@c1m-public/platform-auth 0.5.0 → 0.7.0

package/dist/next.d.ts

@@ -1,2 +1,168 @@
-import "server-only";
-export * from "./index.js";
+import { SessionData, CookieOptions } from './index.js';
+export { AUTH_ERROR_MESSAGES, AuthResponse, DeviceIdentity, DeviceIdentityConfig, DeviceIdentityStore, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, HandoffSource, HandoffSourceConfig, HandoffSourceTarget, HandoffTarget, HandoffTargetConfig, RefreshedSession, SSO_ERROR_MESSAGES, SessionGateDecision, SessionGateInput, SessionRefresher, SessionRefresherConfig, SessionUser, TokenPayload, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds } from './index.js';
+export { applyForwardedClientHeaders, forwardedRequestHeaders } from '@c1m-public/transport';
+import { R as Resolvable } from './internal-rnEuAE21.js';
+
+/**
+ * The error vocabulary every first-party platform surface uses at its edge.
+ * Platform Admin, SaaSDash, the Affiliate Portal and the Knowledge Library
+ * each carried a private copy of these classes; they are the same four
+ * everywhere because the backend's 401 codes are the same everywhere.
+ */
+declare class SessionExpiredError extends Error {
+    constructor();
+}
+/** 401 `recent_authentication_required`: the session is valid but too old for this action. */
+declare class RecentAuthenticationRequiredError extends Error {
+    constructor();
+}
+/** 401 `sso_reauthentication_required`: the identity provider must be revisited. */
+declare class SSOReauthenticationRequiredError extends Error {
+    constructor();
+}
+/** Any other failed platform call, carrying what the backend said so a log line can be matched. */
+declare class PlatformServerFetchError extends Error {
+    readonly path: string;
+    readonly status?: number | undefined;
+    readonly code?: string | undefined;
+    readonly requestId?: string | undefined;
+    constructor(message: string, path: string, status?: number | undefined, code?: string | undefined, requestId?: string | undefined);
+}
+/** Structural checks: correct across duplicate package instances and transformed bundles. */
+declare const isSessionExpiredError: (error: unknown) => error is SessionExpiredError;
+declare const isRecentAuthenticationRequiredError: (error: unknown) => error is RecentAuthenticationRequiredError;
+declare const isSSOReauthenticationRequiredError: (error: unknown) => error is SSOReauthenticationRequiredError;
+declare const isPlatformServerFetchError: (error: unknown) => error is PlatformServerFetchError;
+/** Map a 401 body's `code` onto the session error it means. */
+declare function authenticationErrorFor(code: unknown): SessionExpiredError | RecentAuthenticationRequiredError | SSOReauthenticationRequiredError;
+/**
+ * Translate a `@c1m-public/control-client` failure into this vocabulary. The
+ * backend's code and request id are carried through: dropping them once cost
+ * a real diagnosis, where the operator saw only a Next.js digest while the code
+ * said which call broke and the request id matched the server log line.
+ */
+declare function mapControlError(error: unknown): unknown;
+/** Run a control-client call and rethrow any failure in the platform vocabulary. */
+declare function controlRequest<T>(run: () => Promise<T>): Promise<T>;
+
+/** Forwarded client headers for a backend call made from a request context. */
+declare function buildForwardedRequestHeaders(initHeaders?: HeadersInit): Promise<Headers>;
+interface PlatformFetchTimeouts {
+    /** GET/HEAD/OPTIONS (default 10000). */
+    read?: number;
+    /** Everything else (default 30000). */
+    write?: number;
+}
+interface PlatformFetchConfig {
+    /** Backend origin, no trailing path. */
+    apiUrl: Resolvable<string>;
+    /** The live bearer for the current request, or null when signed out. */
+    getAccessToken: () => Promise<string | null | undefined> | string | null | undefined;
+    /** Defaults to forwarding the incoming request's client headers. */
+    forwardHeaders?: (init?: HeadersInit) => Promise<Headers> | Headers;
+    timeoutMs?: number | PlatformFetchTimeouts;
+    fetch?: typeof fetch;
+}
+/**
+ * The authenticated server-side fetch every first-party platform app makes:
+ * bearer from the session, forwarded client headers, `no-store`, a per-method
+ * timeout, and one error vocabulary. Two apps carried near-identical copies
+ * that had drifted (one returned null on a missing session, one threw); this
+ * throws, so a missing session is never mistaken for an empty result.
+ */
+declare function createPlatformFetch(config: PlatformFetchConfig): {
+    fetchWithAccessToken: (path: string, accessToken: string | null, init?: RequestInit) => Promise<Response>;
+    /** Bearer-authenticated raw response; throws 401 when there is no session. */
+    fetchAuthed: (path: string, init?: RequestInit) => Promise<Response>;
+    /** JSON body, or null for 204/404. */
