@c1m-public/platform-auth 0.22.0 → 0.24.0

package/README.md

@@ -94,7 +94,7 @@ The resolved snapshot from `GET /api/v1/platform/access`.
 | `PLATFORM_PERMISSIONS`, `LEADBROKER_PERMISSIONS`, `WORKSPACE_PERMISSIONS`, `WORKSPACE_ROLES` + key types | Generated from the backend catalog — see the drift guard below. |
 | `parseAccessSnapshot`, `emptySnapshot`, `AccessSnapshot`, `AccessEntry` | Validate and shape the snapshot. |
 | `hasPermission`, `hasAnyPermission`, `hasAllPermissions`, `hasWorkspacePermission`, `isPlatformOwner`, `appScopes`, `permissionsFor` | Scope-aware predicates. |
-| `managedDashes`, `dashRole` | The dashes a subject runs, from the mirrored `dash.owner` / `dash.admin` bundle grants (`snapshot.dash_roles`). Admission only — gate an action with `hasPermission(snapshot, "dash.publish", { dashId })`. Platform managers are not listed; admit them on `platform.tenants.manage`. |
+| `managedDashes`, `dashRole` | The dashes a subject runs, from the mirrored `dash.owner` / `dash.admin` bundle grants (`snapshot.dash_roles`). Admission only — gate an action with `hasPermission(snapshot, "dash.publish", { dashId })`. Platform managers are not listed; admit them on `platform.dashes.manage`. |
 | `fetchAccessSnapshot` | Framework-neutral fetch. Pass `request` and it forwards client identity for you. |
 | `AccessSnapshotError`, `isAccessSnapshotError` | `unauthenticated` / `forbidden` / `unavailable` / `invalid_snapshot`. |
 
@@ -112,7 +112,7 @@ export const access = createAccessLoader({
   // apply inside node_modules, so wrap the fetch here and tag it yourself.
   fetchSnapshot: cachedSnapshot,
 });
-await access.requireAccess("platform.tenants.manage");
+await access.requireAccess("platform.dashes.manage");
 ```
 
 Omit `getSubjectId` and the loader derives the cache-tag subject from the access

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-XWID1Fkg.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-cjvJdaXf.js';

package/dist/access/index.js

@@ -94,6 +94,9 @@ var LEADBROKER_PERMISSIONS = [
   "leadbroker.policy.manage"
 ];
 var WORKSPACE_PERMISSIONS = [
+  "workspace.asset-register.manage",
+  "workspace.asset-register.schema.manage",
+  "workspace.asset-register.view",
   "workspace.channels.manage",
   "workspace.channels.secrets",
   "workspace.channels.view",
@@ -306,7 +309,7 @@ function resolveValue(value) {
   return typeof value === "function" ? value() : value;
 }
 async function timedFetch(url, options = {}) {
-  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const doFetch = options.fetch ?? fetch;
   const controller = options.timeoutMs ? new AbortController() : void 0;
   const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
   try {
@@ -331,8 +334,8 @@ async function fetchAccessSnapshot(opts) {
   try {
     response = await timedFetch(url, {
       init: { method: "GET", headers },
-      timeoutMs: opts.fetchTimeoutMs,
-      fetchImpl: opts.fetchImpl
+      timeoutMs: opts.timeoutMs ?? opts.fetchTimeoutMs,
+      fetch: opts.fetch ?? opts.fetchImpl
     });
   } catch (error) {
     throw new AccessSnapshotError("unavailable", `access snapshot request failed: ${error.message}`);

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-XWID1Fkg.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-XWID1Fkg.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-cjvJdaXf.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-cjvJdaXf.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;
@@ -14,8 +14,8 @@ interface CreateAccessLoaderOptions {
      * per-subject rather than sharing one tag across users.
