@c1m-public/platform-auth 0.15.1 → 0.17.0

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-BEiQTDX9.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-BoZch6LF.js';

package/dist/access/index.js

@@ -17,7 +17,11 @@ var PLATFORM_PERMISSIONS = [
   "platform.channels.manage",
   "platform.channels.view",
   "platform.config.manage",
+  "platform.dashes.archive",
+  "platform.dashes.manage",
   "platform.dashes.purge",
+  "platform.dashes.restore",
+  "platform.dashes.view",
   "platform.docs.manage",
   "platform.docs.view",
   "platform.mcp.access",

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-BEiQTDX9.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-BEiQTDX9.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-BoZch6LF.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-BoZch6LF.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -275,7 +275,11 @@ var PLATFORM_PERMISSIONS = [
   "platform.channels.manage",
   "platform.channels.view",
   "platform.config.manage",
+  "platform.dashes.archive",
+  "platform.dashes.manage",
   "platform.dashes.purge",
+  "platform.dashes.restore",
+  "platform.dashes.view",
   "platform.docs.manage",
   "platform.docs.view",
   "platform.mcp.access",

package/dist/{index-aKe58m6n.d.ts → index-Blx3FNX2.d.ts}

@@ -178,6 +178,29 @@ interface RefreshedSession {
     accessToken: string;
     refreshToken?: string;
 }
+/**
+ * Why a refresh did not produce a session.
+ *
+ * `rejected` and `unavailable` must never be merged. A caller acts on them
+ * oppositely: a rejected token means clear the cookies and send the user to
+ * log in; an unreachable backend means keep the cookies and say "try again".
+ * Collapsing them is what made a backend outage sign operators out of
+ * SaaSDash — and because the cookies were cleared, they stayed out after the
+ * backend came back. `refresh()` cannot express this (a truthy failure object
+ * would break every `if (refreshed)` caller), so the distinction lives here.
+ */
+type RefreshOutcome = {
+    status: "refreshed";
+    session: RefreshedSession;
+}
+/** The backend answered: this token is no good. Definitive. */
+ | {
+    status: "rejected";
+}
+/** We could not ask, or could not trust the answer. Says nothing about the token. */
+ | {
+    status: "unavailable";
+};
 interface SessionRefresherConfig {
     /** Backend origin, no /api/v1. May resolve asynchronously (a tenant-scoped origin). */
     apiUrl: AsyncResolvable<string>;
@@ -202,7 +225,17 @@ interface SessionRefresherConfig {
  */
 declare function parseRefreshEnvelope(value: unknown): RefreshedSession | null;
 declare function createSessionRefresher(config: SessionRefresherConfig): {
+    /**
+     * The session, or null for any failure.
+     *
+     * Kept for callers that cannot act on the difference. Anything deciding
+     * whether to CLEAR COOKIES must use {@link attemptRefresh} instead — null
+     * here means "rejected or unreachable", and treating that as rejected
+     * signs a user out because the backend restarted.
+     */
     refresh(refreshToken: string): Promise<RefreshedSession | null>;
+    /** The refresh outcome, keeping a rejected token apart from an unreachable backend. */
+    attemptRefresh: (refreshToken: string) => Promise<RefreshOutcome>;
     size(): number;
 };
 type SessionRefresher = ReturnType<typeof createSessionRefresher>;
@@ -220,12 +253,20 @@ type SessionGateDecision = {
     kind: "unauthorized_api";
 } | {
     kind: "redirect_login";
+} | {
+    kind: "unavailable";
 };
 interface SessionGateInput {
     accessToken?: string | null;
     refreshToken?: string | null;
     audience: string;
-    refresher: Pick<SessionRefresher, "refresh">;
+    /**
+     * `attemptRefresh` is what distinguishes a rejected token from an
+     * unreachable backend. A refresher supplying only `refresh` still works and
+     * keeps the old behaviour — an outage reads as "signed out" — so pass a
+     * refresher that has it wherever a session is at stake.
+     */
+    refresher: Pick<SessionRefresher, "refresh"> & Partial<Pick<SessionRefresher, "attemptRefresh">>;
     isPublic: boolean;
     isLoginPath: boolean;
     isApiPath: boolean;
@@ -233,4 +274,4 @@ interface SessionGateInput {
 }
 declare function evaluateSessionGate(input: SessionGateInput): Promise<SessionGateDecision>;
 