+    fetchAuthedJson<T>(path: string, init?: RequestInit): Promise<T | null>;
+    /** JSON body; every non-2xx (404 included) is an error. */
+    fetchAuthedJsonStrict<T>(path: string, init?: RequestInit): Promise<T>;
+    fetchJsonWithAccessToken<T>(path: string, accessToken: string, init?: RequestInit): Promise<T | null>;
+    /** Unauthenticated JSON read (public endpoints), same headers/timeout/error rules. */
+    fetchPublicJson<T>(path: string, init?: RequestInit): Promise<T | null>;
+    fetchAuthedField<TEnvelope, TValue>(path: string, select: (data: TEnvelope) => TValue | null | undefined, init?: RequestInit): Promise<TValue | null>;
+    fetchAuthedItems<T>(path: string, init?: RequestInit): Promise<T[]>;
+};
+type PlatformFetch = ReturnType<typeof createPlatformFetch>;
+
+interface SessionCookieNames {
+    session: string;
+    refreshToken: string;
+    rememberMe: string;
+}
+interface SessionStoreRefreshConfig {
+    apiUrl: Resolvable<string>;
+    /** e.g. `/api/v1/platform/auth/refresh` */
+    refreshPath: string;
+    clientType: string;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+}
+interface SessionStoreConfig {
+    /** The only access-token audience this surface may consume. */
+    audience: string;
+    cookies: SessionCookieNames;
+    /** Persistent-session lifetime cap in seconds (default 7 days); a token's own exp wins when shorter. */
+    maxAgeSeconds?: number;
+    /**
+     * `Secure` on every cookie (default true). false only for plain-http local
+     * development, and never honoured for `__Host-` names, which require it.
+     */
+    secure?: boolean;
+    /** Ignored for `__Host-` names, which forbid Domain. */
+    cookieDomain?: string;
+    /** What `createSession` does when the caller does not say (default true). */
+    defaultRememberMe?: boolean;
+    /** Refresh-on-read for `getSessionWithRefresh`; omitted means never refresh. */
+    refresh?: SessionStoreRefreshConfig;
+    decodeToken?: (token: string) => SessionData | null;
+    /**
+     * Awaited before any cookie read. Pass `connection` from `next/server` so
+     * Cache Components treat session state as request-time, never prerendered.
+     */
+    requestBoundary?: () => Promise<void>;
+    /** Called when a cookie read/write fails outside a request (prerender); default swallows. */
+    onError?: (error: unknown, operation: string) => void;
+}
+/**
+ * Session cookies for a first-party Next.js platform surface, written once.
+ *
+ * Every consumer had reimplemented this — Platform Admin, SaaSDash (via
+ * shared-auth), the Affiliate Portal and the Knowledge Library — around the
+ * same primitives, with the same three cookies and the same rules:
+ *
+ * - rememberMe=false → no Max-Age, so the cookies die with the browser; true →
+ *   the configured cap, shortened to the token's own expiry.
+ * - The remember choice is preserved across refreshes; a session login never
+ *   silently becomes a persistent one.
+ * - Delete with the SAME attributes as set. A `__Host-` cookie is only cleared
+ *   by an expiring Set-Cookie that itself carries Secure; a Secure-less delete
+ *   is silently ignored and the session survives logout.
+ * - A token with the wrong audience is never stored and never read as a
+ *   session, so one host's cookie can never impersonate another surface.
+ */
+declare function createSessionStore(config: SessionStoreConfig): {
+    audience: string;
+    cookieNames: SessionCookieNames;
+    cookieOptions: (rememberMe: boolean, token?: string) => CookieOptions & {
+        httpOnly: true;
+        sameSite: "lax";
+        path: "/";
+    };
+    createSession: (accessToken: string, refreshToken?: string, rememberMe?: boolean) => Promise<void>;
+    writeSessionCookies: (response: Response, accessToken: string, refreshToken?: string, rememberMe?: boolean) => Response;
+    getAccessToken: () => Promise<string | null>;
+    getRefreshToken: () => Promise<string | null>;
+    getSession: () => Promise<SessionData | null>;
+    getSessionWithRefresh: () => Promise<SessionData | null>;
+    isRememberMe: () => Promise<boolean>;
+    updateAccessToken: (accessToken: string, refreshToken?: string) => Promise<void>;
+    destroySession: () => Promise<void>;
+    clearSessionCookies: (response: Response) => Response;
+    requireSession: () => Promise<SessionData>;
+    isAuthenticated(): Promise<boolean>;
+};
+type SessionStore = ReturnType<typeof createSessionStore>;
+
+export { CookieOptions, type PlatformFetch, type PlatformFetchConfig, type PlatformFetchTimeouts, PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, type SessionCookieNames, SessionData, SessionExpiredError, type SessionStore, type SessionStoreConfig, type SessionStoreRefreshConfig, authenticationErrorFor, buildForwardedRequestHeaders, controlRequest, createPlatformFetch, createSessionStore, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, mapControlError };

