@bytescale/sdk 3.56.0 → 3.58.0

package/dist/browser/esm/main.mjs

@@ -3156,11 +3156,12 @@ function AuthManagerBrowser_awaitIgnored(value, direct) {
     return value && value.then ? value.then(AuthManagerBrowser_empty) : Promise.resolve();
   }
 }
-function AuthManagerBrowser_invokeIgnored(body) {
+function AuthManagerBrowser_invoke(body, then) {
   var result = body();
   if (result && result.then) {
-    return result.then(AuthManagerBrowser_empty);
+    return result.then(then);
   }
+  return then(result);
 }
 function AuthManagerBrowser_await(value, then, direct) {
   if (direct) {
@@ -3183,12 +3184,11 @@ function AuthManagerBrowser_async(f) {
     }
   };
 }
-function AuthManagerBrowser_invoke(body, then) {
+function AuthManagerBrowser_invokeIgnored(body) {
   var result = body();
   if (result && result.then) {
-    return result.then(then);
+    return result.then(AuthManagerBrowser_empty);
   }
-  return then(result);
 }
 function AuthManagerBrowser_catch(body, recover) {
   try {
@@ -3221,14 +3221,29 @@ function AuthManagerBrowser_continueIgnored(value) {
     return value.then(AuthManagerBrowser_empty);
   }
 }
+function AuthManagerBrowser_call(body, then, direct) {
+  if (direct) {
+    return then ? then(body()) : body();
+  }
+  try {
+    var result = Promise.resolve(body());
+    return then ? result.then(then) : result;
+  } catch (e) {
+    return Promise.reject(e);
+  }
+}
 function AuthManagerBrowser_continue(value, then) {
   return value && value.then ? value.then(then) : then(value);
 }
-function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
 function AuthManagerBrowser_defineProperty(e, r, t) { return (r = AuthManagerBrowser_toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
 function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = AuthManagerBrowser_unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function AuthManagerBrowser_toConsumableArray(r) { return AuthManagerBrowser_arrayWithoutHoles(r) || AuthManagerBrowser_iterableToArray(r) || AuthManagerBrowser_unsupportedIterableToArray(r) || AuthManagerBrowser_nonIterableSpread(); }
+function AuthManagerBrowser_nonIterableSpread() { throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
 function AuthManagerBrowser_unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return AuthManagerBrowser_arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? AuthManagerBrowser_arrayLikeToArray(r, a) : void 0; } }
+function AuthManagerBrowser_iterableToArray(r) { if ("undefined" != typeof Symbol && null != r[Symbol.iterator] || null != r["@@iterator"]) return Array.from(r); }
+function AuthManagerBrowser_arrayWithoutHoles(r) { if (Array.isArray(r)) return AuthManagerBrowser_arrayLikeToArray(r); }
 function AuthManagerBrowser_arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
 function AuthManagerBrowser_classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
 function AuthManagerBrowser_defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, AuthManagerBrowser_toPropertyKey(o.key), o); } }
 function AuthManagerBrowser_createClass(e, r, t) { return r && AuthManagerBrowser_defineProperties(e.prototype, r), t && AuthManagerBrowser_defineProperties(e, t), Object.defineProperty(e, "prototype", { writable: !1 }), e; }
@@ -3262,8 +3277,9 @@ var AuthManagerImpl = /*#__PURE__*/function () {
   }, {
     key: "isAuthSessionReady",
     value: function isAuthSessionReady() {
+      var _a;
       var session = AuthSessionState.getSession();
-      return (session === null || session === void 0 ? void 0 : session.isReady) === true || (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
+      return (_a = session === null || session === void 0 ? void 0 : session.isReady) !== null && _a !== void 0 ? _a : (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
     }
   }, {
     key: "beginAuthSession",
@@ -3276,8 +3292,13 @@ var AuthManagerImpl = /*#__PURE__*/function () {
             throw new Error("Auth session already active. Please call 'await endAuthSession()' and then call 'await beginAuthSession(...)' to start a new auth session.");
           }
           var canUseServiceWorkers = _this.serviceWorkerUtils.canUseServiceWorkers();
-          if (_this.isV2(params) && !canUseServiceWorkers) {
-            throw new Error("This auth session requires service workers, but this browser does not support them.");
+          if (params.serviceWorkerConfig !== undefined) {
+            if (params.serviceWorkerScript === undefined) {
+              throw new Error("The 'serviceWorkerScript' field is required when 'serviceWorkerConfig' is provided.");
+            }
+            if (!canUseServiceWorkers) {
+              throw new Error("The 'serviceWorkerConfig' field requires service workers, but this browser does not support them.");
+            }
           }
           var newSession = {
             accessToken: undefined,
@@ -3288,18 +3309,21 @@ var AuthManagerImpl = /*#__PURE__*/function () {
             authServiceWorker: params.serviceWorkerScript !== undefined && canUseServiceWorkers ? {
               serviceWorkerScript: params.serviceWorkerScript,
               type: "Uninitialized"
-            } : undefined