      */
     getSubjectId?: () => Promise<string | null>;
-    fetchTimeoutMs?: number;
-    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
     headers?: () => Promise<HeadersInit | undefined> | HeadersInit | undefined;
     /**
      * Optional cross-request cache seam. When provided, the loader calls this

package/dist/access/next.js

@@ -10,7 +10,7 @@ function resolveValue(value) {
   return typeof value === "function" ? value() : value;
 }
 async function timedFetch(url, options = {}) {
-  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const doFetch = options.fetch ?? fetch;
   const controller = options.timeoutMs ? new AbortController() : void 0;
   const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
   try {
@@ -180,8 +180,8 @@ async function fetchAccessSnapshot(opts) {
   try {
     response = await timedFetch(url, {
       init: { method: "GET", headers },
-      timeoutMs: opts.fetchTimeoutMs,
-      fetchImpl: opts.fetchImpl
+      timeoutMs: opts.timeoutMs ?? opts.fetchTimeoutMs,
+      fetch: opts.fetch ?? opts.fetchImpl
     });
   } catch (error) {
     throw new AccessSnapshotError("unavailable", `access snapshot request failed: ${error.message}`);
@@ -352,6 +352,9 @@ var LEADBROKER_PERMISSIONS = [
   "leadbroker.policy.manage"
 ];
 var WORKSPACE_PERMISSIONS = [
+  "workspace.asset-register.manage",
+  "workspace.asset-register.schema.manage",
+  "workspace.asset-register.view",
   "workspace.channels.manage",
   "workspace.channels.secrets",
   "workspace.channels.view",
@@ -404,8 +407,8 @@ function createAccessLoader(options) {
       apiUrl: resolveValue(options.apiUrl),
       accessToken,
       endpointPath: options.endpointPath,
-      fetchTimeoutMs: options.fetchTimeoutMs,
-      fetchImpl: options.fetchImpl,
+      timeoutMs: options.timeoutMs,
+      fetch: options.fetch,
       headers
     });
   });

package/dist/{index-Bc_E5HWA.d.ts → index-BKUzRIXJ.d.ts}

@@ -140,8 +140,6 @@ interface HandoffTargetConfig {
     establishSession: (session: AuthResponse, response: Response, request: Request) => Promise<Response | void> | Response | void;
     secureCookies?: boolean;
     timeoutMs?: number;
-    /** @deprecated use `timeoutMs`. */
-    fetchTimeoutMs?: number;
     fetch?: typeof fetch;
 }
 declare function createHandoffTarget(config: HandoffTargetConfig): {
@@ -169,8 +167,6 @@ interface HandoffSourceConfig {
     getAccessToken: (request: Request) => Promise<string | null> | string | null;
     loginPath: string;
     timeoutMs?: number;
-    /** @deprecated use `timeoutMs`. */
-    fetchTimeoutMs?: number;
     fetch?: typeof fetch;
 }
 declare function createHandoffSource(config: HandoffSourceConfig): {
@@ -221,8 +217,6 @@ interface SessionRefresherConfig {
     singleflightTtlMs?: number;
     maxSingleflights?: number;
     timeoutMs?: number;
-    /** @deprecated use `timeoutMs`. */
-    fetchTimeoutMs?: number;
     fetch?: typeof fetch;
 }
 /**

package/dist/{index-XWID1Fkg.d.ts → index-cjvJdaXf.d.ts}

@@ -11,7 +11,7 @@ type DashRole = (typeof DASH_ROLES)[number];
 declare const LEADBROKER_PERMISSIONS: readonly ["leadbroker.finance.manage", "leadbroker.leads.dispatch", "leadbroker.leads.review", "leadbroker.leads.view", "leadbroker.policy.manage"];
 type LeadBrokerPermissionKey = (typeof LEADBROKER_PERMISSIONS)[number];
 /** Workspace-staff permission keys. */
-declare const WORKSPACE_PERMISSIONS: readonly ["workspace.channels.manage", "workspace.channels.secrets", "workspace.channels.view", "workspace.crm.manage", "workspace.crm.view", "workspace.customers.manage", "workspace.customers.view", "workspace.drafts.delete", "workspace.lifecycle.manage", "workspace.orders.manage", "workspace.orders.view", "workspace.payments.record", "workspace.payments.refund", "workspace.site.edit", "workspace.site.view", "workspace.staff.manage"];
+declare const WORKSPACE_PERMISSIONS: readonly ["workspace.asset-register.manage", "workspace.asset-register.schema.manage", "workspace.asset-register.view", "workspace.channels.manage", "workspace.channels.secrets", "workspace.channels.view", "workspace.crm.manage", "workspace.crm.view", "workspace.customers.manage", "workspace.customers.view", "workspace.drafts.delete", "workspace.lifecycle.manage", "workspace.orders.manage", "workspace.orders.view", "workspace.payments.record", "workspace.payments.refund", "workspace.site.edit", "workspace.site.view", "workspace.staff.manage"];
 type WorkspacePermissionKey = (typeof WORKSPACE_PERMISSIONS)[number];
 /** Assignable workspace-staff role bundles (grant keys at workspace scope). */
 declare const WORKSPACE_ROLES: readonly ["workspace.editor", "workspace.frontdesk", "workspace.manager"];
@@ -106,7 +106,7 @@ declare function hasWorkspacePermission(snapshot: AccessSnapshot, workspaceId: s
  * The dashes this subject runs, from the mirrored dash bundle grants — the
  * admission list for the Admin Center's dash area. Platform managers are not
  * listed: their reach is platform-wide, so admit them with
- * `hasPermission(snapshot, "platform.tenants.manage")` instead.
