@c1m-public/platform-auth 0.14.0 → 0.15.0

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-C-wuZVM9.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-D7Y5nD3s.js';

package/dist/access/index.js

@@ -41,20 +41,33 @@ var PLATFORM_PERMISSIONS = [
   "platform.users.view"
 ];
 var DASH_PERMISSIONS = [
+  "dash.activity.view",
   "dash.apps.manage",
+  "dash.apps.view",
   "dash.billing.manage",
   "dash.billing.view",
   "dash.channels.manage",
   "dash.customers.manage",
+  "dash.customers.view",
   "dash.domains.manage",
   "dash.domains.view",
+  "dash.leads.export",
+  "dash.leads.view",
+  "dash.learning.records.view",
+  "dash.learning.view",
+  "dash.marketing.view",
   "dash.mcp.access",
   "dash.members.manage",
+  "dash.members.view",
+  "dash.ops_library.view",
+  "dash.overview.view",
   "dash.ownership.transfer",
   "dash.plans.manage",
   "dash.plans.view",
   "dash.publish",
   "dash.settings.manage",
+  "dash.settings.view",
+  "dash.shop.view",
   "dash.workspaces.admin",
   "dash.workspaces.manage",
   "dash.workspaces.view"
@@ -109,7 +122,9 @@ var AccessSnapshotError = class extends Error {
   }
 };
 function isAccessSnapshotError(error, code) {
-  return error instanceof AccessSnapshotError && (code === void 0 || error.code === code);
+  if (typeof error !== "object" || error === null) return false;
+  const candidate = error;
+  return candidate.name === "AccessSnapshotError" && typeof candidate.message === "string" && (candidate.code === "unauthenticated" || candidate.code === "forbidden" || candidate.code === "unavailable" || candidate.code === "invalid_snapshot") && (candidate.status === void 0 || Number.isInteger(candidate.status) && candidate.status >= 100 && candidate.status <= 599) && (code === void 0 || candidate.code === code);
 }
 
 // src/access/snapshot.ts

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-C-wuZVM9.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-C-wuZVM9.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-D7Y5nD3s.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-D7Y5nD3s.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -61,7 +61,9 @@ var AccessSnapshotError = class extends Error {
   }
 };
 function isAccessSnapshotError(error, code) {
-  return error instanceof AccessSnapshotError && (code === void 0 || error.code === code);
+  if (typeof error !== "object" || error === null) return false;
+  const candidate = error;
+  return candidate.name === "AccessSnapshotError" && typeof candidate.message === "string" && (candidate.code === "unauthenticated" || candidate.code === "forbidden" || candidate.code === "unavailable" || candidate.code === "invalid_snapshot") && (candidate.status === void 0 || Number.isInteger(candidate.status) && candidate.status >= 100 && candidate.status <= 599) && (code === void 0 || candidate.code === code);
 }
 
 // ../transport/src/forwarding.ts
@@ -297,20 +299,33 @@ var PLATFORM_PERMISSIONS = [
   "platform.users.view"
 ];
 var DASH_PERMISSIONS = [
+  "dash.activity.view",
   "dash.apps.manage",
+  "dash.apps.view",
   "dash.billing.manage",
   "dash.billing.view",
   "dash.channels.manage",
   "dash.customers.manage",
+  "dash.customers.view",
   "dash.domains.manage",
   "dash.domains.view",
+  "dash.leads.export",
+  "dash.leads.view",
+  "dash.learning.records.view",
+  "dash.learning.view",
+  "dash.marketing.view",
   "dash.mcp.access",
   "dash.members.manage",
+  "dash.members.view",
+  "dash.ops_library.view",
+  "dash.overview.view",
   "dash.ownership.transfer",
   "dash.plans.manage",
   "dash.plans.view",
   "dash.publish",
   "dash.settings.manage",
+  "dash.settings.view",
+  "dash.shop.view",
   "dash.workspaces.admin",
   "dash.workspaces.manage",
   "dash.workspaces.view"

