@bytescale/sdk 3.57.0 → 3.59.0

package/dist/browser/cjs/main.js

@@ -250,6 +250,55 @@ var AuthSessionState = /*#__PURE__*/function () {
       }
       return window[AuthSessionState.stateKey];
     }
+    /** Resolves request-time auth while remaining compatible with the single-token session used by SDK 3.54.0. */
+  }, {
+    key: "resolveAuthConfig",
+    value: function resolveAuthConfig(authConfigId, requireReadyDefault) {
+      if (authConfigId === false) {
+        return undefined;
+      }
+      var session = AuthSessionState.getSession();
+      if (session === undefined || !session.isActive) {
+        if (typeof authConfigId === "string") {
+          throw new Error("No active AuthManager configuration has ID '".concat(authConfigId, "'."));
+        }
+        return undefined;
+      }
+      if (Array.isArray(session.authConfigs)) {
+        var state = session.authConfigs.find(function (config) {
+          return config.config.authConfigId === authConfigId;
+        });
+        if (state === undefined) {
+          if (typeof authConfigId === "string") {
+            throw new Error("No active AuthManager configuration has ID '".concat(authConfigId, "'."));
+          }
+          return undefined;
+        }
+        if (state.accessToken === undefined || state.expiresAt === undefined || state.expiresAt <= Date.now() || state.jwt === undefined) {
+          var isV2Session = typeof session.params.authConfigs === "function";
+          if (typeof authConfigId === "string" || requireReadyDefault || isV2Session) {
+            throw new Error("AuthManager configuration '".concat(authConfigId !== null && authConfigId !== void 0 ? authConfigId : "default", "' is not ready."));
+          }
+          return undefined;
+        }
+        return {
+          accessToken: state.accessToken,
+          accountId: state.config.accountId,
+          jwt: state.jwt
+        };
+      }
+      if (typeof authConfigId === "string") {
+        throw new Error("No active AuthManager configuration has ID '".concat(authConfigId, "'."));
+      }
+      if (session.accessToken === undefined || typeof session.params.accountId !== "string") {
+        return undefined;
+      }
+      return {
+        accessToken: session.accessToken,
+        accountId: session.params.accountId,
+        jwt: undefined
+      };
+    }
   }]);
 }();
 AuthSessionState.stateKey = "BytescaleSessionState";
@@ -393,12 +442,47 @@ var BytescaleApiClientConfigUtils = /*#__PURE__*/function () {
   }, {
     key: "getAccountId",
     value: function getAccountId(config) {
+      return BytescaleApiClientConfigUtils.resolveAuthentication(config).accountId;
+    }
+  }, {
+    key: "resolveAuthentication",
+    value: function resolveAuthentication(config) {
+      var _a, _b;
+      var apiKey = (_a = config.apiKey) !== null && _a !== void 0 ? _a : undefined;
+      var authConfig = AuthSessionState.resolveAuthConfig(config.authConfigId, apiKey === undefined);
+      var apiKeyAccountId = apiKey === undefined ? undefined : BytescaleApiClientConfigUtils.getApiKeyAccountId(apiKey);
+      if (apiKeyAccountId !== undefined && authConfig !== undefined && apiKeyAccountId !== authConfig.accountId) {
+        throw new Error("The API key belongs to account '".concat(apiKeyAccountId, "', but AuthManager configuration '").concat((_b = config.authConfigId) !== null && _b !== void 0 ? _b : "default", "' belongs to account '").concat(authConfig.accountId, "'."));
+      }
+      if (apiKey !== undefined) {
+        return {
+          accountId: apiKeyAccountId,
+          headers: Object.assign({
+            Authorization: "Bearer ".concat(apiKey)
+          }, authConfig === undefined ? {} : {
+            "Authorization-Token": authConfig.accessToken
+          })
+        };
+      }
+      if ((authConfig === null || authConfig === void 0 ? void 0 : authConfig.jwt) !== undefined) {
+        return {
+          accountId: authConfig.accountId,
+          headers: {
+            Authorization: "Bearer ".concat(authConfig.jwt)
+          }
+        };
+      }
+      throw new Error("Please provide an API key via the 'apiKey' config parameter.");
+    }
+  }, {
+    key: "getApiKeyAccountId",
+    value: function getApiKeyAccountId(apiKey) {
       var _a, _b;
       var accountId;
-      if (BytescaleApiClientConfigUtils.specialApiKeys.includes(config.apiKey)) {
+      if (BytescaleApiClientConfigUtils.specialApiKeys.includes(apiKey)) {
         accountId = BytescaleApiClientConfigUtils.specialApiKeyAccountId;
       } else {
-        accountId = (_b = (_a = config.apiKey.split("_")[1]) === null || _a === void 0 ? void 0 : _a.substr(0, BytescaleApiClientConfigUtils.accountIdLength)) !== null && _b !== void 0 ? _b : "";
+        accountId = (_b = (_a = apiKey.split("_")[1]) === null || _a === void 0 ? void 0 : _a.substr(0, BytescaleApiClientConfigUtils.accountIdLength)) !== null && _b !== void 0 ? _b : "";
         if (accountId.length !== BytescaleApiClientConfigUtils.accountIdLength) {
           throw new Error("Invalid Bytescale API key.");
         }
@@ -408,21 +492,24 @@ var BytescaleApiClientConfigUtils = /*#__PURE__*/function () {
   }, {
     key: "validate",
     value: function validate(config) {
-      var _a;
       // Defensive programming, for users not using TypeScript. Mainly because this is used by UploadWidget users.
       if ((config !== null && config !== void 0 ? config : undefined) === undefined) {
         throw new Error("Config parameter required.");
       }
-      if (((_a = config.apiKey) !== null && _a !== void 0 ? _a : undefined) === undefined) {
-        throw new Error("Please provide an API key via the 'apiKey' config parameter.");
+      if (config.authConfigId !== undefined && config.authConfigId !== false && typeof config.authConfigId !== "string") {
+        throw new Error("The 'authConfigId' config parameter must be a string, false, or undefined.");
       }
-      if (config.apiKey.trim() !== config.apiKey) {
+      if (config.apiKey !== undefined && typeof config.apiKey !== "string") {
+        throw new Error("The 'apiKey' config parameter must be a string when provided.");
+      }
+      if (config.apiKey !== undefined && config.apiKey.trim() !== config.apiKey) {
         // We do not support API keys with whitespace (by trimming ourselves) because otherwise we'd need to support this
         // everywhere in perpetuity (since removing the trimming would be a breaking change).
         throw new Error("API key needs trimming (whitespace detected).");
       }
-      // This performs futher validation on the API key...
-      BytescaleApiClientConfigUtils.getAccountId(config);
+      if (config.apiKey !== undefined) {
+        BytescaleApiClientConfigUtils.getApiKeyAccountId(config.apiKey);
+      }
     }
   }]);
 }();
@@ -449,12 +536,7 @@ var BaseAPI = /*#__PURE__*/function () {
       try {
         var _this = this;
         var _a;
-        var apiKey = _this.config.apiKey;
-        context.headers["Authorization"] = "Bearer ".concat(apiKey); // authorization-header authentication
-        var session = AuthSessionState.getSession();
-        if ((session === null || session === void 0 ? void 0 : session.accessToken) !== undefined) {
-          context.headers["Authorization-Token"] = session.accessToken;
-        }
+        Object.assign(context.headers, BytescaleApiClientConfigUtils.resolveAuthentication(_this.config).headers);
         // Key: any possible value for 'baseUrlOverride'
         // Value: user-overridden value for that base URL from the config.
         var nonDefaultBasePaths = _defineProperty({}, BytescaleApiClientConfigUtils.defaultCdnUrl, BytescaleApiClientConfigUtils.getCdnUrl(_this.config));
@@ -494,9 +576,21 @@ var BaseAPI = /*#__PURE__*/function () {
           url += "?" + querystring(context.query);
         }
         var configHeaders = _this2.config.headers;
-        var _Object$assign = Object.assign({}, context.headers);
-        return runtime_await(runtime_await(configHeaders === undefined ? {} : typeof configHeaders === "function" ? configHeaders() : configHeaders, function (_configHeaders) {
-          var headers = Object.assign(_Object$assign, configHeaders === undefined ? _configHeaders : _configHeaders);
+        return runtime_await(runtime_await(configHeaders === undefined ? {} : typeof configHeaders === "function" ? configHeaders() : configHeaders, function (resolvedConfigHeaders) {
+          for (var _i = 0, _Object$keys = Object.keys(resolvedConfigHeaders); _i < _Object$keys.length; _i++) {
+            var key = _Object$keys[_i];
+            if (key.toLowerCase() === "authorization" || key.toLowerCase() === "authorization-token") {
+              for (var _i2 = 0, _Object$keys2 = Object.keys(context.headers); _i2 < _Object$keys2.length; _i2++) {
+                var generatedKey = _Object$keys2[_i2];
+                if (generatedKey.toLowerCase() === key.toLowerCase()) {
+                  // Custom auth headers have documented precedence; remove the generated spelling to make that deterministic.