+ * `hasPermission(snapshot, "platform.dashes.manage")` instead.
  */
 declare function managedDashes(snapshot: AccessSnapshot): Array<{
     dashId: string;
@@ -138,7 +138,11 @@ interface FetchAccessSnapshotOptions {
     accessToken: string;
     /** Defaults to /api/v1/platform/access. */
     endpointPath?: string;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+    /** @deprecated use `timeoutMs`; kept until platform_fe's access.server.ts renames it. */
     fetchTimeoutMs?: number;
+    /** @deprecated use `fetch`; kept until platform_fe's access.server.ts renames it. */
     fetchImpl?: typeof fetch;
     /** Extra headers. Authorization and Accept are always set here. */
     headers?: HeadersInit;

package/dist/index.d.ts

@@ -1 +1 @@
-export { a as ADMIN_HOST_ROOT, b as AUTH_ERROR_MESSAGES, c as AuthResponse, C as CookieOptions, D as DeviceIdentity, d as DeviceIdentityConfig, e as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, f as HANDOFF_ERROR_MESSAGES, g as HandoffSource, h as HandoffSourceConfig, i as HandoffSourceTarget, j as HandoffTarget, k as HandoffTargetConfig, l as RefreshOutcome, m as RefreshedSession, n as SIGN_IN_HINT_COOKIE, o as SSO_ERROR_MESSAGES, p as SafeInternalPathOptions, S as SessionData, q as SessionGateDecision, r as SessionGateInput, s as SessionRefresher, t as SessionRefresherConfig, u as SessionUser, v as SignInHintCookieAttributes, w as SignInHintDomainOptions, T as TokenPayload, x as adminSlugFromHost, y as applyForwardedClientHeaders, z as authErrorMessage, B as brandedAdminHost, E as brokerPaths, F as createDeviceIdentity, G as createHandoffSource, I as createHandoffTarget, J as createSessionRefresher, K as decodeBase64Url, L as decodeDefaultSession, M as decodeTokenPayload, N as deleteCookie, O as evaluateSessionGate, P as forwardedRequestHeaders, Q as handoffErrorMessage, U as hasSessionShape, V as hasSignInHint, W as hasTokenAudience, X as isAdminRootHost, Y as isAuthErrorCode, Z as isHandoffErrorCode, _ as isTokenExpired, $ as isTokenExpiringSoon, a0 as parseAuthResponse, a1 as parseRefreshEnvelope, a2 as readCookie, a3 as recoveryAdminOrigin, a4 as safeInternalPath, a5 as serializeCookie, a6 as setCookie, a7 as signInHintCookie, a8 as signInHintDomain, a9 as sourceStartPath, aa as tokenMaxAgeSeconds } from './index-Bc_E5HWA.js';
+export { a as ADMIN_HOST_ROOT, b as AUTH_ERROR_MESSAGES, c as AuthResponse, C as CookieOptions, D as DeviceIdentity, d as DeviceIdentityConfig, e as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, f as HANDOFF_ERROR_MESSAGES, g as HandoffSource, h as HandoffSourceConfig, i as HandoffSourceTarget, j as HandoffTarget, k as HandoffTargetConfig, l as RefreshOutcome, m as RefreshedSession, n as SIGN_IN_HINT_COOKIE, o as SSO_ERROR_MESSAGES, p as SafeInternalPathOptions, S as SessionData, q as SessionGateDecision, r as SessionGateInput, s as SessionRefresher, t as SessionRefresherConfig, u as SessionUser, v as SignInHintCookieAttributes, w as SignInHintDomainOptions, T as TokenPayload, x as adminSlugFromHost, y as applyForwardedClientHeaders, z as authErrorMessage, B as brandedAdminHost, E as brokerPaths, F as createDeviceIdentity, G as createHandoffSource, I as createHandoffTarget, J as createSessionRefresher, K as decodeBase64Url, L as decodeDefaultSession, M as decodeTokenPayload, N as deleteCookie, O as evaluateSessionGate, P as forwardedRequestHeaders, Q as handoffErrorMessage, U as hasSessionShape, V as hasSignInHint, W as hasTokenAudience, X as isAdminRootHost, Y as isAuthErrorCode, Z as isHandoffErrorCode, _ as isTokenExpired, $ as isTokenExpiringSoon, a0 as parseAuthResponse, a1 as parseRefreshEnvelope, a2 as readCookie, a3 as recoveryAdminOrigin, a4 as safeInternalPath, a5 as serializeCookie, a6 as setCookie, a7 as signInHintCookie, a8 as signInHintDomain, a9 as sourceStartPath, aa as tokenMaxAgeSeconds } from './index-BKUzRIXJ.js';

