@c1m-public/platform-auth 0.16.0 → 0.18.0

package/README.md

@@ -11,7 +11,6 @@ need — the boundary is the subpath.
 ```
 .               session: token reads, handoff, proxy gate, refresh   (Web Request/Response)
 ./next          session, server-only guard                            (Next route handlers)
-./service-accounts  operator-owned service accounts and credentials   (framework-neutral)
 ./access        authorization: snapshot, keys, predicates             (framework-neutral)
 ./access/next   access loader: require / forbidden / invalidate       (Next, server-only)
 ./access/react  <Can>, useCan, AccessProvider                         (client)
@@ -20,34 +19,11 @@ need — the boundary is the subpath.
 `next` and `react` are **optional** peer dependencies: a BFF that only reads
 sessions never needs them.
 
-## `./service-accounts` — operator service accounts
-
-`createServiceAccountClient` manages the operator-owned service accounts under
-`/api/v1/platform/identity/service-accounts`: list, create, update, replace
-grants, and list, mint or revoke credentials. Reads need
-`SERVICE_ACCOUNTS_VIEW_PERMISSION`; every mutation needs
-`SERVICE_ACCOUNTS_MANAGE_PERMISSION` and is never retried.
-
-A credential is minted from **reviewed operation ids**, not from arbitrary
-permissions: callers name `operation_ids` and the backend derives the
-permission ceiling, so a caller cannot widen its own grant. The client also
-holds the caller to the wire contract before a request leaves the process — a
-`dash:<id>` audience must carry exactly its route Dash in `dash_ids`, a Dash
-grant must name one Dash rather than `*`, `expires_in_days` is 1–30, and
-`max_output_bytes` is 1–1048576.
-
-Every mutation carries `expected_version`; a `409` with
-`service_account_version_conflict` means the record moved under the caller and
-the read has to be repeated. A `recent_authentication_required` API error is a
-step-up challenge, not an expired session. The minted `secret` is one-time and
-is checked to correlate with the credential it belongs to: keep it out of URLs,
-logs, storage, and telemetry — the server never returns it again.
-
 ## `.` — session
 
 | Export | Purpose |
 |---|---|
-| `decodeTokenPayload`, `decodeDefaultSession`, `hasTokenAudience`, `isTokenExpired`, `isTokenExpiringSoon`, `tokenMaxAgeSeconds` | Read an access token for routing. Decoding is **not** verification — the backend re-verifies every call. `decodeDefaultSession` prefers `effective_user_id`, so a support session resolves as the impersonated user. |
+| `decodeTokenPayload`, `decodeDefaultSession`, `hasTokenAudience`, `isTokenExpired`, `isTokenExpiringSoon`, `tokenMaxAgeSeconds` | Read an access token for routing. Decoding is **not** verification — the backend re-verifies every call. `decodeDefaultSession` prefers `impersonation_target`, so a support session resolves as the impersonated user. |
 | `parseAuthResponse`, `AuthResponse` | Validate a backend auth envelope before trusting it. |
 | `readCookie`, `serializeCookie`, `setCookie`, `deleteCookie` | Cookie helpers over Web `Request`/`Response`. `__Host-` names get `Secure` automatically. |
 | `createDeviceIdentity` | The `X-Client-Device-ID` cookie the backend requires to create a session. |

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-BoZch6LF.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-DieAxYYh.js';

package/dist/access/index.js

@@ -30,18 +30,17 @@ var PLATFORM_PERMISSIONS = [
   "platform.offboarding.view",
   "platform.ops.manage",
   "platform.ops.view",
+  "platform.ownership.transfer",
   "platform.service_accounts.manage",
   "platform.service_accounts.view",
   "platform.support.impersonate",
+  "platform.support.impersonation.delegate",
   "platform.support.sessions",
-  "platform.tenants.archive",
-  "platform.tenants.manage",
-  "platform.tenants.restore",
-  "platform.tenants.view",
   "platform.users.deactivate",
   "platform.users.delete",
   "platform.users.invite",
   "platform.users.manage_access",
+  "platform.users.manage_profile",
   "platform.users.reactivate",
   "platform.users.view"
 ];
@@ -96,6 +95,8 @@ var WORKSPACE_PERMISSIONS = [
   "workspace.crm.view",
   "workspace.customers.manage",
   "workspace.customers.view",
+  "workspace.drafts.delete",
+  "workspace.lifecycle.manage",
   "workspace.orders.manage",
   "workspace.orders.view",
   "workspace.payments.record",

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-BoZch6LF.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-BoZch6LF.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-DieAxYYh.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-DieAxYYh.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -288,18 +288,17 @@ var PLATFORM_PERMISSIONS = [
   "platform.offboarding.view",
   "platform.ops.manage",
   "platform.ops.view",
+  "platform.ownership.transfer",
   "platform.service_accounts.manage",
   "platform.service_accounts.view",
   "platform.support.impersonate",
+  "platform.support.impersonation.delegate",
   "platform.support.sessions",
-  "platform.tenants.archive",
-  "platform.tenants.manage",
-  "platform.tenants.restore",
-  "platform.tenants.view",
   "platform.users.deactivate",
   "platform.users.delete",
   "platform.users.invite",
   "platform.users.manage_access",
+  "platform.users.manage_profile",
   "platform.users.reactivate",
   "platform.users.view"
 ];
@@ -354,6 +353,8 @@ var WORKSPACE_PERMISSIONS = [
   "workspace.crm.view",
   "workspace.customers.manage",
   "workspace.customers.view",
+  "workspace.drafts.delete",
+  "workspace.lifecycle.manage",
   "workspace.orders.manage",
   "workspace.orders.view",
   "workspace.payments.record",

package/dist/{index-aKe58m6n.d.ts → index-BxyVV6Wt.d.ts}

@@ -20,7 +20,7 @@ type TokenPayload = Record<string, unknown> & {
     exp?: number;
     iat?: number;
     actor_id?: string;
-    effective_user_id?: string;
+    impersonation_target?: string;
     customer_id?: string;
     user_id?: string;
     aud?: string | string[];
@@ -178,6 +178,27 @@ interface RefreshedSession {
     accessToken: string;
     refreshToken?: string;
 }
+/**
+ * Why a refresh did not produce a session.
+ *
+ * `rejected` and `unavailable` must never be merged. A caller acts on them
+ * oppositely: a rejected token means clear the cookies and send the user to
+ * log in; an unreachable backend means keep the cookies and say "try again".
+ * `refresh()` cannot express this (a truthy failure object
+ * would break every `if (refreshed)` caller), so the distinction lives here.
+ */
+type RefreshOutcome = {
+    status: "refreshed";
+    session: RefreshedSession;
+}
+/** The backend answered: this token is no good. Definitive. */
+ | {
+    status: "rejected";
+}
+/** We could not ask, or could not trust the answer. Says nothing about the token. */
+ | {
+    status: "unavailable";
+};
 interface SessionRefresherConfig {
     /** Backend origin, no /api/v1. May resolve asynchronously (a tenant-scoped origin). */
     apiUrl: AsyncResolvable<string>;
@@ -202,7 +223,17 @@ interface SessionRefresherConfig {
  */
 declare function parseRefreshEnvelope(value: unknown): RefreshedSession | null;
 declare function createSessionRefresher(config: SessionRefresherConfig): {
+    /**
+     * The session, or null for any failure.
+     *
+     * Kept for callers that cannot act on the difference. Anything deciding
+     * whether to CLEAR COOKIES must use {@link attemptRefresh} instead — null
+     * here means "rejected or unreachable", and treating that as rejected
+     * signs a user out because the backend restarted.