+            } : undefined,
+            primaryAuthSwConfig: undefined,
+            serviceWorkerConfig: undefined,
+            serviceWorkerConfigRefreshHandle: undefined
           };
           AuthSessionState.setSession(newSession);
           return newSession;
         })), function (session) {
           // IMPORTANT: must be called outside the above, else re-entrant deadlock will occur.
-          return AuthManagerBrowser_invokeIgnored(function () {
-            if (_this.isV2(session.params)) {
+          return AuthManagerBrowser_invoke(function () {
+            if (session.params.serviceWorkerConfig !== undefined) {
               return AuthManagerBrowser_awaitIgnored(_this.refreshServiceWorkerConfig(session, session.params));
-            } else {
-              return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
             }
+          }, function () {
+            return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
           });
         });
       } catch (e) {
@@ -3321,8 +3345,13 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           if (session.accessTokenRefreshHandle !== undefined) {
             _this2.scheduler.unschedule(session.accessTokenRefreshHandle);
           }
+          if (session.serviceWorkerConfigRefreshHandle !== undefined) {
+            _this2.scheduler.unschedule(session.serviceWorkerConfigRefreshHandle);
+          }
+          // AuthSessionState is shared between bundled SDK versions. Service-worker-only sessions from 3.56.0 did not
+          // contain an accountId, so allow a newer SDK instance to tear those sessions down without calling this endpoint.
           return AuthManagerBrowser_invoke(function () {
-            if (!_this2.isV2(session.params)) {
+            if (typeof session.params.accountId === "string") {
               return AuthManagerBrowser_awaitIgnored(_this2.deleteAccessToken(session.params));
             }
           }, function () {
@@ -3364,21 +3393,24 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                   return AuthManagerBrowser_await(_this3.setAccessToken(params, jwt, setCookie), function (setTokenResult) {
                     return AuthManagerBrowser_invoke(function () {
                       if (session.authServiceWorker !== undefined) {
-                        return AuthManagerBrowser_await(_this3.sendServiceWorkerConfig(session, [{
+                        var primaryAuthSwConfig = {
                           headers: [{
                             key: "Authorization",
                             value: "Bearer ".concat(jwt)
                           }],
                           expires: secondsFromNow(setTokenResult.ttlSeconds),
-                          sourceUrlPrefixes: params.sourceUrlPrefixes,
                           urlPrefix: "".concat(_this3.getCdnUrl(params), "/").concat(params.accountId, "/")
-                        }]), function () {
-                          // Allow time for the service worker to receive and process the message. Since this is asynchronous and not
-                          // synchronized, we need to wait for a sufficient amount of time to ensure the service worker is ready to
-                          // authenticate requests, so that after 'beginAuthSession' completes, users can start making requests.
-                          return AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
-                            return setTimeout(resolve, 100);
-                          }));
+                        };
+                        // Fail closed until the initial serviceWorkerConfig callback succeeds: without its result, we do not know
+                        // the source-page restrictions intended for the primary JWT.
+                        return AuthManagerBrowser_invoke(function () {
+                          if (params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined) {
+                            return AuthManagerBrowser_await(_this3.sendMergedServiceWorkerConfig(session, primaryAuthSwConfig, session.serviceWorkerConfig), function () {
+                              return AuthManagerBrowser_awaitIgnored(_this3.waitForServiceWorker());
+                            });
+                          }
+                        }, function () {
+                          session.primaryAuthSwConfig = primaryAuthSwConfig;
                         });
                       }
                     }, function () {
@@ -3390,7 +3422,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
                       expires = secondsFromNow(actualTtl);
                       // Set this at the end, as it's also used to signal 'isAuthSessionReady', so must be set after configuring the Service Worker, etc.
                       session.accessToken = setTokenResult.accessToken;
-                      session.isReady = true;
+                      _this3.updateSessionReadiness(session);
                     });
                   });
                 });
@@ -3421,6 +3453,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     value: function refreshServiceWorkerConfig(session, params) {
       try {
