@c1m-public/platform-auth 0.8.2 → 0.8.4

package/dist/{chunk-GQ36R3RQ.js → chunk-Q7YI7RMG.js}

@@ -308,6 +308,16 @@ function createHandoffSource(config) {
 // src/session-refresh.ts
 var DEFAULT_TTL_MS = 5e3;
 var DEFAULT_MAX = 1e3;
+function parseRefreshEnvelope(value) {
+  if (!value || typeof value !== "object") return null;
+  const outer = value;
+  const payload = outer.data && typeof outer.data === "object" ? outer.data : value;
+  if (typeof payload.access_token !== "string" || !payload.access_token) return null;
+  return {
+    accessToken: payload.access_token,
+    refreshToken: typeof payload.refresh_token === "string" && payload.refresh_token ? payload.refresh_token : void 0
+  };
+}
 function createSessionRefresher(config) {
   const ttl = config.singleflightTtlMs ?? DEFAULT_TTL_MS;
   const max = config.maxSingleflights ?? DEFAULT_MAX;
@@ -330,8 +340,8 @@ function createSessionRefresher(config) {
         fetch: config.fetch
       });
       if (!response.ok) return null;
-      const data = parseAuthResponse(await response.json());
-      return data && hasTokenAudience(data.access_token, config.audience) ? { accessToken: data.access_token, refreshToken: data.refresh_token } : null;
+      const refreshed = parseRefreshEnvelope(await response.json());
+      return refreshed && hasTokenAudience(refreshed.accessToken, config.audience) ? refreshed : null;
     } catch {
       return null;
     }
@@ -391,4 +401,4 @@ async function evaluateSessionGate(input) {
   return { kind: "redirect_login" };
 }
 
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath };
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath };

package/dist/index.d.ts

@@ -189,6 +189,13 @@ interface SessionRefresherConfig {
     fetchTimeoutMs?: number;
     fetch?: typeof fetch;
 }
+/**
+ * Two refresh envelopes exist: the platform one (flat, with token_type and
+ * expires_at) and the end-user one (`{ data: { access_token, refresh_token? } }`,
+ * where a rotated refresh token is optional). Both carry the access token the
+ * same way; that is all a refresh needs.
+ */
+declare function parseRefreshEnvelope(value: unknown): RefreshedSession | null;
 declare function createSessionRefresher(config: SessionRefresherConfig): {
     refresh(refreshToken: string): Promise<RefreshedSession | null>;
     size(): number;
@@ -221,4 +228,4 @@ interface SessionGateInput {
 }
 declare function evaluateSessionGate(input: SessionGateInput): Promise<SessionGateDecision>;
 
-export { AUTH_ERROR_MESSAGES, type AuthResponse, type CookieOptions, type DeviceIdentity, type DeviceIdentityConfig, type DeviceIdentityStore, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, type HandoffSource, type HandoffSourceConfig, type HandoffSourceTarget, type HandoffTarget, type HandoffTargetConfig, type RefreshedSession, SSO_ERROR_MESSAGES, type SessionData, type SessionGateDecision, type SessionGateInput, type SessionRefresher, type SessionRefresherConfig, type SessionUser, type TokenPayload, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds };
+export { AUTH_ERROR_MESSAGES, type AuthResponse, type CookieOptions, type DeviceIdentity, type DeviceIdentityConfig, type DeviceIdentityStore, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, type HandoffSource, type HandoffSourceConfig, type HandoffSourceTarget, type HandoffTarget, type HandoffTargetConfig, type RefreshedSession, SSO_ERROR_MESSAGES, type SessionData, type SessionGateDecision, type SessionGateInput, type SessionRefresher, type SessionRefresherConfig, type SessionUser, type TokenPayload, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds };

package/dist/index.js

@@ -1,3 +1,3 @@
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-GQ36R3RQ.js';
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-Q7YI7RMG.js';
 export { decodeBase64Url, decodeDefaultSession, decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, tokenMaxAgeSeconds } from './chunk-FBC2NUH7.js';
 export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-ZWSJVE5S.js';

