthManagerBrowser_call(body, then, direct) {
+  if (direct) {
+    return then ? then(body()) : body();
+  }
+  try {
+    var result = Promise.resolve(body());
+    return then ? result.then(then) : result;
+  } catch (e) {
+    return Promise.reject(e);
+  }
+}
 function AuthManagerBrowser_continue(value, then) {
   return value && value.then ? value.then(then) : then(value);
 }
-function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
 function AuthManagerBrowser_defineProperty(e, r, t) { return (r = AuthManagerBrowser_toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
 function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = AuthManagerBrowser_unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function AuthManagerBrowser_toConsumableArray(r) { return AuthManagerBrowser_arrayWithoutHoles(r) || AuthManagerBrowser_iterableToArray(r) || AuthManagerBrowser_unsupportedIterableToArray(r) || AuthManagerBrowser_nonIterableSpread(); }
+function AuthManagerBrowser_nonIterableSpread() { throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
 function AuthManagerBrowser_unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return AuthManagerBrowser_arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? AuthManagerBrowser_arrayLikeToArray(r, a) : void 0; } }
+function AuthManagerBrowser_iterableToArray(r) { if ("undefined" != typeof Symbol && null != r[Symbol.iterator] || null != r["@@iterator"]) return Array.from(r); }
+function AuthManagerBrowser_arrayWithoutHoles(r) { if (Array.isArray(r)) return AuthManagerBrowser_arrayLikeToArray(r); }
 function AuthManagerBrowser_arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
 function AuthManagerBrowser_classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
 function AuthManagerBrowser_defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, AuthManagerBrowser_toPropertyKey(o.key), o); } }
 function AuthManagerBrowser_createClass(e, r, t) { return r && AuthManagerBrowser_defineProperties(e.prototype, r), t && AuthManagerBrowser_defineProperties(e, t), Object.defineProperty(e, "prototype", { writable: !1 }), e; }
@@ -3302,8 +3317,9 @@ var AuthManagerImpl = /*#__PURE__*/function () {
   }, {
     key: "isAuthSessionReady",
     value: function isAuthSessionReady() {
+      var _a;
       var session = AuthSessionState.getSession();
-      return (session === null || session === void 0 ? void 0 : session.isReady) === true || (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
+      return (_a = session === null || session === void 0 ? void 0 : session.isReady) !== null && _a !== void 0 ? _a : (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
     }
   }, {
     key: "beginAuthSession",
@@ -3316,8 +3332,13 @@ var AuthManagerImpl = /*#__PURE__*/function () {
             throw new Error("Auth session already active. Please call 'await endAuthSession()' and then call 'await beginAuthSession(...)' to start a new auth session.");
           }
           var canUseServiceWorkers = _this.serviceWorkerUtils.canUseServiceWorkers();
-          if (_this.isV2(params) && !canUseServiceWorkers) {
-            throw new Error("This auth session requires service workers, but this browser does not support them.");
+          if (params.serviceWorkerConfig !== undefined) {
+            if (params.serviceWorkerScript === undefined) {
+              throw new Error("The 'serviceWorkerScript' field is required when 'serviceWorkerConfig' is provided.");
+            }
+            if (!canUseServiceWorkers) {
+              throw new Error("The 'serviceWorkerConfig' field requires service workers, but this browser does not support them.");
+            }
           }
           var newSession = {
             accessToken: undefined,
@@ -3328,18 +3349,21 @@ var AuthManagerImpl = /*#__PURE__*/function () {
             authServiceWorker: params.serviceWorkerScript !== undefined && canUseServiceWorkers ? {
               serviceWorkerScript: params.serviceWorkerScript,
               type: "Uninitialized"
-            } : undefined
+            } : undefined,
+            primaryAuthSwConfig: undefined,
+            serviceWorkerConfig: undefined,
+            serviceWorkerConfigRefreshHandle: undefined
           };
           AuthSessionState.setSession(newSession);
           return newSession;
         })), function (session) {
           // IMPORTANT: must be called outside the above, else re-entrant deadlock will occur.
-          return AuthManagerBrowser_invokeIgnored(function () {
-            if (_this.isV2(session.params)) {
+          return AuthManagerBrowser_invoke(function () {
+            if (session.params.serviceWorkerConfig !== undefined) {
               return AuthManagerBrowser_awaitIgnored(_this.refreshServiceWorkerConfig(session, session.params));
-            } else {
-              return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
             }
+          }, function () {
+            return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
           });
         });
       } catch (e) {
@@ -3361,8 +3385,13 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (session.accessTokenRefreshHandle !== undefined) {
             _this2.scheduler.unschedule(session.accessTokenRefreshHandle);
           }
+          if (session.serviceWorkerConfigRefreshHandle !== undefined) {
+            _this2.scheduler.unschedule(session.serviceWorkerConfigRefreshHandle);
+          }
+          // AuthSessionState is shared between bundled SDK versions. Service-worker-only sessions from 3.56.0 did not
+          // contain an accountId, so allow a newer SDK instance to tear those sessions down without calling this endpoint.
           return AuthManagerBrowser_invoke(function () {
-            if (!_this2.isV2(session.params)) {
+            if (typeof session.params.accountId === "string") {
               return AuthManagerBrowser_awaitIgnored(_this2.deleteAccessToken(session.params));
             }
           }, function () {
@@ -3404,21 +3433,24 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                   return AuthManagerBrowser_await(_this3.setAccessToken(params, jwt, setCookie), function (setTokenResult) {
                     return AuthManagerBrowser_invoke(function () {
                       if (session.authServiceWorker !== undefined) {
-                        return AuthManagerBrowser_await(_this3.sendServiceWorkerConfig(session, [{
+                        var primaryAuthSwConfig = {
                           headers: [{
                             key: "Authorization",
                             value: "Bearer ".concat(jwt)
                           }],
                           expires: secondsFromNow(setTokenResult.ttlSeconds),
-                          sourceUrlPrefixes: params.sourceUrlPrefixes,
                           urlPrefix: "".concat(_this3.getCdnUrl(params), "/").concat(params.accountId, "/")
-                        }]), function () {
-                          // Allow time for the service worker to receive and process the message. Since this is asynchronous and not
-                          // synchronized, we need to wait for a sufficient amount of time to ensure the service worker is ready to
-                          // authenticate requests, so that after 'beginAuthSession' completes, users can start making requests.
-                          return AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
-                            return setTimeout(resolve, 100);
-                          }));
+                        };
+                        // Fail closed until the initial serviceWorkerConfig callback succeeds: without its result, we do not know
+                        // the source-page restrictions intended for the primary JWT.
+                        return AuthManagerBrowser_invoke(function () {
+                          if (params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined) {
+                            return AuthManagerBrowser_await(_this3.sendMergedServiceWorkerConfig(session, primaryAuthSwConfig, session.serviceWorkerConfig), function () {
+                              return AuthManagerBrowser_awaitIgnored(_this3.waitForServiceWorker());
+                            });
+                          }
+                        }, function () {
+                          session.primaryAuthSwConfig = primaryAuthSwConfig;
                         });
                       }
                     }, function () {
@@ -3430,7 +3462,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                       expires = secondsFromNow(actualTtl);
                       // Set this at the end, as it's also used to signal 'isAuthSessionReady', so must be set after configuring the Service Worker, etc.
                       session.accessToken = setTokenResult.accessToken;
-                      session.isReady = true;
+                      _this3.updateSessionReadiness(session);
                     });
                   });
                 });
@@ -3461,6 +3493,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     value: function refreshServiceWorkerConfig(session, params) {
       try {
         var _this4 = this;
+        var getServiceWorkerConfig = params.serviceWorkerConfig;