+     */
     refresh(refreshToken: string): Promise<RefreshedSession | null>;
+    /** The refresh outcome, keeping a rejected token apart from an unreachable backend. */
+    attemptRefresh: (refreshToken: string) => Promise<RefreshOutcome>;
     size(): number;
 };
 type SessionRefresher = ReturnType<typeof createSessionRefresher>;
@@ -220,12 +251,20 @@ type SessionGateDecision = {
     kind: "unauthorized_api";
 } | {
     kind: "redirect_login";
+} | {
+    kind: "unavailable";
 };
 interface SessionGateInput {
     accessToken?: string | null;
     refreshToken?: string | null;
     audience: string;
-    refresher: Pick<SessionRefresher, "refresh">;
+    /**
+     * `attemptRefresh` is what distinguishes a rejected token from an
+     * unreachable backend. A refresher supplying only `refresh` still works and
+     * keeps the old behaviour — an outage reads as "signed out" — so pass a
+     * refresher that has it wherever a session is at stake.
+     */
+    refresher: Pick<SessionRefresher, "refresh"> & Partial<Pick<SessionRefresher, "attemptRefresh">>;
     isPublic: boolean;
     isLoginPath: boolean;
     isApiPath: boolean;
@@ -233,4 +272,4 @@ interface SessionGateInput {
 }
 declare function evaluateSessionGate(input: SessionGateInput): Promise<SessionGateDecision>;
 
-export { type AsyncResolvable as A, decodeTokenPayload as B, type CookieOptions as C, type DeviceIdentity as D, deleteCookie as E, evaluateSessionGate as F, forwardedRequestHeaders as G, HANDOFF_ERROR_FALLBACK as H, handoffErrorMessage as I, hasSessionShape as J, hasTokenAudience as K, isAuthErrorCode as L, isHandoffErrorCode as M, isTokenExpired as N, isTokenExpiringSoon as O, parseAuthResponse as P, parseRefreshEnvelope as Q, type Resolvable as R, type SessionData as S, type TokenPayload as T, readCookie as U, safeInternalPath as V, serializeCookie as W, setCookie as X, sourceStartPath as Y, tokenMaxAgeSeconds as Z, AUTH_ERROR_MESSAGES as a, type AuthResponse as b, type DeviceIdentityConfig as c, type DeviceIdentityStore as d, HANDOFF_ERROR_MESSAGES as e, type HandoffSource as f, type HandoffSourceConfig as g, type HandoffSourceTarget as h, type HandoffTarget as i, type HandoffTargetConfig as j, type RefreshedSession as k, SSO_ERROR_MESSAGES as l, type SessionGateDecision as m, type SessionGateInput as n, type SessionRefresher as o, type SessionRefresherConfig as p, type SessionUser as q, applyForwardedClientHeaders as r, authErrorMessage as s, brokerPaths as t, createDeviceIdentity as u, createHandoffSource as v, createHandoffTarget as w, createSessionRefresher as x, decodeBase64Url as y, decodeDefaultSession as z };
+export { type AsyncResolvable as A, decodeDefaultSession as B, type CookieOptions as C, type DeviceIdentity as D, decodeTokenPayload as E, deleteCookie as F, evaluateSessionGate as G, HANDOFF_ERROR_FALLBACK as H, forwardedRequestHeaders as I, handoffErrorMessage as J, hasSessionShape as K, hasTokenAudience as L, isAuthErrorCode as M, isHandoffErrorCode as N, isTokenExpired as O, isTokenExpiringSoon as P, parseAuthResponse as Q, type Resolvable as R, type SessionData as S, type TokenPayload as T, parseRefreshEnvelope as U, readCookie as V, safeInternalPath as W, serializeCookie as X, setCookie as Y, sourceStartPath as Z, tokenMaxAgeSeconds as _, AUTH_ERROR_MESSAGES as a, type AuthResponse as b, type DeviceIdentityConfig as c, type DeviceIdentityStore as d, HANDOFF_ERROR_MESSAGES as e, type HandoffSource as f, type HandoffSourceConfig as g, type HandoffSourceTarget as h, type HandoffTarget as i, type HandoffTargetConfig as j, type RefreshOutcome as k, type RefreshedSession as l, SSO_ERROR_MESSAGES as m, type SessionGateDecision as n, type SessionGateInput as o, type SessionRefresher as p, type SessionRefresherConfig as q, type SessionUser as r, applyForwardedClientHeaders as s, authErrorMessage as t, brokerPaths as u, createDeviceIdentity as v, createHandoffSource as w, createHandoffTarget as x, createSessionRefresher as y, decodeBase64Url as z };

package/dist/{index-BoZch6LF.d.ts → index-DieAxYYh.d.ts}

@@ -1,5 +1,5 @@
 /** Platform-operator permission keys. */
-declare const PLATFORM_PERMISSIONS: readonly ["affiliates.enrollments.manage", "affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.billing.view", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.dashes.archive", "platform.dashes.manage", "platform.dashes.purge", "platform.dashes.restore", "platform.dashes.view", "platform.docs.manage", "platform.docs.view", "platform.mcp.access", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.ops.view", "platform.service_accounts.manage", "platform.service_accounts.view", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.tenants.view", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
+declare const PLATFORM_PERMISSIONS: readonly ["affiliates.enrollments.manage", "affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.billing.view", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.dashes.archive", "platform.dashes.manage", "platform.dashes.purge", "platform.dashes.restore", "platform.dashes.view", "platform.docs.manage", "platform.docs.view", "platform.mcp.access", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.ops.view", "platform.ownership.transfer", "platform.service_accounts.manage", "platform.service_accounts.view", "platform.support.impersonate", "platform.support.impersonation.delegate", "platform.support.sessions", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.manage_profile", "platform.users.reactivate", "platform.users.view"];
 type PlatformPermissionKey = (typeof PLATFORM_PERMISSIONS)[number];
 /** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
 declare const DASH_PERMISSIONS: readonly ["dash.activity.view", "dash.apps.manage", "dash.apps.view", "dash.billing.manage", "dash.billing.view", "dash.channels.manage", "dash.customers.manage", "dash.customers.view", "dash.domains.manage", "dash.domains.view", "dash.leads.export", "dash.leads.view", "dash.learning.records.view", "dash.learning.view", "dash.marketing.view", "dash.mcp.access", "dash.members.manage", "dash.members.view", "dash.ops_library.view", "dash.overview.view", "dash.ownership.transfer", "dash.plans.manage", "dash.plans.view", "dash.publish", "dash.settings.manage", "dash.settings.view", "dash.shop.view", "dash.workspaces.admin", "dash.workspaces.manage", "dash.workspaces.view"];