package/dist/index.js

@@ -277,7 +277,7 @@ function resolveAll(...values) {
 }
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function timedFetch(url, options = {}) {
-  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const doFetch = options.fetch ?? fetch;
   const controller = options.timeoutMs ? new AbortController() : void 0;
   const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
   try {
@@ -341,7 +341,7 @@ function createHandoffTarget(config) {
   const prefix = `${secure ? "__Host-" : ""}${config.cookiePrefix}_handoff_`;
   const cookies = { state: `${prefix}state`, verifier: `${prefix}verifier`, from: `${prefix}from` };
   const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeout = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const clearHandoffCookies = (response) => {
     let result = response;
     for (const name of Object.values(cookies)) {
@@ -412,7 +412,7 @@ function createHandoffTarget(config) {
 var DEFAULT_TARGET_CALLBACK = "/api/auth/platform-sso/callback";
 var DEFAULT_TARGET_LOGIN = "/login";
 function createHandoffSource(config) {
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeout = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   return {
     /** GET `/api/auth/handoffs/{app}/start?code_challenge=&state=` */
     async start(request, app) {
@@ -482,7 +482,7 @@ function parseRefreshEnvelope(value) {
 function createSessionRefresher(config) {
   const ttl = config.singleflightTtlMs ?? DEFAULT_TTL_MS;
   const max = config.maxSingleflights ?? DEFAULT_MAX;
-  const timeoutMs = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeoutMs = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const inflight = /* @__PURE__ */ new Map();
   async function perform(refreshToken) {
     try {

package/dist/next.d.ts

@@ -1,5 +1,5 @@
-import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-Bc_E5HWA.js';
-export { a as ADMIN_HOST_ROOT, b as AUTH_ERROR_MESSAGES, c as AuthResponse, D as DeviceIdentity, d as DeviceIdentityConfig, e as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, f as HANDOFF_ERROR_MESSAGES, g as HandoffSource, h as HandoffSourceConfig, i as HandoffSourceTarget, j as HandoffTarget, k as HandoffTargetConfig, l as RefreshOutcome, m as RefreshedSession, n as SIGN_IN_HINT_COOKIE, o as SSO_ERROR_MESSAGES, p as SafeInternalPathOptions, q as SessionGateDecision, r as SessionGateInput, s as SessionRefresher, t as SessionRefresherConfig, u as SessionUser, v as SignInHintCookieAttributes, w as SignInHintDomainOptions, T as TokenPayload, x as adminSlugFromHost, y as applyForwardedClientHeaders, z as authErrorMessage, B as brandedAdminHost, E as brokerPaths, F as createDeviceIdentity, G as createHandoffSource, I as createHandoffTarget, J as createSessionRefresher, K as decodeBase64Url, L as decodeDefaultSession, M as decodeTokenPayload, N as deleteCookie, O as evaluateSessionGate, P as forwardedRequestHeaders, Q as handoffErrorMessage, U as hasSessionShape, V as hasSignInHint, W as hasTokenAudience, X as isAdminRootHost, Y as isAuthErrorCode, Z as isHandoffErrorCode, _ as isTokenExpired, $ as isTokenExpiringSoon, a0 as parseAuthResponse, a1 as parseRefreshEnvelope, a2 as readCookie, a3 as recoveryAdminOrigin, a4 as safeInternalPath, a5 as serializeCookie, a6 as setCookie, a7 as signInHintCookie, a8 as signInHintDomain, a9 as sourceStartPath, aa as tokenMaxAgeSeconds } from './index-Bc_E5HWA.js';
+import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-BKUzRIXJ.js';