+                  // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+                  delete context.headers[generatedKey];
+                }
+              }
+            }
+          }
+          var headers = Object.assign(Object.assign({}, context.headers), resolvedConfigHeaders);
           Object.keys(headers).forEach(function (key) {
             return headers[key] === undefined ? delete headers[key] : {};
           });
@@ -508,12 +602,12 @@ var BaseAPI = /*#__PURE__*/function () {
             headers: headers,
             body: context.body
           };
-          var _Object$assign2 = Object.assign({}, initParams);
+          var _Object$assign = Object.assign({}, initParams);
           return runtime_await(initOverrideFn({
             init: initParams,
             context: context
           }), function (_initOverrideFn) {
-            var overriddenInit = Object.assign(_Object$assign2, _initOverrideFn);
+            var overriddenInit = Object.assign(_Object$assign, _initOverrideFn);
             var init = Object.assign(Object.assign({}, overriddenInit), {
               body: JSON.stringify(overriddenInit.body)
             });
@@ -2138,7 +2232,6 @@ var UploadManagerBase = /*#__PURE__*/function () {
     this.defaultMaxConcurrentUploadParts = 4;
     this.intervalMs = 500;
     this.uploadApi = new UploadApi(config);
-    this.accountId = BytescaleApiClientConfigUtils.getAccountId(config);
   }
   return UploadManagerBase_createClass(UploadManagerBase, [{
     key: "upload",
@@ -2146,6 +2239,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
       try {
         var _this = this;
         _this.assertNotCancelled(request);
+        var accountId = BytescaleApiClientConfigUtils.getAccountId(_this.config);
         var source = _this.processUploadSource(request.data);
         var preUploadInfo = _this.getPreUploadInfo(request, source);
         var bytesTotal = preUploadInfo.size;
@@ -2155,7 +2249,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
         if (request.onProgress !== undefined) {
           request.onProgress(_this.makeProgressEvent(0, bytesTotal));
         }
-        return UploadManagerBase_await(_this.beginUpload(request, preUploadInfo), function (uploadInfo) {
+        return UploadManagerBase_await(_this.beginUpload(request, preUploadInfo, accountId), function (uploadInfo) {
           var partCount = uploadInfo.uploadParts.count;
           var parts = UploadManagerBase_toConsumableArray(Array(partCount).keys());
           var _this$makeCancellatio = _this.makeCancellationMethods(),
@@ -2165,7 +2259,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
           var uploadedParts;
           return UploadManagerBase_continue(UploadManagerBase_finallyRethrows(function () {
             return UploadManagerBase_await(_this.mapAsync(parts, preUploadInfo.maxConcurrentUploadParts, _async(function (part) {
-              return _this.uploadPart(request, source, part, uploadInfo, makeOnProgressForPart(), addCancellationHandler);
+              return _this.uploadPart(request, source, part, uploadInfo, makeOnProgressForPart(), addCancellationHandler, accountId);
             })), function (_this$mapAsync) {
               uploadedParts = _this$mapAsync;
               return UploadManagerBase_awaitIgnored(_this.postUpload(init));
@@ -2277,14 +2371,14 @@ var UploadManagerBase = /*#__PURE__*/function () {
     }
   }, {
     key: "beginUpload",
-    value: function beginUpload(request, _ref2) {
+    value: function beginUpload(request, _ref2, accountId) {
       var size = _ref2.size,
         mime = _ref2.mime,
         originalFileName = _ref2.originalFileName;
       try {
         var _this4 = this;
         return UploadManagerBase_await(_this4.uploadApi.beginMultipartUpload({
-          accountId: _this4.accountId,
+          accountId: accountId,
           beginMultipartUploadRequest: {
             metadata: request.metadata,
             mime: mime,
@@ -2301,16 +2395,16 @@ var UploadManagerBase = /*#__PURE__*/function () {
     }
   }, {
     key: "uploadPart",
-    value: function uploadPart(request, source, partIndex, uploadInfo, onProgress, addCancellationHandler) {
+    value: function uploadPart(request, source, partIndex, uploadInfo, onProgress, addCancellationHandler, accountId) {
       try {
         var _this5 = this;
         _this5.assertNotCancelled(request);
-        return UploadManagerBase_await(_this5.getUploadPart(partIndex, uploadInfo), function (part) {
+        return UploadManagerBase_await(_this5.getUploadPart(partIndex, uploadInfo, accountId), function (part) {
           _this5.assertNotCancelled(request);
           return UploadManagerBase_await(_this5.putUploadPart(part, source, onProgress, addCancellationHandler), function (etag) {
             _this5.assertNotCancelled(request);
             return UploadManagerBase_await(_this5.uploadApi.completeUploadPart({
-              accountId: _this5.accountId,
+              accountId: accountId,
               uploadId: uploadInfo.uploadId,
               uploadPartIndex: partIndex,
               completeUploadPartRequest: {
@@ -2351,7 +2445,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
     }
   }, {
     key: "getUploadPart",
-    value: function getUploadPart(partIndex, uploadInfo) {
+    value: function getUploadPart(partIndex, uploadInfo, accountId) {
       try {
         var _this7 = this;
         if (partIndex === 0) {
@@ -2359,7 +2453,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
         }
         return UploadManagerBase_await(_this7.uploadApi.getUploadPart({
           uploadId: uploadInfo.uploadId,
-          accountId: _this7.accountId,
+          accountId: accountId,
           uploadPartIndex: partIndex
         }));
       } catch (e) {
@@ -3196,12 +3290,178 @@ function AuthManagerBrowser_awaitIgnored(value, direct) {
     return value && value.then ? value.then(AuthManagerBrowser_empty) : Promise.resolve();
   }
 }
-function AuthManagerBrowser_invoke(body, then) {
-  var result = body();
+var AuthManagerBrowser_iteratorSymbol = /*#__PURE__*/typeof Symbol !== "undefined" ? Symbol.iterator || (Symbol.iterator = Symbol("Symbol.iterator")) : "@@iterator";
+function AuthManagerBrowser_settle(pact, state, value) {
+  if (!pact.s) {
+    if (value instanceof AuthManagerBrowser_Pact) {
+      if (value.s) {
+        if (state & 1) {
+          state = value.s;
+        }
+        value = value.v;
+      } else {
+        value.o = AuthManagerBrowser_settle.bind(null, pact, state);
+        return;
+      }
+    }
+    if (value && value.then) {
+      value.then(AuthManagerBrowser_settle.bind(null, pact, state), AuthManagerBrowser_settle.bind(null, pact, 2));
+      return;
+    }
+    pact.s = state;
+    pact.v = value;
+    var observer = pact.o;
+    if (observer) {
+      observer(pact);
+    }
+  }
+}
+var AuthManagerBrowser_Pact = /*#__PURE__*/function () {
+  function _Pact() {}
+  _Pact.prototype.then = function (onFulfilled, onRejected) {
+    var result = new _Pact();
+    var state = this.s;
+    if (state) {
+      var callback = state & 1 ? onFulfilled : onRejected;
+      if (callback) {
+        try {
+          AuthManagerBrowser_settle(result, 1, callback(this.v));
+        } catch (e) {
+          AuthManagerBrowser_settle(result, 2, e);
+        }
+        return result;
+      } else {
+        return this;
+      }
+    }
+    this.o = function (_this) {
+      try {
+        var value = _this.v;
+        if (_this.s & 1) {
+          AuthManagerBrowser_settle(result, 1, onFulfilled ? onFulfilled(value) : value);
+        } else if (onRejected) {
+          AuthManagerBrowser_settle(result, 1, onRejected(value));
+        } else {
+          AuthManagerBrowser_settle(result, 2, value);
+        }
+      } catch (e) {
+        AuthManagerBrowser_settle(result, 2, e);
+      }
+    };
+    return result;
+  };
+  return _Pact;
+}();
+function AuthManagerBrowser_isSettledPact(thenable) {
+  return thenable instanceof AuthManagerBrowser_Pact && thenable.s & 1;
+}
+function AuthManagerBrowser_forTo(array, body, check) {
+  var i = -1,
+    pact,
+    reject;
+  function _cycle(result) {
+    try {
+      while (++i < array.length && (!check || !check())) {
+        result = body(i);
+        if (result && result.then) {
+          if (AuthManagerBrowser_isSettledPact(result)) {
+            result = result.v;
+          } else {
+            result.then(_cycle, reject || (reject = AuthManagerBrowser_settle.bind(null, pact = new AuthManagerBrowser_Pact(), 2)));
+            return;
+          }
+        }
+      }
+      if (pact) {
+        AuthManagerBrowser_settle(pact, 1, result);
+      } else {
+        pact = result;
+      }
+    } catch (e) {
+      AuthManagerBrowser_settle(pact || (pact = new AuthManagerBrowser_Pact()), 2, e);
+    }
+  }
+  _cycle();
+  return pact;
+}
+function AuthManagerBrowser_forOf(target, body, check) {
+  if (typeof target[AuthManagerBrowser_iteratorSymbol] === "function") {
