@c1m-public/platform-auth 0.6.0 → 0.8.0

package/dist/access/generated/keys.js

@@ -1,87 +0,0 @@
-// GENERATED by `node scripts/generate-access-types.mjs` from contracts/authz-keys.json
-// (vendored from c1m-server/schemas/api/authz-keys.json). Do not edit by hand.
-/** Platform-operator permission keys. */
-export const PLATFORM_PERMISSIONS = [
-    "affiliates.finance.manage",
-    "affiliates.partners.manage",
-    "affiliates.programmes.manage",
-    "affiliates.view",
-    "linkservice.domains.manage",
-    "linkservice.links.manage",
-    "linkservice.qr.manage",
-    "linkservice.view",
-    "platform.admin.view",
-    "platform.audit.view",
-    "platform.auth.manage",
-    "platform.billing.manage",
-    "platform.channels.manage",
-    "platform.channels.view",
-    "platform.config.manage",
-    "platform.docs.manage",
-    "platform.docs.view",
-    "platform.observability.manage",
-    "platform.observability.view",
-    "platform.offboarding.view",
-    "platform.ops.manage",
-    "platform.support.impersonate",
-    "platform.support.sessions",
-    "platform.tenants.archive",
-    "platform.tenants.manage",
-    "platform.tenants.restore",
-    "platform.users.deactivate",
-    "platform.users.delete",
-    "platform.users.invite",
-    "platform.users.manage_access",
-    "platform.users.reactivate",
-    "platform.users.view",
-];
-/** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
-export const DASH_PERMISSIONS = [
-    "dash.apps.manage",
-    "dash.billing.manage",
-    "dash.channels.manage",
-    "dash.customers.manage",
-    "dash.domains.manage",
-    "dash.members.manage",
-    "dash.ownership.transfer",
-    "dash.plans.manage",
-    "dash.publish",
-    "dash.settings.manage",
-    "dash.workspaces.admin",
-    "dash.workspaces.manage",
-];
-/** Membership-mirrored dash role bundles (grant keys at dash scope). */
-export const DASH_ROLES = [
-    "dash.admin",
-    "dash.owner",
-];
-/** Lead-broker workload permission keys. */
-export const LEADBROKER_PERMISSIONS = [
-    "leadbroker.finance.manage",
-    "leadbroker.leads.dispatch",
-    "leadbroker.leads.review",
-    "leadbroker.leads.view",
-    "leadbroker.policy.manage",
-];
-/** Workspace-staff permission keys. */
-export const WORKSPACE_PERMISSIONS = [
-    "workspace.channels.manage",
-    "workspace.channels.secrets",
-    "workspace.channels.view",
-    "workspace.crm.manage",
-    "workspace.crm.view",
-    "workspace.customers.manage",
-    "workspace.customers.view",
-    "workspace.orders.manage",
-    "workspace.orders.view",
-    "workspace.payments.record",
-    "workspace.site.edit",
-    "workspace.site.view",
-    "workspace.staff.manage",
-];
-/** Assignable workspace-staff role bundles (grant keys at workspace scope). */
-export const WORKSPACE_ROLES = [
-    "workspace.editor",
-    "workspace.frontdesk",
-    "workspace.manager",
-];