         var _this4 = this;
+        var getServiceWorkerConfig = params.serviceWorkerConfig;
+        if (getServiceWorkerConfig === undefined) {
+          return AuthManagerBrowser_await();
+        }
         return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this4.authSessionMutex.safe(AuthManagerBrowser_async(function () {
           var _exit = false;
           if (!session.isActive) {
@@ -3428,17 +3464,35 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           }
           var refreshAt;
           return AuthManagerBrowser_continue(AuthManagerBrowser_catch(function () {
-            return AuthManagerBrowser_await(params.getServiceWorkerConfig(), function (config) {
-              if (!Array.isArray(config)) {
-                throw new Error("The 'getServiceWorkerConfig' callback must return an array.");
+            return AuthManagerBrowser_call(getServiceWorkerConfig, function (result) {
+              if (result === null || AuthManagerBrowser_typeof(result) !== "object" || !Array.isArray(result.additionalConfig)) {
+                throw new Error("The 'serviceWorkerConfig' callback must return an object containing 'additionalConfig'.");
               }
-              return AuthManagerBrowser_await(_this4.sendServiceWorkerConfig(session, config), function () {
-                return AuthManagerBrowser_await(new Promise(function (resolve) {
-                  return setTimeout(resolve, 100);
-                }), function () {
-                  session.isReady = true;
-                  refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config);
-                });
+              if (result.sourceUrlPrefixes !== undefined && (!Array.isArray(result.sourceUrlPrefixes) || !result.sourceUrlPrefixes.every(function (prefix) {
+                return typeof prefix === "string";
+              }))) {
+                throw new Error("The 'sourceUrlPrefixes' field returned by 'serviceWorkerConfig' must be an array of strings.");
+              }
+              if (result.urlRewriteRules !== undefined && (!Array.isArray(result.urlRewriteRules) || !result.urlRewriteRules.every(function (rule) {
+                return rule !== null && AuthManagerBrowser_typeof(rule) === "object" && typeof rule.fromUrlPrefix === "string" && typeof rule.toUrlPrefix === "string";
+              }))) {
+                throw new Error("The 'urlRewriteRules' field returned by 'serviceWorkerConfig' must be an array of URL rewrite rules.");
+              }
+              var config = {
+                additionalConfig: result.additionalConfig,
+                sourceUrlPrefixes: result.sourceUrlPrefixes,
+                urlRewriteRules: result.urlRewriteRules
+              };
+              return AuthManagerBrowser_invoke(function () {
+                if (session.primaryAuthSwConfig !== undefined) {
+                  return AuthManagerBrowser_await(_this4.sendMergedServiceWorkerConfig(session, session.primaryAuthSwConfig, config), function () {
+                    return AuthManagerBrowser_awaitIgnored(_this4.waitForServiceWorker());
+                  });
+                }
+              }, function () {
+                session.serviceWorkerConfig = config;
+                _this4.updateSessionReadiness(session);
+                refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config.additionalConfig);
               });
             });
           }, function (e) {
@@ -3447,7 +3501,7 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           }), function (_result2) {
             if (_exit) return _result2;
             if (refreshAt !== undefined) {
-              session.accessTokenRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
+              session.serviceWorkerConfigRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
                 _this4.refreshServiceWorkerConfig(session, params).then(function () {}, function (e) {
                   return ConsoleUtils.error("Unexpected error when refreshing service worker auth config: ".concat(e));
                 });
@@ -3459,6 +3513,19 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "sendMergedServiceWorkerConfig",
+    value: function sendMergedServiceWorkerConfig(session, primaryConfig, serviceWorkerConfig) {
+      try {
+        var _this5 = this;
+        var _a;
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this5.sendServiceWorkerConfig(session, [Object.assign(Object.assign({}, primaryConfig), {
+          sourceUrlPrefixes: serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.sourceUrlPrefixes
+        })].concat(AuthManagerBrowser_toConsumableArray((_a = serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.additionalConfig) !== null && _a !== void 0 ? _a : [])), serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.urlRewriteRules)));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "getServiceWorkerConfigRefreshEpoch",
     value: function getServiceWorkerConfigRefreshEpoch(config) {
@@ -3481,26 +3548,46 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "sendServiceWorkerConfig",
-    value: function sendServiceWorkerConfig(session, config) {
+    value: function sendServiceWorkerConfig(session, config, urlRewriteRules) {