-export { type AsyncResolvable as A, decodeTokenPayload as B, type CookieOptions as C, type DeviceIdentity as D, deleteCookie as E, evaluateSessionGate as F, forwardedRequestHeaders as G, HANDOFF_ERROR_FALLBACK as H, handoffErrorMessage as I, hasSessionShape as J, hasTokenAudience as K, isAuthErrorCode as L, isHandoffErrorCode as M, isTokenExpired as N, isTokenExpiringSoon as O, parseAuthResponse as P, parseRefreshEnvelope as Q, type Resolvable as R, type SessionData as S, type TokenPayload as T, readCookie as U, safeInternalPath as V, serializeCookie as W, setCookie as X, sourceStartPath as Y, tokenMaxAgeSeconds as Z, AUTH_ERROR_MESSAGES as a, type AuthResponse as b, type DeviceIdentityConfig as c, type DeviceIdentityStore as d, HANDOFF_ERROR_MESSAGES as e, type HandoffSource as f, type HandoffSourceConfig as g, type HandoffSourceTarget as h, type HandoffTarget as i, type HandoffTargetConfig as j, type RefreshedSession as k, SSO_ERROR_MESSAGES as l, type SessionGateDecision as m, type SessionGateInput as n, type SessionRefresher as o, type SessionRefresherConfig as p, type SessionUser as q, applyForwardedClientHeaders as r, authErrorMessage as s, brokerPaths as t, createDeviceIdentity as u, createHandoffSource as v, createHandoffTarget as w, createSessionRefresher as x, decodeBase64Url as y, decodeDefaultSession as z };
+export { type AsyncResolvable as A, decodeDefaultSession as B, type CookieOptions as C, type DeviceIdentity as D, decodeTokenPayload as E, deleteCookie as F, evaluateSessionGate as G, HANDOFF_ERROR_FALLBACK as H, forwardedRequestHeaders as I, handoffErrorMessage as J, hasSessionShape as K, hasTokenAudience as L, isAuthErrorCode as M, isHandoffErrorCode as N, isTokenExpired as O, isTokenExpiringSoon as P, parseAuthResponse as Q, type Resolvable as R, type SessionData as S, type TokenPayload as T, parseRefreshEnvelope as U, readCookie as V, safeInternalPath as W, serializeCookie as X, setCookie as Y, sourceStartPath as Z, tokenMaxAgeSeconds as _, AUTH_ERROR_MESSAGES as a, type AuthResponse as b, type DeviceIdentityConfig as c, type DeviceIdentityStore as d, HANDOFF_ERROR_MESSAGES as e, type HandoffSource as f, type HandoffSourceConfig as g, type HandoffSourceTarget as h, type HandoffTarget as i, type HandoffTargetConfig as j, type RefreshOutcome as k, type RefreshedSession as l, SSO_ERROR_MESSAGES as m, type SessionGateDecision as n, type SessionGateInput as o, type SessionRefresher as p, type SessionRefresherConfig as q, type SessionUser as r, applyForwardedClientHeaders as s, authErrorMessage as t, brokerPaths as u, createDeviceIdentity as v, createHandoffSource as w, createHandoffTarget as x, createSessionRefresher as y, decodeBase64Url as z };

package/dist/{index-BEiQTDX9.d.ts → index-BoZch6LF.d.ts}

@@ -1,5 +1,5 @@
 /** Platform-operator permission keys. */
-declare const PLATFORM_PERMISSIONS: readonly ["affiliates.enrollments.manage", "affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.billing.view", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.dashes.purge", "platform.docs.manage", "platform.docs.view", "platform.mcp.access", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.ops.view", "platform.service_accounts.manage", "platform.service_accounts.view", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.tenants.view", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
+declare const PLATFORM_PERMISSIONS: readonly ["affiliates.enrollments.manage", "affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.billing.view", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.dashes.archive", "platform.dashes.manage", "platform.dashes.purge", "platform.dashes.restore", "platform.dashes.view", "platform.docs.manage", "platform.docs.view", "platform.mcp.access", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.ops.view", "platform.service_accounts.manage", "platform.service_accounts.view", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.tenants.view", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
 type PlatformPermissionKey = (typeof PLATFORM_PERMISSIONS)[number];
 /** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
 declare const DASH_PERMISSIONS: readonly ["dash.activity.view", "dash.apps.manage", "dash.apps.view", "dash.billing.manage", "dash.billing.view", "dash.channels.manage", "dash.customers.manage", "dash.customers.view", "dash.domains.manage", "dash.domains.view", "dash.leads.export", "dash.leads.view", "dash.learning.records.view", "dash.learning.view", "dash.marketing.view", "dash.mcp.access", "dash.members.manage", "dash.members.view", "dash.ops_library.view", "dash.overview.view", "dash.ownership.transfer", "dash.plans.manage", "dash.plans.view", "dash.publish", "dash.settings.manage", "dash.settings.view", "dash.shop.view", "dash.workspaces.admin", "dash.workspaces.manage", "dash.workspaces.view"];