@@ -11,7 +11,7 @@ type DashRole = (typeof DASH_ROLES)[number];
 declare const LEADBROKER_PERMISSIONS: readonly ["leadbroker.finance.manage", "leadbroker.leads.dispatch", "leadbroker.leads.review", "leadbroker.leads.view", "leadbroker.policy.manage"];
 type LeadBrokerPermissionKey = (typeof LEADBROKER_PERMISSIONS)[number];
 /** Workspace-staff permission keys. */
-declare const WORKSPACE_PERMISSIONS: readonly ["workspace.channels.manage", "workspace.channels.secrets", "workspace.channels.view", "workspace.crm.manage", "workspace.crm.view", "workspace.customers.manage", "workspace.customers.view", "workspace.orders.manage", "workspace.orders.view", "workspace.payments.record", "workspace.site.edit", "workspace.site.view", "workspace.staff.manage"];
+declare const WORKSPACE_PERMISSIONS: readonly ["workspace.channels.manage", "workspace.channels.secrets", "workspace.channels.view", "workspace.crm.manage", "workspace.crm.view", "workspace.customers.manage", "workspace.customers.view", "workspace.drafts.delete", "workspace.lifecycle.manage", "workspace.orders.manage", "workspace.orders.view", "workspace.payments.record", "workspace.site.edit", "workspace.site.view", "workspace.staff.manage"];
 type WorkspacePermissionKey = (typeof WORKSPACE_PERMISSIONS)[number];
 /** Assignable workspace-staff role bundles (grant keys at workspace scope). */
 declare const WORKSPACE_ROLES: readonly ["workspace.editor", "workspace.frontdesk", "workspace.manager"];

package/dist/index.d.ts

@@ -1 +1 @@
-export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, C as CookieOptions, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshedSession, l as SSO_ERROR_MESSAGES, S as SessionData, m as SessionGateDecision, n as SessionGateInput, o as SessionRefresher, p as SessionRefresherConfig, q as SessionUser, T as TokenPayload, r as applyForwardedClientHeaders, s as authErrorMessage, t as brokerPaths, u as createDeviceIdentity, v as createHandoffSource, w as createHandoffTarget, x as createSessionRefresher, y as decodeBase64Url, z as decodeDefaultSession, B as decodeTokenPayload, E as deleteCookie, F as evaluateSessionGate, G as forwardedRequestHeaders, I as handoffErrorMessage, J as hasSessionShape, K as hasTokenAudience, L as isAuthErrorCode, M as isHandoffErrorCode, N as isTokenExpired, O as isTokenExpiringSoon, P as parseAuthResponse, Q as parseRefreshEnvelope, U as readCookie, V as safeInternalPath, W as serializeCookie, X as setCookie, Y as sourceStartPath, Z as tokenMaxAgeSeconds } from './index-aKe58m6n.js';
+export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, C as CookieOptions, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshOutcome, l as RefreshedSession, m as SSO_ERROR_MESSAGES, S as SessionData, n as SessionGateDecision, o as SessionGateInput, p as SessionRefresher, q as SessionRefresherConfig, r as SessionUser, T as TokenPayload, s as applyForwardedClientHeaders, t as authErrorMessage, u as brokerPaths, v as createDeviceIdentity, w as createHandoffSource, x as createHandoffTarget, y as createSessionRefresher, z as decodeBase64Url, B as decodeDefaultSession, E as decodeTokenPayload, F as deleteCookie, G as evaluateSessionGate, I as forwardedRequestHeaders, J as handoffErrorMessage, K as hasSessionShape, L as hasTokenAudience, M as isAuthErrorCode, N as isHandoffErrorCode, O as isTokenExpired, P as isTokenExpiringSoon, Q as parseAuthResponse, U as parseRefreshEnvelope, V as readCookie, W as safeInternalPath, X as serializeCookie, Y as setCookie, Z as sourceStartPath, _ as tokenMaxAgeSeconds } from './index-BxyVV6Wt.js';

package/dist/index.js

@@ -53,7 +53,7 @@ function isTokenExpiringSoon(token, bufferSeconds = 120) {
 function decodeDefaultSession(token) {
   const decoded = decodeTokenPayload(token);
   if (!decoded) return null;
-  const actorId = decoded.effective_user_id || decoded.actor_id || decoded.customer_id || decoded.user_id || (typeof decoded.sub === "string" ? decoded.sub : void 0);
+  const actorId = decoded.impersonation_target || decoded.actor_id || decoded.customer_id || decoded.user_id || (typeof decoded.sub === "string" ? decoded.sub : void 0);
   if (!actorId) return null;
   return {
     user: {
@@ -462,6 +462,7 @@ function createHandoffSource(config) {
 }
 
 // src/session-refresh.ts
+var REJECTION_STATUSES = /* @__PURE__ */ new Set([400, 401, 403]);
 var DEFAULT_TTL_MS = 5e3;
 var DEFAULT_MAX = 1e3;
 function parseRefreshEnvelope(value) {
@@ -495,11 +496,22 @@ function createSessionRefresher(config) {
         timeoutMs,
         fetch: config.fetch
       });
-      if (!response.ok) return null;
-      const refreshed = parseRefreshEnvelope(await response.json());
-      return refreshed && hasTokenAudience(refreshed.accessToken, config.audience) ? refreshed : null;
+      if (!response.ok) {
+        return REJECTION_STATUSES.has(response.status) ? { status: "rejected" } : { status: "unavailable" };
+      }
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        return { status: "unavailable" };
+      }
+      const refreshed = parseRefreshEnvelope(parsed);
+      if (!refreshed || !hasTokenAudience(refreshed.accessToken, config.audience)) {
+        return { status: "rejected" };
+      }
+      return { status: "refreshed", session: refreshed };
     } catch {
-      return null;
+      return { status: "unavailable" };
     }
   }
   function prune(now) {
@@ -512,19 +524,32 @@ function createSessionRefresher(config) {
       inflight.delete(oldest);
     }
   }
+  function attempt(refreshToken) {
+    const now = Date.now();
+    prune(now);
+    const existing = inflight.get(refreshToken);
+    if (existing && existing.expiresAt > now) return existing.promise;
+    const promise = perform(refreshToken).then((outcome) => {
+      if (outcome.status !== "refreshed") inflight.delete(refreshToken);
+      return outcome;
+    });
+    inflight.set(refreshToken, { expiresAt: now + ttl, promise });
+    return promise;
+  }
   return {
+    /**
+     * The session, or null for any failure.
+     *
+     * Kept for callers that cannot act on the difference. Anything deciding
+     * whether to CLEAR COOKIES must use {@link attemptRefresh} instead — null
+     * here means "rejected or unreachable", and treating that as rejected
+     * signs a user out because the backend restarted.