+    var _cycle2 = function _cycle(result) {
+      try {
+        while (!(step = iterator.next()).done && (!check || !check())) {
+          result = body(step.value);
+          if (result && result.then) {
+            if (AuthManagerBrowser_isSettledPact(result)) {
+              result = result.v;
+            } else {
+              result.then(_cycle2, reject || (reject = AuthManagerBrowser_settle.bind(null, pact = new AuthManagerBrowser_Pact(), 2)));
+              return;
+            }
+          }
+        }
+        if (pact) {
+          AuthManagerBrowser_settle(pact, 1, result);
+        } else {
+          pact = result;
+        }
+      } catch (e) {
+        AuthManagerBrowser_settle(pact || (pact = new AuthManagerBrowser_Pact()), 2, e);
+      }
+    };
+    var iterator = target[AuthManagerBrowser_iteratorSymbol](),
+      step,
+      pact,
+      reject;
+    _cycle2();
+    if (iterator.return) {
+      var _fixup = function _fixup(value) {
+        try {
+          if (!step.done) {
+            iterator.return();
+          }
+        } catch (e) {}
+        return value;
+      };
+      if (pact && pact.then) {
+        return pact.then(_fixup, function (e) {
+          throw _fixup(e);
+        });
+      }
+      _fixup();
+    }
+    return pact;
+  }
+  // No support for Symbol.iterator
+  if (!("length" in target)) {
+    throw new TypeError("Object is not iterable");
+  }
+  // Handle live collections properly
+  var values = [];
+  for (var i = 0; i < target.length; i++) {
+    values.push(target[i]);
+  }
+  return AuthManagerBrowser_forTo(values, function (i) {
+    return body(values[i]);
+  }, check);
+}
+function AuthManagerBrowser_continueIgnored(value) {
+  if (value && value.then) {
+    return value.then(AuthManagerBrowser_empty);
+  }
+}
+function AuthManagerBrowser_catch(body, recover) {
+  try {
+    var result = body();
+  } catch (e) {
+    return recover(e);
+  }
   if (result && result.then) {
-    return result.then(then);
+    return result.then(void 0, recover);
   }
-  return then(result);
+  return result;
+}
+function AuthManagerBrowser_continue(value, then) {
+  return value && value.then ? value.then(then) : then(value);
 }
 function AuthManagerBrowser_await(value, then, direct) {
   if (direct) {
@@ -3224,22 +3484,12 @@ function AuthManagerBrowser_async(f) {
     }
   };
 }
-function AuthManagerBrowser_invokeIgnored(body) {
+function AuthManagerBrowser_invoke(body, then) {
   var result = body();
   if (result && result.then) {
-    return result.then(AuthManagerBrowser_empty);
-  }
-}
-function AuthManagerBrowser_catch(body, recover) {
-  try {
-    var result = body();
-  } catch (e) {
-    return recover(e);
-  }
-  if (result && result.then) {
-    return result.then(void 0, recover);
+    return result.then(then);
   }
-  return result;
+  return then(result);
 }
 function AuthManagerBrowser_rethrow(thrown, value) {
   if (thrown) throw value;
@@ -3256,44 +3506,43 @@ function AuthManagerBrowser_finallyRethrows(body, finalizer) {
   }
   return finalizer(false, result);
 }
-function AuthManagerBrowser_continueIgnored(value) {
-  if (value && value.then) {
-    return value.then(AuthManagerBrowser_empty);
-  }
-}
-function AuthManagerBrowser_call(body, then, direct) {
-  if (direct) {
-    return then ? then(body()) : body();
-  }
-  try {
-    var result = Promise.resolve(body());
-    return then ? result.then(then) : result;
-  } catch (e) {
-    return Promise.reject(e);
-  }
-}
-function AuthManagerBrowser_continue(value, then) {
-  return value && value.then ? value.then(then) : then(value);
-}
 function AuthManagerBrowser_defineProperty(e, r, t) { return (r = AuthManagerBrowser_toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
-function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = AuthManagerBrowser_unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
 function AuthManagerBrowser_toConsumableArray(r) { return AuthManagerBrowser_arrayWithoutHoles(r) || AuthManagerBrowser_iterableToArray(r) || AuthManagerBrowser_unsupportedIterableToArray(r) || AuthManagerBrowser_nonIterableSpread(); }
 function AuthManagerBrowser_nonIterableSpread() { throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
-function AuthManagerBrowser_unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return AuthManagerBrowser_arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? AuthManagerBrowser_arrayLikeToArray(r, a) : void 0; } }
 function AuthManagerBrowser_iterableToArray(r) { if ("undefined" != typeof Symbol && null != r[Symbol.iterator] || null != r["@@iterator"]) return Array.from(r); }
 function AuthManagerBrowser_arrayWithoutHoles(r) { if (Array.isArray(r)) return AuthManagerBrowser_arrayLikeToArray(r); }
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = AuthManagerBrowser_unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function AuthManagerBrowser_unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return AuthManagerBrowser_arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? AuthManagerBrowser_arrayLikeToArray(r, a) : void 0; } }
 function AuthManagerBrowser_arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 function AuthManagerBrowser_typeof(o) { "@babel/helpers - typeof"; return AuthManagerBrowser_typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, AuthManagerBrowser_typeof(o); }
-function AuthManagerBrowser_classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
 function AuthManagerBrowser_defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, AuthManagerBrowser_toPropertyKey(o.key), o); } }
 function AuthManagerBrowser_createClass(e, r, t) { return r && AuthManagerBrowser_defineProperties(e.prototype, r), t && AuthManagerBrowser_defineProperties(e, t), Object.defineProperty(e, "prototype", { writable: !1 }), e; }
 function AuthManagerBrowser_toPropertyKey(t) { var i = AuthManagerBrowser_toPrimitive(t, "string"); return "symbol" == AuthManagerBrowser_typeof(i) ? i : i + ""; }
 function AuthManagerBrowser_toPrimitive(t, r) { if ("object" != AuthManagerBrowser_typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != AuthManagerBrowser_typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
+function AuthManagerBrowser_classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
+function AuthManagerBrowser_callSuper(t, o, e) { return o = AuthManagerBrowser_getPrototypeOf(o), AuthManagerBrowser_possibleConstructorReturn(t, AuthManagerBrowser_isNativeReflectConstruct() ? Reflect.construct(o, e || [], AuthManagerBrowser_getPrototypeOf(t).constructor) : o.apply(t, e)); }
+function AuthManagerBrowser_possibleConstructorReturn(t, e) { if (e && ("object" == AuthManagerBrowser_typeof(e) || "function" == typeof e)) return e; if (void 0 !== e) throw new TypeError("Derived constructors may only return object or undefined"); return AuthManagerBrowser_assertThisInitialized(t); }
+function AuthManagerBrowser_assertThisInitialized(e) { if (void 0 === e) throw new ReferenceError("this hasn't been initialised - super() hasn't been called"); return e; }
+function AuthManagerBrowser_inherits(t, e) { if ("function" != typeof e && null !== e) throw new TypeError("Super expression must either be null or a function"); t.prototype = Object.create(e && e.prototype, { constructor: { value: t, writable: !0, configurable: !0 } }), Object.defineProperty(t, "prototype", { writable: !1 }), e && AuthManagerBrowser_setPrototypeOf(t, e); }
+function AuthManagerBrowser_wrapNativeSuper(t) { var r = "function" == typeof Map ? new Map() : void 0; return AuthManagerBrowser_wrapNativeSuper = function _wrapNativeSuper(t) { if (null === t || !AuthManagerBrowser_isNativeFunction(t)) return t; if ("function" != typeof t) throw new TypeError("Super expression must either be null or a function"); if (void 0 !== r) { if (r.has(t)) return r.get(t); r.set(t, Wrapper); } function Wrapper() { return AuthManagerBrowser_construct(t, arguments, AuthManagerBrowser_getPrototypeOf(this).constructor); } return Wrapper.prototype = Object.create(t.prototype, { constructor: { value: Wrapper, enumerable: !1, writable: !0, configurable: !0 } }), AuthManagerBrowser_setPrototypeOf(Wrapper, t); }, AuthManagerBrowser_wrapNativeSuper(t); }
+function AuthManagerBrowser_construct(t, e, r) { if (AuthManagerBrowser_isNativeReflectConstruct()) return Reflect.construct.apply(null, arguments); var o = [null]; o.push.apply(o, e); var p = new (t.bind.apply(t, o))(); return r && AuthManagerBrowser_setPrototypeOf(p, r.prototype), p; }
+function AuthManagerBrowser_isNativeReflectConstruct() { try { var t = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function () {})); } catch (t) {} return (AuthManagerBrowser_isNativeReflectConstruct = function _isNativeReflectConstruct() { return !!t; })(); }
+function AuthManagerBrowser_isNativeFunction(t) { try { return -1 !== Function.toString.call(t).indexOf("[native code]"); } catch (n) { return "function" == typeof t; } }
