@c1m-public/platform-auth 0.14.0 → 0.14.1

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-C-wuZVM9.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-DExfJ-AE.js';

package/dist/access/index.js

@@ -109,7 +109,9 @@ var AccessSnapshotError = class extends Error {
   }
 };
 function isAccessSnapshotError(error, code) {
-  return error instanceof AccessSnapshotError && (code === void 0 || error.code === code);
+  if (typeof error !== "object" || error === null) return false;
+  const candidate = error;
+  return candidate.name === "AccessSnapshotError" && typeof candidate.message === "string" && (candidate.code === "unauthenticated" || candidate.code === "forbidden" || candidate.code === "unavailable" || candidate.code === "invalid_snapshot") && (candidate.status === void 0 || Number.isInteger(candidate.status) && candidate.status >= 100 && candidate.status <= 599) && (code === void 0 || candidate.code === code);
 }
 
 // src/access/snapshot.ts

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-C-wuZVM9.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-C-wuZVM9.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-DExfJ-AE.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-DExfJ-AE.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -61,7 +61,9 @@ var AccessSnapshotError = class extends Error {
   }
 };
 function isAccessSnapshotError(error, code) {
-  return error instanceof AccessSnapshotError && (code === void 0 || error.code === code);
+  if (typeof error !== "object" || error === null) return false;
+  const candidate = error;
+  return candidate.name === "AccessSnapshotError" && typeof candidate.message === "string" && (candidate.code === "unauthenticated" || candidate.code === "forbidden" || candidate.code === "unavailable" || candidate.code === "invalid_snapshot") && (candidate.status === void 0 || Number.isInteger(candidate.status) && candidate.status >= 100 && candidate.status <= 599) && (code === void 0 || candidate.code === code);
 }
 
 // ../transport/src/forwarding.ts

package/dist/{index-C-wuZVM9.d.ts → index-DExfJ-AE.d.ts}

@@ -36,6 +36,7 @@ declare class AccessSnapshotError extends Error {
     readonly status: number | undefined;
     constructor(code: AccessErrorCode, message: string, status?: number);
 }
+/** Class identity is not shared by /access and /access/next (or duplicate installs). */
 declare function isAccessSnapshotError(error: unknown, code?: AccessErrorCode): error is AccessSnapshotError;
 
 /** Scope a permission entry applies to. Mirrors c1m-server authz.Scope*. */

package/dist/next.d.ts

@@ -30,7 +30,7 @@ declare class PlatformServerFetchError extends Error {
 declare const isSessionExpiredError: (error: unknown) => error is SessionExpiredError;
 declare const isRecentAuthenticationRequiredError: (error: unknown) => error is RecentAuthenticationRequiredError;
 declare const isSSOReauthenticationRequiredError: (error: unknown) => error is SSOReauthenticationRequiredError;
-declare const isPlatformServerFetchError: (error: unknown) => error is PlatformServerFetchError;
+declare function isPlatformServerFetchError(error: unknown): error is PlatformServerFetchError;
 /** Map a 401 body's `code` onto the session error it means. */
 declare function authenticationErrorFor(code: unknown): SessionExpiredError | RecentAuthenticationRequiredError | SSOReauthenticationRequiredError;
 /**

package/dist/next.js

@@ -595,23 +595,28 @@ var PlatformServerFetchError = class extends Error {
   code;
   requestId;
 };
-var named = (error, name) => typeof error === "object" && error !== null && error.name === name;
+var named = (error, name) => typeof error === "object" && error !== null && error.name === name && typeof error.message === "string";
 var isSessionExpiredError = (error) => named(error, "SessionExpiredError");
 var isRecentAuthenticationRequiredError = (error) => named(error, "RecentAuthenticationRequiredError");
 var isSSOReauthenticationRequiredError = (error) => named(error, "SSOReauthenticationRequiredError");
-var isPlatformServerFetchError = (error) => named(error, "PlatformServerFetchError");
+function isPlatformServerFetchError(error) {
+  if (!named(error, "PlatformServerFetchError")) return false;
+  const candidate = error;
+  return typeof candidate.path === "string" && (candidate.status === void 0 || Number.isInteger(candidate.status) && candidate.status >= 100 && candidate.status <= 599) && (candidate.code === void 0 || typeof candidate.code === "string") && (candidate.requestId === void 0 || typeof candidate.requestId === "string");
+}
 function authenticationErrorFor(code) {
   if (code === "sso_reauthentication_required") return new SSOReauthenticationRequiredError();
   if (code === "recent_authentication_required") return new RecentAuthenticationRequiredError();
   return new SessionExpiredError();
 }
 function isControlAPIErrorLike(error) {
-  return typeof error === "object" && error !== null && error.name === "ControlAPIError" && typeof error.status === "number" && typeof error.code === "string" && typeof error.requestId === "string";
+  return typeof error === "object" && error !== null && error.name === "ControlAPIError" && typeof error.message === "string" && typeof error.status === "number" && typeof error.code === "string" && typeof error.requestId === "string";
 }
 function mapControlError(error) {
   if (!isControlAPIErrorLike(error)) return error;
   if (error.status === 401) return authenticationErrorFor(error.code);
-  return new PlatformServerFetchError(error.message, "control API", error.status, error.code, error.requestId);
+  const status = Number.isInteger(error.status) && error.status >= 400 && error.status <= 599 ? error.status : error.code === "control_request_timeout" ? 504 : 502;
+  return new PlatformServerFetchError(error.message, "control API", status, error.code, error.requestId);
 }
 async function controlRequest(run) {
   try {
@@ -652,7 +657,7 @@ function createPlatformFetch(config) {
         signal: init?.signal ? AbortSignal.any([init.signal, deadline]) : deadline
       });
     } catch (error) {
-      if (error instanceof PlatformServerFetchError) throw error;
+      if (isPlatformServerFetchError(error)) throw error;
       if (isTimeout(error)) throw new PlatformServerFetchError("Platform service timed out", path, 504, "upstream_timeout");
       throw new PlatformServerFetchError("Platform service is unavailable", path);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",