+     */
     refresh(refreshToken) {
-      const now = Date.now();
-      prune(now);
-      const existing = inflight.get(refreshToken);
-      if (existing && existing.expiresAt > now) return existing.promise;
-      const promise = perform(refreshToken).then((result) => {
-        if (!result) inflight.delete(refreshToken);
-        return result;
-      });
-      inflight.set(refreshToken, { expiresAt: now + ttl, promise });
-      return promise;
+      return attempt(refreshToken).then((outcome) => outcome.status === "refreshed" ? outcome.session : null);
     },
+    /** The refresh outcome, keeping a rejected token apart from an unreachable backend. */
+    attemptRefresh: attempt,
     size() {
       return inflight.size;
     }
@@ -540,17 +565,23 @@ function hasSessionShape(token) {
 async function evaluateSessionGate(input) {
   const { accessToken, refreshToken, audience, refresher, isPublic, isLoginPath, isApiPath } = input;
   const live = !!accessToken && hasSessionShape(accessToken) && hasTokenAudience(accessToken, audience) && !isTokenExpired(accessToken);
+  const attempt = async (token) => refresher.attemptRefresh ? await refresher.attemptRefresh(token) : await refresher.refresh(token).then(
+    (session) => session ? { status: "refreshed", session } : { status: "rejected" }
+  );
   if (live) {
     if (isPublic && isLoginPath) return { kind: "redirect_home" };
     if (refreshToken && isTokenExpiringSoon(accessToken, input.expiringSoonBufferSeconds)) {
-      const refreshed = await refresher.refresh(refreshToken);
-      if (refreshed) return { kind: "pass", refreshed };
+      const outcome = await attempt(refreshToken);
+      if (outcome.status === "refreshed") return { kind: "pass", refreshed: outcome.session };
     }
     return { kind: "pass" };
   }
   if (refreshToken) {
-    const refreshed = await refresher.refresh(refreshToken);
-    if (refreshed) return isPublic ? { kind: "redirect_home", refreshed } : { kind: "pass", refreshed };
+    const outcome = await attempt(refreshToken);
+    if (outcome.status === "refreshed") {
+      return isPublic ? { kind: "redirect_home", refreshed: outcome.session } : { kind: "pass", refreshed: outcome.session };
+    }
+    if (outcome.status === "unavailable" && !isPublic) return { kind: "unavailable" };
   }
   if (isPublic) return { kind: "anonymous_public" };
   if (isApiPath) return { kind: "unauthorized_api" };

package/dist/next.d.ts

@@ -1,11 +1,9 @@
-import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-aKe58m6n.js';
-export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshedSession, l as SSO_ERROR_MESSAGES, m as SessionGateDecision, n as SessionGateInput, o as SessionRefresher, p as SessionRefresherConfig, q as SessionUser, T as TokenPayload, r as applyForwardedClientHeaders, s as authErrorMessage, t as brokerPaths, u as createDeviceIdentity, v as createHandoffSource, w as createHandoffTarget, x as createSessionRefresher, y as decodeBase64Url, z as decodeDefaultSession, B as decodeTokenPayload, E as deleteCookie, F as evaluateSessionGate, G as forwardedRequestHeaders, I as handoffErrorMessage, J as hasSessionShape, K as hasTokenAudience, L as isAuthErrorCode, M as isHandoffErrorCode, N as isTokenExpired, O as isTokenExpiringSoon, P as parseAuthResponse, Q as parseRefreshEnvelope, U as readCookie, V as safeInternalPath, W as serializeCookie, X as setCookie, Y as sourceStartPath, Z as tokenMaxAgeSeconds } from './index-aKe58m6n.js';
+import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-BxyVV6Wt.js';
+export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshOutcome, l as RefreshedSession, m as SSO_ERROR_MESSAGES, n as SessionGateDecision, o as SessionGateInput, p as SessionRefresher, q as SessionRefresherConfig, r as SessionUser, T as TokenPayload, s as applyForwardedClientHeaders, t as authErrorMessage, u as brokerPaths, v as createDeviceIdentity, w as createHandoffSource, x as createHandoffTarget, y as createSessionRefresher, z as decodeBase64Url, B as decodeDefaultSession, E as decodeTokenPayload, F as deleteCookie, G as evaluateSessionGate, I as forwardedRequestHeaders, J as handoffErrorMessage, K as hasSessionShape, L as hasTokenAudience, M as isAuthErrorCode, N as isHandoffErrorCode, O as isTokenExpired, P as isTokenExpiringSoon, Q as parseAuthResponse, U as parseRefreshEnvelope, V as readCookie, W as safeInternalPath, X as serializeCookie, Y as setCookie, Z as sourceStartPath, _ as tokenMaxAgeSeconds } from './index-BxyVV6Wt.js';
 
 /**
- * The error vocabulary every first-party platform surface uses at its edge.
- * Platform Admin, SaaSDash, the Affiliate Portal and the Knowledge Library
- * each carried a private copy of these classes; they are the same four
- * everywhere because the backend's 401 codes are the same everywhere.
+ * The error vocabulary every first-party platform surface uses at its edge,
+ * mirroring the backend's 401 codes.
  */
 declare class SessionExpiredError extends Error {
     constructor();
@@ -132,11 +130,9 @@ interface SessionWriteOptions {
     cookieDomain?: string;
 }
 /**
- * Session cookies for a first-party Next.js platform surface, written once.
+ * Session cookies for a first-party Next.js platform surface.
  *
- * Every consumer had reimplemented this — Platform Admin, SaaSDash (via
- * shared-auth), the Affiliate Portal and the Knowledge Library — around the
- * same primitives, with the same three cookies and the same rules:
+ * Three cookies, with these rules:
  *
  * - rememberMe=false → no Max-Age, so the cookies die with the browser; true →
  *   the configured cap, shortened to the token's own expiry.

package/dist/next.js

@@ -58,7 +58,7 @@ function isTokenExpiringSoon(token, bufferSeconds = 120) {
 function decodeDefaultSession(token) {
   const decoded = decodeTokenPayload(token);
   if (!decoded) return null;
-  const actorId = decoded.effective_user_id || decoded.actor_id || decoded.customer_id || decoded.user_id || (typeof decoded.sub === "string" ? decoded.sub : void 0);
+  const actorId = decoded.impersonation_target || decoded.actor_id || decoded.customer_id || decoded.user_id || (typeof decoded.sub === "string" ? decoded.sub : void 0);
   if (!actorId) return null;
   return {
     user: {
@@ -467,6 +467,7 @@ function createHandoffSource(config) {
 }
 
 // src/session-refresh.ts
+var REJECTION_STATUSES = /* @__PURE__ */ new Set([400, 401, 403]);
 var DEFAULT_TTL_MS = 5e3;
 var DEFAULT_MAX = 1e3;
 function parseRefreshEnvelope(value) {
@@ -500,11 +501,22 @@ function createSessionRefresher(config) {
         timeoutMs,
         fetch: config.fetch
       });
-      if (!response.ok) return null;
-      const refreshed = parseRefreshEnvelope(await response.json());
-      return refreshed && hasTokenAudience(refreshed.accessToken, config.audience) ? refreshed : null;
+      if (!response.ok) {
+        return REJECTION_STATUSES.has(response.status) ? { status: "rejected" } : { status: "unavailable" };
+      }
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        return { status: "unavailable" };
+      }
+      const refreshed = parseRefreshEnvelope(parsed);
+      if (!refreshed || !hasTokenAudience(refreshed.accessToken, config.audience)) {
+        return { status: "rejected" };
+      }
+      return { status: "refreshed", session: refreshed };
     } catch {
-      return null;
+      return { status: "unavailable" };
     }
   }
   function prune(now) {
@@ -517,19 +529,32 @@ function createSessionRefresher(config) {
       inflight.delete(oldest);
     }
   }
+  function attempt(refreshToken) {
+    const now = Date.now();
+    prune(now);
+    const existing = inflight.get(refreshToken);
+    if (existing && existing.expiresAt > now) return existing.promise;
+    const promise = perform(refreshToken).then((outcome) => {
+      if (outcome.status !== "refreshed") inflight.delete(refreshToken);
+      return outcome;
+    });
+    inflight.set(refreshToken, { expiresAt: now + ttl, promise });
+    return promise;
+  }
   return {
+    /**
+     * The session, or null for any failure.
+     *
+     * Kept for callers that cannot act on the difference. Anything deciding
+     * whether to CLEAR COOKIES must use {@link attemptRefresh} instead — null
+     * here means "rejected or unreachable", and treating that as rejected
+     * signs a user out because the backend restarted.