+function AuthManagerBrowser_setPrototypeOf(t, e) { return AuthManagerBrowser_setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function (t, e) { return t.__proto__ = e, t; }, AuthManagerBrowser_setPrototypeOf(t, e); }
+function AuthManagerBrowser_getPrototypeOf(t) { return AuthManagerBrowser_getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf.bind() : function (t) { return t.__proto__ || Object.getPrototypeOf(t); }, AuthManagerBrowser_getPrototypeOf(t); }
 
 
 
 
 
+var InvalidAuthTokenError = /*#__PURE__*/function (_Error) {
+  function InvalidAuthTokenError() {
+    AuthManagerBrowser_classCallCheck(this, InvalidAuthTokenError);
+    return AuthManagerBrowser_callSuper(this, InvalidAuthTokenError, arguments);
+  }
+  AuthManagerBrowser_inherits(InvalidAuthTokenError, _Error);
+  return AuthManagerBrowser_createClass(InvalidAuthTokenError);
+}(/*#__PURE__*/AuthManagerBrowser_wrapNativeSuper(Error));
 var AuthManagerImpl = /*#__PURE__*/function () {
   function AuthManagerImpl(serviceWorkerUtils) {
     AuthManagerBrowser_classCallCheck(this, AuthManagerImpl);
@@ -3317,53 +3566,71 @@ var AuthManagerImpl = /*#__PURE__*/function () {
   }, {
     key: "isAuthSessionReady",
     value: function isAuthSessionReady() {
-      var _a;
+      var _this = this;
       var session = AuthSessionState.getSession();
-      return (_a = session === null || session === void 0 ? void 0 : session.isReady) !== null && _a !== void 0 ? _a : (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
+      if (session !== undefined && Array.isArray(session.authConfigs)) {
+        return session.isReady === true && session.authConfigs.every(function (state) {
+          return _this.isConfigUsable(state);
+        });
+      }
+      return (session === null || session === void 0 ? void 0 : session.accessToken) !== undefined;
     }
   }, {
     key: "beginAuthSession",
     value: function beginAuthSession(params) {
       try {
-        var _this = this;
-        return AuthManagerBrowser_await(_this.authSessionMutex.safe(AuthManagerBrowser_async(function () {
-          // We check both 'session' and 'sessionDisposing' here, as we don't want to call 'beginAuthSession' until the session is fully disposed.
-          if (_this.isAuthSessionActive()) {
+        var _this2 = this;
+        var _a;
+        return AuthManagerBrowser_await(_this2.authSessionMutex.safe(AuthManagerBrowser_async(function () {
+          var _a, _b;
+          if (_this2.isAuthSessionActive()) {
             throw new Error("Auth session already active. Please call 'await endAuthSession()' and then call 'await beginAuthSession(...)' to start a new auth session.");
           }
-          var canUseServiceWorkers = _this.serviceWorkerUtils.canUseServiceWorkers();
-          if (params.serviceWorkerConfig !== undefined) {
-            if (params.serviceWorkerScript === undefined) {
-              throw new Error("The 'serviceWorkerScript' field is required when 'serviceWorkerConfig' is provided.");
-            }
-            if (!canUseServiceWorkers) {
-              throw new Error("The 'serviceWorkerConfig' field requires service workers, but this browser does not support them.");
-            }
+          if (Object.prototype.hasOwnProperty.call(params, "authConfigs") && typeof params.authConfigs !== "function") {
+            throw new Error("The 'authConfigs' field must be a callback returning a non-empty array.");
           }
-          var newSession = {
-            accessToken: undefined,
-            accessTokenRefreshHandle: undefined,
-            params: params,
-            isActive: true,
-            isReady: false,
-            authServiceWorker: params.serviceWorkerScript !== undefined && canUseServiceWorkers ? {
-              serviceWorkerScript: params.serviceWorkerScript,
-              type: "Uninitialized"
-            } : undefined,
-            primaryAuthSwConfig: undefined,
-            serviceWorkerConfig: undefined,
-            serviceWorkerConfigRefreshHandle: undefined
-          };
-          AuthSessionState.setSession(newSession);
-          return newSession;
+          var isV2 = _this2.isV2Params(params);
+          return AuthManagerBrowser_await(isV2 ? _this2.getV2Configs(params) : [_this2.normalizeV1Config(params)], function (configs) {
+            var canUseServiceWorkers = _this2.serviceWorkerUtils.canUseServiceWorkers();
+            var requiresServiceWorker = configs.some(function (config) {
+              return config !== null && AuthManagerBrowser_typeof(config) === "object" && _this2.isServiceWorkerEnabled(config);
+            }) || isV2 && ((_b = (_a = params.urlRewriteRules) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0;
+            _this2.validateSessionConfig(params, configs, canUseServiceWorkers, requiresServiceWorker);
+            var newSession = {
+              accessToken: undefined,
+              accessTokenRefreshHandle: undefined,
+              authConfigs: configs.map(function (config) {
+                return {
+                  accessToken: undefined,
+                  config: config,
+                  expiresAt: undefined,
+                  jwt: undefined,
+                  refreshHandle: undefined
+                };
+              }),
+              authServiceWorker: requiresServiceWorker && params.serviceWorkerScript !== undefined && canUseServiceWorkers ? {
+                serviceWorkerScript: params.serviceWorkerScript,
+                type: "Uninitialized"
+              } : undefined,
+              isActive: true,
+              isReady: false,
+              params: params,
+              serviceWorkerConfigured: false
+            };
+            AuthSessionState.setSession(newSession);
+            return newSession;
+          }, !isV2);
         })), function (session) {
-          // IMPORTANT: must be called outside the above, else re-entrant deadlock will occur.
-          return AuthManagerBrowser_invoke(function () {
-            if (session.params.serviceWorkerConfig !== undefined) {
-              return AuthManagerBrowser_awaitIgnored(_this.refreshServiceWorkerConfig(session, session.params));
-            }
-          }, function () {
-            return AuthManagerBrowser_awaitIgnored(_this.refreshAccessToken(session, session.params));
+          return AuthManagerBrowser_catch(function () {
+            return AuthManagerBrowser_continueIgnored(AuthManagerBrowser_forOf((_a = session.authConfigs) !== null && _a !== void 0 ? _a : [], function (config) {
+              return AuthManagerBrowser_awaitIgnored(_this2.refreshAuthConfig(session, config, _this2.isV2Params(session.params)));
+            }));
+          }, function (e) {
+            return AuthManagerBrowser_continue(AuthManagerBrowser_catch(function () {
+              return AuthManagerBrowser_awaitIgnored(_this2.endAuthSession());
+            }, AuthManagerBrowser_empty), function () {
+              throw e;
+            });
           });
         });
       } catch (e) {
@@ -3374,31 +3641,68 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     key: "endAuthSession",
     value: function endAuthSession() {
       try {
-        var _this2 = this;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this2.authSessionMutex.safe(AuthManagerBrowser_async(function () {
+        var _this3 = this;
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this3.authSessionMutex.safe(AuthManagerBrowser_async(function () {
+          var _a, _b, _c;
           var session = AuthSessionState.getSession();
           if (session === undefined) {
             return;
           }
           AuthSessionState.setSession(undefined);
           session.isActive = false;
-          if (session.accessTokenRefreshHandle !== undefined) {
-            _this2.scheduler.unschedule(session.accessTokenRefreshHandle);
-          }
-          if (session.serviceWorkerConfigRefreshHandle !== undefined) {
-            _this2.scheduler.unschedule(session.serviceWorkerConfigRefreshHandle);
+          if (session.authConfigs === undefined) {
+            if (session.accessTokenRefreshHandle !== undefined) {
+              _this3.scheduler.unschedule(session.accessTokenRefreshHandle);
+            }
+          } else {
+            var _iterator = _createForOfIteratorHelper(session.authConfigs),
+              _step;
+            try {
+              for (_iterator.s(); !(_step = _iterator.n()).done;) {
+                var state = _step.value;
+                if (state.refreshHandle !== undefined) {
+                  _this3.scheduler.unschedule(state.refreshHandle);
+                }
+              }
+            } catch (err) {
+              _iterator.e(err);
+            } finally {
+              _iterator.f();
+            }
           }
-          // AuthSessionState is shared between bundled SDK versions. Service-worker-only sessions from 3.56.0 did not
-          // contain an accountId, so allow a newer SDK instance to tear those sessions down without calling this endpoint.