package/dist/access/predicates.d.ts

@@ -1,48 +0,0 @@
-import type { AccessEntry, AccessSnapshot } from "./snapshot.js";
-export interface PermissionCheckOptions {
-    /**
-     * SaaS app (dash) slug the check is about. Omit for "anywhere": platform
-     * entries and any saas_app entry satisfy the check.
-     */
-    saasApp?: string;
-}
-/**
- * Mirrors c1m-server authz.entryCoversApp: platform scope covers every app;
- * saas_app scope covers "*" or a case-insensitive slug match; workspace-scoped
- * entries never satisfy an app-level check.
- */
-export declare function entryCoversApp(entry: AccessEntry, saasApp: string | undefined): boolean;
-/** True when the subject is active and holds `key` for the given app (or anywhere). */
-export declare function hasPermission(snapshot: AccessSnapshot, key: string, opts?: PermissionCheckOptions): boolean;
-export declare function hasAnyPermission(snapshot: AccessSnapshot, keys: readonly string[], opts?: PermissionCheckOptions): boolean;
-export declare function hasAllPermissions(snapshot: AccessSnapshot, keys: readonly string[], opts?: PermissionCheckOptions): boolean;
-/**
- * Workspace-staff check. Platform owners always pass (they own every
- * workspace); otherwise the workspace's effective permission list decides.
- * Platform/saas_app entries never confer workspace-staff permissions.
- */
-export declare function hasWorkspacePermission(snapshot: AccessSnapshot, workspaceId: string, key: string): boolean;
-/**
- * The dashes this subject runs, from the mirrored dash bundle grants — the
- * admission list for the Admin Center's dash area. Platform managers are not
- * listed: their reach is platform-wide, so admit them with
- * `hasPermission(snapshot, "platform.tenants.manage")` instead.
- */
-export declare function managedDashes(snapshot: AccessSnapshot): Array<{
-    saasApp: string;
-    role: string;
-}>;
-/** The dash bundle held on one dash, or "" when the subject holds none there. */
-export declare function dashRole(snapshot: AccessSnapshot, saasApp: string): string;
-export declare function isPlatformOwner(snapshot: AccessSnapshot): boolean;
-/**
- * The saas_app scopes under which `key` is held. Returns `{ all: true }` when a
- * platform-scoped or "*" entry grants it everywhere; otherwise the explicit
- * app slugs (empty = nowhere). Mirrors authz.AppPermissionScope.
- */
-export declare function appScopes(snapshot: AccessSnapshot, key: string): {
-    all: boolean;
-    apps: string[];
-};
-/** Distinct permission keys held for `saasApp` (or anywhere). Handy for nav/badges. */
-export declare function permissionsFor(snapshot: AccessSnapshot, opts?: PermissionCheckOptions): string[];

package/dist/access/predicates.js

@@ -1,95 +0,0 @@
-/**
- * Mirrors c1m-server authz.entryCoversApp: platform scope covers every app;
- * saas_app scope covers "*" or a case-insensitive slug match; workspace-scoped
- * entries never satisfy an app-level check.
- */
-export function entryCoversApp(entry, saasApp) {
-    switch (entry.scope_type) {
-        case "platform":
-            return true;
-        case "saas_app":
-            if (saasApp === undefined)
-                return true;
-            return entry.scope_id === "*" || entry.scope_id.toLowerCase() === saasApp.toLowerCase();
-        default:
-            return false;
-    }
-}
-/** True when the subject is active and holds `key` for the given app (or anywhere). */
-export function hasPermission(snapshot, key, opts = {}) {
-    if (!snapshot.active)
-        return false;
-    return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.saasApp));
-}
-export function hasAnyPermission(snapshot, keys, opts = {}) {
-    return keys.some((key) => hasPermission(snapshot, key, opts));
-}
-export function hasAllPermissions(snapshot, keys, opts = {}) {
-    return keys.every((key) => hasPermission(snapshot, key, opts));
-}
-/**
- * Workspace-staff check. Platform owners always pass (they own every
- * workspace); otherwise the workspace's effective permission list decides.
- * Platform/saas_app entries never confer workspace-staff permissions.
- */
-export function hasWorkspacePermission(snapshot, workspaceId, key) {
-    if (!snapshot.active)
-        return false;
-    if (snapshot.is_owner)
-        return true;
-    return (snapshot.workspace_permissions[workspaceId] ?? []).includes(key);
-}
-/**
- * The dashes this subject runs, from the mirrored dash bundle grants — the
- * admission list for the Admin Center's dash area. Platform managers are not
- * listed: their reach is platform-wide, so admit them with
- * `hasPermission(snapshot, "platform.tenants.manage")` instead.
- */
-export function managedDashes(snapshot) {
-    if (!snapshot.active)
-        return [];
-    return Object.entries(snapshot.dash_roles)
-        .map(([saasApp, role]) => ({ saasApp, role }))
-        .sort((a, b) => a.saasApp.localeCompare(b.saasApp));
-}
-/** The dash bundle held on one dash, or "" when the subject holds none there. */
-export function dashRole(snapshot, saasApp) {
-    if (!snapshot.active)
-        return "";
-    return snapshot.dash_roles[saasApp] ?? "";
-}
-export function isPlatformOwner(snapshot) {
-    return snapshot.active && snapshot.is_owner;
-}
-/**
- * The saas_app scopes under which `key` is held. Returns `{ all: true }` when a
- * platform-scoped or "*" entry grants it everywhere; otherwise the explicit
- * app slugs (empty = nowhere). Mirrors authz.AppPermissionScope.
- */
-export function appScopes(snapshot, key) {
-    if (!snapshot.active)
-        return { all: false, apps: [] };
-    const apps = new Set();
-    for (const entry of snapshot.permissions) {
-        if (entry.key !== key)
-            continue;
-        if (entry.scope_type === "platform")
-            return { all: true, apps: [] };
-        if (entry.scope_type === "saas_app") {
-            if (entry.scope_id === "*")
-                return { all: true, apps: [] };
-            apps.add(entry.scope_id.toLowerCase());
-        }
-    }
-    return { all: false, apps: [...apps].sort() };
-}
-/** Distinct permission keys held for `saasApp` (or anywhere). Handy for nav/badges. */
-export function permissionsFor(snapshot, opts = {}) {
-    if (!snapshot.active)
-        return [];
-    const keys = new Set();
-    for (const entry of snapshot.permissions)
-        if (entryCoversApp(entry, opts.saasApp))
-            keys.add(entry.key);
-    return [...keys].sort();
-}