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { SessionData, CookieOptions } from './index.js';
-export { AUTH_ERROR_MESSAGES, AuthResponse, DeviceIdentity, DeviceIdentityConfig, DeviceIdentityStore, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, HandoffSource, HandoffSourceConfig, HandoffSourceTarget, HandoffTarget, HandoffTargetConfig, RefreshedSession, SSO_ERROR_MESSAGES, SessionGateDecision, SessionGateInput, SessionRefresher, SessionRefresherConfig, SessionUser, TokenPayload, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds } from './index.js';
+export { AUTH_ERROR_MESSAGES, AuthResponse, DeviceIdentity, DeviceIdentityConfig, DeviceIdentityStore, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, HandoffSource, HandoffSourceConfig, HandoffSourceTarget, HandoffTarget, HandoffTargetConfig, RefreshedSession, SSO_ERROR_MESSAGES, SessionGateDecision, SessionGateInput, SessionRefresher, SessionRefresherConfig, SessionUser, TokenPayload, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds } from './index.js';
 export { applyForwardedClientHeaders, forwardedRequestHeaders } from '@c1m-public/transport';
 import { R as Resolvable, A as AsyncResolvable } from './internal-D6RafCm2.js';
 
@@ -128,6 +128,11 @@ interface SessionStoreConfig {
     /** Called when a cookie read/write fails outside a request (prerender); default swallows. */
     onError?: (error: unknown, operation: string) => void;
 }
+/** Per-call overrides: a multi-host surface picks the cookie domain per request. */
+interface SessionWriteOptions {
+    /** Ignored for `__Host-` names, which forbid Domain. */
+    cookieDomain?: string;
+}
 /**
  * Session cookies for a first-party Next.js platform surface, written once.
  *
@@ -148,24 +153,24 @@ interface SessionStoreConfig {
 declare function createSessionStore(config: SessionStoreConfig): {
     audience: string;
     cookieNames: SessionCookieNames;
-    cookieOptions: (rememberMe: boolean, token?: string) => CookieOptions & {
+    cookieOptions: (rememberMe: boolean, token?: string, options?: SessionWriteOptions) => CookieOptions & {
         httpOnly: true;
         sameSite: "lax";
         path: "/";
     };
-    createSession: (accessToken: string, refreshToken?: string, rememberMe?: boolean) => Promise<void>;
+    createSession: (accessToken: string, refreshToken?: string, rememberMe?: boolean, options?: SessionWriteOptions) => Promise<void>;
     writeSessionCookies: (response: Response, accessToken: string, refreshToken?: string, rememberMe?: boolean) => Response;
     getAccessToken: () => Promise<string | null>;
     getRefreshToken: () => Promise<string | null>;
     getSession: () => Promise<SessionData | null>;
     getSessionWithRefresh: () => Promise<SessionData | null>;
     isRememberMe: () => Promise<boolean>;
-    updateAccessToken: (accessToken: string, refreshToken?: string) => Promise<void>;
-    destroySession: () => Promise<void>;
+    updateAccessToken: (accessToken: string, refreshToken?: string, options?: SessionWriteOptions) => Promise<void>;
+    destroySession: (options?: SessionWriteOptions) => Promise<void>;
     clearSessionCookies: (response: Response) => Response;
     requireSession: () => Promise<SessionData>;
     isAuthenticated(): Promise<boolean>;
 };
 type SessionStore = ReturnType<typeof createSessionStore>;
 