+          var cleanupError;
+          var cookieConfigs = _this3.isV2Params(session.params) ? (_b = (_a = session.authConfigs) === null || _a === void 0 ? void 0 : _a.filter(function (state) {
+            return state.config.enableCookieAuth === true;
+          })) !== null && _b !== void 0 ? _b : [] : (_c = session.authConfigs) !== null && _c !== void 0 ? _c : [];
+          // A 3.54.0 session will not contain authConfigs, but a newer bundle must still be able to end it.
           return AuthManagerBrowser_invoke(function () {
-            if (typeof session.params.accountId === "string") {
-              return AuthManagerBrowser_awaitIgnored(_this2.deleteAccessToken(session.params));
+            if (session.authConfigs === undefined && typeof session.params.accountId === "string") {
+              return AuthManagerBrowser_continueIgnored(AuthManagerBrowser_catch(function () {
+                return AuthManagerBrowser_awaitIgnored(_this3.deleteAccessToken(session.params.options, session.params.accountId));
+              }, function (e) {
+                cleanupError = e;
+              }));
+            } else {
+              return AuthManagerBrowser_continueIgnored(AuthManagerBrowser_forOf(cookieConfigs, function (state) {
+                return AuthManagerBrowser_continueIgnored(AuthManagerBrowser_catch(function () {
+                  return AuthManagerBrowser_awaitIgnored(_this3.deleteAccessToken(session.params.options, state.config.accountId));
+                }, function (e) {
+                  cleanupError !== null && cleanupError !== void 0 ? cleanupError : cleanupError = e;
+                }));
+              }));
             }
           }, function () {
-            return AuthManagerBrowser_invokeIgnored(function () {
+            return AuthManagerBrowser_invoke(function () {
               if (session.authServiceWorker !== undefined) {
-                // Prevent service worker from authorizing subsequent requests.
-                return AuthManagerBrowser_awaitIgnored(_this2.sendServiceWorkerConfig(session, []));
+                return AuthManagerBrowser_continueIgnored(AuthManagerBrowser_catch(function () {
+                  return AuthManagerBrowser_awaitIgnored(_this3.sendServiceWorkerConfig(session, []));
+                }, function (e) {
+                  cleanupError !== null && cleanupError !== void 0 ? cleanupError : cleanupError = e;
+                }));
+              }
+            }, function () {
+              if (cleanupError !== undefined) {
+                throw cleanupError instanceof Error ? cleanupError : new Error(String(cleanupError));
               }
             });
           });
@@ -3408,139 +3712,71 @@ var AuthManagerImpl = /*#__PURE__*/function () {
       }
     }
   }, {
-    key: "refreshAccessToken",
-    value: function refreshAccessToken(session, params) {
+    key: "refreshAuthConfig",
+    value: function refreshAuthConfig(session, state) {
+      var rejectInvalidInitialToken = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
       try {
-        var _this3 = this;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this3.authSessionMutex.safe(AuthManagerBrowser_async(function () {
+        var _this4 = this;
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this4.authSessionMutex.safe(AuthManagerBrowser_async(function () {
+          var _a;
           if (!session.isActive) {
             return;
           }
-          var secondsFromNow = function secondsFromNow(seconds) {
-            return Date.now() + seconds * 1000;
+          if (state.refreshHandle !== undefined) {
+            _this4.scheduler.unschedule(state.refreshHandle);
+          }
+          var previous = {
+            accessToken: state.accessToken,
+            expiresAt: state.expiresAt,
+            jwt: state.jwt,
+            serviceWorkerConfigured: session.serviceWorkerConfigured
           };
-          var expires = secondsFromNow(_this3.retryAuthAfterErrorSeconds);
-          return AuthManagerBrowser_continueIgnored(AuthManagerBrowser_finallyRethrows(function () {
+          var refreshAt = Date.now() + _this4.retryAuthAfterErrorSeconds * 1000;
+          return AuthManagerBrowser_finallyRethrows(function () {
             return AuthManagerBrowser_catch(function () {
-              var _getAccessToken = _this3.getAccessToken;
-              return AuthManagerBrowser_await(params.authHeaders(), function (_params$authHeaders) {
-                return AuthManagerBrowser_await(_getAccessToken.call(_this3, params, _params$authHeaders), function (jwt) {
-                  // We don't use cookie-based auth if the browser supports service worker-based auth, as using both will cause
-                  // confusion for us in the future (i.e. we may question "do we need to use both together? was there a reason?").
-                  // Also: if the user has omitted "allowedOrigins" from their JWT, then service worker-based auth is more secure
-                  // than cookie-based auth, which is another reason to prevent these cookies from being set unless required.
-                  var setCookie = session.authServiceWorker === undefined;
-                  return AuthManagerBrowser_await(_this3.setAccessToken(params, jwt, setCookie), function (setTokenResult) {
-                    return AuthManagerBrowser_invoke(function () {
-                      if (session.authServiceWorker !== undefined) {
-                        var primaryAuthSwConfig = {
-                          headers: [{
-                            key: "Authorization",
-                            value: "Bearer ".concat(jwt)
-                          }],
-                          expires: secondsFromNow(setTokenResult.ttlSeconds),
-                          urlPrefix: "".concat(_this3.getCdnUrl(params), "/").concat(params.accountId, "/")
-                        };
-                        // Fail closed until the initial serviceWorkerConfig callback succeeds: without its result, we do not know
-                        // the source-page restrictions intended for the primary JWT.
-                        return AuthManagerBrowser_invoke(function () {
-                          if (params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined) {
-                            return AuthManagerBrowser_await(_this3.sendMergedServiceWorkerConfig(session, primaryAuthSwConfig, session.serviceWorkerConfig), function () {
-                              return AuthManagerBrowser_awaitIgnored(_this3.waitForServiceWorker());
-                            });
-                          }
-                        }, function () {
-                          session.primaryAuthSwConfig = primaryAuthSwConfig;
+              return AuthManagerBrowser_await(_this4.getAuthorizationToken(session.params, state.config), function (jwt) {
+                var setCookie = _this4.shouldSetCookie(session, state.config);
+                return AuthManagerBrowser_await(_this4.setAccessToken(session.params.options, state.config.accountId, jwt, setCookie), function (token) {
+                  var expiresAt = Date.now() + token.ttlSeconds * 1000;
+                  state.accessToken = token.accessToken;
+                  state.expiresAt = expiresAt;
+                  state.jwt = jwt;
+                  return AuthManagerBrowser_invoke(function () {
+                    if (session.authServiceWorker !== undefined && (_this4.isServiceWorkerEnabled(state.config) || session.serviceWorkerConfigured !== true)) {
+                      return AuthManagerBrowser_await(_this4.sendCurrentServiceWorkerConfig(session), function () {
+                        return AuthManagerBrowser_await(_this4.waitForServiceWorker(), function () {
+                          session.serviceWorkerConfigured = true;
                         });
-                      }
-                    }, function () {
-                      var desiredTtl = setTokenResult.ttlSeconds - _this3.refreshBeforeExpirySeconds;
-                      var actualTtl = Math.max(desiredTtl, _this3.minJwtTtlSeconds);
-                      if (desiredTtl !== actualTtl) {
-                        ConsoleUtils.warn("JWT expiration is too short: waiting for ".concat(actualTtl, " seconds before refreshing."));
-                      }
-                      expires = secondsFromNow(actualTtl);
-                      // Set this at the end, as it's also used to signal 'isAuthSessionReady', so must be set after configuring the Service Worker, etc.