package/dist/access/snapshot.d.ts

@@ -1,39 +0,0 @@
-/** Scope a permission entry applies to. Mirrors c1m-server authz.Scope*. */
-export type AccessScopeType = "platform" | "saas_app" | "workspace";
-export interface AccessEntry {
-    /** Permission key, e.g. "platform.users.manage_access". */
-    key: string;
-    scope_type: AccessScopeType;
-    /** "" for platform scope; saas_app slug or "*" for saas_app scope; workspace id for workspace scope. */
-    scope_id: string;
-}
-/**
- * The resolved authorization snapshot for one subject, as returned by
- * `GET /api/v1/platform/access`. This is the *output* of the backend resolver
- * (base-role grant ∪ scoped grants), never the grant rows themselves.
- */
-export interface AccessSnapshot {
-    subject_id: string;
-    /** Monotonic; bumps on any grant/role change. Use for optimistic concurrency and cache keys. */
-    access_version: number;
-    is_owner: boolean;
-    active: boolean;
-    /** Platform operator base role (derived; display only — never authorize on it). */
-    platform_role: string;
-    permissions: AccessEntry[];
-    /**
-     * Dash bundle (`dash.owner` / `dash.admin`) per saas_app id, mirrored from
-     * the subject's dash membership. This is the admission list for the dash
-     * area: the dashes this subject runs. What they may *do* on one is a normal
-     * `hasPermission(snapshot, key, { saasApp })` check — platform managers hold
-     * their authority platform-wide and so appear here not at all.
-     */
-    dash_roles: Record<string, string>;
-    /** Effective workspace-staff permission keys per workspace id. */
-    workspace_permissions: Record<string, string[]>;
-    /** Workspace-staff role bundle per workspace id (display only). */
-    workspace_roles: Record<string, string>;
-}
-export declare function emptySnapshot(subjectId?: string): AccessSnapshot;
-/** Runtime validator for the wire payload. Throws AccessSnapshotError("invalid_snapshot"). */
-export declare function parseAccessSnapshot(input: unknown): AccessSnapshot;