package/dist/next.js

@@ -1,3 +1,306 @@
-// Server-only entry: root API plus the bundler guard against client bundles.
-import "server-only";
-export * from "./index.js";
+import { createSessionRefresher, setCookie, deleteCookie } from './chunk-SMBKTB5V.js';
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-SMBKTB5V.js';
+import { decodeDefaultSession, tokenMaxAgeSeconds, hasTokenAudience, isTokenExpiringSoon, isTokenExpired } from './chunk-FBC2NUH7.js';
+export { decodeBase64Url, decodeDefaultSession, decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, tokenMaxAgeSeconds } from './chunk-FBC2NUH7.js';
+import { applyForwardedClientHeaders, resolveValue } from './chunk-RVKIDFXM.js';
+export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-RVKIDFXM.js';
+import 'server-only';
+import { headers, cookies } from 'next/headers';
+
+// src/next/errors.ts
+var SessionExpiredError = class extends Error {
+  constructor() {
+    super("SESSION_EXPIRED");
+    this.name = "SessionExpiredError";
+  }
+};
+var RecentAuthenticationRequiredError = class extends Error {
+  constructor() {
+    super("Sign in again before continuing.");
+    this.name = "RecentAuthenticationRequiredError";
+  }
+};
+var SSOReauthenticationRequiredError = class extends Error {
+  constructor() {
+    super("SSO_REAUTHENTICATION_REQUIRED");
+    this.name = "SSOReauthenticationRequiredError";
+  }
+};
+var PlatformServerFetchError = class extends Error {
+  constructor(message, path, status, code, requestId) {
+    super(message);
+    this.path = path;
+    this.status = status;
+    this.code = code;
+    this.requestId = requestId;
+    this.name = "PlatformServerFetchError";
+  }
+  path;
+  status;
+  code;
+  requestId;
+};
+var named = (error, name) => typeof error === "object" && error !== null && error.name === name;
+var isSessionExpiredError = (error) => named(error, "SessionExpiredError");
+var isRecentAuthenticationRequiredError = (error) => named(error, "RecentAuthenticationRequiredError");
+var isSSOReauthenticationRequiredError = (error) => named(error, "SSOReauthenticationRequiredError");
+var isPlatformServerFetchError = (error) => named(error, "PlatformServerFetchError");
+function authenticationErrorFor(code) {
+  if (code === "sso_reauthentication_required") return new SSOReauthenticationRequiredError();
+  if (code === "recent_authentication_required") return new RecentAuthenticationRequiredError();
+  return new SessionExpiredError();
+}
+function isControlAPIErrorLike(error) {
+  return typeof error === "object" && error !== null && error.name === "ControlAPIError" && typeof error.status === "number" && typeof error.code === "string" && typeof error.requestId === "string";
+}
+function mapControlError(error) {
+  if (!isControlAPIErrorLike(error)) return error;
+  if (error.status === 401) return authenticationErrorFor(error.code);
+  return new PlatformServerFetchError(error.message, "control API", error.status, error.code, error.requestId);
+}
+async function controlRequest(run) {
+  try {
+    return await run();
+  } catch (error) {
+    throw mapControlError(error);
+  }
+}
+async function buildForwardedRequestHeaders(initHeaders) {
+  const headers$1 = new Headers(initHeaders);
+  try {
+    applyForwardedClientHeaders(await headers(), headers$1);
+  } catch {
+  }
+  return headers$1;
+}
+var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function timeoutFor(init, timeouts) {
+  const method = (init?.method ?? "GET").toUpperCase();
+  if (typeof timeouts === "number") return timeouts;
+  return READ_METHODS.has(method) ? timeouts?.read ?? 1e4 : timeouts?.write ?? 3e4;
+}
+function isTimeout(error) {
+  return error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
+}
+function createPlatformFetch(config) {
+  const doFetch = config.fetch ?? globalThis.fetch;
+  const forward = config.forwardHeaders ?? buildForwardedRequestHeaders;
+  async function fetchWithAccessToken(path, accessToken, init) {
+    try {
+      const headers = await forward(init?.headers);
+      if (accessToken) headers.set("Authorization", `Bearer ${accessToken}`);
+      const deadline = AbortSignal.timeout(timeoutFor(init, config.timeoutMs));
+      return await doFetch(`${resolveValue(config.apiUrl)}${path}`, {
+        ...init,
+        headers,