+        if (getServiceWorkerConfig === undefined) {
+          return AuthManagerBrowser_await();
+        }
         return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this4.authSessionMutex.safe(AuthManagerBrowser_async(function () {
           var _exit = false;
           if (!session.isActive) {
@@ -3468,17 +3504,29 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           }
           var refreshAt;
           return AuthManagerBrowser_continue(AuthManagerBrowser_catch(function () {
-            return AuthManagerBrowser_await(params.getServiceWorkerConfig(), function (config) {
-              if (!Array.isArray(config)) {
-                throw new Error("The 'getServiceWorkerConfig' callback must return an array.");
+            return AuthManagerBrowser_call(getServiceWorkerConfig, function (result) {
+              if (result === null || AuthManagerBrowser_typeof(result) !== "object" || !Array.isArray(result.additionalConfig)) {
+                throw new Error("The 'serviceWorkerConfig' callback must return an object containing 'additionalConfig'.");
               }
-              return AuthManagerBrowser_await(_this4.sendServiceWorkerConfig(session, config), function () {
-                return AuthManagerBrowser_await(new Promise(function (resolve) {
-                  return setTimeout(resolve, 100);
-                }), function () {
-                  session.isReady = true;
-                  refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config);
-                });
+              if (result.sourceUrlPrefixes !== undefined && (!Array.isArray(result.sourceUrlPrefixes) || !result.sourceUrlPrefixes.every(function (prefix) {
+                return typeof prefix === "string";
+              }))) {
+                throw new Error("The 'sourceUrlPrefixes' field returned by 'serviceWorkerConfig' must be an array of strings.");
+              }
+              var config = {
+                additionalConfig: result.additionalConfig,
+                sourceUrlPrefixes: result.sourceUrlPrefixes
+              };
+              return AuthManagerBrowser_invoke(function () {
+                if (session.primaryAuthSwConfig !== undefined) {
+                  return AuthManagerBrowser_await(_this4.sendMergedServiceWorkerConfig(session, session.primaryAuthSwConfig, config), function () {
+                    return AuthManagerBrowser_awaitIgnored(_this4.waitForServiceWorker());
+                  });
+                }
+              }, function () {
+                session.serviceWorkerConfig = config;
+                _this4.updateSessionReadiness(session);
+                refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config.additionalConfig);
               });
             });
           }, function (e) {
@@ -3487,7 +3535,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           }), function (_result2) {
             if (_exit) return _result2;
             if (refreshAt !== undefined) {
-              session.accessTokenRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
+              session.serviceWorkerConfigRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
                 _this4.refreshServiceWorkerConfig(session, params).then(function () {}, function (e) {
                   return ConsoleUtils.error("Unexpected error when refreshing service worker auth config: ".concat(e));
                 });
@@ -3499,6 +3547,19 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "sendMergedServiceWorkerConfig",
+    value: function sendMergedServiceWorkerConfig(session, primaryConfig, serviceWorkerConfig) {
+      try {
+        var _this5 = this;
+        var _a;
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this5.sendServiceWorkerConfig(session, [Object.assign(Object.assign({}, primaryConfig), {
+          sourceUrlPrefixes: serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.sourceUrlPrefixes
+        })].concat(AuthManagerBrowser_toConsumableArray((_a = serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.additionalConfig) !== null && _a !== void 0 ? _a : [])))));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "getServiceWorkerConfigRefreshEpoch",
     value: function getServiceWorkerConfigRefreshEpoch(config) {
@@ -3523,24 +3584,42 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "sendServiceWorkerConfig",
     value: function sendServiceWorkerConfig(session, config) {
       try {
-        var _this5 = this;
+        var _this6 = this;
         if (session.authServiceWorker === undefined) {
           throw new Error("Service worker configuration cannot be applied because service workers are unavailable.");
         }
-        return AuthManagerBrowser_await(_this5.serviceWorkerUtils.sendMessage({
+        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage({
           type: "SET_BYTESCALE_AUTH_CONFIG",
           config: config.map(function (entry) {
             return Object.assign(Object.assign({}, entry), {
-              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this5.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
+              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this6.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
             });
           })
-        }, session.authServiceWorker, _this5.serviceWorkerScriptFieldName), function (_this5$serviceWorkerU) {
-          session.authServiceWorker = _this5$serviceWorkerU;
+        }, session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
+          session.authServiceWorker = _this6$serviceWorkerU;
         });
       } catch (e) {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "updateSessionReadiness",
+    value: function updateSessionReadiness(session) {
+      session.isReady = session.accessToken !== undefined && (session.params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined);
+    }
+  }, {
+    key: "waitForServiceWorker",
+    value: function waitForServiceWorker() {
+      try {
+        // Message delivery is asynchronous and has no acknowledgement, so allow the worker time to apply the config before
+        // beginAuthSession reports that authenticated requests are ready.
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
+          return setTimeout(resolve, 100);
+        })));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "getAccessTokenUrl",
     value: function getAccessTokenUrl(params, setCookie) {
@@ -3556,9 +3635,9 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "deleteAccessToken",
     value: function deleteAccessToken(params) {
       try {
-        var _this6 = this;
+        var _this7 = this;
         var _a;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this6.getAccessTokenUrl(params, true), {
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this7.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -3574,15 +3653,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "setAccessToken",
     value: function setAccessToken(params, jwt, setCookie) {
       try {
-        var _this7 = this;
+        var _this8 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this7.getAccessTokenUrl(params, setCookie), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this8.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
-          headers: AuthManagerBrowser_defineProperty({}, _this7.contentType, _this7.contentTypeJson),
+          headers: AuthManagerBrowser_defineProperty({}, _this8.contentType, _this8.contentTypeJson),
           body: JSON.stringify(request)
         }, {
           isBytescaleApi: true,
@@ -3598,10 +3677,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "getAccessToken",
     value: function getAccessToken(params, headers) {
       try {
-        var _this8 = this;
+        var _this9 = this;
         var _a, _b;
         var endpointName = "Your auth API endpoint";
-        var requiredContentType = _this8.contentTypeText;
+        var requiredContentType = _this9.contentTypeText;
         return AuthManagerBrowser_await(BaseAPI.fetch(params.authUrl, {
           method: "GET",
           headers: headers
@@ -3609,10 +3688,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           isBytescaleApi: false,
           fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
         }), function (result) {
-          var actualContentType = (_b = result.headers.get(_this8.contentType)) !== null && _b !== void 0 ? _b : "";
+          var actualContentType = (_b = result.headers.get(_this9.contentType)) !== null && _b !== void 0 ? _b : "";
           // Support content types like "text/plain; charset=utf-8" and "text/plain"
           if (actualContentType.split(";")[0] !== requiredContentType) {
-            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this8.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
+            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this9.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
           }
           return AuthManagerBrowser_await(result.text(), function (jwt) {
             if (jwt.length === 0) {
@@ -3629,11 +3708,6 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
-  }, {
-    key: "isV2",
-    value: function isV2(params) {
-      return "getServiceWorkerConfig" in params;
-    }
   }]);
 }();
 /**

