@c1m-public/platform-auth 0.8.3 → 0.8.4

package/dist/next.d.ts

@@ -128,6 +128,11 @@ interface SessionStoreConfig {
     /** Called when a cookie read/write fails outside a request (prerender); default swallows. */
     onError?: (error: unknown, operation: string) => void;
 }
+/** Per-call overrides: a multi-host surface picks the cookie domain per request. */
+interface SessionWriteOptions {
+    /** Ignored for `__Host-` names, which forbid Domain. */
+    cookieDomain?: string;
+}
 /**
  * Session cookies for a first-party Next.js platform surface, written once.
  *
@@ -148,24 +153,24 @@ interface SessionStoreConfig {
 declare function createSessionStore(config: SessionStoreConfig): {
     audience: string;
     cookieNames: SessionCookieNames;
-    cookieOptions: (rememberMe: boolean, token?: string) => CookieOptions & {
+    cookieOptions: (rememberMe: boolean, token?: string, options?: SessionWriteOptions) => CookieOptions & {
         httpOnly: true;
         sameSite: "lax";
         path: "/";
     };
-    createSession: (accessToken: string, refreshToken?: string, rememberMe?: boolean) => Promise<void>;
+    createSession: (accessToken: string, refreshToken?: string, rememberMe?: boolean, options?: SessionWriteOptions) => Promise<void>;
     writeSessionCookies: (response: Response, accessToken: string, refreshToken?: string, rememberMe?: boolean) => Response;
     getAccessToken: () => Promise<string | null>;
     getRefreshToken: () => Promise<string | null>;
     getSession: () => Promise<SessionData | null>;
     getSessionWithRefresh: () => Promise<SessionData | null>;
     isRememberMe: () => Promise<boolean>;
-    updateAccessToken: (accessToken: string, refreshToken?: string) => Promise<void>;
-    destroySession: () => Promise<void>;
+    updateAccessToken: (accessToken: string, refreshToken?: string, options?: SessionWriteOptions) => Promise<void>;
+    destroySession: (options?: SessionWriteOptions) => Promise<void>;
     clearSessionCookies: (response: Response) => Response;
     requireSession: () => Promise<SessionData>;
     isAuthenticated(): Promise<boolean>;
 };
 type SessionStore = ReturnType<typeof createSessionStore>;
 
-export { CookieOptions, type PlatformFetch, type PlatformFetchConfig, type PlatformFetchTimeouts, PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, type SessionCookieNames, SessionData, SessionExpiredError, type SessionStore, type SessionStoreConfig, type SessionStoreRefreshConfig, authenticationErrorFor, buildForwardedRequestHeaders, controlRequest, createPlatformFetch, createSessionStore, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, mapControlError };
+export { CookieOptions, type PlatformFetch, type PlatformFetchConfig, type PlatformFetchTimeouts, PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, type SessionCookieNames, SessionData, SessionExpiredError, type SessionStore, type SessionStoreConfig, type SessionStoreRefreshConfig, type SessionWriteOptions, authenticationErrorFor, buildForwardedRequestHeaders, controlRequest, createPlatformFetch, createSessionStore, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, mapControlError };

package/dist/next.js

@@ -176,15 +176,16 @@ function createSessionStore(config) {
     timeoutMs: config.refresh.timeoutMs,
     fetch: config.refresh.fetch
   }) : void 0;
-  function cookieOptions(rememberMe, token) {
+  function cookieOptions(rememberMe, token, options) {
     const maxAge = token ? tokenMaxAgeSeconds(token, maxAgeCap) : maxAgeCap;
+    const effectiveDomain = hostPrefixed ? void 0 : options?.cookieDomain ?? domain;
     return {
       httpOnly: true,
       secure,
       sameSite: "lax",
       path: "/",
       ...rememberMe ? { maxAge } : {},
-      ...domain ? { domain } : {}
+      ...effectiveDomain ? { domain: effectiveDomain } : {}
     };
   }
   function assertAudience(token) {
@@ -207,13 +208,13 @@ function createSessionStore(config) {
   function rememberedIn(store) {
     return store?.get(names.rememberMe)?.value === "true";
   }
-  async function createSession(accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
+  async function createSession(accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true, options) {
     assertAudience(accessToken);
     const store = await jar("createSession");
     if (!store) throw new Error("Cannot create a session outside a request");
-    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken));
-    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
-    store.set(names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe));
+    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken, options));
+    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken, options));
+    store.set(names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe, void 0, options));
   }
   function writeSessionCookies(response, accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
     assertAudience(accessToken);
@@ -238,13 +239,13 @@ function createSessionStore(config) {
   async function isRememberMe() {
     return rememberedIn(await jar("isRememberMe"));
   }
-  async function updateAccessToken(accessToken, refreshToken) {
+  async function updateAccessToken(accessToken, refreshToken, options) {
     assertAudience(accessToken);
     const store = await jar("updateAccessToken");
     if (!store) throw new Error("Cannot update a session outside a request");
     const rememberMe = rememberedIn(store);
-    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken));
-    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
+    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken, options));
+    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken, options));
   }
   async function getSessionWithRefresh() {
     const store = await jar("getSessionWithRefresh");
@@ -264,12 +265,12 @@ function createSessionStore(config) {
   function clearOptions() {
     return { path: "/", secure };
   }
-  async function destroySession() {
+  async function destroySession(options) {
     const store = await jar("destroySession");
     if (!store) return;
     try {
-      const options = cookieOptions(false);
-      for (const name of [names.session, names.refreshToken, names.rememberMe]) store.delete({ name, ...options });
+      const attributes = cookieOptions(false, void 0, options);
+      for (const name of [names.session, names.refreshToken, names.rememberMe]) store.delete({ name, ...attributes });
     } catch (error) {
       onError(error, "destroySession");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",