-                      session.accessToken = setTokenResult.accessToken;
-                      _this3.updateSessionReadiness(session);
-                    });
+                      });
+                    }
+                  }, function () {
+                    var desiredTtl = token.ttlSeconds - _this4.refreshBeforeExpirySeconds;
+                    var actualTtl = Math.max(desiredTtl, _this4.minJwtTtlSeconds);
+                    if (desiredTtl !== actualTtl) {
+                      ConsoleUtils.warn("JWT expiration is too short: waiting for ".concat(actualTtl, " seconds before refreshing."));
+                    }
+                    refreshAt = Date.now() + actualTtl * 1000;
                   });
                 });
               });
             }, function (e) {
-              // Use 'warn' instead of 'error' since this happens frequently, i.e. user goes through a tunnel, and some customers report these errors to systems like Sentry, so we don't want to spam.
-              ConsoleUtils.warn("Unable to refresh JWT access token: ".concat(e));
+              state.accessToken = previous.accessToken;
+              state.expiresAt = previous.expiresAt;
+              state.jwt = previous.jwt;
+              session.serviceWorkerConfigured = previous.serviceWorkerConfigured;
+              ConsoleUtils.warn("Unable to refresh JWT access token for auth config '".concat((_a = state.config.authConfigId) !== null && _a !== void 0 ? _a : "default", "': ").concat(e));
+              if (rejectInvalidInitialToken && e instanceof InvalidAuthTokenError) {
+                throw e;
+              }
             });
-          }, function (_wasThrown, _result) {
-            // 'setTimeout' can be paused (e.g., during hibernation), risking JWT expiration before it triggers. We use a
-            // scheduler to check wall-clock time every second and execute the callback at the scheduled time (below).
-            session.accessTokenRefreshHandle = _this3.scheduler.schedule(expires, function () {
-              _this3.refreshAccessToken(session, params).then(function () {},
-              // Should not occur, as this method shouldn't throw errors.
-              function (e) {
+          }, function (_wasThrown, _result2) {
+            state.refreshHandle = _this4.scheduler.schedule(refreshAt, function () {
+              _this4.refreshAuthConfig(session, state).then(function () {}, function (e) {
                 return ConsoleUtils.error("Unexpected error when refreshing JWT access token: ".concat(e));
               });
             });
-            return AuthManagerBrowser_rethrow(_wasThrown, _result);
-          }));
-        }))));
-      } catch (e) {
-        return Promise.reject(e);
-      }
-    }
-  }, {
-    key: "refreshServiceWorkerConfig",
-    value: function refreshServiceWorkerConfig(session, params) {
-      try {
-        var _this4 = this;
-        var getServiceWorkerConfig = params.serviceWorkerConfig;
-        if (getServiceWorkerConfig === undefined) {
-          return AuthManagerBrowser_await();
-        }
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this4.authSessionMutex.safe(AuthManagerBrowser_async(function () {
-          var _exit = false;
-          if (!session.isActive) {
-            return;
-          }
-          var refreshAt;
-          return AuthManagerBrowser_continue(AuthManagerBrowser_catch(function () {
-            return AuthManagerBrowser_call(getServiceWorkerConfig, function (result) {
-              if (result === null || AuthManagerBrowser_typeof(result) !== "object" || !Array.isArray(result.additionalConfig)) {
-                throw new Error("The 'serviceWorkerConfig' callback must return an object containing 'additionalConfig'.");
-              }
-              if (result.sourceUrlPrefixes !== undefined && (!Array.isArray(result.sourceUrlPrefixes) || !result.sourceUrlPrefixes.every(function (prefix) {
-                return typeof prefix === "string";
-              }))) {
-                throw new Error("The 'sourceUrlPrefixes' field returned by 'serviceWorkerConfig' must be an array of strings.");
-              }
-              var config = {
-                additionalConfig: result.additionalConfig,
-                sourceUrlPrefixes: result.sourceUrlPrefixes
-              };
-              return AuthManagerBrowser_invoke(function () {
-                if (session.primaryAuthSwConfig !== undefined) {
-                  return AuthManagerBrowser_await(_this4.sendMergedServiceWorkerConfig(session, session.primaryAuthSwConfig, config), function () {
-                    return AuthManagerBrowser_awaitIgnored(_this4.waitForServiceWorker());
-                  });
-                }
-              }, function () {
-                session.serviceWorkerConfig = config;
-                _this4.updateSessionReadiness(session);
-                refreshAt = _this4.getServiceWorkerConfigRefreshEpoch(config.additionalConfig);
-              });
-            });
-          }, function (e) {
-            ConsoleUtils.warn("Unable to refresh service worker auth config: ".concat(e));
-            refreshAt = Date.now() + _this4.retryAuthAfterErrorSeconds * 1000;
-          }), function (_result2) {
-            if (_exit) return _result2;
-            if (refreshAt !== undefined) {
-              session.serviceWorkerConfigRefreshHandle = _this4.scheduler.schedule(refreshAt, function () {
-                _this4.refreshServiceWorkerConfig(session, params).then(function () {}, function (e) {
-                  return ConsoleUtils.error("Unexpected error when refreshing service worker auth config: ".concat(e));
-                });
-              });
-            }
+            _this4.updateSessionState(session);
+            return AuthManagerBrowser_rethrow(_wasThrown, _result2);
           });
         }))));
       } catch (e) {
@@ -3548,54 +3784,49 @@ var AuthManagerImpl = /*#__PURE__*/function () {
       }
     }
   }, {
-    key: "sendMergedServiceWorkerConfig",
-    value: function sendMergedServiceWorkerConfig(session, primaryConfig, serviceWorkerConfig) {
+    key: "sendCurrentServiceWorkerConfig",
+    value: function sendCurrentServiceWorkerConfig(session) {
       try {
         var _this5 = this;
         var _a;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this5.sendServiceWorkerConfig(session, [Object.assign(Object.assign({}, primaryConfig), {
-          sourceUrlPrefixes: serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.sourceUrlPrefixes
-        })].concat(AuthManagerBrowser_toConsumableArray((_a = serviceWorkerConfig === null || serviceWorkerConfig === void 0 ? void 0 : serviceWorkerConfig.additionalConfig) !== null && _a !== void 0 ? _a : [])))));
+        var now = Date.now();
+        var config = ((_a = session.authConfigs) !== null && _a !== void 0 ? _a : []).flatMap(function (state) {
+          if (!_this5.isServiceWorkerEnabled(state.config) || state.jwt === undefined || state.expiresAt === undefined || state.expiresAt <= now) {
+            return [];
+          }
+          return [{
+            expires: state.expiresAt,
+            headers: [{
+              key: "Authorization",
+              value: "Bearer ".concat(state.jwt)
+            }],
+            sourceUrlPrefixes: state.config.sourceUrlPrefixes,
+            urlPrefix: "".concat(_this5.getCdnUrl(session.params), "/").concat(state.config.accountId, "/")
+          }];
+        });
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(_this5.sendServiceWorkerConfig(session, config, _this5.isV2Params(session.params) ? session.params.urlRewriteRules : undefined)));
       } catch (e) {
         return Promise.reject(e);
       }
     }
-  }, {
-    key: "getServiceWorkerConfigRefreshEpoch",
-    value: function getServiceWorkerConfigRefreshEpoch(config) {
-      var earliestExpiry;
-      var _iterator = _createForOfIteratorHelper(config),
-        _step;
-      try {
-        for (_iterator.s(); !(_step = _iterator.n()).done;) {
-          var entry = _step.value;
-          if (entry.expires !== undefined && (earliestExpiry === undefined || entry.expires < earliestExpiry)) {
-            earliestExpiry = entry.expires;
-          }
-        }
-      } catch (err) {
-        _iterator.e(err);
-      } finally {
-        _iterator.f();
-      }
-      return earliestExpiry === undefined ? undefined : earliestExpiry - this.refreshBeforeExpirySeconds * 1000;
-    }
   }, {
     key: "sendServiceWorkerConfig",
-    value: function sendServiceWorkerConfig(session, config) {
+    value: function sendServiceWorkerConfig(session, config, urlRewriteRules) {
       try {
         var _this6 = this;
         if (session.authServiceWorker === undefined) {
           throw new Error("Service worker configuration cannot be applied because service workers are unavailable.");
         }
-        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage({
+        return AuthManagerBrowser_await(_this6.serviceWorkerUtils.sendMessage(Object.assign({
           type: "SET_BYTESCALE_AUTH_CONFIG",
           config: config.map(function (entry) {
             return Object.assign(Object.assign({}, entry), {
               urlPrefix: "".concat(entry.sourceUrlPrefixes === undefined ? "" : _this6.sourceScopedUrlPrefixMarker).concat(entry.urlPrefix)