       try {
-        var _this5 = this;
+        var _this6 = this;
         if (session.authServiceWorker === undefined) {
           throw new Error("Service worker configuration cannot be applied because service workers are unavailable.");
         }
-        return AuthManagerBrowser_await(_this5.serviceWorkerUtils.sendMessage({
+        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage(Object.assign({
           type: "SET_BYTESCALE_AUTH_CONFIG",
           config: config.map(function (entry) {
             return Object.assign(Object.assign({}, entry), {
-              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this5.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
+              urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this6.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
             });
           })
-        }, session.authServiceWorker, _this5.serviceWorkerScriptFieldName), function (_this5$serviceWorkerU) {
-          session.authServiceWorker = _this5$serviceWorkerU;
+        }, urlRewriteRules === undefined ? {} : {
+          urlRewriteRules: urlRewriteRules
+        }), session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
+          session.authServiceWorker = _this6$serviceWorkerU;
         });
       } catch (e) {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "updateSessionReadiness",
+    value: function updateSessionReadiness(session) {
+      session.isReady = session.accessToken !== undefined && (session.params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined);
+    }
+  }, {
+    key: "waitForServiceWorker",
+    value: function waitForServiceWorker() {
+      try {
+        // Message delivery is asynchronous and has no acknowledgement, so allow the worker time to apply the config before
+        // beginAuthSession reports that authenticated requests are ready.
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
+          return setTimeout(resolve, 100);
+        })));
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
   }, {
     key: "getAccessTokenUrl",
     value: function getAccessTokenUrl(params, setCookie) {
@@ -3516,9 +3603,9 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "deleteAccessToken",
     value: function deleteAccessToken(params) {
       try {
-        var _this6 = this;
+        var _this7 = this;
         var _a;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this6.getAccessTokenUrl(params, true), {
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this7.getAccessTokenUrl(params, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
@@ -3534,15 +3621,15 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "setAccessToken",
     value: function setAccessToken(params, jwt, setCookie) {
       try {
-        var _this7 = this;
+        var _this8 = this;
         var _a;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this7.getAccessTokenUrl(params, setCookie), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this8.getAccessTokenUrl(params, setCookie), {
           method: "PUT",
           credentials: "include",
-          headers: AuthManagerBrowser_defineProperty({}, _this7.contentType, _this7.contentTypeJson),
+          headers: AuthManagerBrowser_defineProperty({}, _this8.contentType, _this8.contentTypeJson),
           body: JSON.stringify(request)
         }, {
           isBytescaleApi: true,
@@ -3558,10 +3645,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "getAccessToken",
     value: function getAccessToken(params, headers) {
       try {
-        var _this8 = this;
+        var _this9 = this;
         var _a, _b;
         var endpointName = "Your auth API endpoint";
-        var requiredContentType = _this8.contentTypeText;
+        var requiredContentType = _this9.contentTypeText;
         return AuthManagerBrowser_await(BaseAPI.fetch(params.authUrl, {
           method: "GET",
           headers: headers
@@ -3569,10 +3656,10 @@ var AuthManagerImpl = /*#__PURE__*/function () {
           isBytescaleApi: false,
           fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
         }), function (result) {
-          var actualContentType = (_b = result.headers.get(_this8.contentType)) !== null && _b !== void 0 ? _b : "";
+          var actualContentType = (_b = result.headers.get(_this9.contentType)) !== null && _b !== void 0 ? _b : "";
           // Support content types like "text/plain; charset=utf-8" and "text/plain"
           if (actualContentType.split(";")[0] !== requiredContentType) {
-            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this8.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
+            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this9.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
           }
           return AuthManagerBrowser_await(result.text(), function (jwt) {
             if (jwt.length === 0) {
@@ -3589,11 +3676,6 @@ var AuthManagerImpl = /*#__PURE__*/function () {
         return Promise.reject(e);
       }
     }
-  }, {
-    key: "isV2",
-    value: function isV2(params) {
-      return "getServiceWorkerConfig" in params;
-    }
   }]);
 }();
 /**