package/dist/access/snapshot.js

@@ -1,92 +0,0 @@
-import { AccessSnapshotError } from "./errors.js";
-const SCOPE_TYPES = new Set(["platform", "saas_app", "workspace"]);
-export function emptySnapshot(subjectId = "") {
-    return {
-        subject_id: subjectId,
-        access_version: 0,
-        is_owner: false,
-        active: false,
-        platform_role: "",
-        permissions: [],
-        dash_roles: {},
-        workspace_permissions: {},
-        workspace_roles: {},
-    };
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function fail(field, why) {
-    throw new AccessSnapshotError("invalid_snapshot", `access snapshot: ${field} ${why}`);
-}
-/** Runtime validator for the wire payload. Throws AccessSnapshotError("invalid_snapshot"). */
-export function parseAccessSnapshot(input) {
-    if (!isRecord(input))
-        fail("payload", "is not an object");
-    const { subject_id, access_version, is_owner, active, platform_role, permissions, dash_roles, workspace_permissions, workspace_roles } = input;
-    if (typeof subject_id !== "string" || subject_id === "")
-        fail("subject_id", "must be a non-empty string");
-    if (typeof access_version !== "number" || !Number.isInteger(access_version) || access_version < 0)
-        fail("access_version", "must be a non-negative integer");
-    if (typeof is_owner !== "boolean")
-        fail("is_owner", "must be a boolean");
-    if (typeof active !== "boolean")
-        fail("active", "must be a boolean");
-    if (platform_role !== undefined && platform_role !== null && typeof platform_role !== "string")
-        fail("platform_role", "must be a string");
-    if (!Array.isArray(permissions))
-        fail("permissions", "must be an array");
-    const entries = permissions.map((raw, i) => {
-        if (!isRecord(raw))
-            fail(`permissions[${i}]`, "is not an object");
-        const { key, scope_type, scope_id } = raw;
-        if (typeof key !== "string" || key === "")
-            fail(`permissions[${i}].key`, "must be a non-empty string");
-        if (typeof scope_type !== "string" || !SCOPE_TYPES.has(scope_type))
-            fail(`permissions[${i}].scope_type`, "must be platform|saas_app|workspace");
-        if (scope_id !== undefined && scope_id !== null && typeof scope_id !== "string")
-            fail(`permissions[${i}].scope_id`, "must be a string");
-        return { key, scope_type: scope_type, scope_id: typeof scope_id === "string" ? scope_id : "" };
-    });
-    const dashRoles = {};
-    if (dash_roles !== undefined && dash_roles !== null) {
-        if (!isRecord(dash_roles))
-            fail("dash_roles", "must be an object");
-        for (const [dash, role] of Object.entries(dash_roles)) {
-            if (typeof role !== "string")
-                fail(`dash_roles[${dash}]`, "must be a string");
-            dashRoles[dash] = role;
-        }
-    }
-    const wsPerms = {};
-    if (workspace_permissions !== undefined && workspace_permissions !== null) {
-        if (!isRecord(workspace_permissions))
-            fail("workspace_permissions", "must be an object");
-        for (const [ws, keys] of Object.entries(workspace_permissions)) {
-            if (!Array.isArray(keys) || keys.some((k) => typeof k !== "string"))
-                fail(`workspace_permissions[${ws}]`, "must be a string array");
-            wsPerms[ws] = [...keys];
-        }
-    }
-    const wsRoles = {};
-    if (workspace_roles !== undefined && workspace_roles !== null) {
-        if (!isRecord(workspace_roles))
-            fail("workspace_roles", "must be an object");
-        for (const [ws, role] of Object.entries(workspace_roles)) {
-            if (typeof role !== "string")
-                fail(`workspace_roles[${ws}]`, "must be a string");
-            wsRoles[ws] = role;
-        }
-    }
-    return {
-        subject_id,
-        access_version,
-        is_owner,
-        active,
-        platform_role: typeof platform_role === "string" ? platform_role : "",
-        permissions: entries,
-        dash_roles: dashRoles,
-        workspace_permissions: wsPerms,
-        workspace_roles: wsRoles,
-    };
-}

package/dist/cookies.d.ts

@@ -1,11 +0,0 @@
-export interface CookieOptions {
-    httpOnly?: boolean;
-    secure?: boolean;
-    sameSite?: "lax" | "strict" | "none";
-    path?: string;
-    maxAge?: number;
-}
-export declare function readCookie(request: Request, name: string): string | null;
-export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
-export declare function setCookie(response: Response, name: string, value: string, options?: CookieOptions): Response;
-export declare function deleteCookie(response: Response, name: string, options?: Pick<CookieOptions, "path" | "secure">): Response;

