@c1m-public/platform-auth 0.7.0 → 0.8.1

package/dist/access/index.d.ts

@@ -1,4 +1,4 @@
-import { R as Resolvable } from '../internal-rnEuAE21.js';
+import { R as Resolvable } from '../internal-D6RafCm2.js';
 
 /** Platform-operator permission keys. */
 declare const PLATFORM_PERMISSIONS: readonly ["affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];

package/dist/access/index.js

@@ -1,2 +1,2 @@
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-RR5DP3QT.js';
-import '../chunk-RVKIDFXM.js';
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-73ZH67GM.js';
+import '../chunk-ZWSJVE5S.js';

package/dist/access/next.d.ts

@@ -1,4 +1,4 @@
-import { R as Resolvable } from '../internal-rnEuAE21.js';
+import { R as Resolvable } from '../internal-D6RafCm2.js';
 import { AccessSnapshot, PermissionCheckOptions } from './index.js';
 export { AccessEntry, AccessErrorCode, AccessScopeType, AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, DashPermissionKey, DashRole, FetchAccessSnapshotOptions, LEADBROKER_PERMISSIONS, LeadBrokerPermissionKey, PLATFORM_PERMISSIONS, PermissionKey, PlatformPermissionKey, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, WorkspacePermissionKey, WorkspaceRole, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from './index.js';
 

package/dist/access/next.js

@@ -1,11 +1,11 @@
 import { decodeTokenPayload } from '../chunk-FBC2NUH7.js';
-import { AccessSnapshotError, fetchAccessSnapshot, isAccessSnapshotError, hasAnyPermission, hasAllPermissions, hasWorkspacePermission } from '../chunk-RR5DP3QT.js';
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-RR5DP3QT.js';
-import { resolveValue } from '../chunk-RVKIDFXM.js';
+import { AccessSnapshotError, fetchAccessSnapshot, isAccessSnapshotError, hasAnyPermission, hasAllPermissions, hasWorkspacePermission } from '../chunk-73ZH67GM.js';
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-73ZH67GM.js';
+import { resolveValue } from '../chunk-ZWSJVE5S.js';
 import 'server-only';
 import { cache } from 'react';
-import { forbidden, unauthorized } from 'next/navigation';
-import { updateTag } from 'next/cache';
+import { forbidden, unauthorized } from 'next/navigation.js';
+import { updateTag } from 'next/cache.js';
 
 function accessCacheTag(subjectId) {
   return `access:${subjectId}`;

package/dist/{chunk-RR5DP3QT.js → chunk-73ZH67GM.js}

@@ -1,4 +1,4 @@
-import { resolveValue, forwardedRequestHeaders, timedFetch } from './chunk-RVKIDFXM.js';
+import { resolveValue, forwardedRequestHeaders, timedFetch } from './chunk-ZWSJVE5S.js';
 
 // src/access/generated/keys.ts
 var PLATFORM_PERMISSIONS = [

package/dist/{chunk-SMBKTB5V.js → chunk-GQ36R3RQ.js}

@@ -1,5 +1,5 @@
 import { parseAuthResponse, hasTokenAudience, decodeTokenPayload, isTokenExpired, isTokenExpiringSoon } from './chunk-FBC2NUH7.js';
-import { DEFAULT_FETCH_TIMEOUT_MS, forwardedRequestHeaders, timedFetch, resolveValue } from './chunk-RVKIDFXM.js';
+import { DEFAULT_FETCH_TIMEOUT_MS, forwardedRequestHeaders, timedFetch, resolveValue, resolveAll } from './chunk-ZWSJVE5S.js';
 
 // src/return-path.ts
 function safeInternalPath(raw) {
@@ -315,10 +315,15 @@ function createSessionRefresher(config) {
   const inflight = /* @__PURE__ */ new Map();
   async function perform(refreshToken) {
     try {
-      const response = await timedFetch(`${resolveValue(config.apiUrl)}${config.refreshPath}`, {
+      const pending = resolveAll(config.apiUrl, config.headers);
+      const [origin, extra] = pending instanceof Promise ? await pending : pending;
+      const headers = new Headers(extra);
+      headers.set("Content-Type", "application/json");
+      headers.set("X-Client-Type", config.clientType);
+      const response = await timedFetch(`${origin}${config.refreshPath}`, {
         init: {
           method: "POST",
-          headers: { "Content-Type": "application/json", "X-Client-Type": config.clientType },
+          headers,
           body: JSON.stringify({ refresh_token: refreshToken })
         },
         timeoutMs,

package/dist/{chunk-RVKIDFXM.js → chunk-ZWSJVE5S.js}

@@ -25,6 +25,14 @@ function forwardedRequestHeaders(request, init) {
 function resolveValue(value) {
   return typeof value === "function" ? value() : value;
 }
+function resolveAsync(value) {
+  return typeof value === "function" ? value() : value;
+}
+var isPromise = (value) => typeof value === "object" && value !== null && typeof value.then === "function";
+function resolveAll(...values) {
+  const resolved = values.map((value) => resolveAsync(value));
+  return resolved.some(isPromise) ? Promise.all(resolved) : resolved;
+}
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function timedFetch(url, options = {}) {
   const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
@@ -41,4 +49,4 @@ async function timedFetch(url, options = {}) {
   }
 }
 