+        cache: init?.cache ?? "no-store",
+        signal: init?.signal ? AbortSignal.any([init.signal, deadline]) : deadline
+      });
+    } catch (error) {
+      if (error instanceof PlatformServerFetchError) throw error;
+      if (isTimeout(error)) throw new PlatformServerFetchError("Platform service timed out", path, 504, "upstream_timeout");
+      throw new PlatformServerFetchError("Platform service is unavailable", path);
+    }
+  }
+  async function responseError(response, path) {
+    const body = await response.clone().json().catch(() => null);
+    if (response.status === 401) return authenticationErrorFor(body?.code);
+    const message = body?.message || body?.code || "Platform request failed";
+    return new PlatformServerFetchError(message, path, response.status, body?.code, body?.request_id);
+  }
+  async function parseJson(response, path) {
+    try {
+      return await response.json();
+    } catch {
+      throw new PlatformServerFetchError("Platform response was not valid JSON", path, response.status);
+    }
+  }
+  async function jsonOrNull(response, path) {
+    if (response.status === 404 || response.status === 204) return null;
+    if (!response.ok) throw await responseError(response, path);
+    return parseJson(response, path);
+  }
+  async function fetchAuthed(path, init) {
+    const token = await config.getAccessToken();
+    if (!token) throw new PlatformServerFetchError("Authentication is required", path, 401);
+    return fetchWithAccessToken(path, token, init);
+  }
+  return {
+    fetchWithAccessToken,
+    /** Bearer-authenticated raw response; throws 401 when there is no session. */
+    fetchAuthed,
+    /** JSON body, or null for 204/404. */
+    async fetchAuthedJson(path, init) {
+      return jsonOrNull(await fetchAuthed(path, init), path);
+    },
+    /** JSON body; every non-2xx (404 included) is an error. */
+    async fetchAuthedJsonStrict(path, init) {
+      const response = await fetchAuthed(path, init);
+      if (!response.ok) throw await responseError(response, path);
+      return parseJson(response, path);
+    },
+    async fetchJsonWithAccessToken(path, accessToken, init) {
+      return jsonOrNull(await fetchWithAccessToken(path, accessToken, init), path);
+    },
+    /** Unauthenticated JSON read (public endpoints), same headers/timeout/error rules. */
+    async fetchPublicJson(path, init) {
+      return jsonOrNull(await fetchWithAccessToken(path, null, init), path);
+    },
+    async fetchAuthedField(path, select, init) {
+      const response = await fetchAuthed(path, init);
+      const data = await jsonOrNull(response, path);
+      return data ? select(data) ?? null : null;
+    },
+    async fetchAuthedItems(path, init) {
+      const response = await fetchAuthed(path, init);
+      const data = await jsonOrNull(response, path);
+      return data?.items ?? [];
+    }
+  };
+}
+function createSessionStore(config) {
+  const names = config.cookies;
+  const hostPrefixed = names.session.startsWith("__Host-") || names.refreshToken.startsWith("__Host-");
+  const secure = hostPrefixed || (config.secure ?? true);
+  const domain = hostPrefixed ? void 0 : config.cookieDomain;
+  const maxAgeCap = config.maxAgeSeconds ?? 7 * 24 * 60 * 60;
+  const decode = config.decodeToken ?? decodeDefaultSession;
+  const onError = config.onError ?? (() => {
+  });
+  const refresher = config.refresh ? createSessionRefresher({
+    apiUrl: config.refresh.apiUrl,
+    refreshPath: config.refresh.refreshPath,
+    clientType: config.refresh.clientType,
+    audience: config.audience,
+    timeoutMs: config.refresh.timeoutMs,
+    fetch: config.refresh.fetch
+  }) : void 0;
+  function cookieOptions(rememberMe, token) {
+    const maxAge = token ? tokenMaxAgeSeconds(token, maxAgeCap) : maxAgeCap;
+    return {
+      httpOnly: true,
+      secure,
+      sameSite: "lax",
+      path: "/",
+      ...rememberMe ? { maxAge } : {},
+      ...domain ? { domain } : {}
+    };
+  }
+  function assertAudience(token) {
+    if (!hasTokenAudience(token, config.audience)) {
+      throw new Error(`refusing to store a session token that is not for ${config.audience}`);
+    }
+  }
+  function acceptable(token) {
+    return Boolean(token && !isTokenExpired(token) && hasTokenAudience(token, config.audience));
+  }
