@c1m-public/platform-auth 0.22.0 → 0.23.0

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-XWID1Fkg.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-FoojTvYk.js';

package/dist/access/index.js

@@ -306,7 +306,7 @@ function resolveValue(value) {
   return typeof value === "function" ? value() : value;
 }
 async function timedFetch(url, options = {}) {
-  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const doFetch = options.fetch ?? fetch;
   const controller = options.timeoutMs ? new AbortController() : void 0;
   const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
   try {
@@ -331,8 +331,8 @@ async function fetchAccessSnapshot(opts) {
   try {
     response = await timedFetch(url, {
       init: { method: "GET", headers },
-      timeoutMs: opts.fetchTimeoutMs,
-      fetchImpl: opts.fetchImpl
+      timeoutMs: opts.timeoutMs ?? opts.fetchTimeoutMs,
+      fetch: opts.fetch ?? opts.fetchImpl
     });
   } catch (error) {
     throw new AccessSnapshotError("unavailable", `access snapshot request failed: ${error.message}`);

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-XWID1Fkg.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-XWID1Fkg.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-FoojTvYk.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-FoojTvYk.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;
@@ -14,8 +14,8 @@ interface CreateAccessLoaderOptions {
      * per-subject rather than sharing one tag across users.
      */
     getSubjectId?: () => Promise<string | null>;
-    fetchTimeoutMs?: number;
-    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
     headers?: () => Promise<HeadersInit | undefined> | HeadersInit | undefined;
     /**
      * Optional cross-request cache seam. When provided, the loader calls this

package/dist/access/next.js

@@ -10,7 +10,7 @@ function resolveValue(value) {
   return typeof value === "function" ? value() : value;
 }
 async function timedFetch(url, options = {}) {
-  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const doFetch = options.fetch ?? fetch;
   const controller = options.timeoutMs ? new AbortController() : void 0;
   const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
   try {
@@ -180,8 +180,8 @@ async function fetchAccessSnapshot(opts) {
   try {
     response = await timedFetch(url, {
       init: { method: "GET", headers },
-      timeoutMs: opts.fetchTimeoutMs,
-      fetchImpl: opts.fetchImpl
+      timeoutMs: opts.timeoutMs ?? opts.fetchTimeoutMs,
+      fetch: opts.fetch ?? opts.fetchImpl
     });
   } catch (error) {
     throw new AccessSnapshotError("unavailable", `access snapshot request failed: ${error.message}`);
@@ -404,8 +404,8 @@ function createAccessLoader(options) {
       apiUrl: resolveValue(options.apiUrl),
       accessToken,
       endpointPath: options.endpointPath,
-      fetchTimeoutMs: options.fetchTimeoutMs,
-      fetchImpl: options.fetchImpl,
+      timeoutMs: options.timeoutMs,
+      fetch: options.fetch,
       headers
     });
   });

package/dist/{index-Bc_E5HWA.d.ts → index-BKUzRIXJ.d.ts}

@@ -140,8 +140,6 @@ interface HandoffTargetConfig {
     establishSession: (session: AuthResponse, response: Response, request: Request) => Promise<Response | void> | Response | void;
     secureCookies?: boolean;
     timeoutMs?: number;
-    /** @deprecated use `timeoutMs`. */
-    fetchTimeoutMs?: number;
     fetch?: typeof fetch;
 }
 declare function createHandoffTarget(config: HandoffTargetConfig): {
@@ -169,8 +167,6 @@ interface HandoffSourceConfig {
     getAccessToken: (request: Request) => Promise<string | null> | string | null;
     loginPath: string;
     timeoutMs?: number;
-    /** @deprecated use `timeoutMs`. */
-    fetchTimeoutMs?: number;
     fetch?: typeof fetch;
 }
 declare function createHandoffSource(config: HandoffSourceConfig): {
@@ -221,8 +217,6 @@ interface SessionRefresherConfig {
     singleflightTtlMs?: number;
     maxSingleflights?: number;
     timeoutMs?: number;
-    /** @deprecated use `timeoutMs`. */
-    fetchTimeoutMs?: number;
     fetch?: typeof fetch;
 }
 /**