package/dist/index.d.ts

@@ -1 +1 @@
-export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, C as CookieOptions, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshedSession, l as SSO_ERROR_MESSAGES, S as SessionData, m as SessionGateDecision, n as SessionGateInput, o as SessionRefresher, p as SessionRefresherConfig, q as SessionUser, T as TokenPayload, r as applyForwardedClientHeaders, s as authErrorMessage, t as brokerPaths, u as createDeviceIdentity, v as createHandoffSource, w as createHandoffTarget, x as createSessionRefresher, y as decodeBase64Url, z as decodeDefaultSession, B as decodeTokenPayload, E as deleteCookie, F as evaluateSessionGate, G as forwardedRequestHeaders, I as handoffErrorMessage, J as hasSessionShape, K as hasTokenAudience, L as isAuthErrorCode, M as isHandoffErrorCode, N as isTokenExpired, O as isTokenExpiringSoon, P as parseAuthResponse, Q as parseRefreshEnvelope, U as readCookie, V as safeInternalPath, W as serializeCookie, X as setCookie, Y as sourceStartPath, Z as tokenMaxAgeSeconds } from './index-aKe58m6n.js';
+export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, C as CookieOptions, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshOutcome, l as RefreshedSession, m as SSO_ERROR_MESSAGES, S as SessionData, n as SessionGateDecision, o as SessionGateInput, p as SessionRefresher, q as SessionRefresherConfig, r as SessionUser, T as TokenPayload, s as applyForwardedClientHeaders, t as authErrorMessage, u as brokerPaths, v as createDeviceIdentity, w as createHandoffSource, x as createHandoffTarget, y as createSessionRefresher, z as decodeBase64Url, B as decodeDefaultSession, E as decodeTokenPayload, F as deleteCookie, G as evaluateSessionGate, I as forwardedRequestHeaders, J as handoffErrorMessage, K as hasSessionShape, L as hasTokenAudience, M as isAuthErrorCode, N as isHandoffErrorCode, O as isTokenExpired, P as isTokenExpiringSoon, Q as parseAuthResponse, U as parseRefreshEnvelope, V as readCookie, W as safeInternalPath, X as serializeCookie, Y as setCookie, Z as sourceStartPath, _ as tokenMaxAgeSeconds } from './index-Blx3FNX2.js';