-export { CookieOptions, type PlatformFetch, type PlatformFetchConfig, type PlatformFetchTimeouts, PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, type SessionCookieNames, SessionData, SessionExpiredError, type SessionStore, type SessionStoreConfig, type SessionStoreRefreshConfig, authenticationErrorFor, buildForwardedRequestHeaders, controlRequest, createPlatformFetch, createSessionStore, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, mapControlError };
+export { CookieOptions, type PlatformFetch, type PlatformFetchConfig, type PlatformFetchTimeouts, PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, type SessionCookieNames, SessionData, SessionExpiredError, type SessionStore, type SessionStoreConfig, type SessionStoreRefreshConfig, type SessionWriteOptions, authenticationErrorFor, buildForwardedRequestHeaders, controlRequest, createPlatformFetch, createSessionStore, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, mapControlError };

package/dist/next.js

@@ -1,5 +1,5 @@
-import { createSessionRefresher, setCookie, deleteCookie } from './chunk-GQ36R3RQ.js';
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-GQ36R3RQ.js';
+import { createSessionRefresher, setCookie, deleteCookie } from './chunk-Q7YI7RMG.js';
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-Q7YI7RMG.js';
 import { decodeDefaultSession, tokenMaxAgeSeconds, hasTokenAudience, isTokenExpiringSoon, isTokenExpired } from './chunk-FBC2NUH7.js';
 export { decodeBase64Url, decodeDefaultSession, decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, tokenMaxAgeSeconds } from './chunk-FBC2NUH7.js';
 import { applyForwardedClientHeaders, resolveValue } from './chunk-ZWSJVE5S.js';
@@ -176,15 +176,16 @@ function createSessionStore(config) {
     timeoutMs: config.refresh.timeoutMs,
     fetch: config.refresh.fetch
   }) : void 0;
-  function cookieOptions(rememberMe, token) {
+  function cookieOptions(rememberMe, token, options) {
     const maxAge = token ? tokenMaxAgeSeconds(token, maxAgeCap) : maxAgeCap;
+    const effectiveDomain = hostPrefixed ? void 0 : options?.cookieDomain ?? domain;
     return {
       httpOnly: true,
       secure,
       sameSite: "lax",
       path: "/",
       ...rememberMe ? { maxAge } : {},
-      ...domain ? { domain } : {}
+      ...effectiveDomain ? { domain: effectiveDomain } : {}
     };
   }
   function assertAudience(token) {
@@ -207,13 +208,13 @@ function createSessionStore(config) {
   function rememberedIn(store) {
     return store?.get(names.rememberMe)?.value === "true";
   }
-  async function createSession(accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
+  async function createSession(accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true, options) {
     assertAudience(accessToken);
     const store = await jar("createSession");
     if (!store) throw new Error("Cannot create a session outside a request");
-    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken));
-    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
-    store.set(names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe));
+    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken, options));
+    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken, options));
+    store.set(names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe, void 0, options));
   }
   function writeSessionCookies(response, accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
     assertAudience(accessToken);
@@ -238,13 +239,13 @@ function createSessionStore(config) {
   async function isRememberMe() {
     return rememberedIn(await jar("isRememberMe"));
   }
-  async function updateAccessToken(accessToken, refreshToken) {
+  async function updateAccessToken(accessToken, refreshToken, options) {
     assertAudience(accessToken);
     const store = await jar("updateAccessToken");
     if (!store) throw new Error("Cannot update a session outside a request");
     const rememberMe = rememberedIn(store);
-    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken));
-    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
+    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken, options));
+    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken, options));
   }
   async function getSessionWithRefresh() {
     const store = await jar("getSessionWithRefresh");
@@ -264,12 +265,12 @@ function createSessionStore(config) {
   function clearOptions() {
     return { path: "/", secure };
   }
-  async function destroySession() {
+  async function destroySession(options) {
     const store = await jar("destroySession");
     if (!store) return;
     try {
-      const options = cookieOptions(false);
-      for (const name of [names.session, names.refreshToken, names.rememberMe]) store.delete({ name, ...options });
+      const attributes = cookieOptions(false, void 0, options);
+      for (const name of [names.session, names.refreshToken, names.rememberMe]) store.delete({ name, ...attributes });
     } catch (error) {
       onError(error, "destroySession");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",