+export { a as ADMIN_HOST_ROOT, b as AUTH_ERROR_MESSAGES, c as AuthResponse, D as DeviceIdentity, d as DeviceIdentityConfig, e as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, f as HANDOFF_ERROR_MESSAGES, g as HandoffSource, h as HandoffSourceConfig, i as HandoffSourceTarget, j as HandoffTarget, k as HandoffTargetConfig, l as RefreshOutcome, m as RefreshedSession, n as SIGN_IN_HINT_COOKIE, o as SSO_ERROR_MESSAGES, p as SafeInternalPathOptions, q as SessionGateDecision, r as SessionGateInput, s as SessionRefresher, t as SessionRefresherConfig, u as SessionUser, v as SignInHintCookieAttributes, w as SignInHintDomainOptions, T as TokenPayload, x as adminSlugFromHost, y as applyForwardedClientHeaders, z as authErrorMessage, B as brandedAdminHost, E as brokerPaths, F as createDeviceIdentity, G as createHandoffSource, I as createHandoffTarget, J as createSessionRefresher, K as decodeBase64Url, L as decodeDefaultSession, M as decodeTokenPayload, N as deleteCookie, O as evaluateSessionGate, P as forwardedRequestHeaders, Q as handoffErrorMessage, U as hasSessionShape, V as hasSignInHint, W as hasTokenAudience, X as isAdminRootHost, Y as isAuthErrorCode, Z as isHandoffErrorCode, _ as isTokenExpired, $ as isTokenExpiringSoon, a0 as parseAuthResponse, a1 as parseRefreshEnvelope, a2 as readCookie, a3 as recoveryAdminOrigin, a4 as safeInternalPath, a5 as serializeCookie, a6 as setCookie, a7 as signInHintCookie, a8 as signInHintDomain, a9 as sourceStartPath, aa as tokenMaxAgeSeconds } from './index-BKUzRIXJ.js';
 
 /**
  * The error vocabulary every first-party platform surface uses at its edge,

package/dist/next.js

@@ -282,7 +282,7 @@ function resolveAll(...values) {
 }
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function timedFetch(url, options = {}) {
-  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const doFetch = options.fetch ?? fetch;
   const controller = options.timeoutMs ? new AbortController() : void 0;
   const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
   try {
@@ -346,7 +346,7 @@ function createHandoffTarget(config) {
   const prefix = `${secure ? "__Host-" : ""}${config.cookiePrefix}_handoff_`;
   const cookies = { state: `${prefix}state`, verifier: `${prefix}verifier`, from: `${prefix}from` };
   const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeout = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const clearHandoffCookies = (response) => {
     let result = response;
     for (const name of Object.values(cookies)) {
@@ -417,7 +417,7 @@ function createHandoffTarget(config) {
 var DEFAULT_TARGET_CALLBACK = "/api/auth/platform-sso/callback";
 var DEFAULT_TARGET_LOGIN = "/login";
 function createHandoffSource(config) {
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeout = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   return {
     /** GET `/api/auth/handoffs/{app}/start?code_challenge=&state=` */
     async start(request, app) {
@@ -487,7 +487,7 @@ function parseRefreshEnvelope(value) {
 function createSessionRefresher(config) {
   const ttl = config.singleflightTtlMs ?? DEFAULT_TTL_MS;
   const max = config.maxSingleflights ?? DEFAULT_MAX;
-  const timeoutMs = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timeoutMs = config.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const inflight = /* @__PURE__ */ new Map();
   async function perform(refreshToken) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",
@@ -55,8 +55,8 @@
     "tsup": "^8.5.1",
     "typescript": "5.9.3",
     "vitest": "^4.1.4",
-    "@c1m-public/resilience": "0.1.0",
-    "@c1m-public/transport": "0.0.0"
+    "@c1m-public/transport": "0.0.0",
+    "@c1m-public/resilience": "0.1.0"
   },
   "peerDependencies": {
     "next": ">=15",