package/dist/{index-C-wuZVM9.d.ts → index-D7Y5nD3s.d.ts}

@@ -2,7 +2,7 @@
 declare const PLATFORM_PERMISSIONS: readonly ["affiliates.enrollments.manage", "affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.billing.view", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.mcp.access", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.ops.view", "platform.service_accounts.manage", "platform.service_accounts.view", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.tenants.view", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
 type PlatformPermissionKey = (typeof PLATFORM_PERMISSIONS)[number];
 /** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
-declare const DASH_PERMISSIONS: readonly ["dash.apps.manage", "dash.billing.manage", "dash.billing.view", "dash.channels.manage", "dash.customers.manage", "dash.domains.manage", "dash.domains.view", "dash.mcp.access", "dash.members.manage", "dash.ownership.transfer", "dash.plans.manage", "dash.plans.view", "dash.publish", "dash.settings.manage", "dash.workspaces.admin", "dash.workspaces.manage", "dash.workspaces.view"];
+declare const DASH_PERMISSIONS: readonly ["dash.activity.view", "dash.apps.manage", "dash.apps.view", "dash.billing.manage", "dash.billing.view", "dash.channels.manage", "dash.customers.manage", "dash.customers.view", "dash.domains.manage", "dash.domains.view", "dash.leads.export", "dash.leads.view", "dash.learning.records.view", "dash.learning.view", "dash.marketing.view", "dash.mcp.access", "dash.members.manage", "dash.members.view", "dash.ops_library.view", "dash.overview.view", "dash.ownership.transfer", "dash.plans.manage", "dash.plans.view", "dash.publish", "dash.settings.manage", "dash.settings.view", "dash.shop.view", "dash.workspaces.admin", "dash.workspaces.manage", "dash.workspaces.view"];
 type DashPermissionKey = (typeof DASH_PERMISSIONS)[number];
 /** Membership-mirrored dash role bundles (grant keys at dash scope). */
 declare const DASH_ROLES: readonly ["dash.admin", "dash.owner"];
@@ -36,6 +36,7 @@ declare class AccessSnapshotError extends Error {
     readonly status: number | undefined;
     constructor(code: AccessErrorCode, message: string, status?: number);
 }
+/** Class identity is not shared by /access and /access/next (or duplicate installs). */
 declare function isAccessSnapshotError(error: unknown, code?: AccessErrorCode): error is AccessSnapshotError;
 
 /** Scope a permission entry applies to. Mirrors c1m-server authz.Scope*. */

package/dist/next.d.ts

@@ -30,7 +30,7 @@ declare class PlatformServerFetchError extends Error {
 declare const isSessionExpiredError: (error: unknown) => error is SessionExpiredError;
 declare const isRecentAuthenticationRequiredError: (error: unknown) => error is RecentAuthenticationRequiredError;
 declare const isSSOReauthenticationRequiredError: (error: unknown) => error is SSOReauthenticationRequiredError;
-declare const isPlatformServerFetchError: (error: unknown) => error is PlatformServerFetchError;
+declare function isPlatformServerFetchError(error: unknown): error is PlatformServerFetchError;
 /** Map a 401 body's `code` onto the session error it means. */
 declare function authenticationErrorFor(code: unknown): SessionExpiredError | RecentAuthenticationRequiredError | SSOReauthenticationRequiredError;
 /**

package/dist/next.js

@@ -595,23 +595,28 @@ var PlatformServerFetchError = class extends Error {
   code;
   requestId;
 };
-var named = (error, name) => typeof error === "object" && error !== null && error.name === name;
+var named = (error, name) => typeof error === "object" && error !== null && error.name === name && typeof error.message === "string";
 var isSessionExpiredError = (error) => named(error, "SessionExpiredError");
 var isRecentAuthenticationRequiredError = (error) => named(error, "RecentAuthenticationRequiredError");
 var isSSOReauthenticationRequiredError = (error) => named(error, "SSOReauthenticationRequiredError");
-var isPlatformServerFetchError = (error) => named(error, "PlatformServerFetchError");
+function isPlatformServerFetchError(error) {
+  if (!named(error, "PlatformServerFetchError")) return false;
+  const candidate = error;
+  return typeof candidate.path === "string" && (candidate.status === void 0 || Number.isInteger(candidate.status) && candidate.status >= 100 && candidate.status <= 599) && (candidate.code === void 0 || typeof candidate.code === "string") && (candidate.requestId === void 0 || typeof candidate.requestId === "string");
+}
 function authenticationErrorFor(code) {
   if (code === "sso_reauthentication_required") return new SSOReauthenticationRequiredError();
   if (code === "recent_authentication_required") return new RecentAuthenticationRequiredError();
   return new SessionExpiredError();
 }
 function isControlAPIErrorLike(error) {
-  return typeof error === "object" && error !== null && error.name === "ControlAPIError" && typeof error.status === "number" && typeof error.code === "string" && typeof error.requestId === "string";
+  return typeof error === "object" && error !== null && error.name === "ControlAPIError" && typeof error.message === "string" && typeof error.status === "number" && typeof error.code === "string" && typeof error.requestId === "string";
 }
 function mapControlError(error) {
   if (!isControlAPIErrorLike(error)) return error;
   if (error.status === 401) return authenticationErrorFor(error.code);
-  return new PlatformServerFetchError(error.message, "control API", error.status, error.code, error.requestId);
+  const status = Number.isInteger(error.status) && error.status >= 400 && error.status <= 599 ? error.status : error.code === "control_request_timeout" ? 504 : 502;
+  return new PlatformServerFetchError(error.message, "control API", status, error.code, error.requestId);
 }
 async function controlRequest(run) {
   try {
@@ -652,7 +657,7 @@ function createPlatformFetch(config) {
         signal: init?.signal ? AbortSignal.any([init.signal, deadline]) : deadline
       });
     } catch (error) {
-      if (error instanceof PlatformServerFetchError) throw error;
+      if (isPlatformServerFetchError(error)) throw error;
       if (isTimeout(error)) throw new PlatformServerFetchError("Platform service timed out", path, 504, "upstream_timeout");
       throw new PlatformServerFetchError("Platform service is unavailable", path);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",