             });
           })
-        }, session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
+        }, urlRewriteRules === undefined ? {} : {
+          urlRewriteRules: urlRewriteRules
+        }), session.authServiceWorker, _this6.serviceWorkerScriptFieldName), function (_this6$serviceWorkerU) {
           session.authServiceWorker = _this6$serviceWorkerU;
         });
       } catch (e) {
@@ -3603,16 +3834,169 @@ var AuthManagerImpl = /*#__PURE__*/function () {
       }
     }
   }, {
-    key: "updateSessionReadiness",
-    value: function updateSessionReadiness(session) {
-      session.isReady = session.accessToken !== undefined && (session.params.serviceWorkerConfig === undefined || session.serviceWorkerConfig !== undefined);
+    key: "getV2Configs",
+    value: function getV2Configs(params) {
+      try {
+        return AuthManagerBrowser_await(params.authConfigs(), function (configs) {
+          if (!Array.isArray(configs) || configs.length === 0) {
+            throw new Error("The 'authConfigs' callback must return a non-empty array.");
+          }
+          return configs.map(function (config) {
+            return config === null || AuthManagerBrowser_typeof(config) !== "object" ? config : Object.assign(Object.assign({}, config), {
+              sourceUrlPrefixes: Array.isArray(config.sourceUrlPrefixes) ? AuthManagerBrowser_toConsumableArray(config.sourceUrlPrefixes) : config.sourceUrlPrefixes
+            });
+          });
+        });
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    }
+  }, {
+    key: "normalizeV1Config",
+    value: function normalizeV1Config(params) {
+      return {
+        accountId: params.accountId,
+        authConfigId: undefined,
+        authHeaders: params.authHeaders,
+        authUrl: params.authUrl,
+        enableCookieAuth: params.serviceWorkerScript === undefined,
+        enableServiceWorkerAuth: params.serviceWorkerScript !== undefined
+      };
+    }
+  }, {
+    key: "validateSessionConfig",
+    value: function validateSessionConfig(params, configs, canUseServiceWorkers, requiresServiceWorker) {
+      var isV2 = this.isV2Params(params);
+      if (isV2 && (params.accountId !== undefined || params.authHeaders !== undefined || params.authUrl !== undefined)) {
+        throw new Error("V2 auth sessions must use 'authConfigs' instead of top-level auth fields.");
+      }
+      var ids = new Set();
+      var cookieConfig;
+      var workerConfigsByPrefix = new Map();
+      var _iterator2 = _createForOfIteratorHelper(configs),
+        _step2;
+      try {
+        for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
+          var config = _step2.value;
+          if (config === null || AuthManagerBrowser_typeof(config) !== "object") {
+            throw new Error("Each auth configuration must be an object.");
+          }
+          if (!Object.prototype.hasOwnProperty.call(config, "authConfigId")) {
+            throw new Error("Each auth configuration must explicitly provide 'authConfigId'.");
+          }
+          if (config.authConfigId !== undefined && typeof config.authConfigId !== "string") {
+            throw new Error("The 'authConfigId' field must be a string or undefined.");
+          }
+          if (ids.has(config.authConfigId)) {
+            throw new Error(config.authConfigId === undefined ? "Only one default auth configuration is allowed." : "Duplicate auth configuration ID: '".concat(config.authConfigId, "'."));
+          }
+          ids.add(config.authConfigId);
+          if (isV2 && !this.isValidAccountId(config.accountId)) {
+            throw new Error("Invalid Bytescale account ID: '".concat(String(config.accountId), "'."));
+          }
+          if (config.enableCookieAuth !== undefined && typeof config.enableCookieAuth !== "boolean" || config.enableServiceWorkerAuth !== undefined && typeof config.enableServiceWorkerAuth !== "boolean") {
+            throw new Error("Authentication enablement flags must be booleans when provided.");
+          }
+          if (config.sourceUrlPrefixes !== undefined && (!Array.isArray(config.sourceUrlPrefixes) || !config.sourceUrlPrefixes.every(function (prefix) {
+            return typeof prefix === "string";
+          }))) {
+            throw new Error("The 'sourceUrlPrefixes' field must be an array of strings.");
+          }
+          var isManual = typeof config.getAuthorizationToken === "function";
+          var isAutomatic = typeof config.authUrl === "string" && typeof config.authHeaders === "function";
+          if (isManual === isAutomatic || isManual && (config.authUrl !== undefined || config.authHeaders !== undefined)) {
+            throw new Error("Each auth configuration must provide either 'getAuthorizationToken' or both 'authUrl' and 'authHeaders'.");
+          }
+          if (config.enableCookieAuth === true) {
+            if (cookieConfig !== undefined) {
+              throw new Error("Only one auth configuration may enable cookie authentication.");
+            }
+            cookieConfig = config;
+          }
+          if (this.isServiceWorkerEnabled(config)) {
+            var _prefix = "".concat(this.getCdnUrl(params), "/").concat(config.accountId, "/");
+            if (workerConfigsByPrefix.has(_prefix)) {
+              throw new Error("Multiple service-worker auth configurations target the same URL prefix: '".concat(_prefix, "'."));
+            }
+            workerConfigsByPrefix.set(_prefix, config);
+          }
+        }
+      } catch (err) {
+        _iterator2.e(err);
+      } finally {
+        _iterator2.f();
+      }
+      if (cookieConfig !== undefined) {
+        var prefix = "".concat(this.getCdnUrl(params), "/").concat(cookieConfig.accountId, "/");
+        var workerConfig = workerConfigsByPrefix.get(prefix);
+        if (workerConfig !== undefined && workerConfig !== cookieConfig) {
+          throw new Error("Cookie and service-worker authentication cannot target the same account from different configs.");
+        }
+      }
+      if (isV2) {
+        this.validateUrlRewriteRules(params.urlRewriteRules);
+        if (requiresServiceWorker && params.serviceWorkerScript === undefined) {
+          throw new Error("The 'serviceWorkerScript' field is required when service-worker authentication or URL rewriting is enabled.");
+        }
+        if (requiresServiceWorker && !canUseServiceWorkers) {
+          throw new Error("This auth session requires service workers, but this browser does not support them.");
+        }
+      }
+    }
+  }, {
+    key: "validateUrlRewriteRules",
+    value: function validateUrlRewriteRules(rules) {
+      if (rules !== undefined && (!Array.isArray(rules) || !rules.every(function (rule) {
+        return rule !== null && AuthManagerBrowser_typeof(rule) === "object" && typeof rule.fromUrlPrefix === "string" && typeof rule.toUrlPrefix === "string";
+      }))) {
+        throw new Error("The 'urlRewriteRules' field must be an array of URL rewrite rules.");
+      }
+    }
+  }, {
+    key: "updateSessionState",
+    value: function updateSessionState(session) {
+      var _this7 = this;
+      var _a;
+      var configs = (_a = session.authConfigs) !== null && _a !== void 0 ? _a : [];
+      var defaultConfig = configs.find(function (state) {
+        return state.config.authConfigId === undefined;
+      });
+      var exposeLegacyDefault = !this.isV2Params(session.params);
+      session.accessToken = exposeLegacyDefault && defaultConfig !== undefined && this.isConfigUsable(defaultConfig) ? defaultConfig.accessToken : undefined;
+      session.accessTokenRefreshHandle = exposeLegacyDefault ? defaultConfig === null || defaultConfig === void 0 ? void 0 : defaultConfig.refreshHandle : undefined;
+      session.isReady = configs.length > 0 && configs.every(function (state) {
+        return _this7.isConfigUsable(state);
+      }) && (session.authServiceWorker === undefined || session.serviceWorkerConfigured === true);
+    }
+  }, {
+    key: "isConfigUsable",
+    value: function isConfigUsable(state) {
+      return (state === null || state === void 0 ? void 0 : state.accessToken) !== undefined && state.expiresAt !== undefined && state.expiresAt > Date.now();
+    }
+  }, {
+    key: "isServiceWorkerEnabled",
+    value: function isServiceWorkerEnabled(config) {
+      return config.enableServiceWorkerAuth !== false;
+    }
+  }, {
+    key: "isV2Params",
+    value: function isV2Params(params) {
+      return typeof params.authConfigs === "function";
+    }
+  }, {
+    key: "isValidAccountId",
+    value: function isValidAccountId(accountId) {
+      return typeof accountId === "string" && /^[1-9A-HJ-NP-Za-km-z]{7}$/.test(accountId);
+    }
+  }, {
+    key: "shouldSetCookie",
+    value: function shouldSetCookie(session, config) {
+      return this.isV2Params(session.params) ? config.enableCookieAuth === true : session.authServiceWorker === undefined;
     }
   }, {
     key: "waitForServiceWorker",
     value: function waitForServiceWorker() {
       try {
-        // Message delivery is asynchronous and has no acknowledgement, so allow the worker time to apply the config before
-        // beginAuthSession reports that authenticated requests are ready.