package/dist/cookies.js

@@ -1,42 +0,0 @@
-// Dependency-free cookie helpers over Web Request/Response (what Next route handlers use).
-export function readCookie(request, name) {
-    const header = request.headers.get("cookie");
-    if (!header)
-        return null;
-    for (const part of header.split(";")) {
-        const separator = part.indexOf("=");
-        if (separator < 0)
-            continue;
-        if (part.slice(0, separator).trim() !== name)
-            continue;
-        const raw = part.slice(separator + 1).trim();
-        try {
-            return decodeURIComponent(raw);
-        }
-        catch {
-            return raw;
-        }
-    }
-    return null;
-}
-export function serializeCookie(name, value, options = {}) {
-    const parts = [`${name}=${encodeURIComponent(value)}`];
-    parts.push(`Path=${options.path ?? "/"}`);
-    if (options.maxAge !== undefined)
-        parts.push(`Max-Age=${Math.max(0, Math.floor(options.maxAge))}`);
-    if (options.httpOnly ?? true)
-        parts.push("HttpOnly");
-    if (options.secure ?? name.startsWith("__Host-"))
-        parts.push("Secure");
-    const sameSite = options.sameSite ?? "lax";
-    parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
-    return parts.join("; ");
-}
-export function setCookie(response, name, value, options) {
-    response.headers.append("Set-Cookie", serializeCookie(name, value, options));
-    return response;
-}
-export function deleteCookie(response, name, options) {
-    response.headers.append("Set-Cookie", serializeCookie(name, "", { ...options, maxAge: 0 }));
-    return response;
-}

package/dist/device-cookie.d.ts

@@ -1,18 +0,0 @@
-/**
- * Per-browser identity sent as `X-Client-Device-ID`; c1m-server refuses to
- * create a session without it. Informational only, no authority.
- */
-export interface DeviceIdentity {
-    value: string;
-    created: boolean;
-}
-export interface DeviceIdentityConfig {
-    cookieName: string;
-    secure?: boolean;
-    maxAgeSeconds?: number;
-}
-export declare function createDeviceIdentity(config: DeviceIdentityConfig): {
-    read(request: Request): DeviceIdentity;
-    persist(response: Response, identity: DeviceIdentity): Response;
-};
-export type DeviceIdentityStore = ReturnType<typeof createDeviceIdentity>;

package/dist/device-cookie.js

@@ -1,22 +0,0 @@
-import { readCookie, setCookie } from "./cookies.js";
-const DEFAULT_DEVICE_MAX_AGE = 365 * 24 * 60 * 60;
-export function createDeviceIdentity(config) {
-    const maxAge = config.maxAgeSeconds ?? DEFAULT_DEVICE_MAX_AGE;
-    return {
-        read(request) {
-            const existing = readCookie(request, config.cookieName)?.trim();
-            return existing ? { value: existing, created: false } : { value: crypto.randomUUID(), created: true };
-        },
-        persist(response, identity) {
-            if (!identity.created)
-                return response;
-            return setCookie(response, config.cookieName, identity.value, {
-                httpOnly: true,
-                secure: config.secure ?? true,
-                sameSite: "lax",
-                path: "/",
-                maxAge,
-            });
-        },
-    };
-}

package/dist/forwarding.d.ts

@@ -1,2 +0,0 @@
-export declare function applyForwardedClientHeaders(incoming: Headers, headers?: Headers): Headers;
-export declare function forwardedRequestHeaders(request: Request, init?: HeadersInit): Headers;

package/dist/forwarding.js

@@ -1,32 +0,0 @@
-// Copies client identity (IP, geo, UA, host, proto) from an incoming BFF request onto a backend
-// request as X-Client-* / X-Forwarded-*. Used for device records, rate limits, audit — never auth.
-export function applyForwardedClientHeaders(incoming, headers = new Headers()) {
-    const forwardedFor = incoming.get("x-forwarded-for");
-    const realIp = incoming.get("x-real-ip") ?? forwardedFor?.split(",")[0]?.trim();
-    if (realIp && !headers.has("X-Client-IP"))
-        headers.set("X-Client-IP", realIp);
-    if (realIp && !headers.has("X-Real-IP"))
-        headers.set("X-Real-IP", realIp);
-    if (forwardedFor && !headers.has("X-Forwarded-For"))
-        headers.set("X-Forwarded-For", forwardedFor);
-    const country = incoming.get("cf-ipcountry") ??
-        incoming.get("x-vercel-ip-country") ??
-        incoming.get("x-geo-country") ??
-        incoming.get("x-country-code");
-    if (country && country !== "XX" && !headers.has("X-Geo-Country")) {
-        headers.set("X-Geo-Country", country);
-    }
-    const host = incoming.get("host");
-    if (host && !headers.has("X-Forwarded-Host"))
-        headers.set("X-Forwarded-Host", host);
-    const proto = incoming.get("x-forwarded-proto");
-    if (proto && !headers.has("X-Forwarded-Proto"))
-        headers.set("X-Forwarded-Proto", proto);
-    const userAgent = incoming.get("user-agent");
-    if (userAgent && !headers.has("X-Client-User-Agent"))
-        headers.set("X-Client-User-Agent", userAgent);
-    return headers;
-}
-export function forwardedRequestHeaders(request, init) {
-    return applyForwardedClientHeaders(request.headers, new Headers(init));
-}