package/dist/{index-XWID1Fkg.d.ts → index-FoojTvYk.d.ts}

@@ -138,7 +138,11 @@ interface FetchAccessSnapshotOptions {
     accessToken: string;
     /** Defaults to /api/v1/platform/access. */
     endpointPath?: string;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+    /** @deprecated use `timeoutMs`; kept until platform_fe's access.server.ts renames it. */
     fetchTimeoutMs?: number;
+    /** @deprecated use `fetch`; kept until platform_fe's access.server.ts renames it. */
     fetchImpl?: typeof fetch;
     /** Extra headers. Authorization and Accept are always set here. */
     headers?: HeadersInit;

package/dist/index.d.ts

@@ -1 +1 @@
-export { a as ADMIN_HOST_ROOT, b as AUTH_ERROR_MESSAGES, c as AuthResponse, C as CookieOptions, D as DeviceIdentity, d as DeviceIdentityConfig, e as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, f as HANDOFF_ERROR_MESSAGES, g as HandoffSource, h as HandoffSourceConfig, i as HandoffSourceTarget, j as HandoffTarget, k as HandoffTargetConfig, l as RefreshOutcome, m as RefreshedSession, n as SIGN_IN_HINT_COOKIE, o as SSO_ERROR_MESSAGES, p as SafeInternalPathOptions, S as SessionData, q as SessionGateDecision, r as SessionGateInput, s as SessionRefresher, t as SessionRefresherConfig, u as SessionUser, v as SignInHintCookieAttributes, w as SignInHintDomainOptions, T as TokenPayload, x as adminSlugFromHost, y as applyForwardedClientHeaders, z as authErrorMessage, B as brandedAdminHost, E as brokerPaths, F as createDeviceIdentity, G as createHandoffSource, I as createHandoffTarget, J as createSessionRefresher, K as decodeBase64Url, L as decodeDefaultSession, M as decodeTokenPayload, N as deleteCookie, O as evaluateSessionGate, P as forwardedRequestHeaders, Q as handoffErrorMessage, U as hasSessionShape, V as hasSignInHint, W as hasTokenAudience, X as isAdminRootHost, Y as isAuthErrorCode, Z as isHandoffErrorCode, _ as isTokenExpired, $ as isTokenExpiringSoon, a0 as parseAuthResponse, a1 as parseRefreshEnvelope, a2 as readCookie, a3 as recoveryAdminOrigin, a4 as safeInternalPath, a5 as serializeCookie, a6 as setCookie, a7 as signInHintCookie, a8 as signInHintDomain, a9 as sourceStartPath, aa as tokenMaxAgeSeconds } from './index-Bc_E5HWA.js';
+export { a as ADMIN_HOST_ROOT, b as AUTH_ERROR_MESSAGES, c as AuthResponse, C as CookieOptions, D as DeviceIdentity, d as DeviceIdentityConfig, e as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, f as HANDOFF_ERROR_MESSAGES, g as HandoffSource, h as HandoffSourceConfig, i as HandoffSourceTarget, j as HandoffTarget, k as HandoffTargetConfig, l as RefreshOutcome, m as RefreshedSession, n as SIGN_IN_HINT_COOKIE, o as SSO_ERROR_MESSAGES, p as SafeInternalPathOptions, S as SessionData, q as SessionGateDecision, r as SessionGateInput, s as SessionRefresher, t as SessionRefresherConfig, u as SessionUser, v as SignInHintCookieAttributes, w as SignInHintDomainOptions, T as TokenPayload, x as adminSlugFromHost, y as applyForwardedClientHeaders, z as authErrorMessage, B as brandedAdminHost, E as brokerPaths, F as createDeviceIdentity, G as createHandoffSource, I as createHandoffTarget, J as createSessionRefresher, K as decodeBase64Url, L as decodeDefaultSession, M as decodeTokenPayload, N as deleteCookie, O as evaluateSessionGate, P as forwardedRequestHeaders, Q as handoffErrorMessage, U as hasSessionShape, V as hasSignInHint, W as hasTokenAudience, X as isAdminRootHost, Y as isAuthErrorCode, Z as isHandoffErrorCode, _ as isTokenExpired, $ as isTokenExpiringSoon, a0 as parseAuthResponse, a1 as parseRefreshEnvelope, a2 as readCookie, a3 as recoveryAdminOrigin, a4 as safeInternalPath, a5 as serializeCookie, a6 as setCookie, a7 as signInHintCookie, a8 as signInHintDomain, a9 as sourceStartPath, aa as tokenMaxAgeSeconds } from './index-BKUzRIXJ.js';