package/dist/types/private/dtos/AuthSwSetConfigDto.d.ts

@@ -1,4 +1,5 @@
 import { AuthSwConfigDto } from "./AuthSwConfigDto";
+import { UrlRewriteRule } from "../model/AuthManagerInterface";
 export interface AuthSwSetConfigDto {
     config: AuthSwConfigDto;
     /**
@@ -8,4 +9,5 @@ export interface AuthSwSetConfigDto {
      * with the user's events.
      */
     type: "SET_BYTESCALE_AUTH_CONFIG";
+    urlRewriteRules?: UrlRewriteRule[];
 }

package/dist/types/private/model/AuthManagerInterface.d.ts

@@ -1,7 +1,30 @@
 import { BytescaleApiClientConfig } from "../../public/shared";
 import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
-export type BeginAuthSessionParams = BeginAuthSessionParamsV1 | BeginAuthSessionParamsV2;
-export interface BeginAuthSessionParamsV1 {
+export interface UrlRewriteRule {
+    /** URL prefix to replace. This URL must be covered by the service worker's origin and scope. */
+    fromUrlPrefix: string;
+    /** Replacement URL prefix. The remainder of the original URL is appended unchanged. */
+    toUrlPrefix: string;
+}
+export interface AuthManagerServiceWorkerConfig {
+    /**
+     * Additional download-only service-worker authorization rules.
+     * An empty array clears all additional rules.
+     */
+    additionalConfig: AuthSwConfigEntryDto[];
+    /**
+     * Restricts the primary JWT to pages and iframes whose URL starts with one of these prefixes.
+     * An empty array matches no clients. Omit this field to preserve the existing service-worker behavior.
+     * History API changes do not update the matched client URL.
+     */
+    sourceUrlPrefixes?: string[];
+    /**
+     * Rewrites matching service-worker requests before applying authorization rules. The first matching rule wins and
+     * rewritten URLs are not processed recursively.
+     */
+    urlRewriteRules?: UrlRewriteRule[];
+}
+export interface BeginAuthSessionParams {
     /**
      * The account ID to authorize requests for.
      */
@@ -20,6 +43,19 @@ export interface BeginAuthSessionParamsV1 {
      * Optional configuration.
      */
     options?: Pick<BytescaleApiClientConfig, "fetchApi" | "cdnUrl">;
+    /**
+     * Returns configuration for service-worker authorization. The primary JWT returned by `authUrl` is restricted using
+     * `sourceUrlPrefixes`; `additionalConfig` contains download-only rules and never authenticates SDK API operations;
+     * `urlRewriteRules` rewrites in-scope URLs before download authorization is evaluated.
+     * Called when the session begins and again 20 seconds before the earliest additional entry expires. Entries without
+     * an expiry do not trigger a refresh.
+     *
+     * Requires `serviceWorkerScript` and browser service-worker support. Additional rules cannot use the CDN cookie
+     * fallback.
+     *
+     * IMPORTANT: do not call 'AuthManager.beginAuthSession' or 'AuthManager.endAuthSession' inside this callback, as this will cause a deadlock.
+     */
+    serviceWorkerConfig?: () => Promise<AuthManagerServiceWorkerConfig>;
     /**
      * Enables support for modern browsers that block third-party cookies (like Safari).
      *
@@ -66,35 +102,13 @@ export interface BeginAuthSessionParamsV1 {
      * script must be hosted on your website's domain in the root directory.
      */
     serviceWorkerScript?: string;
-    /**
-     * Restricts service-worker authorization to pages and iframes whose URL starts with one of these prefixes.
-     * An empty array matches no clients. Omit this field to preserve the existing service-worker behavior.
-     * Applies only with `serviceWorkerScript`; History API changes do not update the matched client URL.
-     */
-    sourceUrlPrefixes?: string[];
-}
-export interface BeginAuthSessionParamsV2 {
-    /**
-     * Returns the complete replacement service-worker authorization config. Called when the session begins and again
-     * 20 seconds before the earliest configured expiry. Entries without an expiry do not trigger a refresh.
-     *
-     * IMPORTANT: do not call 'AuthManager.beginAuthSession' or 'AuthManager.endAuthSession' inside this callback, as this will cause a deadlock.
-     */
-    getServiceWorkerConfig: () => Promise<AuthSwConfigEntryDto[]>;
-    /**
-     * The path to the service worker JavaScript file hosted at the root of your website.
-     *
-     * Unlike V1 sessions, V2 sessions require service-worker support and do not create an SDK API access token or use
-     * CDN cookies as a fallback.
-     */
-    serviceWorkerScript: string;
 }
 export interface AuthManagerInterface {
     /**
      * Begins a JWT auth session with the Bytescale API and Bytescale CDN.
      *
-     * V1 sessions fetch and refresh a JWT using the supplied auth endpoint. V2 sessions instead refresh the complete
-     * service-worker configuration using `getServiceWorkerConfig`.
+     * The primary JWT authenticates Bytescale API operations and downloads for `accountId`. Optional additional
+     * service-worker rules authenticate downloads only.
      *
      * Specifically, calling this method will cause the SDK to periodically acquire a JWT from your JWT endpoint. The SDK will then automatically include this JWT in all subsequent Bytescale API requests (via the 'authorization-token' request header) and also in all Bytescale CDN download requests (via a session cookie, or an 'authorization' header if service workers are being used).
      *