package/dist/handoff-errors.d.ts

@@ -1,13 +0,0 @@
-export declare const HANDOFF_ERROR_MESSAGES: Record<string, string>;
-export declare const HANDOFF_ERROR_FALLBACK = "Sign-in failed \u2014 please try again.";
-export declare const SSO_ERROR_MESSAGES: Record<string, string>;
-/** Every sign-in failure code this package knows: handoff, admission, and SSO. */
-export declare const AUTH_ERROR_MESSAGES: Record<string, string>;
-export declare function handoffErrorMessage(code: string | null | undefined): string;
-export declare function isHandoffErrorCode(code: string | null | undefined): boolean;
-/**
- * Resolve any sign-in failure code to copy. `overrides` wins, so a surface can
- * reword a shared code or add its own without forking the whole map.
- */
-export declare function authErrorMessage(code: string | null | undefined, overrides?: Record<string, string>): string;
-export declare function isAuthErrorCode(code: string | null | undefined, overrides?: Record<string, string>): boolean;

package/dist/handoff-errors.js

@@ -1,65 +0,0 @@
-// One error vocabulary for the handoff: backend codes (c1m-server mapHandoffError) + BFF codes.
-export const HANDOFF_ERROR_MESSAGES = {
-    // backend — handoff broker
-    handoff_unknown_app: "That application is not registered for sign-in handoff.",
-    handoff_not_configured: "Sign-in handoff is not configured for this application yet.",
-    handoff_source_not_allowed: "Your current session cannot open that application. Sign in there directly.",
-    handoff_invalid: "That sign-in handoff expired or was already used. Start again from where you came from.",
-    handoff_device_required: "The handoff could not identify this browser. Please try again.",
-    handoff_request_invalid: "The sign-in handoff request was malformed. Please try again.",
-    handoff_failed: "Sign-in handoff failed. Sign in with an email code instead.",
-    // backend — target admission (same codes the target's own login returns)
-    knowledge_library_access_required: "Your account has not been granted Knowledge Library access. Ask a platform admin to enable it.",
-    admin_center_access_required: "Your account has not been granted Admin Center access.",
-    platform_admin_surface_required: "Platform operator accounts sign in through the Platform Admin Center.",
-    account_disabled: "This account is disabled.",
-    // BFF — target callback
-    handoff_state_invalid: "Sign-in attempt expired — please try again.",
-    handoff_exchange_failed: "Sign-in could not be completed. Please try again.",
-    // BFF — source start
-    handoff_start_failed: "Could not start the sign-in handoff. Please try again.",
-    handoff_redirect_invalid: "The sign-in handoff returned an unexpected destination and was stopped.",
-    // BFF — surface bounces
-    admin_surface: "Platform operators sign in here; SaaSDash sent you to the Admin Center.",
-};
-export const HANDOFF_ERROR_FALLBACK = "Sign-in failed — please try again.";
-// External sign-in (OIDC/social) codes every platform surface renders identically.
-// Surface-specific copy stays in the app and is passed as `overrides`.
-export const SSO_ERROR_MESSAGES = {
-    sso_cancelled: "Sign-in was cancelled.",
-    sso_denied: "Sign-in was refused by the provider.",
-    sso_state_invalid: "Sign-in attempt expired — please try again.",
-    sso_start_failed: "Could not start sign-in with that provider. Please try again.",
-    sso_complete_failed: "Sign-in could not be completed. Please try again.",
-    sso_unknown_operator: "No operator account matches that identity. Ask an admin for an invite.",
-    sso_provider_not_found: "That sign-in provider is not available.",
-    sso_not_configured: "That sign-in provider is not fully configured.",
-};
-/** Every sign-in failure code this package knows: handoff, admission, and SSO. */
-export const AUTH_ERROR_MESSAGES = {
-    ...HANDOFF_ERROR_MESSAGES,
-    ...SSO_ERROR_MESSAGES,
-};
-export function handoffErrorMessage(code) {
-    if (!code)
-        return HANDOFF_ERROR_FALLBACK;
-    return HANDOFF_ERROR_MESSAGES[code] ?? HANDOFF_ERROR_FALLBACK;
-}
-export function isHandoffErrorCode(code) {
-    return !!code && Object.prototype.hasOwnProperty.call(HANDOFF_ERROR_MESSAGES, code);
-}
-/**
- * Resolve any sign-in failure code to copy. `overrides` wins, so a surface can
- * reword a shared code or add its own without forking the whole map.
- */
-export function authErrorMessage(code, overrides) {
-    if (!code)
-        return HANDOFF_ERROR_FALLBACK;
-    return overrides?.[code] ?? AUTH_ERROR_MESSAGES[code] ?? HANDOFF_ERROR_FALLBACK;
-}
-export function isAuthErrorCode(code, overrides) {
-    if (!code)
-        return false;
-    return (Object.prototype.hasOwnProperty.call(AUTH_ERROR_MESSAGES, code) ||
-        (!!overrides && Object.prototype.hasOwnProperty.call(overrides, code)));
-}