+     */
     refresh(refreshToken) {
-      const now = Date.now();
-      prune(now);
-      const existing = inflight.get(refreshToken);
-      if (existing && existing.expiresAt > now) return existing.promise;
-      const promise = perform(refreshToken).then((result) => {
-        if (!result) inflight.delete(refreshToken);
-        return result;
-      });
-      inflight.set(refreshToken, { expiresAt: now + ttl, promise });
-      return promise;
+      return attempt(refreshToken).then((outcome) => outcome.status === "refreshed" ? outcome.session : null);
     },
+    /** The refresh outcome, keeping a rejected token apart from an unreachable backend. */
+    attemptRefresh: attempt,
     size() {
       return inflight.size;
     }
@@ -545,17 +570,23 @@ function hasSessionShape(token) {
 async function evaluateSessionGate(input) {
   const { accessToken, refreshToken, audience, refresher, isPublic, isLoginPath, isApiPath } = input;
   const live = !!accessToken && hasSessionShape(accessToken) && hasTokenAudience(accessToken, audience) && !isTokenExpired(accessToken);
+  const attempt = async (token) => refresher.attemptRefresh ? await refresher.attemptRefresh(token) : await refresher.refresh(token).then(
+    (session) => session ? { status: "refreshed", session } : { status: "rejected" }
+  );
   if (live) {
     if (isPublic && isLoginPath) return { kind: "redirect_home" };
     if (refreshToken && isTokenExpiringSoon(accessToken, input.expiringSoonBufferSeconds)) {
-      const refreshed = await refresher.refresh(refreshToken);
-      if (refreshed) return { kind: "pass", refreshed };
+      const outcome = await attempt(refreshToken);
+      if (outcome.status === "refreshed") return { kind: "pass", refreshed: outcome.session };
     }
     return { kind: "pass" };
   }
   if (refreshToken) {
-    const refreshed = await refresher.refresh(refreshToken);
-    if (refreshed) return isPublic ? { kind: "redirect_home", refreshed } : { kind: "pass", refreshed };
+    const outcome = await attempt(refreshToken);
+    if (outcome.status === "refreshed") {
+      return isPublic ? { kind: "redirect_home", refreshed: outcome.session } : { kind: "pass", refreshed: outcome.session };
+    }
+    if (outcome.status === "unavailable" && !isPublic) return { kind: "unavailable" };
   }
   if (isPublic) return { kind: "anonymous_public" };
   if (isApiPath) return { kind: "unauthorized_api" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",
@@ -20,10 +20,6 @@
       "types": "./dist/next.d.ts",
       "default": "./dist/next.js"
     },
-    "./service-accounts": {
-      "types": "./dist/service-accounts.d.ts",
-      "default": "./dist/service-accounts.js"
-    },
     "./access": {
       "types": "./dist/access/index.d.ts",
       "default": "./dist/access/index.js"
@@ -56,9 +52,10 @@
     "next": "16.3.1",
     "react": "19.2.4",
     "react-dom": "19.2.4",
+    "tsup": "^8.5.1",
     "typescript": "5.9.3",
     "vitest": "^4.1.4",
-    "tsup": "^8.5.1",
+    "@c1m-public/resilience": "0.1.0",
     "@c1m-public/transport": "0.0.0"
   },
   "peerDependencies": {

package/dist/service-accounts.d.ts

@@ -1,149 +0,0 @@
-declare const SERVICE_ACCOUNTS_VIEW_PERMISSION: "platform.service_accounts.view";
-declare const SERVICE_ACCOUNTS_MANAGE_PERMISSION: "platform.service_accounts.manage";
-type ServiceAccountAudience = "platform" | `dash:${string}`;
-type ServiceAccountGrantScope = "platform" | "dash_id";
-type ServiceAccountOperation = "platform.identity.service_accounts.list" | "platform.identity.service_accounts.create" | "platform.identity.service_accounts.get" | "platform.identity.service_accounts.update" | "platform.identity.service_accounts.grants.list" | "platform.identity.service_accounts.grants.replace" | "platform.identity.service_accounts.credentials.list" | "platform.identity.service_accounts.credentials.mint" | "platform.identity.service_accounts.credentials.revoke";
-type ServiceAccountRequestOutcome = "success" | "api_error" | "network_error" | "timeout" | "invalid_response" | "cancelled";
-interface ServiceAccountView {
-    id: string;
-    name: string;
-    purpose: string;
-    owner_user_id: string;
-    enabled: boolean;
-    version: number;
-    created_by: string;
-    updated_by: string;
-    created_at: string;
-    updated_at: string;
-}
-interface ServiceAccountEnvelope {
-    service_account: ServiceAccountView;
-}
-interface ServiceAccountPage {
-    items: ServiceAccountView[];
-    next_cursor?: string;
-    has_more: boolean;
-}
-interface ServiceAccountGrant {
-    grant_key: string;
-    scope_type: string;
-    scope_id: string;
-    id?: string;
-    subject_id?: string;
-    subject_type?: string;
-    granted_by?: string;
-    created_at?: string;
-}
-interface ServiceAccountGrantInput {
-    grant_key: string;
-    scope_type: ServiceAccountGrantScope;
-    scope_id: string;
-}
-interface ServiceAccountGrantPage {
-    items: ServiceAccountGrant[];
-}
-interface ServiceAccountCredential {
-    id: string;
-    service_account_id: string;
-    name: string;
-    audience: ServiceAccountAudience;
-    permissions: string[];
-    operation_ids: string[];
-    dash_ids: string[];
-    max_output_bytes: number;
-    created_by: string;
-    created_at: string;
-    expires_at: string;
-    last_used_at?: string;
-    revoked_at?: string;
-}
-interface ServiceAccountCredentialPage {
-    items: ServiceAccountCredential[];
-    next_cursor?: string;
-    has_more: boolean;
-}
-interface CreateServiceAccountInput {
-    name: string;
-    purpose: string;
-    owner_user_id: string;
-    reason: string;
-}
-interface UpdateServiceAccountInput extends CreateServiceAccountInput {
-    enabled: boolean;
-    expected_version: number;
-}
-interface ReplaceServiceAccountGrantsInput {
-    grants: ServiceAccountGrantInput[];
-    expected_version: number;
-    reason: string;
-}
-type ServiceAccountCredentialTemplate = "read_only" | "full" | "custom";
-interface MintServiceAccountCredentialInput {
-    name: string;
-    audience: ServiceAccountAudience;
-    /** Authority template; `custom` names the permissions to carry. Operations are derived server-side. */
-    template: ServiceAccountCredentialTemplate;
-    permissions?: string[];
-    dash_ids: string[];
-    expires_in_days: number;
-    expected_version: number;
-    reason: string;
-    max_output_bytes?: number;
-}
-interface MintServiceAccountCredentialResponse {
-    credential: ServiceAccountCredential;
-    /** One-time presented secret. The server never returns it again. */
-    secret: string;
-}
-interface RevokeServiceAccountCredentialInput {
-    expected_version: number;
-    reason: string;
-}
-interface ServiceAccountListParams {
-    cursor?: string;
-    limit?: number;
-}
-interface ServiceAccountRequestObservation {
-    operation: ServiceAccountOperation;
-    method: string;
-    outcome: ServiceAccountRequestOutcome;
-    status: number;
-    requestId: string;
-    durationMs: number;
-    attempts: number;
-}
-interface CreateServiceAccountClientOptions {
-    baseUrl: string;
-    getAccessToken: () => Promise<string | null | undefined> | string | null | undefined;
-    getHeaders?: () => Promise<HeadersInit | undefined> | HeadersInit | undefined;
-    fetch?: typeof globalThis.fetch;
-    /** Per attempt (default 10000). */
-    timeoutMs?: number;
-    /** Additional attempts for GET only (default 1). Mutations are never retried. */
-    retryAttempts?: number;
-    /** Cap on one retry delay (default 2000). */
-    maxRetryDelayMs?: number;
-    observe?: (event: ServiceAccountRequestObservation) => void;
-    signal?: AbortSignal;
-}
-declare class ServiceAccountAPIError extends Error {
-    readonly status: number;
-    readonly code: string;
-    readonly requestId: string;
-    constructor(message: string, status: number, code: string, requestId: string);