package/dist/browser/esm/main.mjs

@@ -3156,11 +3156,12 @@ function AuthManagerBrowser_awaitIgnored(value, direct) {
     return value && value.then ? value.then(AuthManagerBrowser_empty) : Promise.resolve();
   }
 }
-function AuthManagerBrowser_invokeIgnored(body) {
+function AuthManagerBrowser_invoke(body, then) {
   var result = body();
   if (result && result.then) {
-    return result.then(AuthManagerBrowser_empty);
+    return result.then(then);
   }
+  return then(result);
 }
 function AuthManagerBrowser_await(value, then, direct) {
   if (direct) {
@@ -3183,12 +3184,11 @@ function AuthManagerBrowser_async(f) {
     }
   };
 }
-function AuthManagerBrowser_invoke(body, then) {
+function AuthManagerBrowser_invokeIgnored(body) {
   var result = body();
   if (result && result.then) {
-    return result.then(then);
+    return result.then(AuthManagerBrowser_empty);
   }
-  return then(result);
 }
 function AuthManagerBrowser_catch(body, recover) {
   try {
@@ -3221,14 +3221,29 @@ function AuthManagerBrowser_continueIgnored(value) {
     return value.then(AuthManagerBrowser_empty);
   }
 }
+function AuthManagerBrowser_call(body, then, direct) {
+  if (direct) {
+    return then ? then(body()) : body();
+  }
+  try {
+    var result = Promise.resolve(body());
+    return then ? result.then(then) : result;
+  } catch (e) {
+    return Promise.reject(e);
+  }
+}
 function AuthManagerBrowser_continue(value, then) {
   return value && value.then ? value.then(then) : then(value);
 }
-function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
 function AuthManagerBrowser_defineProperty(e, r, t) { return (r = AuthManagerBrowser_toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
 function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = AuthManagerBrowser_unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function AuthManagerBrowser_toConsumableArray(r) { return AuthManagerBrowser_arrayWithoutHoles(r) || AuthManagerBrowser_iterableToArray(r) || AuthManagerBrowser_unsupportedIterableToArray(r) || AuthManagerBrowser_nonIterableSpread(); }
+function AuthManagerBrowser_nonIterableSpread() { throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
 function AuthManagerBrowser_unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return AuthManagerBrowser_arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? AuthManagerBrowser_arrayLikeToArray(r, a) : void 0; } }
+function AuthManagerBrowser_iterableToArray(r) { if ("undefined" != typeof Symbol && null != r[Symbol.iterator] || null != r["@@iterator"]) return Array.from(r); }
+function AuthManagerBrowser_arrayWithoutHoles(r) { if (Array.isArray(r)) return AuthManagerBrowser_arrayLikeToArray(r); }
 function AuthManagerBrowser_arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
 function AuthManagerBrowser_classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
 function AuthManagerBrowser_defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, AuthManagerBrowser_toPropertyKey(o.key), o); } }
 function AuthManagerBrowser_createClass(e, r, t) { return r && AuthManagerBrowser_defineProperties(e.prototype, r), t && AuthManagerBrowser_defineProperties(e, t), Object.defineProperty(e, "prototype", { writable: !1 }), e; }
@@ -3262,8 +3277,9 @@ var AuthManagerImpl = /*#__PURE__*/function () {
   }, {
     key: "isAuthSessionReady",
     value: function isAuthSessionReady() {
+      var _a;
       var session = AuthSessionState.getSession();
-      return (session === null || session === void 0 ? void 0 : session.isReady) === true || (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
+      return (_a = session === null || session === void 0 ? void 0 : session.isReady) !== null && _a !== void 0 ? _a : (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
     }
   }, {
     key: "beginAuthSession",
@@ -3276,8 +3292,13 @@ var AuthManagerImpl = /*#__PURE__*/function () {
             throw new Error("Auth session already active. Please call 'await endAuthSession()' and then call 'await beginAuthSession(...)' to start a new auth session.");
           }
           var canUseServiceWorkers = _this.serviceWorkerUtils.canUseServiceWorkers();
-          if (_this.isV2(params) && !canUseServiceWorkers) {
-            throw new Error("This auth session requires service workers, but this browser does not support them.");
+          if (params.serviceWorkerConfig !== undefined) {
+            if (params.serviceWorkerScript === undefined) {
+              throw new Error("The 'serviceWorkerScript' field is required when 'serviceWorkerConfig' is provided.");
+            }
+            if (!canUseServiceWorkers) {
+              throw new Error("The 'serviceWorkerConfig' field requires service workers, but this browser does not support them.");
+            }
           }
           var newSession = {
             accessToken: undefined,
@@ -3288,18 +3309,21 @@ var AuthManagerImpl = /*#__PURE__*/function () {
             authServiceWorker: params.serviceWorkerScript !== undefined && canUseServiceWorkers ? {
               serviceWorkerScript: params.serviceWorkerScript,
               type: "Uninitialized"
-            } : undefined
+            } : undefined,
+            primaryAuthSwConfig: undefined,
+            serviceWorkerConfig: undefined,
+            serviceWorkerConfigRefreshHandle: undefined
           };
           AuthSessionState.setSession(newSession);
           return newSession;
         })), function (session) {
           // IMPORTANT: must be called outside the above, else re-entrant deadlock will occur.
-          return AuthManagerBrowser_invokeIgnored(function () {
-            if (_this.isV2(session.params)) {
+          return AuthManagerBrowser_invoke(function () {
+            if (session.params.serviceWorkerConfig !== undefined) {
               return AuthManagerBrowser_awaitIgnored(_this.refreshServiceWorkerConfig(session, session.params));
-            } else {
-              return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
             }
+          }, function () {
+            return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
           });
         });
       } catch (e) {
@@ -3321,8 +3345,13 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (session.accessTokenRefreshHandle !== undefined) {
             _this2.scheduler.unschedule(session.accessTokenRefreshHandle);
           }
+          if (session.serviceWorkerConfigRefreshHandle !== undefined) {
+            _this2.scheduler.unschedule(session.serviceWorkerConfigRefreshHandle);
+          }
+          // AuthSessionState is shared between bundled SDK versions. Service-worker-only sessions from 3.56.0 did not
+          // contain an accountId, so allow a newer SDK instance to tear those sessions down without calling this endpoint.
           return AuthManagerBrowser_invoke(function () {
-            if (!_this2.isV2(session.params)) {
+            if (typeof session.params.accountId === "string") {
               return AuthManagerBrowser_awaitIgnored(_this2.deleteAccessToken(session.params));
             }
           }, function () {
@@ -3364,21 +3393,24 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                   return AuthManagerBrowser_await(_this3.setAccessToken(params, jwt, setCookie), function (setTokenResult) {
                     return AuthManagerBrowser_invoke(function () {
                       if (session.authServiceWorker !== undefined) {
-                        return AuthManagerBrowser_await(_this3.sendServiceWorkerConfig(session, [{
+                        var primaryAuthSwConfig = {
                           headers: [{
                             key: "Authorization",
                             value: "Bearer ".concat(jwt)
                           }],
                           expires: secondsFromNow(setTokenResult.ttlSeconds),
-                          sourceUrlPrefixes: params.sourceUrlPrefixes,
                           urlPrefix: "".concat(_this3.getCdnUrl(params), "/").concat(params.accountId, "/")
-                        }]), function () {
-                          // Allow time for the service worker to receive and process the message. Since this is asynchronous and not
-                          // synchronized, we need to wait for a sufficient amount of time to ensure the service worker is ready to
-                          // authenticate requests, so that after 'beginAuthSession' completes, users can start making requests.
-                          return AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
-                            return setTimeout(resolve, 100);
-                          }));
+                        };
+                        // Fail closed until the initial serviceWorkerConfig callback succeeds: without its result, we do not know
+                        // the source-page restrictions intended for the primary JWT.
+                        return AuthManagerBrowser_invoke(function () {
+                          if (params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined) {
+                            return AuthManagerBrowser_await(_this3.sendMergedServiceWorkerConfig(session, primaryAuthSwConfig, session.serviceWorkerConfig), function () {
+                              return AuthManagerBrowser_awaitIgnored(_this3.waitForServiceWorker());
+                            });
+                          }
+                        }, function () {
+                          session.primaryAuthSwConfig = primaryAuthSwConfig;
                         });
                       }
                     }, function () {
@@ -3390,7 +3422,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                       expires = secondsFromNow(actualTtl);
                       // Set this at the end, as it's also used to signal 'isAuthSessionReady', so must be set after configuring the Service Worker, etc.