package/dist/handoff.d.ts

@@ -1,55 +0,0 @@
-import type { DeviceIdentityStore } from "./device-cookie.js";
-import { type Resolvable } from "./internal.js";
-import { type AuthResponse } from "./token.js";
-export declare function sourceStartPath(app: string): string;
-export declare function brokerPaths(app: string): {
-    readonly start: `/api/v1/platform/auth/handoffs/${string}/start`;
-    readonly exchange: `/api/v1/platform/auth/handoffs/${string}/exchange`;
-};
-export interface HandoffTargetConfig {
-    app: string;
-    apiUrl: Resolvable;
-    audience: string;
-    clientType: string;
-    sources: Record<string, Resolvable>;
-    defaultSource: string;
-    cookiePrefix: string;
-    loginPath: string;
-    defaultReturnPath: string;
-    device: DeviceIdentityStore;
-    /** Write session cookies onto `response` (or return void if written via a framework store). */
-    establishSession: (session: AuthResponse, response: Response, request: Request) => Promise<Response | void> | Response | void;
-    secureCookies?: boolean;
-    fetchTimeoutMs?: number;
-}
-export declare function createHandoffTarget(config: HandoffTargetConfig): {
-    cookies: {
-        readonly state: `${string}state`;
-        readonly verifier: `${string}verifier`;
-        readonly from: `${string}from`;
-    };
-    /** GET `?source=&from=` */
-    start(request: Request): Promise<Response>;
-    /** GET `?code=&state=` */
-    callback(request: Request): Promise<Response>;
-};
-export type HandoffTarget = ReturnType<typeof createHandoffTarget>;
-export interface HandoffSourceTarget {
-    origin: Resolvable;
-    callbackPath?: string;
-    loginPath?: string;
-}
-export interface HandoffSourceConfig {
-    apiUrl: Resolvable;
-    clientType: string;
-    targets: Record<string, HandoffSourceTarget>;
-    /** Live bearer or null when signed out; refresh an expiring token before returning it. */
-    getAccessToken: (request: Request) => Promise<string | null> | string | null;
-    loginPath: string;
-    fetchTimeoutMs?: number;
-}
-export declare function createHandoffSource(config: HandoffSourceConfig): {
-    /** GET `/api/auth/handoffs/{app}/start?code_challenge=&state=` */
-    start(request: Request, app: string): Promise<Response>;
-};
-export type HandoffSource = ReturnType<typeof createHandoffSource>;