package/dist/index.js

@@ -277,7 +277,7 @@ function resolveAll(...values) {
 }
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function timedFetch(url, options = {}) {
-  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const doFetch = options.fetch ?? fetch;
   const controller = options.timeoutMs ? new AbortController() : void 0;
   const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
   try {
@@ -341,7 +341,7 @@ function createHandoffTarget(config) {
   const prefix = `${secure ? "__Host-" : ""}${config.cookiePrefix}_handoff_`;
   const cookies = { state: `${prefix}state`, verifier: `${prefix}verifier`, from: `${prefix}from` };
   const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeout = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const clearHandoffCookies = (response) => {
     let result = response;
     for (const name of Object.values(cookies)) {
@@ -412,7 +412,7 @@ function createHandoffTarget(config) {
 var DEFAULT_TARGET_CALLBACK = "/api/auth/platform-sso/callback";
 var DEFAULT_TARGET_LOGIN = "/login";
 function createHandoffSource(config) {
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeout = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   return {
     /** GET `/api/auth/handoffs/{app}/start?code_challenge=&state=` */
     async start(request, app) {
@@ -482,7 +482,7 @@ function parseRefreshEnvelope(value) {
 function createSessionRefresher(config) {
   const ttl = config.singleflightTtlMs ?? DEFAULT_TTL_MS;
   const max = config.maxSingleflights ?? DEFAULT_MAX;
-  const timeoutMs = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeoutMs = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const inflight = /* @__PURE__ */ new Map();
   async function perform(refreshToken) {
     try {