-}
-declare function isServiceAccountAPIError(error: unknown): error is ServiceAccountAPIError;
-declare function createServiceAccountClient(options: CreateServiceAccountClientOptions): {
-    readonly list: (params?: ServiceAccountListParams) => Promise<ServiceAccountPage>;
-    readonly get: (serviceAccountID: string) => Promise<ServiceAccountEnvelope>;
-    readonly create: (input: CreateServiceAccountInput) => Promise<ServiceAccountEnvelope>;
-    readonly update: (serviceAccountID: string, input: UpdateServiceAccountInput) => Promise<ServiceAccountEnvelope>;
-    readonly listGrants: (serviceAccountID: string) => Promise<ServiceAccountGrantPage>;
-    readonly replaceGrants: (serviceAccountID: string, input: ReplaceServiceAccountGrantsInput) => Promise<ServiceAccountEnvelope>;
-    readonly listCredentials: (serviceAccountID: string, params?: ServiceAccountListParams) => Promise<ServiceAccountCredentialPage>;
-    readonly mintCredential: (serviceAccountID: string, input: MintServiceAccountCredentialInput) => Promise<MintServiceAccountCredentialResponse>;
-    readonly revokeCredential: (serviceAccountID: string, credentialID: string, input: RevokeServiceAccountCredentialInput) => Promise<ServiceAccountEnvelope>;
-};
-type ServiceAccountClient = ReturnType<typeof createServiceAccountClient>;
-
-export { type CreateServiceAccountClientOptions, type CreateServiceAccountInput, type MintServiceAccountCredentialInput, type MintServiceAccountCredentialResponse, type ReplaceServiceAccountGrantsInput, type RevokeServiceAccountCredentialInput, SERVICE_ACCOUNTS_MANAGE_PERMISSION, SERVICE_ACCOUNTS_VIEW_PERMISSION, ServiceAccountAPIError, type ServiceAccountAudience, type ServiceAccountClient, type ServiceAccountCredential, type ServiceAccountCredentialPage, type ServiceAccountCredentialTemplate, type ServiceAccountEnvelope, type ServiceAccountGrant, type ServiceAccountGrantInput, type ServiceAccountGrantPage, type ServiceAccountGrantScope, type ServiceAccountListParams, type ServiceAccountOperation, type ServiceAccountPage, type ServiceAccountRequestObservation, type ServiceAccountRequestOutcome, type ServiceAccountView, type UpdateServiceAccountInput, createServiceAccountClient, isServiceAccountAPIError };

package/dist/service-accounts.js

@@ -1,484 +0,0 @@
-// ../transport/src/index.ts
-var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
-var TransportError = class extends Error {
-  constructor(failure) {
-    super(failure.message || failure.outcome);
-    this.failure = failure;
-    this.name = "TransportError";
-  }
-  failure;
-};
-function isTransportError(error) {
-  return error instanceof TransportError || typeof error === "object" && error !== null && error.name === "TransportError";
-}
-function positiveNumber(value, label, fail) {
-  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) throw fail(`${label} must be a positive finite number`);
-  return value;
-}
-function nonNegativeInteger(value, label, fail) {
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw fail(`${label} must be a non-negative safe integer`);
-  return value;
-}
-function requiredString(value, label, fail) {
-  const normalized = typeof value === "string" ? value.trim() : "";
-  if (!normalized) throw fail(`${label} is required`);
-  return normalized;
-}
-function backoffDelay(attempt, maxDelayMs) {
-  const base = Math.min(250 * 2 ** Math.max(attempt, 0), maxDelayMs);
-  return Math.floor(Math.random() * base);
-}
-function retryDelay(response, attempt, maxDelayMs) {
-  const value = response.headers.get("Retry-After");
-  if (!value) return backoffDelay(attempt, maxDelayMs);
-  const seconds = Number(value);
-  if (Number.isFinite(seconds)) return Math.min(Math.max(seconds * 1e3, 0), maxDelayMs);
-  const date = Date.parse(value);
-  return Number.isNaN(date) ? backoffDelay(attempt, maxDelayMs) : Math.min(Math.max(date - Date.now(), 0), maxDelayMs);
-}
-function wait(ms) {
-  return ms <= 0 ? Promise.resolve() : new Promise((resolve) => setTimeout(resolve, ms));
-}
-function combineSignals(...signals) {
-  const active = signals.filter((signal) => Boolean(signal));
-  if (active.length === 0) return void 0;
-  if (active.length === 1) return active[0];
-  return AbortSignal.any(active);
-}
-function isRetryableRequest(method, headers, retry) {
-  if (method === "GET") return true;
-  return retry.idempotentWrites === true && headers.has("Idempotency-Key");
-}
-async function performRequest(transport, url, init, observe, decode) {
-  const method = (init.method ?? "GET").toUpperCase();
-  const headers = new Headers(init.headers);
-  const startedAt = Date.now();
-  const retryable = isRetryableRequest(method, headers, transport.retry);
-  const maxAttempts = retryable ? transport.retry.attempts : 0;
-  let attempts = 0;
-  let status = 0;
-  let requestId = "";
-  let outcome = "network_error";
-  const fail = (failure) => {
-    outcome = failure.outcome;
-    throw new TransportError({ requestId, ...failure });
-  };
-  try {
-    let response;
-    for (let attempt = 0; attempt <= maxAttempts; attempt += 1) {
-      attempts = attempt + 1;
-      const controller = new AbortController();
-      const timeout = setTimeout(() => controller.abort(), transport.timeoutMs);
-      try {
-        response = await transport.fetch(url, {
-          ...init,
-          method,
-          headers,
-          signal: combineSignals(transport.signal, init.signal, controller.signal)
-        });
-      } catch {
-        if (controller.signal.aborted) fail({ outcome: "timeout", status: 0, code: "", message: "" });
-        if (transport.signal?.aborted || init.signal?.aborted) fail({ outcome: "cancelled", status: 0, code: "", message: "" });
-        if (attempt < maxAttempts) {
-          await wait(backoffDelay(attempt, transport.retry.maxDelayMs));
-          continue;
-        }
-        fail({ outcome: "network_error", status: 0, code: "", message: "" });
-      } finally {
-        clearTimeout(timeout);
-      }
-      if (!RETRYABLE_STATUSES.has(response.status) || attempt === maxAttempts) break;
-      await wait(retryDelay(response, attempt, transport.retry.maxDelayMs));
-    }
-    if (!response) return fail({ outcome: "network_error", status: 0, code: "", message: "" });
-    status = response.status;
-    requestId = response.headers.get("X-Request-ID") ?? "";
-    if (!response.ok) {
-      const envelope = await response.json().catch(() => ({}));
-      if (typeof envelope.request_id === "string") requestId = envelope.request_id;
-      return fail({
-        outcome: "api_error",
-        status,
-        code: typeof envelope.code === "string" ? envelope.code : "",
-        message: typeof envelope.message === "string" ? envelope.message : "",
-        requestId
-      });
-    }
-    let payload;
-    try {
-      if (status === 204) {
-        payload = void 0;
-      } else {
-        const text = await response.text();
-        const parsed = text ? JSON.parse(text) : void 0;
-        payload = decode ? decode(parsed) : parsed;
-      }
-    } catch {
-      return fail({ outcome: "invalid_response", status, code: "", message: "", requestId });
-    }
-    outcome = "success";
-    return { payload, status, requestId };
-  } finally {
-    if (observe) {
-      try {
-        observe({ method, outcome, status, requestId, durationMs: Math.max(0, Date.now() - startedAt), attempts });
-      } catch {
-      }
-    }
-  }
-}
-
-// src/service-accounts.ts
-var SERVICE_ACCOUNTS_VIEW_PERMISSION = "platform.service_accounts.view";
-var SERVICE_ACCOUNTS_MANAGE_PERMISSION = "platform.service_accounts.manage";
-var ServiceAccountAPIError = class extends Error {
-  constructor(message, status, code, requestId) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.requestId = requestId;
-    this.name = "ServiceAccountAPIError";
-  }
-  status;
-  code;