                       session.accessToken = setTokenResult.accessToken;
-                      session.isReady = true;
+                      _this3.updateSessionReadiness(session);
                     });
                   });
                 });
@@ -3421,6 +3453,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     value: function refreshServiceWorkerConfig(session, params) {
       try {
         var _this4 = this;
+        var getServiceWorkerConfig = params.serviceWorkerConfig;
+        if (getServiceWorkerConfig === undefined) {
+          return AuthManagerBrowser_await();
+        }
         return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this4.authSessionMutex.safe(AuthManagerBrowser_async(function () {
           var _exit = false;
           if (!session.isActive) {
@@ -3428,17 +3464,29 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           }
           var refreshAt;
           return AuthManagerBrowser_continue(AuthManagerBrowser_catch(function () {
-            return AuthManagerBrowser_await(params.getServiceWorkerConfig(), function (config) {
-              if (!Array.isArray(config)) {
-                throw new Error("The 'getServiceWorkerConfig' callback must return an array.");
+            return AuthManagerBrowser_call(getServiceWorkerConfig, function (result) {
+              if (result === null || AuthManagerBrowser_typeof(result) !== "object" || !Array.isArray(result.additionalConfig)) {
+                throw new Error("The 'serviceWorkerConfig' callback must return an object containing 'additionalConfig'.");
               }
-              return AuthManagerBrowser_await(_this4.sendServiceWorkerConfig(session, config), function () {
-                return AuthManagerBrowser_await(new Promise(function (resolve) {
-                  return setTimeout(resolve, 100);
-                }), function () {
-                  session.isReady = true;
-                  refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config);
-                });
+              if (result.sourceUrlPrefixes !== undefined && (!Array.isArray(result.sourceUrlPrefixes) || !result.sourceUrlPrefixes.every(function (prefix) {
+                return typeof prefix === "string";
+              }))) {
+                throw new Error("The 'sourceUrlPrefixes' field returned by 'serviceWorkerConfig' must be an array of strings.");
+              }
+              var config = {
+                additionalConfig: result.additionalConfig,
+                sourceUrlPrefixes: result.sourceUrlPrefixes
+              };
+              return AuthManagerBrowser_invoke(function () {
+                if (session.primaryAuthSwConfig !== undefined) {
+                  return AuthManagerBrowser_await(_this4.sendMergedServiceWorkerConfig(session, session.primaryAuthSwConfig, config), function () {
+                    return AuthManagerBrowser_awaitIgnored(_this4.waitForServiceWorker());
+                  });
+                }
+              }, function () {
+                session.serviceWorkerConfig = config;
+                _this4.updateSessionReadiness(session);
+                refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config.additionalConfig);
               });
             });
           }, function (e) {
@@ -3447,7 +3495,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           }), function (_result2) {
             if (_exit) return _result2;
             if (refreshAt !== undefined) {
-              session.accessTokenRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
+              session.serviceWorkerConfigRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
                 _this4.refreshServiceWorkerConfig(session, params).then(function () {}, function (e) {
                   return ConsoleUtils.error("Unexpected error when refreshing service worker auth config: ".concat(e));
                 });
@@ -3459,6 +3507,19 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "sendMergedServiceWorkerConfig",
+    value: function sendMergedServiceWorkerConfig(session, primaryConfig, serviceWorkerConfig) {
+      try {
+        var _this5 = this;
+        var _a;
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this5.sendServiceWorkerConfig(session, [Object.assign(Object.assign({}, primaryConfig), {
+          sourceUrlPrefixes: serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.sourceUrlPrefixes
+        })].concat(AuthManagerBrowser_toConsumableArray((_a = serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.additionalConfig) !== null && _a !== void 0 ? _a : [])))));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "getServiceWorkerConfigRefreshEpoch",
     value: function getServiceWorkerConfigRefreshEpoch(config) {
@@ -3483,24 +3544,42 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "sendServiceWorkerConfig",
     value: function sendServiceWorkerConfig(session, config) {
       try {
-        var _this5 = this;
+        var _this6 = this;
         if (session.authServiceWorker === undefined) {
           throw new Error("Service worker configuration cannot be applied because service workers are unavailable.");
         }
-        return AuthManagerBrowser_await(_this5.serviceWorkerUtils.sendMessage({
+        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage({
           type: "SET_BYTESCALE_AUTH_CONFIG",
           config: config.map(function (entry) {
             return Object.assign(Object.assign({}, entry), {
-              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this5.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
+              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this6.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
             });
           })
-        }, session.authServiceWorker, _this5.serviceWorkerScriptFieldName), function (_this5$serviceWorkerU) {
-          session.authServiceWorker = _this5$serviceWorkerU;
+        }, session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
+          session.authServiceWorker = _this6$serviceWorkerU;
         });
       } catch (e) {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "updateSessionReadiness",
+    value: function updateSessionReadiness(session) {
+      session.isReady = session.accessToken !== undefined && (session.params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined);
+    }
+  }, {
+    key: "waitForServiceWorker",
+    value: function waitForServiceWorker() {
+      try {
+        // Message delivery is asynchronous and has no acknowledgement, so allow the worker time to apply the config before
+        // beginAuthSession reports that authenticated requests are ready.
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
+          return setTimeout(resolve, 100);
+        })));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "getAccessTokenUrl",
     value: function getAccessTokenUrl(params, setCookie) {
@@ -3516,9 +3595,9 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "deleteAccessToken",
     value: function deleteAccessToken(params) {
       try {
-        var _this6 = this;
+        var _this7 = this;
         var _a;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this6.getAccessTokenUrl(params, true), {
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this7.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -3534,15 +3613,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "setAccessToken",
     value: function setAccessToken(params, jwt, setCookie) {
       try {
-        var _this7 = this;
+        var _this8 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this7.getAccessTokenUrl(params, setCookie), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this8.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
-          headers: AuthManagerBrowser_defineProperty({}, _this7.contentType, _this7.contentTypeJson),
+          headers: AuthManagerBrowser_defineProperty({}, _this8.contentType, _this8.contentTypeJson),
           body: JSON.stringify(request)
         }, {
           isBytescaleApi: true,
@@ -3558,10 +3637,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "getAccessToken",
     value: function getAccessToken(params, headers) {
       try {
-        var _this8 = this;
+        var _this9 = this;
         var _a, _b;
         var endpointName = "Your auth API endpoint";
-        var requiredContentType = _this8.contentTypeText;
+        var requiredContentType = _this9.contentTypeText;
         return AuthManagerBrowser_await(BaseAPI.fetch(params.authUrl, {
           method: "GET",
           headers: headers
@@ -3569,10 +3648,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           isBytescaleApi: false,
           fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
         }), function (result) {
-          var actualContentType = (_b = result.headers.get(_this8.contentType)) !== null && _b !== void 0 ? _b : "";
+          var actualContentType = (_b = result.headers.get(_this9.contentType)) !== null && _b !== void 0 ? _b : "";
           // Support content types like "text/plain; charset=utf-8" and "text/plain"
           if (actualContentType.split(";")[0] !== requiredContentType) {
-            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this8.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
+            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this9.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
           }
           return AuthManagerBrowser_await(result.text(), function (jwt) {
             if (jwt.length === 0) {
@@ -3589,11 +3668,6 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
-  }, {
-    key: "isV2",
-    value: function isV2(params) {
-      return "getServiceWorkerConfig" in params;
-    }
   }]);
 }();
 /**