+  async function jar(operation) {
+    try {
+      await config.requestBoundary?.();
+      return await cookies();
+    } catch (error) {
+      onError(error, operation);
+      return null;
+    }
+  }
+  function rememberedIn(store) {
+    return store?.get(names.rememberMe)?.value === "true";
+  }
+  async function createSession(accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
+    assertAudience(accessToken);
+    const store = await jar("createSession");
+    if (!store) throw new Error("Cannot create a session outside a request");
+    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken));
+    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
+    store.set(names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe));
+  }
+  function writeSessionCookies(response, accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
+    assertAudience(accessToken);
+    setCookie(response, names.session, accessToken, cookieOptions(rememberMe, accessToken));
+    if (refreshToken) setCookie(response, names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
+    setCookie(response, names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe));
+    return response;
+  }
+  async function getAccessToken() {
+    const store = await jar("getAccessToken");
+    const token = store?.get(names.session)?.value;
+    return acceptable(token) ? token : null;
+  }
+  async function getRefreshToken() {
+    const store = await jar("getRefreshToken");
+    return store?.get(names.refreshToken)?.value || null;
+  }
+  async function getSession() {
+    const token = await getAccessToken();
+    return token ? decode(token) : null;
+  }
+  async function isRememberMe() {
+    return rememberedIn(await jar("isRememberMe"));
+  }
+  async function updateAccessToken(accessToken, refreshToken) {
+    assertAudience(accessToken);
+    const store = await jar("updateAccessToken");
+    if (!store) throw new Error("Cannot update a session outside a request");
+    const rememberMe = rememberedIn(store);
+    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken));
+    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
+  }
+  async function getSessionWithRefresh() {
+    const store = await jar("getSessionWithRefresh");
+    const token = store?.get(names.session)?.value;
+    if (!token || !hasTokenAudience(token, config.audience)) return null;
+    if (!isTokenExpiringSoon(token)) return decode(token);
+    const refreshToken = store?.get(names.refreshToken)?.value;
+    if (refresher && refreshToken) {
+      const refreshed = await refresher.refresh(refreshToken);
+      if (refreshed) {
+        await updateAccessToken(refreshed.accessToken, refreshed.refreshToken);
+        return decode(refreshed.accessToken);
+      }
+    }
+    return isTokenExpired(token) ? null : decode(token);
+  }
+  function clearOptions() {
+    return { path: "/", secure };
+  }
+  async function destroySession() {
+    const store = await jar("destroySession");
+    if (!store) return;
+    try {
+      const options = cookieOptions(false);
+      for (const name of [names.session, names.refreshToken, names.rememberMe]) store.delete({ name, ...options });
+    } catch (error) {
+      onError(error, "destroySession");
+    }
+  }
+  function clearSessionCookies(response) {
+    for (const name of [names.session, names.refreshToken, names.rememberMe]) deleteCookie(response, name, clearOptions());
+    return response;
+  }
+  async function requireSession() {
+    const session = await getSession();
+    if (!session) throw new Error("Unauthorized");
+    return session;
+  }
+  return {
+    audience: config.audience,
+    cookieNames: names,
+    cookieOptions,
+    createSession,
+    writeSessionCookies,
+    getAccessToken,
+    getRefreshToken,
+    getSession,
+    getSessionWithRefresh,
+    isRememberMe,
+    updateAccessToken,
+    destroySession,
+    clearSessionCookies,
+    requireSession,
+    async isAuthenticated() {
+      return await getSession() !== null;
+    }
+  };
+}
+
+export { PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, SessionExpiredError, authenticationErrorFor, buildForwardedRequestHeaders, controlRequest, createPlatformFetch, createSessionStore, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, mapControlError };