         return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(new Promise(function (resolve) {
           return setTimeout(resolve, 100);
         })));
@@ -3622,8 +4006,8 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "getAccessTokenUrl",
-    value: function getAccessTokenUrl(params, setCookie) {
-      return "".concat(this.getCdnUrl(params), "/api/v1/access_tokens/").concat(params.accountId, "?set-cookie=").concat(setCookie ? "true" : "false");
+    value: function getAccessTokenUrl(options, accountId, setCookie) {
+      return "".concat(BytescaleApiClientConfigUtils.getCdnUrl(options !== null && options !== void 0 ? options : {}), "/api/v1/access_tokens/").concat(accountId, "?set-cookie=").concat(setCookie ? "true" : "false");
     }
   }, {
     key: "getCdnUrl",
@@ -3633,17 +4017,16 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "deleteAccessToken",
-    value: function deleteAccessToken(params) {
+    value: function deleteAccessToken(options, accountId) {
       try {
-        var _this7 = this;
-        var _a;
-        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this7.getAccessTokenUrl(params, true), {
+        var _this8 = this;
+        return AuthManagerBrowser_await(AuthManagerBrowser_awaitIgnored(BaseAPI.fetch(_this8.getAccessTokenUrl(options, accountId, true), {
           method: "DELETE",
           credentials: "include",
           headers: {}
         }, {
           isBytescaleApi: true,
-          fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
+          fetchApi: options === null || options === void 0 ? void 0 : options.fetchApi
         })));
       } catch (e) {
         return Promise.reject(e);
@@ -3651,68 +4034,96 @@ var AuthManagerImpl = /*#__PURE__*/function () {
     }
   }, {
     key: "setAccessToken",
-    value: function setAccessToken(params, jwt, setCookie) {
+    value: function setAccessToken(options, accountId, jwt, setCookie) {
       try {
-        var _this8 = this;
-        var _a;
+        var _this9 = this;
         var request = {
           accessToken: jwt
         };
-        return AuthManagerBrowser_await(BaseAPI.fetch(_this8.getAccessTokenUrl(params, setCookie), {
+        return AuthManagerBrowser_await(BaseAPI.fetch(_this9.getAccessTokenUrl(options, accountId, setCookie), {
           method: "PUT",
           credentials: "include",
-          headers: AuthManagerBrowser_defineProperty({}, _this8.contentType, _this8.contentTypeJson),
+          headers: AuthManagerBrowser_defineProperty({}, _this9.contentType, _this9.contentTypeJson),
           body: JSON.stringify(request)
         }, {
           isBytescaleApi: true,
-          fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
+          fetchApi: options === null || options === void 0 ? void 0 : options.fetchApi
         }), function (response) {
-          return AuthManagerBrowser_await(response.json());
+          return AuthManagerBrowser_await(response.json(), function (result) {
+            if (typeof result.accessToken !== "string" || result.accessToken.length === 0 || typeof result.ttlSeconds !== "number" || !Number.isFinite(result.ttlSeconds) || result.ttlSeconds <= 0) {
+              throw new Error("Bytescale returned an invalid access-token registration response.");
+            }
+            return result;
+          });
         });
       } catch (e) {
         return Promise.reject(e);
       }
     }
   }, {
-    key: "getAccessToken",
-    value: function getAccessToken(params, headers) {
+    key: "getAuthorizationToken",
+    value: function getAuthorizationToken(params, config) {
       try {
-        var _this9 = this;
+        var _exit = false;
+        var _this0 = this;
         var _a, _b;
-        var endpointName = "Your auth API endpoint";
-        var requiredContentType = _this9.contentTypeText;
-        return AuthManagerBrowser_await(BaseAPI.fetch(params.authUrl, {
-          method: "GET",
-          headers: headers
-        }, {
-          isBytescaleApi: false,
-          fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
-        }), function (result) {
-          var actualContentType = (_b = result.headers.get(_this9.contentType)) !== null && _b !== void 0 ? _b : "";
-          // Support content types like "text/plain; charset=utf-8" and "text/plain"
-          if (actualContentType.split(";")[0] !== requiredContentType) {
-            throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this9.contentType, " response header, but the Bytescale SDK requires \"").concat(requiredContentType, "\"."));
+        return AuthManagerBrowser_await(AuthManagerBrowser_invoke(function () {
+          if (typeof config.getAuthorizationToken === "function") {
+            var _validateJwt = _this0.validateJwt;
+            return AuthManagerBrowser_await(config.getAuthorizationToken(), function (_config$getAuthorizat) {
+              var _this0$validateJwt = _validateJwt.call(_this0, _config$getAuthorizat, "The 'getAuthorizationToken' callback");
+              _exit = true;
+              return _this0$validateJwt;
+            });
           }
-          return AuthManagerBrowser_await(result.text(), function (jwt) {
-            if (jwt.length === 0) {
-              throw new Error("".concat(endpointName, " returned an empty string. Please return a valid JWT instead."));
-            }
-            if (jwt.trim().length !== jwt.length) {
-              // Whitespace can be a nightmare to spot/debug, so we fail early here.
-              throw new Error("".concat(endpointName, " returned whitespace around the JWT, please remove it."));
-            }
-            return jwt;
+        }, function (_result3) {
+          if (_exit) return _result3;
+          var endpointName = "Your auth API endpoint";
+          var _fetch = BaseAPI.fetch,
+            _config$authUrl = config.authUrl;
+          return AuthManagerBrowser_await(config.authHeaders(), function (_config$authHeaders) {
+            return AuthManagerBrowser_await(_fetch.call(BaseAPI, _config$authUrl, {
+              method: "GET",
+              headers: _config$authHeaders
+            }, {
+              isBytescaleApi: false,
+              fetchApi: (_a = params.options) === null || _a === void 0 ? void 0 : _a.fetchApi
+            }), function (result) {
+              var actualContentType = (_b = result.headers.get(_this0.contentType)) !== null && _b !== void 0 ? _b : "";
+              if (actualContentType.split(";")[0] !== _this0.contentTypeText) {
+                throw new Error("".concat(endpointName, " returned \"").concat(actualContentType, "\" for the ").concat(_this0.contentType, " response header, but the Bytescale SDK requires \"").concat(_this0.contentTypeText, "\"."));
+              }
+              var _validateJwt2 = _this0.validateJwt;
+              return AuthManagerBrowser_await(result.text(), function (_result$text) {
+                return _validateJwt2.call(_this0, _result$text, endpointName);
+              });
+            });
           });
-        });
+        }));
       } catch (e) {
         return Promise.reject(e);
       }
     }
+  }, {
+    key: "validateJwt",
+    value: function validateJwt(jwt, source) {
+      if (typeof jwt !== "string" || jwt.length === 0) {
+        throw new InvalidAuthTokenError("".concat(source, " returned an empty or malformed token. Please return a valid JWT instead."));
+      }
+      if (jwt.trim().length !== jwt.length) {
+        throw new InvalidAuthTokenError("".concat(source, " returned whitespace around the JWT, please remove it."));
+      }
+      var parts = jwt.split(".");
+      if (parts.length !== 3 || parts.some(function (part) {
+        return part.length === 0 || !/^[A-Za-z0-9_-]+$/.test(part);
+      })) {
+        throw new InvalidAuthTokenError("".concat(source, " returned a malformed JWT."));
+      }
+      return jwt;
+    }
   }]);
 }();
-/**
- * Alternative way of implementing a static class (i.e. all methods static). We do this so we can use a interface on the class (interfaces can't define static methods).
- */
+/** Alternative to a static class that allows the implementation to satisfy an interface. */
 var AuthManager = new AuthManagerImpl(new ServiceWorkerUtils());
 ;// ./src/public/browser/index.ts