package/dist/index.js

@@ -462,6 +462,7 @@ function createHandoffSource(config) {
 }
 
 // src/session-refresh.ts
+var REJECTION_STATUSES = /* @__PURE__ */ new Set([400, 401, 403]);
 var DEFAULT_TTL_MS = 5e3;
 var DEFAULT_MAX = 1e3;
 function parseRefreshEnvelope(value) {
@@ -495,11 +496,22 @@ function createSessionRefresher(config) {
         timeoutMs,
         fetch: config.fetch
       });
-      if (!response.ok) return null;
-      const refreshed = parseRefreshEnvelope(await response.json());
-      return refreshed && hasTokenAudience(refreshed.accessToken, config.audience) ? refreshed : null;
+      if (!response.ok) {
+        return REJECTION_STATUSES.has(response.status) ? { status: "rejected" } : { status: "unavailable" };
+      }
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        return { status: "unavailable" };
+      }
+      const refreshed = parseRefreshEnvelope(parsed);
+      if (!refreshed || !hasTokenAudience(refreshed.accessToken, config.audience)) {
+        return { status: "rejected" };
+      }
+      return { status: "refreshed", session: refreshed };
     } catch {
-      return null;
+      return { status: "unavailable" };
     }
   }
   function prune(now) {
@@ -512,19 +524,32 @@ function createSessionRefresher(config) {
       inflight.delete(oldest);
     }
   }
+  function attempt(refreshToken) {
+    const now = Date.now();
+    prune(now);
+    const existing = inflight.get(refreshToken);
+    if (existing && existing.expiresAt > now) return existing.promise;
+    const promise = perform(refreshToken).then((outcome) => {
+      if (outcome.status !== "refreshed") inflight.delete(refreshToken);
+      return outcome;
+    });
+    inflight.set(refreshToken, { expiresAt: now + ttl, promise });
+    return promise;
+  }
   return {
+    /**
+     * The session, or null for any failure.
+     *
+     * Kept for callers that cannot act on the difference. Anything deciding
+     * whether to CLEAR COOKIES must use {@link attemptRefresh} instead — null
+     * here means "rejected or unreachable", and treating that as rejected
+     * signs a user out because the backend restarted.
+     */
     refresh(refreshToken) {
-      const now = Date.now();
-      prune(now);
-      const existing = inflight.get(refreshToken);
-      if (existing && existing.expiresAt > now) return existing.promise;
-      const promise = perform(refreshToken).then((result) => {
-        if (!result) inflight.delete(refreshToken);
-        return result;
-      });
-      inflight.set(refreshToken, { expiresAt: now + ttl, promise });
-      return promise;
+      return attempt(refreshToken).then((outcome) => outcome.status === "refreshed" ? outcome.session : null);
     },
+    /** The refresh outcome, keeping a rejected token apart from an unreachable backend. */
+    attemptRefresh: attempt,
     size() {
       return inflight.size;
     }
@@ -540,17 +565,23 @@ function hasSessionShape(token) {
 async function evaluateSessionGate(input) {
   const { accessToken, refreshToken, audience, refresher, isPublic, isLoginPath, isApiPath } = input;
   const live = !!accessToken && hasSessionShape(accessToken) && hasTokenAudience(accessToken, audience) && !isTokenExpired(accessToken);
+  const attempt = async (token) => refresher.attemptRefresh ? await refresher.attemptRefresh(token) : await refresher.refresh(token).then(
+    (session) => session ? { status: "refreshed", session } : { status: "rejected" }
+  );
   if (live) {
     if (isPublic && isLoginPath) return { kind: "redirect_home" };
     if (refreshToken && isTokenExpiringSoon(accessToken, input.expiringSoonBufferSeconds)) {
-      const refreshed = await refresher.refresh(refreshToken);
-      if (refreshed) return { kind: "pass", refreshed };
+      const outcome = await attempt(refreshToken);
+      if (outcome.status === "refreshed") return { kind: "pass", refreshed: outcome.session };
     }
     return { kind: "pass" };
   }
   if (refreshToken) {
-    const refreshed = await refresher.refresh(refreshToken);
-    if (refreshed) return isPublic ? { kind: "redirect_home", refreshed } : { kind: "pass", refreshed };
+    const outcome = await attempt(refreshToken);
+    if (outcome.status === "refreshed") {
+      return isPublic ? { kind: "redirect_home", refreshed: outcome.session } : { kind: "pass", refreshed: outcome.session };
+    }
+    if (outcome.status === "unavailable" && !isPublic) return { kind: "unavailable" };
   }
   if (isPublic) return { kind: "anonymous_public" };
   if (isApiPath) return { kind: "unauthorized_api" };