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "type": "module",
   "license": "MIT",
-  "description": "Server-side session and authorization helpers for C1M platform surfaces: token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh, plus the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings under ./access",
+  "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cloud1mediaLtd/mml-js.git",
@@ -53,7 +53,9 @@
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "typescript": "5.9.3",
-    "vitest": "^4.1.4"
+    "vitest": "^4.1.4",
+    "tsup": "^8.5.1",
+    "@c1m-public/transport": "0.0.0"
   },
   "peerDependencies": {
     "next": ">=15",
@@ -69,7 +71,7 @@
   },
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "pnpm clean && tsc -p tsconfig.build.json",
+    "build": "pnpm clean && tsup",
     "lint": "tsc -p tsconfig.json --noEmit",
     "test": "vitest",
     "test:run": "vitest run",

package/dist/access/errors.d.ts

@@ -1,13 +0,0 @@
-export type AccessErrorCode = "unauthenticated" | "forbidden" | "unavailable" | "invalid_snapshot";
-/**
- * Typed failure for loading or validating an access snapshot. `unauthenticated`
- * = no/expired session (401); `forbidden` = the backend refused the snapshot
- * (403; e.g. wrong audience); `unavailable` = transport/5xx; `invalid_snapshot`
- * = the payload did not match the contract.
- */
-export declare class AccessSnapshotError extends Error {
-    readonly code: AccessErrorCode;
-    readonly status: number | undefined;
-    constructor(code: AccessErrorCode, message: string, status?: number);
-}
-export declare function isAccessSnapshotError(error: unknown, code?: AccessErrorCode): error is AccessSnapshotError;

package/dist/access/errors.js

@@ -1,19 +0,0 @@
-/**
- * Typed failure for loading or validating an access snapshot. `unauthenticated`
- * = no/expired session (401); `forbidden` = the backend refused the snapshot
- * (403; e.g. wrong audience); `unavailable` = transport/5xx; `invalid_snapshot`
- * = the payload did not match the contract.
- */
-export class AccessSnapshotError extends Error {
-    code;
-    status;
-    constructor(code, message, status) {
-        super(message);
-        this.name = "AccessSnapshotError";
-        this.code = code;
-        this.status = status;
-    }
-}
-export function isAccessSnapshotError(error, code) {
-    return error instanceof AccessSnapshotError && (code === undefined || error.code === code);
-}

package/dist/access/fetch.d.ts

@@ -1,23 +0,0 @@
-import { type Resolvable } from "../internal.js";
-import { type AccessSnapshot } from "./snapshot.js";
-export declare const DEFAULT_ACCESS_ENDPOINT_PATH = "/api/v1/platform/access";
-export interface FetchAccessSnapshotOptions {
-    /** Backend origin, e.g. https://api.example.com (no trailing slash needed). */
-    apiUrl: Resolvable;
-    /** Bearer access token for the platform surface. */
-    accessToken: string;
-    /** Defaults to /api/v1/platform/access. */
-    endpointPath?: string;
-    fetchTimeoutMs?: number;
-    fetchImpl?: typeof fetch;
-    /** Extra headers. Authorization and Accept are always set here. */
-    headers?: HeadersInit;
-    /** Incoming BFF request; its client identity (IP, geo, UA) is forwarded to the backend. */
-    request?: Request;
-}
-/**
- * Framework-neutral fetch of the resolved access snapshot. Throws
- * AccessSnapshotError: 401 → unauthenticated, 403 → forbidden, other non-2xx or
- * network failure → unavailable, malformed body → invalid_snapshot.
- */
-export declare function fetchAccessSnapshot(opts: FetchAccessSnapshotOptions): Promise<AccessSnapshot>;