package/dist/next.d.ts

@@ -1,5 +1,5 @@
-import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-Bc_E5HWA.js';
-export { a as ADMIN_HOST_ROOT, b as AUTH_ERROR_MESSAGES, c as AuthResponse, D as DeviceIdentity, d as DeviceIdentityConfig, e as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, f as HANDOFF_ERROR_MESSAGES, g as HandoffSource, h as HandoffSourceConfig, i as HandoffSourceTarget, j as HandoffTarget, k as HandoffTargetConfig, l as RefreshOutcome, m as RefreshedSession, n as SIGN_IN_HINT_COOKIE, o as SSO_ERROR_MESSAGES, p as SafeInternalPathOptions, q as SessionGateDecision, r as SessionGateInput, s as SessionRefresher, t as SessionRefresherConfig, u as SessionUser, v as SignInHintCookieAttributes, w as SignInHintDomainOptions, T as TokenPayload, x as adminSlugFromHost, y as applyForwardedClientHeaders, z as authErrorMessage, B as brandedAdminHost, E as brokerPaths, F as createDeviceIdentity, G as createHandoffSource, I as createHandoffTarget, J as createSessionRefresher, K as decodeBase64Url, L as decodeDefaultSession, M as decodeTokenPayload, N as deleteCookie, O as evaluateSessionGate, P as forwardedRequestHeaders, Q as handoffErrorMessage, U as hasSessionShape, V as hasSignInHint, W as hasTokenAudience, X as isAdminRootHost, Y as isAuthErrorCode, Z as isHandoffErrorCode, _ as isTokenExpired, $ as isTokenExpiringSoon, a0 as parseAuthResponse, a1 as parseRefreshEnvelope, a2 as readCookie, a3 as recoveryAdminOrigin, a4 as safeInternalPath, a5 as serializeCookie, a6 as setCookie, a7 as signInHintCookie, a8 as signInHintDomain, a9 as sourceStartPath, aa as tokenMaxAgeSeconds } from './index-Bc_E5HWA.js';
+import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-BKUzRIXJ.js';
+export { a as ADMIN_HOST_ROOT, b as AUTH_ERROR_MESSAGES, c as AuthResponse, D as DeviceIdentity, d as DeviceIdentityConfig, e as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, f as HANDOFF_ERROR_MESSAGES, g as HandoffSource, h as HandoffSourceConfig, i as HandoffSourceTarget, j as HandoffTarget, k as HandoffTargetConfig, l as RefreshOutcome, m as RefreshedSession, n as SIGN_IN_HINT_COOKIE, o as SSO_ERROR_MESSAGES, p as SafeInternalPathOptions, q as SessionGateDecision, r as SessionGateInput, s as SessionRefresher, t as SessionRefresherConfig, u as SessionUser, v as SignInHintCookieAttributes, w as SignInHintDomainOptions, T as TokenPayload, x as adminSlugFromHost, y as applyForwardedClientHeaders, z as authErrorMessage, B as brandedAdminHost, E as brokerPaths, F as createDeviceIdentity, G as createHandoffSource, I as createHandoffTarget, J as createSessionRefresher, K as decodeBase64Url, L as decodeDefaultSession, M as decodeTokenPayload, N as deleteCookie, O as evaluateSessionGate, P as forwardedRequestHeaders, Q as handoffErrorMessage, U as hasSessionShape, V as hasSignInHint, W as hasTokenAudience, X as isAdminRootHost, Y as isAuthErrorCode, Z as isHandoffErrorCode, _ as isTokenExpired, $ as isTokenExpiringSoon, a0 as parseAuthResponse, a1 as parseRefreshEnvelope, a2 as readCookie, a3 as recoveryAdminOrigin, a4 as safeInternalPath, a5 as serializeCookie, a6 as setCookie, a7 as signInHintCookie, a8 as signInHintDomain, a9 as sourceStartPath, aa as tokenMaxAgeSeconds } from './index-BKUzRIXJ.js';
 
 /**
  * The error vocabulary every first-party platform surface uses at its edge,

package/dist/next.js

@@ -282,7 +282,7 @@ function resolveAll(...values) {
 }
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function timedFetch(url, options = {}) {
-  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const doFetch = options.fetch ?? fetch;
   const controller = options.timeoutMs ? new AbortController() : void 0;
   const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
   try {
@@ -346,7 +346,7 @@ function createHandoffTarget(config) {
   const prefix = `${secure ? "__Host-" : ""}${config.cookiePrefix}_handoff_`;
   const cookies = { state: `${prefix}state`, verifier: `${prefix}verifier`, from: `${prefix}from` };
   const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeout = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const clearHandoffCookies = (response) => {
     let result = response;
     for (const name of Object.values(cookies)) {
@@ -417,7 +417,7 @@ function createHandoffTarget(config) {
 var DEFAULT_TARGET_CALLBACK = "/api/auth/platform-sso/callback";
 var DEFAULT_TARGET_LOGIN = "/login";
 function createHandoffSource(config) {
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeout = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   return {
     /** GET `/api/auth/handoffs/{app}/start?code_challenge=&state=` */
     async start(request, app) {
@@ -487,7 +487,7 @@ function parseRefreshEnvelope(value) {
 function createSessionRefresher(config) {
   const ttl = config.singleflightTtlMs ?? DEFAULT_TTL_MS;
   const max = config.maxSingleflights ?? DEFAULT_MAX;
-  const timeoutMs = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeoutMs = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const inflight = /* @__PURE__ */ new Map();
   async function perform(refreshToken) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",
@@ -55,8 +55,8 @@
     "tsup": "^8.5.1",
     "typescript": "5.9.3",
     "vitest": "^4.1.4",
-    "@c1m-public/resilience": "0.1.0",
-    "@c1m-public/transport": "0.0.0"
+    "@c1m-public/transport": "0.0.0",
+    "@c1m-public/resilience": "0.1.0"
   },
   "peerDependencies": {
     "next": ">=15",