package/dist/next.d.ts

@@ -1,5 +1,5 @@
-import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-aKe58m6n.js';
-export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshedSession, l as SSO_ERROR_MESSAGES, m as SessionGateDecision, n as SessionGateInput, o as SessionRefresher, p as SessionRefresherConfig, q as SessionUser, T as TokenPayload, r as applyForwardedClientHeaders, s as authErrorMessage, t as brokerPaths, u as createDeviceIdentity, v as createHandoffSource, w as createHandoffTarget, x as createSessionRefresher, y as decodeBase64Url, z as decodeDefaultSession, B as decodeTokenPayload, E as deleteCookie, F as evaluateSessionGate, G as forwardedRequestHeaders, I as handoffErrorMessage, J as hasSessionShape, K as hasTokenAudience, L as isAuthErrorCode, M as isHandoffErrorCode, N as isTokenExpired, O as isTokenExpiringSoon, P as parseAuthResponse, Q as parseRefreshEnvelope, U as readCookie, V as safeInternalPath, W as serializeCookie, X as setCookie, Y as sourceStartPath, Z as tokenMaxAgeSeconds } from './index-aKe58m6n.js';
+import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-Blx3FNX2.js';
+export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshOutcome, l as RefreshedSession, m as SSO_ERROR_MESSAGES, n as SessionGateDecision, o as SessionGateInput, p as SessionRefresher, q as SessionRefresherConfig, r as SessionUser, T as TokenPayload, s as applyForwardedClientHeaders, t as authErrorMessage, u as brokerPaths, v as createDeviceIdentity, w as createHandoffSource, x as createHandoffTarget, y as createSessionRefresher, z as decodeBase64Url, B as decodeDefaultSession, E as decodeTokenPayload, F as deleteCookie, G as evaluateSessionGate, I as forwardedRequestHeaders, J as handoffErrorMessage, K as hasSessionShape, L as hasTokenAudience, M as isAuthErrorCode, N as isHandoffErrorCode, O as isTokenExpired, P as isTokenExpiringSoon, Q as parseAuthResponse, U as parseRefreshEnvelope, V as readCookie, W as safeInternalPath, X as serializeCookie, Y as setCookie, Z as sourceStartPath, _ as tokenMaxAgeSeconds } from './index-Blx3FNX2.js';
 
 /**
  * The error vocabulary every first-party platform surface uses at its edge.

package/dist/next.js

@@ -467,6 +467,7 @@ function createHandoffSource(config) {
 }
 
 // src/session-refresh.ts
+var REJECTION_STATUSES = /* @__PURE__ */ new Set([400, 401, 403]);
 var DEFAULT_TTL_MS = 5e3;
 var DEFAULT_MAX = 1e3;
 function parseRefreshEnvelope(value) {
@@ -500,11 +501,22 @@ function createSessionRefresher(config) {
         timeoutMs,
         fetch: config.fetch
       });
-      if (!response.ok) return null;
-      const refreshed = parseRefreshEnvelope(await response.json());
-      return refreshed && hasTokenAudience(refreshed.accessToken, config.audience) ? refreshed : null;
+      if (!response.ok) {
+        return REJECTION_STATUSES.has(response.status) ? { status: "rejected" } : { status: "unavailable" };
+      }
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        return { status: "unavailable" };
+      }
+      const refreshed = parseRefreshEnvelope(parsed);
+      if (!refreshed || !hasTokenAudience(refreshed.accessToken, config.audience)) {
+        return { status: "rejected" };
+      }
+      return { status: "refreshed", session: refreshed };
     } catch {
-      return null;
+      return { status: "unavailable" };
     }
   }
   function prune(now) {
@@ -517,19 +529,32 @@ function createSessionRefresher(config) {
       inflight.delete(oldest);
     }
   }
+  function attempt(refreshToken) {
+    const now = Date.now();
+    prune(now);
+    const existing = inflight.get(refreshToken);
+    if (existing && existing.expiresAt > now) return existing.promise;
+    const promise = perform(refreshToken).then((outcome) => {
+      if (outcome.status !== "refreshed") inflight.delete(refreshToken);
+      return outcome;
+    });
+    inflight.set(refreshToken, { expiresAt: now + ttl, promise });
+    return promise;
+  }
   return {
+    /**
+     * The session, or null for any failure.
+     *
+     * Kept for callers that cannot act on the difference. Anything deciding
+     * whether to CLEAR COOKIES must use {@link attemptRefresh} instead — null
+     * here means "rejected or unreachable", and treating that as rejected
+     * signs a user out because the backend restarted.
+     */
     refresh(refreshToken) {
-      const now = Date.now();
-      prune(now);
-      const existing = inflight.get(refreshToken);
-      if (existing && existing.expiresAt > now) return existing.promise;
-      const promise = perform(refreshToken).then((result) => {
-        if (!result) inflight.delete(refreshToken);
-        return result;
-      });
-      inflight.set(refreshToken, { expiresAt: now + ttl, promise });
-      return promise;
+      return attempt(refreshToken).then((outcome) => outcome.status === "refreshed" ? outcome.session : null);
     },
+    /** The refresh outcome, keeping a rejected token apart from an unreachable backend. */
+    attemptRefresh: attempt,
     size() {
       return inflight.size;
     }
@@ -545,17 +570,23 @@ function hasSessionShape(token) {
 async function evaluateSessionGate(input) {
   const { accessToken, refreshToken, audience, refresher, isPublic, isLoginPath, isApiPath } = input;
   const live = !!accessToken && hasSessionShape(accessToken) && hasTokenAudience(accessToken, audience) && !isTokenExpired(accessToken);
+  const attempt = async (token) => refresher.attemptRefresh ? await refresher.attemptRefresh(token) : await refresher.refresh(token).then(
+    (session) => session ? { status: "refreshed", session } : { status: "rejected" }
+  );
   if (live) {
     if (isPublic && isLoginPath) return { kind: "redirect_home" };
     if (refreshToken && isTokenExpiringSoon(accessToken, input.expiringSoonBufferSeconds)) {
-      const refreshed = await refresher.refresh(refreshToken);
-      if (refreshed) return { kind: "pass", refreshed };
+      const outcome = await attempt(refreshToken);
+      if (outcome.status === "refreshed") return { kind: "pass", refreshed: outcome.session };
     }
     return { kind: "pass" };
   }
   if (refreshToken) {
-    const refreshed = await refresher.refresh(refreshToken);
-    if (refreshed) return isPublic ? { kind: "redirect_home", refreshed } : { kind: "pass", refreshed };
+    const outcome = await attempt(refreshToken);
+    if (outcome.status === "refreshed") {
+      return isPublic ? { kind: "redirect_home", refreshed: outcome.session } : { kind: "pass", refreshed: outcome.session };
+    }
+    if (outcome.status === "unavailable" && !isPublic) return { kind: "unavailable" };
   }
   if (isPublic) return { kind: "anonymous_public" };
   if (isApiPath) return { kind: "unauthorized_api" };