package/dist/access/fetch.js

@@ -1,43 +0,0 @@
-import { forwardedRequestHeaders } from "../forwarding.js";
-import { resolveValue, timedFetch } from "../internal.js";
-import { AccessSnapshotError } from "./errors.js";
-import { parseAccessSnapshot } from "./snapshot.js";
-export const DEFAULT_ACCESS_ENDPOINT_PATH = "/api/v1/platform/access";
-/**
- * Framework-neutral fetch of the resolved access snapshot. Throws
- * AccessSnapshotError: 401 → unauthenticated, 403 → forbidden, other non-2xx or
- * network failure → unavailable, malformed body → invalid_snapshot.
- */
-export async function fetchAccessSnapshot(opts) {
-    const url = `${resolveValue(opts.apiUrl).replace(/\/$/, "")}${opts.endpointPath ?? DEFAULT_ACCESS_ENDPOINT_PATH}`;
-    const headers = opts.request
-        ? forwardedRequestHeaders(opts.request, opts.headers)
-        : new Headers(opts.headers);
-    headers.set("Authorization", `Bearer ${opts.accessToken}`);
-    headers.set("Accept", "application/json");
-    let response;
-    try {
-        response = await timedFetch(url, {
-            init: { method: "GET", headers },
-            timeoutMs: opts.fetchTimeoutMs,
-            fetchImpl: opts.fetchImpl,
-        });
-    }
-    catch (error) {
-        throw new AccessSnapshotError("unavailable", `access snapshot request failed: ${error.message}`);
-    }
-    if (response.status === 401)
-        throw new AccessSnapshotError("unauthenticated", "session expired", 401);
-    if (response.status === 403)
-        throw new AccessSnapshotError("forbidden", "access snapshot refused", 403);
-    if (!response.ok)
-        throw new AccessSnapshotError("unavailable", `access snapshot returned ${response.status}`, response.status);
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        throw new AccessSnapshotError("invalid_snapshot", "access snapshot body is not JSON", response.status);
-    }
-    return parseAccessSnapshot(body);
-}

package/dist/access/generated/keys.d.ts

@@ -1,20 +0,0 @@
-/** Platform-operator permission keys. */
-export declare const PLATFORM_PERMISSIONS: readonly ["platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.observability.manage", "platform.observability.view", "platform.ops.manage", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
-export type PlatformPermissionKey = (typeof PLATFORM_PERMISSIONS)[number];
-/** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
-export declare const DASH_PERMISSIONS: readonly ["dash.apps.manage", "dash.billing.manage", "dash.channels.manage", "dash.customers.manage", "dash.domains.manage", "dash.members.manage", "dash.ownership.transfer", "dash.plans.manage", "dash.publish", "dash.settings.manage", "dash.workspaces.admin", "dash.workspaces.manage"];
-export type DashPermissionKey = (typeof DASH_PERMISSIONS)[number];
-/** Membership-mirrored dash role bundles (grant keys at dash scope). */
-export declare const DASH_ROLES: readonly ["dash.admin", "dash.owner"];
-export type DashRole = (typeof DASH_ROLES)[number];
-/** Lead-broker workload permission keys. */
-export declare const LEADBROKER_PERMISSIONS: readonly ["leadbroker.finance.manage", "leadbroker.leads.dispatch", "leadbroker.leads.review", "leadbroker.leads.view", "leadbroker.policy.manage"];
-export type LeadBrokerPermissionKey = (typeof LEADBROKER_PERMISSIONS)[number];
-/** Workspace-staff permission keys. */
-export declare const WORKSPACE_PERMISSIONS: readonly ["workspace.channels.manage", "workspace.channels.secrets", "workspace.channels.view", "workspace.crm.manage", "workspace.crm.view", "workspace.customers.manage", "workspace.customers.view", "workspace.orders.manage", "workspace.orders.view", "workspace.payments.record", "workspace.site.edit", "workspace.site.view", "workspace.staff.manage"];
-export type WorkspacePermissionKey = (typeof WORKSPACE_PERMISSIONS)[number];
-/** Assignable workspace-staff role bundles (grant keys at workspace scope). */
-export declare const WORKSPACE_ROLES: readonly ["workspace.editor", "workspace.frontdesk", "workspace.manager"];
-export type WorkspaceRole = (typeof WORKSPACE_ROLES)[number];
-/** Every permission key the backend can grant, across all scopes. */
-export type PermissionKey = PlatformPermissionKey | DashPermissionKey | LeadBrokerPermissionKey | WorkspacePermissionKey;