-  requestId;
-};
-function isServiceAccountAPIError(error) {
-  return error instanceof ServiceAccountAPIError || typeof error === "object" && error !== null && error.name === "ServiceAccountAPIError" && typeof error.status === "number" && typeof error.code === "string" && typeof error.requestId === "string";
-}
-var basePath = "/api/v1/platform/identity/service-accounts";
-var uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var credentialIDPattern = /^[0-9a-f]{32}$/;
-var timestampPattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
-var secretPattern = /^mml_sa_([0-9a-f]{32})_([0-9a-f]{64})$/;
-var configurationError = (message) => new Error(message);
-function invalidResponse() {
-  throw new Error("invalid Service Account response");
-}
-function objectValue(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) invalidResponse();
-  return value;
-}
-function responseString(value, options = {}) {
-  if (value === void 0 && options.optional) return void 0;
-  if (typeof value !== "string" || value.length === 0) invalidResponse();
-  if (options.pattern && !options.pattern.test(value)) invalidResponse();
-  if (options.timestamp && (!timestampPattern.test(value) || !Number.isFinite(Date.parse(value)))) invalidResponse();
-  return value;
-}
-function responseStrings(value) {
-  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0)) {
-    invalidResponse();
-  }
-  return [...value];
-}
-function positiveIntegerResponse(value) {
-  if (!Number.isSafeInteger(value) || Number(value) < 1) invalidResponse();
-  return Number(value);
-}
-function parseServiceAccount(value) {
-  const account = objectValue(value);
-  if (typeof account.enabled !== "boolean") invalidResponse();
-  return {
-    id: responseString(account.id, { pattern: uuidPattern }),
-    name: responseString(account.name),
-    purpose: responseString(account.purpose),
-    owner_user_id: responseString(account.owner_user_id),
-    enabled: account.enabled,
-    version: positiveIntegerResponse(account.version),
-    created_by: responseString(account.created_by),
-    updated_by: responseString(account.updated_by),
-    created_at: responseString(account.created_at, { timestamp: true }),
-    updated_at: responseString(account.updated_at, { timestamp: true })
-  };
-}
-function parseServiceAccountEnvelope(value) {
-  return { service_account: parseServiceAccount(objectValue(value).service_account) };
-}
-function parsePage(value, parseItem) {
-  const page = objectValue(value);
-  if (!Array.isArray(page.items) || typeof page.has_more !== "boolean") invalidResponse();
-  const nextCursor = responseString(page.next_cursor, { optional: true });
-  if (Boolean(nextCursor) !== page.has_more) invalidResponse();
-  return { items: page.items.map(parseItem), next_cursor: nextCursor, has_more: page.has_more };
-}
-function parseGrant(value) {
-  const grant = objectValue(value);
-  return {
-    grant_key: responseString(grant.grant_key),
-    scope_type: responseString(grant.scope_type),
-    scope_id: responseString(grant.scope_id),
-    id: responseString(grant.id, { optional: true }),
-    subject_id: responseString(grant.subject_id, { optional: true }),
-    subject_type: responseString(grant.subject_type, { optional: true }),
-    granted_by: responseString(grant.granted_by, { optional: true }),
-    created_at: responseString(grant.created_at, { optional: true, timestamp: true })
-  };
-}
-function parseCredential(value) {
-  const credential = objectValue(value);
-  const audience = responseString(credential.audience);
-  if (audience !== "platform" && !audience.startsWith("dash:")) invalidResponse();
-  return {
-    id: responseString(credential.id, { pattern: credentialIDPattern }),
-    service_account_id: responseString(credential.service_account_id, { pattern: uuidPattern }),
-    name: responseString(credential.name),
-    audience,
-    permissions: responseStrings(credential.permissions),
-    operation_ids: responseStrings(credential.operation_ids),
-    dash_ids: responseStrings(credential.dash_ids),
-    max_output_bytes: positiveIntegerResponse(credential.max_output_bytes),
-    created_by: responseString(credential.created_by),
-    created_at: responseString(credential.created_at, { timestamp: true }),
-    expires_at: responseString(credential.expires_at, { timestamp: true }),
-    last_used_at: responseString(credential.last_used_at, { optional: true, timestamp: true }),
-    revoked_at: responseString(credential.revoked_at, { optional: true, timestamp: true })
-  };
-}
-function parseMintedCredential(value) {
-  const minted = objectValue(value);
-  const credential = parseCredential(minted.credential);
-  const secret = responseString(minted.secret);
-  const match = secret.match(secretPattern);
-  if (!match || match[1] !== credential.id) invalidResponse();
-  return { credential, secret };
-}
-function canonicalID(value, label, pattern) {
-  const id = requiredString(value, label, configurationError);
-  if (!pattern.test(id)) throw configurationError(`${label} is invalid`);
-  return id;
-}
-function version(value) {
-  if (!Number.isSafeInteger(value) || value < 1) throw configurationError("expected_version must be a positive integer");
-  return value;
-}
-function reason(value) {
-  const normalized = requiredString(value, "reason", configurationError);
-  if (normalized.length > 500) throw configurationError("reason must be 500 characters or fewer");
-  return normalized;
-}
-function accountFields(input) {
-  const name = requiredString(input.name, "name", configurationError);
-  const purpose = requiredString(input.purpose, "purpose", configurationError);
-  const ownerUserID = requiredString(input.owner_user_id, "owner_user_id", configurationError);
-  if (name.length > 64) throw configurationError("name must be 64 characters or fewer");
-  if (purpose.length > 500) throw configurationError("purpose must be 500 characters or fewer");
-  return { name, purpose, owner_user_id: ownerUserID, reason: reason(input.reason) };
-}
-function listQuery(params) {
-  const query = new URLSearchParams();
-  const cursor = params.cursor?.trim();
-  if (cursor) query.set("cursor", cursor);
-  if (params.limit !== void 0) {
-    const limit = positiveNumber(params.limit, "limit", configurationError);
-    if (!Number.isSafeInteger(limit) || limit > 100) throw configurationError("limit must be an integer from 1 to 100");
-    query.set("limit", String(limit));
-  }
-  return query.size ? `?${query}` : "";
-}
-function grantInput(value) {
-  const grantKey = requiredString(value.grant_key, "grant_key", configurationError);
-  if (value.scope_type !== "platform" && value.scope_type !== "dash_id") {
-    throw configurationError("scope_type must be platform or dash_id");
-  }
-  const scopeID = requiredString(value.scope_id, "scope_id", configurationError);
-  if (value.scope_type === "platform" && scopeID !== "*") {
-    throw configurationError('platform grants must use scope_id "*"');
-  }
-  if (value.scope_type === "dash_id" && scopeID === "*") {
-    throw configurationError("service-account Dash grants must name one Dash");
-  }
-  return { grant_key: grantKey, scope_type: value.scope_type, scope_id: scopeID };
-}
-function mintInput(value) {
-  const name = requiredString(value.name, "name", configurationError);
-  if (name.length > 64) throw configurationError("name must be 64 characters or fewer");
-  const audience = requiredString(value.audience, "audience", configurationError);
-  if (audience !== "platform" && !audience.startsWith("dash:")) {
-    throw configurationError("audience must be platform or dash:<dash_id>");
-  }
-  if (value.template !== "read_only" && value.template !== "full" && value.template !== "custom") {
-    throw configurationError("template must be read_only, full or custom");
-  }