package/dist/service-accounts.js

@@ -1,29 +1,5 @@
-// ../transport/src/index.ts
+// ../resilience/src/index.ts
 var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
-var TransportError = class extends Error {
-  constructor(failure) {
-    super(failure.message || failure.outcome);
-    this.failure = failure;
-    this.name = "TransportError";
-  }
-  failure;
-};
-function isTransportError(error) {
-  return error instanceof TransportError || typeof error === "object" && error !== null && error.name === "TransportError";
-}
-function positiveNumber(value, label, fail) {
-  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) throw fail(`${label} must be a positive finite number`);
-  return value;
-}
-function nonNegativeInteger(value, label, fail) {
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw fail(`${label} must be a non-negative safe integer`);
-  return value;
-}
-function requiredString(value, label, fail) {
-  const normalized = typeof value === "string" ? value.trim() : "";
-  if (!normalized) throw fail(`${label} is required`);
-  return normalized;
-}
 function backoffDelay(attempt, maxDelayMs) {
   const base = Math.min(250 * 2 ** Math.max(attempt, 0), maxDelayMs);
   return Math.floor(Math.random() * base);
@@ -49,6 +25,32 @@ function isRetryableRequest(method, headers, retry) {
   if (method === "GET") return true;
   return retry.idempotentWrites === true && headers.has("Idempotency-Key");
 }
+
+// ../transport/src/index.ts
+var TransportError = class extends Error {
+  constructor(failure) {
+    super(failure.message || failure.outcome);
+    this.failure = failure;
+    this.name = "TransportError";
+  }
+  failure;
+};
+function isTransportError(error) {
+  return error instanceof TransportError || typeof error === "object" && error !== null && error.name === "TransportError";
+}
+function positiveNumber(value, label, fail) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) throw fail(`${label} must be a positive finite number`);
+  return value;
+}
+function nonNegativeInteger(value, label, fail) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw fail(`${label} must be a non-negative safe integer`);
+  return value;
+}
+function requiredString(value, label, fail) {
+  const normalized = typeof value === "string" ? value.trim() : "";
+  if (!normalized) throw fail(`${label} is required`);
+  return normalized;
+}
 async function performRequest(transport, url, init, observe, decode) {
   const method = (init.method ?? "GET").toUpperCase();
   const headers = new Headers(init.headers);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",
@@ -56,9 +56,10 @@
     "next": "16.3.1",
     "react": "19.2.4",
     "react-dom": "19.2.4",
+    "tsup": "^8.5.1",
     "typescript": "5.9.3",
     "vitest": "^4.1.4",
-    "tsup": "^8.5.1",
+    "@c1m-public/resilience": "0.1.0",
     "@c1m-public/transport": "0.0.0"
   },
   "peerDependencies": {