package/dist/types/private/model/AuthManagerInterface.d.ts

@@ -1,7 +1,19 @@
 import { BytescaleApiClientConfig } from "../../public/shared";
 import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
-export type BeginAuthSessionParams = BeginAuthSessionParamsV1 | BeginAuthSessionParamsV2;
-export interface BeginAuthSessionParamsV1 {
+export interface AuthManagerServiceWorkerConfig {
+    /**
+     * Additional download-only service-worker authorization rules.
+     * An empty array clears all additional rules.
+     */
+    additionalConfig: AuthSwConfigEntryDto[];
+    /**
+     * Restricts the primary JWT to pages and iframes whose URL starts with one of these prefixes.
+     * An empty array matches no clients. Omit this field to preserve the existing service-worker behavior.
+     * History API changes do not update the matched client URL.
+     */
+    sourceUrlPrefixes?: string[];
+}
+export interface BeginAuthSessionParams {
     /**
      * The account ID to authorize requests for.
      */
@@ -20,6 +32,18 @@ export interface BeginAuthSessionParamsV1 {
      * Optional configuration.
      */
     options?: Pick<BytescaleApiClientConfig, "fetchApi" | "cdnUrl">;
+    /**
+     * Returns configuration for service-worker authorization. The primary JWT returned by `authUrl` is restricted using
+     * `sourceUrlPrefixes`; `additionalConfig` contains download-only rules and never authenticates SDK API operations.
+     * Called when the session begins and again 20 seconds before the earliest additional entry expires. Entries without
+     * an expiry do not trigger a refresh.
+     *
+     * Requires `serviceWorkerScript` and browser service-worker support. Additional rules cannot use the CDN cookie
+     * fallback.
+     *
+     * IMPORTANT: do not call 'AuthManager.beginAuthSession' or 'AuthManager.endAuthSession' inside this callback, as this will cause a deadlock.
+     */
+    serviceWorkerConfig?: () => Promise<AuthManagerServiceWorkerConfig>;
     /**
      * Enables support for modern browsers that block third-party cookies (like Safari).
      *
@@ -66,35 +90,13 @@ export interface BeginAuthSessionParamsV1 {
      * script must be hosted on your website's domain in the root directory.
      */
     serviceWorkerScript?: string;
-    /**
-     * Restricts service-worker authorization to pages and iframes whose URL starts with one of these prefixes.
-     * An empty array matches no clients. Omit this field to preserve the existing service-worker behavior.
-     * Applies only with `serviceWorkerScript`; History API changes do not update the matched client URL.
-     */
-    sourceUrlPrefixes?: string[];
-}
-export interface BeginAuthSessionParamsV2 {
-    /**
-     * Returns the complete replacement service-worker authorization config. Called when the session begins and again
-     * 20 seconds before the earliest configured expiry. Entries without an expiry do not trigger a refresh.
-     *
-     * IMPORTANT: do not call 'AuthManager.beginAuthSession' or 'AuthManager.endAuthSession' inside this callback, as this will cause a deadlock.
-     */
-    getServiceWorkerConfig: () => Promise<AuthSwConfigEntryDto[]>;
-    /**
-     * The path to the service worker JavaScript file hosted at the root of your website.
-     *
-     * Unlike V1 sessions, V2 sessions require service-worker support and do not create an SDK API access token or use
-     * CDN cookies as a fallback.
-     */
-    serviceWorkerScript: string;
 }
 export interface AuthManagerInterface {
     /**
      * Begins a JWT auth session with the Bytescale API and Bytescale CDN.
      *
-     * V1 sessions fetch and refresh a JWT using the supplied auth endpoint. V2 sessions instead refresh the complete
-     * service-worker configuration using `getServiceWorkerConfig`.
+     * The primary JWT authenticates Bytescale API operations and downloads for `accountId`. Optional additional
+     * service-worker rules authenticate downloads only.
      *
      * Specifically, calling this method will cause the SDK to periodically acquire a JWT from your JWT endpoint. The SDK will then automatically include this JWT in all subsequent Bytescale API requests (via the 'authorization-token' request header) and also in all Bytescale CDN download requests (via a session cookie, or an 'authorization' header if service workers are being used).
      *

