@c1m-public/platform-auth 0.8.0 → 0.8.2

package/dist/access/index.js

@@ -1,2 +1,2 @@
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-OPF4UZLE.js';
-import '../chunk-P4LKOHR4.js';
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-73ZH67GM.js';
+import '../chunk-ZWSJVE5S.js';

package/dist/access/next.js

@@ -1,11 +1,11 @@
 import { decodeTokenPayload } from '../chunk-FBC2NUH7.js';
-import { AccessSnapshotError, fetchAccessSnapshot, isAccessSnapshotError, hasAnyPermission, hasAllPermissions, hasWorkspacePermission } from '../chunk-OPF4UZLE.js';
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-OPF4UZLE.js';
-import { resolveValue } from '../chunk-P4LKOHR4.js';
+import { AccessSnapshotError, fetchAccessSnapshot, isAccessSnapshotError, hasAnyPermission, hasAllPermissions, hasWorkspacePermission } from '../chunk-73ZH67GM.js';
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-73ZH67GM.js';
+import { resolveValue } from '../chunk-ZWSJVE5S.js';
 import 'server-only';
 import { cache } from 'react';
-import { forbidden, unauthorized } from 'next/navigation';
-import { updateTag } from 'next/cache';
+import { forbidden, unauthorized } from 'next/navigation.js';
+import { updateTag } from 'next/cache.js';
 
 function accessCacheTag(subjectId) {
   return `access:${subjectId}`;

package/dist/{chunk-OPF4UZLE.js → chunk-73ZH67GM.js}

@@ -1,4 +1,4 @@
-import { resolveValue, forwardedRequestHeaders, timedFetch } from './chunk-P4LKOHR4.js';
+import { resolveValue, forwardedRequestHeaders, timedFetch } from './chunk-ZWSJVE5S.js';
 
 // src/access/generated/keys.ts
 var PLATFORM_PERMISSIONS = [

package/dist/{chunk-QV7HSZLE.js → chunk-GQ36R3RQ.js}

@@ -1,5 +1,5 @@
 import { parseAuthResponse, hasTokenAudience, decodeTokenPayload, isTokenExpired, isTokenExpiringSoon } from './chunk-FBC2NUH7.js';
-import { DEFAULT_FETCH_TIMEOUT_MS, forwardedRequestHeaders, timedFetch, resolveValue, resolveAsync } from './chunk-P4LKOHR4.js';
+import { DEFAULT_FETCH_TIMEOUT_MS, forwardedRequestHeaders, timedFetch, resolveValue, resolveAll } from './chunk-ZWSJVE5S.js';
 
 // src/return-path.ts
 function safeInternalPath(raw) {
@@ -315,10 +315,12 @@ function createSessionRefresher(config) {
   const inflight = /* @__PURE__ */ new Map();
   async function perform(refreshToken) {
     try {
-      const headers = new Headers(await resolveAsync(config.headers));
+      const pending = resolveAll(config.apiUrl, config.headers);
+      const [origin, extra] = pending instanceof Promise ? await pending : pending;
+      const headers = new Headers(extra);
       headers.set("Content-Type", "application/json");
       headers.set("X-Client-Type", config.clientType);
-      const response = await timedFetch(`${await resolveAsync(config.apiUrl)}${config.refreshPath}`, {
+      const response = await timedFetch(`${origin}${config.refreshPath}`, {
         init: {
           method: "POST",
           headers,

package/dist/{chunk-P4LKOHR4.js → chunk-ZWSJVE5S.js}

@@ -25,8 +25,13 @@ function forwardedRequestHeaders(request, init) {
 function resolveValue(value) {
   return typeof value === "function" ? value() : value;
 }
-async function resolveAsync(value) {
-  return typeof value === "function" ? await value() : value;
+function resolveAsync(value) {
+  return typeof value === "function" ? value() : value;
+}
+var isPromise = (value) => typeof value === "object" && value !== null && typeof value.then === "function";
+function resolveAll(...values) {
+  const resolved = values.map((value) => resolveAsync(value));
+  return resolved.some(isPromise) ? Promise.all(resolved) : resolved;
 }
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function timedFetch(url, options = {}) {
@@ -44,4 +49,4 @@ async function timedFetch(url, options = {}) {
   }
 }
 
-export { DEFAULT_FETCH_TIMEOUT_MS, applyForwardedClientHeaders, forwardedRequestHeaders, resolveAsync, resolveValue, timedFetch };
+export { DEFAULT_FETCH_TIMEOUT_MS, applyForwardedClientHeaders, forwardedRequestHeaders, resolveAll, resolveValue, timedFetch };

package/dist/index.js

@@ -1,3 +1,3 @@
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-QV7HSZLE.js';
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-GQ36R3RQ.js';
 export { decodeBase64Url, decodeDefaultSession, decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, tokenMaxAgeSeconds } from './chunk-FBC2NUH7.js';
-export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-P4LKOHR4.js';
+export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-ZWSJVE5S.js';

package/dist/next.js

@@ -1,11 +1,11 @@
-import { createSessionRefresher, setCookie, deleteCookie } from './chunk-QV7HSZLE.js';
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-QV7HSZLE.js';
+import { createSessionRefresher, setCookie, deleteCookie } from './chunk-GQ36R3RQ.js';
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-GQ36R3RQ.js';
 import { decodeDefaultSession, tokenMaxAgeSeconds, hasTokenAudience, isTokenExpiringSoon, isTokenExpired } from './chunk-FBC2NUH7.js';
 export { decodeBase64Url, decodeDefaultSession, decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, tokenMaxAgeSeconds } from './chunk-FBC2NUH7.js';
-import { applyForwardedClientHeaders, resolveValue } from './chunk-P4LKOHR4.js';
-export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-P4LKOHR4.js';
+import { applyForwardedClientHeaders, resolveValue } from './chunk-ZWSJVE5S.js';
+export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-ZWSJVE5S.js';
 import 'server-only';
-import { headers, cookies } from 'next/headers';
+import { headers, cookies } from 'next/headers.js';
 
 // src/next/errors.ts
 var SessionExpiredError = class extends Error {
@@ -83,7 +83,7 @@ function isTimeout(error) {
   return error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
 }
 function createPlatformFetch(config) {
-  const doFetch = config.fetch ?? globalThis.fetch;
+  const doFetch = (input, init) => (config.fetch ?? globalThis.fetch)(input, init);
   const forward = config.forwardHeaders ?? buildForwardedRequestHeaders;
   async function fetchWithAccessToken(path, accessToken, init) {
     try {
@@ -189,7 +189,7 @@ function createSessionStore(config) {
   }
   function assertAudience(token) {
     if (!hasTokenAudience(token, config.audience)) {
-      throw new Error(`refusing to store a session token that is not for ${config.audience}`);
+      throw new Error(`refusing to store a session token with the wrong audience (expected ${config.audience})`);
     }
   }
   function acceptable(token) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",