-  const permissions = [...new Set((value.permissions ?? []).map((item) => requiredString(item, "permission", configurationError)))];
-  if (value.template === "custom" && (permissions.length < 1 || permissions.length > 64)) {
-    throw configurationError("a custom template must name 1 to 64 permissions");
-  }
-  const dashIDs = [...new Set(value.dash_ids.map((item) => requiredString(item, "dash_id", configurationError)))];
-  if (dashIDs.length > 32 || dashIDs.includes("*")) throw configurationError("dash_ids must name at most 32 explicit Dashes");
-  if (audience.startsWith("dash:") && (dashIDs.length !== 1 || dashIDs[0] !== audience.slice(5))) {
-    throw configurationError("a Dash audience requires exactly its route Dash in dash_ids");
-  }
-  if (!Number.isSafeInteger(value.expires_in_days) || value.expires_in_days < 1 || value.expires_in_days > 30) {
-    throw configurationError("expires_in_days must be an integer from 1 to 30");
-  }
-  if (value.max_output_bytes !== void 0 && (!Number.isSafeInteger(value.max_output_bytes) || value.max_output_bytes < 1 || value.max_output_bytes > 1048576)) {
-    throw configurationError("max_output_bytes must be an integer from 1 to 1048576");
-  }
-  return {
-    name,
-    audience,
-    template: value.template,
-    ...value.template === "custom" ? { permissions } : {},
-    dash_ids: dashIDs,
-    expires_in_days: value.expires_in_days,
-    expected_version: version(value.expected_version),
-    reason: reason(value.reason),
-    ...value.max_output_bytes === void 0 ? {} : { max_output_bytes: value.max_output_bytes }
-  };
-}
-function createServiceAccountClient(options) {
-  const baseUrl = requiredString(options.baseUrl, "baseUrl", configurationError).replace(/\/+$/, "");
-  const transport = {
-    fetch: (input, init) => (options.fetch ?? globalThis.fetch)(input, init),
-    timeoutMs: positiveNumber(options.timeoutMs ?? 1e4, "timeoutMs", configurationError),
-    retry: {
-      attempts: nonNegativeInteger(options.retryAttempts ?? 1, "retryAttempts", configurationError),
-      maxDelayMs: positiveNumber(options.maxRetryDelayMs ?? 2e3, "maxRetryDelayMs", configurationError),
-      idempotentWrites: false
-    },
-    signal: options.signal
-  };
-  async function request(operation, path, decode, init = {}) {
-    const method = (init.method ?? "GET").toUpperCase();
-    const report = options.observe && ((event) => {
-      options.observe?.({ operation, ...event });
-    });
-    let headers;
-    try {
-      const accessToken = requiredString(await options.getAccessToken() ?? "", "access token", configurationError);
-      headers = new Headers(await options.getHeaders?.());
-      new Headers(init.headers).forEach((value, key) => headers.set(key, value));
-      headers.set("Authorization", `Bearer ${accessToken}`);
-      headers.set("Accept", "application/json");
-      if (init.body !== void 0) headers.set("Content-Type", "application/json");
-    } catch (error) {
-      try {
-        report?.({ method, outcome: "network_error", status: 0, requestId: "", durationMs: 0, attempts: 0 });
-      } catch {
-      }
-      throw error;
-    }
-    try {
-      const result = await performRequest(
-        transport,
-        `${baseUrl}${path}`,
-        { ...init, method, headers, cache: "no-store" },
-        report,
-        decode
-      );
-      return result.payload;
-    } catch (error) {
-      if (!isTransportError(error)) throw error;
-      const { outcome, status, code, message, requestId } = error.failure;
-      switch (outcome) {
-        case "timeout":
-          throw new ServiceAccountAPIError("Service Account request timed out", 0, "service_account_request_timeout", "");
-        case "cancelled":
-          throw new ServiceAccountAPIError("Service Account request was cancelled", 0, "service_account_request_cancelled", "");
-        case "network_error":
-          throw new ServiceAccountAPIError("Service Account service is unavailable", 0, "service_account_service_unavailable", "");
-        case "invalid_response":
-          throw new ServiceAccountAPIError("Service Account service returned an invalid response", status, "service_account_invalid_response", requestId);
-        case "api_error":
-          throw new ServiceAccountAPIError(message || code || "Service Account request failed", status, code, requestId);
-      }
-    }
-  }
-  function accountPath(serviceAccountID) {
-    return `${basePath}/${canonicalID(serviceAccountID, "serviceAccountId", uuidPattern)}`;
-  }
-  return {
-    list(params = {}) {
-      return request(
-        "platform.identity.service_accounts.list",
-        `${basePath}${listQuery(params)}`,
-        (payload) => parsePage(payload, parseServiceAccount)
-      );
-    },
-    get(serviceAccountID) {
-      return request(
-        "platform.identity.service_accounts.get",
-        accountPath(serviceAccountID),
-        parseServiceAccountEnvelope
-      );
-    },
-    create(input) {
-      return request(
-        "platform.identity.service_accounts.create",
-        basePath,
-        parseServiceAccountEnvelope,
-        { method: "POST", body: JSON.stringify(accountFields(input)) }
-      );
-    },
-    update(serviceAccountID, input) {
-      const fields = accountFields(input);
-      return request(
-        "platform.identity.service_accounts.update",
-        accountPath(serviceAccountID),
-        parseServiceAccountEnvelope,
-        {
-          method: "PUT",
-          body: JSON.stringify({ ...fields, enabled: input.enabled, expected_version: version(input.expected_version) })
-        }
-      );
-    },
-    listGrants(serviceAccountID) {
-      return request(
-        "platform.identity.service_accounts.grants.list",
-        `${accountPath(serviceAccountID)}/grants`,
-        (payload) => {
-          const page = objectValue(payload);
-          if (!Array.isArray(page.items)) invalidResponse();
-          return { items: page.items.map(parseGrant) };
-        }
-      );
-    },
-    replaceGrants(serviceAccountID, input) {
-      if (!Array.isArray(input.grants) || input.grants.length > 32) {
-        throw configurationError("grants must contain at most 32 entries");
-      }
-      return request(
-        "platform.identity.service_accounts.grants.replace",
-        `${accountPath(serviceAccountID)}/grants`,
-        parseServiceAccountEnvelope,
-        {
-          method: "PUT",
-          body: JSON.stringify({
-            grants: input.grants.map(grantInput),
-            expected_version: version(input.expected_version),
-            reason: reason(input.reason)
-          })
-        }
-      );
-    },
-    listCredentials(serviceAccountID, params = {}) {
-      return request(
-        "platform.identity.service_accounts.credentials.list",
-        `${accountPath(serviceAccountID)}/credentials${listQuery(params)}`,
-        (payload) => parsePage(payload, parseCredential)
-      );
-    },
-    mintCredential(serviceAccountID, input) {
-      return request(
-        "platform.identity.service_accounts.credentials.mint",
-        `${accountPath(serviceAccountID)}/credentials`,
-        parseMintedCredential,
-        { method: "POST", body: JSON.stringify(mintInput(input)) }
-      );
-    },
-    revokeCredential(serviceAccountID, credentialID, input) {
-      return request(
-        "platform.identity.service_accounts.credentials.revoke",
-        `${accountPath(serviceAccountID)}/credentials/${canonicalID(credentialID, "credentialId", credentialIDPattern)}`,
-        parseServiceAccountEnvelope,
-        {
-          method: "DELETE",
-          body: JSON.stringify({ expected_version: version(input.expected_version), reason: reason(input.reason) })
-        }
-      );
-    }
-  };
-}
-
-export { SERVICE_ACCOUNTS_MANAGE_PERMISSION, SERVICE_ACCOUNTS_VIEW_PERMISSION, ServiceAccountAPIError, createServiceAccountClient, isServiceAccountAPIError };