package/dist/types/private/model/AuthSession.d.ts

@@ -1,4 +1,5 @@
-import { BeginAuthSessionParams } from "./AuthManagerInterface";
+import { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "./AuthManagerInterface";
+import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
 import { ServiceWorkerConfig } from "./ServiceWorkerConfig";
 export interface AuthSession {
     accessToken: string | undefined;
@@ -7,4 +8,7 @@ export interface AuthSession {
     isActive: boolean;
     isReady?: boolean;
     params: BeginAuthSessionParams;
+    primaryAuthSwConfig: AuthSwConfigEntryDto | undefined;
+    serviceWorkerConfig: AuthManagerServiceWorkerConfig | undefined;
+    serviceWorkerConfigRefreshHandle: number | undefined;
 }

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -3,7 +3,7 @@ import { AuthSwSetConfigDto } from "../../private/dtos/AuthSwSetConfigDto";
 import { ServiceWorkerUtils } from "../../private/ServiceWorkerUtils";
 export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
 export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
-export type { BeginAuthSessionParams, BeginAuthSessionParamsV1, BeginAuthSessionParamsV2 } from "../../private/model/AuthManagerInterface";
+export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     private readonly serviceWorkerUtils;
     private readonly authSessionMutex;
@@ -23,14 +23,16 @@ declare class AuthManagerImpl implements AuthManagerInterface {
     endAuthSession(): Promise<void>;
     private refreshAccessToken;
     private refreshServiceWorkerConfig;
+    private sendMergedServiceWorkerConfig;
     private getServiceWorkerConfigRefreshEpoch;
     private sendServiceWorkerConfig;
+    private updateSessionReadiness;
+    private waitForServiceWorker;
     private getAccessTokenUrl;
     private getCdnUrl;
     private deleteAccessToken;
     private setAccessToken;
     private getAccessToken;
-    private isV2;
 }
 /**
  * Alternative way of implementing a static class (i.e. all methods static). We do this so we can use a interface on the class (interfaces can't define static methods).

package/dist/types/public/node/AuthManagerNode.d.ts

@@ -1,7 +1,7 @@
 import { AuthManagerInterface, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
 export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
-export type { BeginAuthSessionParams, BeginAuthSessionParamsV1, BeginAuthSessionParamsV2 } from "../../private/model/AuthManagerInterface";
+export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     beginAuthSession(_params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.56.0",
+  "version": "3.57.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",

package/tests/AuthManagerBrowser.test.ts

@@ -1,14 +1,29 @@
 import { jest } from "@jest/globals";
 import { Response as NodeFetchResponse } from "node-fetch";
-import type { AuthSwConfigEntryDto, BeginAuthSessionParamsV1, BeginAuthSessionParamsV2 } from "../src/index.browser";
+import { AuthSessionState } from "../src/private/AuthSessionState";
+import type {
+  AuthManagerServiceWorkerConfig,
+  AuthSwConfigEntryDto,
+  BeginAuthSessionParams
+} from "../src/index.browser";
+
+type FetchApi = NonNullable<NonNullable<BeginAuthSessionParams["options"]>["fetchApi"]>;
 
 interface AuthManagerApi {
-  beginAuthSession: (params: BeginAuthSessionParamsV1 | BeginAuthSessionParamsV2) => Promise<void>;
+  beginAuthSession: (params: BeginAuthSessionParams) => Promise<void>;
   endAuthSession: () => Promise<void>;
   isAuthSessionActive: () => boolean;
   isAuthSessionReady: () => boolean;
 }
 
+interface AuthManagerInternals extends AuthManagerApi {
+  refreshAccessToken: (
+    session: NonNullable<ReturnType<typeof AuthSessionState.getSession>>,
+    params: BeginAuthSessionParams
+  ) => Promise<void>;
+  scheduler: { unschedule: (handle: number) => void };
+}
+
 describe("AuthManager browser service-worker config", () => {
   const originalNavigator = Object.getOwnPropertyDescriptor(globalThis, "navigator");
   const originalFetch = Object.getOwnPropertyDescriptor(globalThis, "fetch");
@@ -67,168 +82,261 @@ describe("AuthManager browser service-worker config", () => {
     jest.restoreAllMocks();
   });
 
-  test("V2 applies multiple entries and refreshes before the earliest expiry", async () => {
-    const firstConfig: AuthSwConfigEntryDto[] = [
-      {
-        expires: Date.now() + 21_000,
-        headers: [{ key: "Authorization", value: "Bearer account-a" }],
-        sourceUrlPrefixes: ["https://app.example.com/account-a/"],
-        urlPrefix: "https://upcdn.io/account-a/"
-      },
+  test("retains the existing cookie fallback when no additional config is requested", async () => {
+    delete navigatorValue.serviceWorker;
+    const fetchApi = createPrimaryFetchApi();
+
+    await AuthManager.beginAuthSession(createParams(fetchApi));
+
+    expect((fetchApi.mock.calls[1][0] as string).endsWith("?set-cookie=true")).toBe(true);
+    expect(postMessage).not.toHaveBeenCalled();
+    expect(AuthManager.isAuthSessionReady()).toBe(true);
+  });
+
+  test("retains the existing primary-only service-worker flow", async () => {
+    const fetchApi = createPrimaryFetchApi();
+
+    await AuthManager.beginAuthSession({
+      ...createParams(fetchApi),
+      serviceWorkerScript: "/bytescale-auth-sw.js"
+    });
+
+    expect(AuthManager.isAuthSessionReady()).toBe(true);
+    expect(postMessage.mock.calls[0][0]).toEqual({
+      config: [
+        {
+          expires: expect.any(Number),
+          headers: [{ key: "Authorization", value: "Bearer jwt-a" }],
+          urlPrefix: "https://upcdn.io/account-a/"
+        }
+      ],
+      type: "SET_BYTESCALE_AUTH_CONFIG"
+    });
+    expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT"]);
+  });
+
+  test("merges the primary API/download context with additional download-only contexts", async () => {
+    const fetchApi = createPrimaryFetchApi();
+    const additionalConfig: AuthSwConfigEntryDto[] = [
       {
         expires: Date.now() + 60_000,
-        headers: [{ key: "Authorization", value: "Bearer account-b" }],
+        headers: [{ key: "Authorization", value: "Bearer jwt-b" }],
+        sourceUrlPrefixes: ["https://app.example.com/account-b/"],
         urlPrefix: "https://upcdn.io/account-b/"
-      }
-    ];
-    const refreshedConfig: AuthSwConfigEntryDto[] = [
+      },
       {
         expires: undefined,
-        headers: [{ key: "Authorization", value: "Bearer refreshed" }],
-        urlPrefix: "https://upcdn.io/account-a/"
+        headers: [{ key: "Authorization", value: "Bearer jwt-c" }],
+        urlPrefix: "https://upcdn.io/account-c/"
       }
     ];
-    const getServiceWorkerConfig = jest
-      .fn<BeginAuthSessionParamsV2["getServiceWorkerConfig"]>()
-      .mockResolvedValueOnce(firstConfig)
-      .mockResolvedValueOnce(refreshedConfig);
+    const serviceWorkerConfig = jest.fn(
+      async (): Promise<AuthManagerServiceWorkerConfig> => ({
+        additionalConfig,
+        sourceUrlPrefixes: ["https://app.example.com/"]
+      })
+    );
 