package/dist/types/private/model/AuthSession.d.ts

@@ -1,4 +1,5 @@
-import { BeginAuthSessionParams } from "./AuthManagerInterface";
+import { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "./AuthManagerInterface";
+import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
 import { ServiceWorkerConfig } from "./ServiceWorkerConfig";
 export interface AuthSession {
     accessToken: string | undefined;
@@ -7,4 +8,7 @@ export interface AuthSession {
     isActive: boolean;
     isReady?: boolean;
     params: BeginAuthSessionParams;
+    primaryAuthSwConfig: AuthSwConfigEntryDto | undefined;
+    serviceWorkerConfig: AuthManagerServiceWorkerConfig | undefined;
+    serviceWorkerConfigRefreshHandle: number | undefined;
 }

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -3,7 +3,7 @@ import { AuthSwSetConfigDto } from "../../private/dtos/AuthSwSetConfigDto";
 import { ServiceWorkerUtils } from "../../private/ServiceWorkerUtils";
 export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
 export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
-export type { BeginAuthSessionParams, BeginAuthSessionParamsV1, BeginAuthSessionParamsV2 } from "../../private/model/AuthManagerInterface";
+export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams, UrlRewriteRule } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     private readonly serviceWorkerUtils;
     private readonly authSessionMutex;
@@ -23,14 +23,16 @@ declare class AuthManagerImpl implements AuthManagerInterface {
     endAuthSession(): Promise<void>;
     private refreshAccessToken;
     private refreshServiceWorkerConfig;
+    private sendMergedServiceWorkerConfig;
     private getServiceWorkerConfigRefreshEpoch;
     private sendServiceWorkerConfig;
+    private updateSessionReadiness;
+    private waitForServiceWorker;
     private getAccessTokenUrl;
     private getCdnUrl;
     private deleteAccessToken;
     private setAccessToken;
     private getAccessToken;
-    private isV2;
 }
 /**
  * Alternative way of implementing a static class (i.e. all methods static). We do this so we can use a interface on the class (interfaces can't define static methods).

package/dist/types/public/node/AuthManagerNode.d.ts

@@ -1,7 +1,7 @@
 import { AuthManagerInterface, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
 export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
-export type { BeginAuthSessionParams, BeginAuthSessionParamsV1, BeginAuthSessionParamsV2 } from "../../private/model/AuthManagerInterface";
+export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams, UrlRewriteRule } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     beginAuthSession(_params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytescale/sdk",
-  "version": "3.56.0",
+  "version": "3.58.0",
   "description": "Bytescale JavaScript SDK",
   "author": "Bytescale <hello@bytescale.com> (https://www.bytescale.com)",
   "license": "MIT",