-export { DEFAULT_FETCH_TIMEOUT_MS, applyForwardedClientHeaders, forwardedRequestHeaders, resolveValue, timedFetch };
+export { DEFAULT_FETCH_TIMEOUT_MS, applyForwardedClientHeaders, forwardedRequestHeaders, resolveAll, resolveValue, timedFetch };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { applyForwardedClientHeaders, forwardedRequestHeaders } from '@c1m-public/transport';
-import { R as Resolvable } from './internal-rnEuAE21.js';
+import { R as Resolvable, A as AsyncResolvable } from './internal-D6RafCm2.js';
 
 interface SessionUser {
     id: string;
@@ -174,8 +174,12 @@ interface RefreshedSession {
     refreshToken?: string;
 }
 interface SessionRefresherConfig {
-    apiUrl: Resolvable;
+    /** Backend origin, no /api/v1. May resolve asynchronously (a tenant-scoped origin). */
+    apiUrl: AsyncResolvable<string>;
+    /** e.g. /api/v1/platform/auth/refresh; empty when `apiUrl` already resolves to the full URL. */
     refreshPath: string;
+    /** Extra request headers, e.g. a service credential and its tenant selector. */
+    headers?: AsyncResolvable<HeadersInit | undefined>;
     clientType: string;
     audience: string;
     singleflightTtlMs?: number;

package/dist/index.js

@@ -1,3 +1,3 @@
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-SMBKTB5V.js';
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-GQ36R3RQ.js';
 export { decodeBase64Url, decodeDefaultSession, decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, tokenMaxAgeSeconds } from './chunk-FBC2NUH7.js';
-export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-RVKIDFXM.js';
+export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-ZWSJVE5S.js';

package/dist/internal-D6RafCm2.d.ts

@@ -0,0 +1,6 @@
+/** A value that may be fixed or resolved per call (env read at request time). */
+type Resolvable<T = string> = T | (() => T);
+/** A value, a sync resolver, or an async resolver. */
+type AsyncResolvable<T> = T | (() => T | Promise<T>);
+
+export type { AsyncResolvable as A, Resolvable as R };

package/dist/next.d.ts

@@ -1,7 +1,7 @@
 import { SessionData, CookieOptions } from './index.js';
 export { AUTH_ERROR_MESSAGES, AuthResponse, DeviceIdentity, DeviceIdentityConfig, DeviceIdentityStore, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, HandoffSource, HandoffSourceConfig, HandoffSourceTarget, HandoffTarget, HandoffTargetConfig, RefreshedSession, SSO_ERROR_MESSAGES, SessionGateDecision, SessionGateInput, SessionRefresher, SessionRefresherConfig, SessionUser, TokenPayload, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds } from './index.js';
 export { applyForwardedClientHeaders, forwardedRequestHeaders } from '@c1m-public/transport';
-import { R as Resolvable } from './internal-rnEuAE21.js';
+import { R as Resolvable, A as AsyncResolvable } from './internal-D6RafCm2.js';
 
 /**
  * The error vocabulary every first-party platform surface uses at its edge.
@@ -92,9 +92,12 @@ interface SessionCookieNames {
     rememberMe: string;
 }
 interface SessionStoreRefreshConfig {
-    apiUrl: Resolvable<string>;
-    /** e.g. `/api/v1/platform/auth/refresh` */
+    /** Backend origin, or a function resolving it per call (a tenant-scoped origin). */
+    apiUrl: AsyncResolvable<string>;
+    /** e.g. `/api/v1/platform/auth/refresh`; empty when `apiUrl` resolves to the full URL. */
     refreshPath: string;
+    /** Extra headers on the refresh call, e.g. a service credential and its tenant selector. */
+    headers?: AsyncResolvable<HeadersInit | undefined>;
     clientType: string;
     timeoutMs?: number;
     fetch?: typeof fetch;

package/dist/next.js

@@ -1,11 +1,11 @@
-import { createSessionRefresher, setCookie, deleteCookie } from './chunk-SMBKTB5V.js';
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-SMBKTB5V.js';
+import { createSessionRefresher, setCookie, deleteCookie } from './chunk-GQ36R3RQ.js';
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-GQ36R3RQ.js';
 import { decodeDefaultSession, tokenMaxAgeSeconds, hasTokenAudience, isTokenExpiringSoon, isTokenExpired } from './chunk-FBC2NUH7.js';
 export { decodeBase64Url, decodeDefaultSession, decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, tokenMaxAgeSeconds } from './chunk-FBC2NUH7.js';
-import { applyForwardedClientHeaders, resolveValue } from './chunk-RVKIDFXM.js';
-export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-RVKIDFXM.js';
+import { applyForwardedClientHeaders, resolveValue } from './chunk-ZWSJVE5S.js';
+export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-ZWSJVE5S.js';
 import 'server-only';
-import { headers, cookies } from 'next/headers';
+import { headers, cookies } from 'next/headers.js';
 
 // src/next/errors.ts
 var SessionExpiredError = class extends Error {
@@ -170,6 +170,7 @@ function createSessionStore(config) {
   const refresher = config.refresh ? createSessionRefresher({
     apiUrl: config.refresh.apiUrl,
     refreshPath: config.refresh.refreshPath,
+    headers: config.refresh.headers,
     clientType: config.refresh.clientType,
     audience: config.audience,
     timeoutMs: config.refresh.timeoutMs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",

package/dist/internal-rnEuAE21.d.ts

@@ -1,4 +0,0 @@
-/** A value that may be fixed or resolved per call (env read at request time). */
-type Resolvable<T = string> = T | (() => T);
-
-export type { Resolvable as R };