     await AuthManager.beginAuthSession({
-      getServiceWorkerConfig,
+      ...createParams(fetchApi),
+      serviceWorkerConfig,
       serviceWorkerScript: "/bytescale-auth-sw.js"
     });
 
-    expect(AuthManager.isAuthSessionActive()).toBe(true);
     expect(AuthManager.isAuthSessionReady()).toBe(true);
+    expect(serviceWorkerConfig).toHaveBeenCalledTimes(1);
     expect(postMessage.mock.calls[0][0]).toEqual({
       config: [
         {
-          ...firstConfig[0],
+          expires: expect.any(Number),
+          headers: [{ key: "Authorization", value: "Bearer jwt-a" }],
+          sourceUrlPrefixes: ["https://app.example.com/"],
           urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-a/"
         },
-        firstConfig[1]
+        {
+          ...additionalConfig[0],
+          urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-b/"
+        },
+        additionalConfig[1]
       ],
       type: "SET_BYTESCALE_AUTH_CONFIG"
     });
-    expect(firstConfig[0].urlPrefix).toBe("https://upcdn.io/account-a/");
-
-    await new Promise(resolve => setTimeout(resolve, 1_500));
-
-    expect(getServiceWorkerConfig).toHaveBeenCalledTimes(2);
-    expect(postMessage.mock.calls[1][0]).toEqual({
-      config: refreshedConfig,
-      type: "SET_BYTESCALE_AUTH_CONFIG"
-    });
-  });
+    expect(additionalConfig[0].urlPrefix).toBe("https://upcdn.io/account-b/");
+    expect(AuthSessionState.getSession()?.accessToken).toBe("access-a");
+    expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT"]);
 
-  test("V2 clears service-worker config without calling access-token endpoints", async () => {
-    await AuthManager.beginAuthSession({
-      getServiceWorkerConfig: async () => [
-        {
-          expires: undefined,
-          headers: [{ key: "Authorization", value: "Bearer account-a" }],
-          urlPrefix: "https://upcdn.io/account-a/"
-        }
-      ],
-      serviceWorkerScript: "/bytescale-auth-sw.js"
-    });
     await AuthManager.endAuthSession();
 
-    expect(globalFetch).not.toHaveBeenCalled();
+    expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT", "DELETE"]);
     expect(postMessage.mock.calls[1][0]).toEqual({ config: [], type: "SET_BYTESCALE_AUTH_CONFIG" });
-    expect(AuthManager.isAuthSessionActive()).toBe(false);
-    expect(AuthManager.isAuthSessionReady()).toBe(false);
-  });
-
-  test("V2 rejects instead of falling back to cookies when service workers are unavailable", async () => {
-    delete navigatorValue.serviceWorker;
-    const getServiceWorkerConfig = jest.fn(async (): Promise<AuthSwConfigEntryDto[]> => []);
-
-    await expect(
-      AuthManager.beginAuthSession({ getServiceWorkerConfig, serviceWorkerScript: "/bytescale-auth-sw.js" })
-    ).rejects.toThrow("requires service workers");
-
-    expect(getServiceWorkerConfig).not.toHaveBeenCalled();
-    expect(AuthManager.isAuthSessionActive()).toBe(false);
   });
 
-  test("V1 retains cookie fallback when service workers are unavailable", async () => {
-    delete navigatorValue.serviceWorker;
-    const fetchApi = jest.fn(async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
-      switch (init?.method) {
-        case "GET":
-          return new NodeFetchResponse("jwt-a", {
-            headers: { "Content-Type": "text/plain" }
-          }) as unknown as Response;
-        case "PUT":
-          return new NodeFetchResponse(
-            JSON.stringify({ accessToken: "access-a", ttlSeconds: 3600 })
-          ) as unknown as Response;
-        case "DELETE":
-          return new NodeFetchResponse(null, { status: 204 }) as unknown as Response;
-        default:
-          throw new Error(`Unexpected method: ${init?.method ?? "undefined"}`);
+  test("refreshes additional rules independently while retaining the primary context", async () => {
+    const fetchApi = createPrimaryFetchApi();
+    const initialAdditionalConfig: AuthSwConfigEntryDto[] = [
+      {
+        expires: Date.now() + 21_000,
+        headers: [{ key: "Authorization", value: "Bearer jwt-b" }],
+        urlPrefix: "https://upcdn.io/account-b/"
       }
-    });
+    ];
+    const serviceWorkerConfig = jest
+      .fn<() => Promise<AuthManagerServiceWorkerConfig>>()
+      .mockResolvedValueOnce({
+        additionalConfig: initialAdditionalConfig,
+        sourceUrlPrefixes: ["https://app.example.com/initial/"]
+      })
+      .mockResolvedValueOnce({
+        additionalConfig: [],
+        sourceUrlPrefixes: ["https://app.example.com/refreshed/"]
+      });
 
     await AuthManager.beginAuthSession({
-      accountId: "account-a",
-      authHeaders: async (): Promise<Record<string, string>> => ({}),
-      authUrl: "https://app.example.com/auth",
-      options: { fetchApi },
+      ...createParams(fetchApi),
+      serviceWorkerConfig,
       serviceWorkerScript: "/bytescale-auth-sw.js"
     });
+    await new Promise(resolve => setTimeout(resolve, 1_500));
 
-    expect((fetchApi.mock.calls[1][0] as string).endsWith("?set-cookie=true")).toBe(true);
-    expect(postMessage).not.toHaveBeenCalled();
+    expect(serviceWorkerConfig).toHaveBeenCalledTimes(2);
+    expect(postMessage.mock.calls[1][0]).toEqual({
+      config: [
+        {
+          expires: expect.any(Number),
+          headers: [{ key: "Authorization", value: "Bearer jwt-a" }],
+          sourceUrlPrefixes: ["https://app.example.com/refreshed/"],
+          urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-a/"
+        }
+      ],
+      type: "SET_BYTESCALE_AUTH_CONFIG"
+    });
+    expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT"]);
     expect(AuthManager.isAuthSessionReady()).toBe(true);
   });
 
-  test("V1 retains the existing JWT, access-token, and single-entry service-worker flow", async () => {
-    const fetchApi = jest.fn(async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
-      switch (init?.method) {
-        case "GET":
-          return new NodeFetchResponse("jwt-a", {
-            headers: { "Content-Type": "text/plain" }
-          }) as unknown as Response;
-        case "PUT":
-          return new NodeFetchResponse(
-            JSON.stringify({ accessToken: "access-a", ttlSeconds: 3600 })
-          ) as unknown as Response;
-        case "DELETE":
-          return new NodeFetchResponse(null, { status: 204 }) as unknown as Response;
-        default:
-          throw new Error(`Unexpected method: ${init?.method ?? "undefined"}`);
+  test("retains additional rules when the primary JWT refreshes", async () => {
+    const fetchApi = createPrimaryFetchApi();
+    const additionalConfig: AuthSwConfigEntryDto[] = [
+      {
+        expires: undefined,
+        headers: [{ key: "Authorization", value: "Bearer jwt-b" }],
+        urlPrefix: "https://upcdn.io/account-b/"
       }
+    ];
+    const serviceWorkerConfig = jest.fn(
+      async (): Promise<AuthManagerServiceWorkerConfig> => ({
+        additionalConfig
+      })
+    );
+
+    await AuthManager.beginAuthSession({
+      ...createParams(fetchApi),
+      serviceWorkerConfig,
+      serviceWorkerScript: "/bytescale-auth-sw.js"
     });
-    const params: BeginAuthSessionParamsV1 = {
-      accountId: "account-a",
-      authHeaders: async (): Promise<Record<string, string>> => ({ "X-App-Authorization": "app-token" }),
-      authUrl: "https://app.example.com/auth",
-      options: { fetchApi },
-      serviceWorkerScript: "/bytescale-auth-sw.js",
-      sourceUrlPrefixes: ["https://app.example.com/"]
-    };
 
-    await AuthManager.beginAuthSession(params);
+    const session = AuthSessionState.getSession();
+    if (session?.accessTokenRefreshHandle === undefined) {
+      throw new Error("Expected the primary access-token refresh to be scheduled.");
+    }
+    const authManagerInternals = AuthManager as AuthManagerInternals;
+    authManagerInternals.scheduler.unschedule(session.accessTokenRefreshHandle);
+    await authManagerInternals.refreshAccessToken(session, session.params);
 
-    expect(AuthManager.isAuthSessionReady()).toBe(true);
-    expect(postMessage.mock.calls[0][0]).toEqual({
+    expect(serviceWorkerConfig).toHaveBeenCalledTimes(1);
+    expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT", "GET", "PUT"]);
+    expect(postMessage.mock.calls[1][0]).toEqual({
       config: [
         {
           expires: expect.any(Number),
           headers: [{ key: "Authorization", value: "Bearer jwt-a" }],
-          sourceUrlPrefixes: params.sourceUrlPrefixes,
-          urlPrefix: "!bytescale-source-scoped!https://upcdn.io/account-a/"
-        }
+          urlPrefix: "https://upcdn.io/account-a/"
+        },
+        additionalConfig[0]
       ],
       type: "SET_BYTESCALE_AUTH_CONFIG"
     });
+  });
+
+  test("fails closed until the initial service-worker config callback succeeds", async () => {
+    jest.spyOn(console, "warn").mockImplementation(() => {});
+    const fetchApi = createPrimaryFetchApi();
+
+    await AuthManager.beginAuthSession({
+      ...createParams(fetchApi),
+      serviceWorkerConfig: async () => null as unknown as AuthManagerServiceWorkerConfig,
+      serviceWorkerScript: "/bytescale-auth-sw.js"
+    });
+
     expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT"]);
+    expect(postMessage).not.toHaveBeenCalled();
+    expect(AuthManager.isAuthSessionReady()).toBe(false);
+  });
 
-    await AuthManager.endAuthSession();
+  test("requires a service-worker script for additional configuration", async () => {
+    const fetchApi = createPrimaryFetchApi();
+    const serviceWorkerConfig = jest.fn(
+      async (): Promise<AuthManagerServiceWorkerConfig> => ({
+        additionalConfig: []
+      })
+    );
 
-    expect(fetchApi.mock.calls.map(([, init]) => init?.method)).toEqual(["GET", "PUT", "DELETE"]);
-    expect(postMessage.mock.calls[1][0]).toEqual({ config: [], type: "SET_BYTESCALE_AUTH_CONFIG" });
+    await expect(AuthManager.beginAuthSession({ ...createParams(fetchApi), serviceWorkerConfig })).rejects.toThrow(
+      "'serviceWorkerScript' field is required"
+    );
+
+    expect(serviceWorkerConfig).not.toHaveBeenCalled();
+    expect(fetchApi).not.toHaveBeenCalled();
+    expect(AuthManager.isAuthSessionActive()).toBe(false);
+  });
+
+  test("rejects additional configuration when service workers are unavailable", async () => {
+    delete navigatorValue.serviceWorker;
+    const fetchApi = createPrimaryFetchApi();
+    const serviceWorkerConfig = jest.fn(
+      async (): Promise<AuthManagerServiceWorkerConfig> => ({
+        additionalConfig: []
+      })
+    );
+
+    await expect(
+      AuthManager.beginAuthSession({
+        ...createParams(fetchApi),
+        serviceWorkerConfig,
+        serviceWorkerScript: "/bytescale-auth-sw.js"
+      })
+    ).rejects.toThrow("requires service workers");
+
+    expect(serviceWorkerConfig).not.toHaveBeenCalled();
+    expect(fetchApi).not.toHaveBeenCalled();
+    expect(AuthManager.isAuthSessionActive()).toBe(false);
   });
 });
+
+function createParams(fetchApi: FetchApi): BeginAuthSessionParams {
+  return {
+    accountId: "account-a",
+    authHeaders: async (): Promise<Record<string, string>> => ({ "X-App-Authorization": "app-token" }),
+    authUrl: "https://app.example.com/auth",
+    options: { fetchApi }
+  };
+}
+
+function createPrimaryFetchApi(): jest.MockedFunction<FetchApi> {
+  return jest.fn<FetchApi>(async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+    switch (init?.method) {
+      case "GET":
+        return new NodeFetchResponse("jwt-a", {
+          headers: { "Content-Type": "text/plain" }
+        }) as unknown as Response;
+      case "PUT":
+        return new NodeFetchResponse(
+          JSON.stringify({ accessToken: "access-a", ttlSeconds: 3600 })
+        ) as unknown as Response;
+      case "DELETE":
+        return new NodeFetchResponse(null, { status: 204 }) as unknown as Response;
+      default:
+        throw new Error(`Unexpected method: ${init?.method ?? "undefined"}`);
+    }
+  });
+}