@c1m-public/platform-auth 0.8.3 → 0.9.0

package/README.md

@@ -116,6 +116,14 @@ await access.requireAccess("platform.tenants.manage");
 Omit `getSubjectId` and the loader derives the cache-tag subject from the access
 token, so per-user tagging cannot silently collapse to one shared tag.
 
+### Pipeline stages
+
+`PIPELINE_STAGES` / `PipelineStage` / `isPipelineStage` under `./access` are
+the onboarding funnel strings in order (`created`, `awaiting_payment`,
+`provisioning`, `attention`, `active`), generated from the backend's
+`schemas/api/pipeline-stages.json` the same way the permission keys are.
+Labels and descriptions stay with the app; the strings are the backend's.
+
 ## Keys drift guard
 
 `src/access/generated/keys.ts` is generated from the backend authz catalog

package/dist/access/index.d.ts

@@ -21,6 +21,11 @@ type WorkspaceRole = (typeof WORKSPACE_ROLES)[number];
 /** Every permission key the backend can grant, across all scopes. */
 type PermissionKey = PlatformPermissionKey | DashPermissionKey | LeadBrokerPermissionKey | WorkspacePermissionKey;
 
+/** Onboarding pipeline stages, in funnel order. Labels and copy stay with the app; the strings are the backend's. */
+declare const PIPELINE_STAGES: readonly ["created", "awaiting_payment", "provisioning", "attention", "active"];
+type PipelineStage = (typeof PIPELINE_STAGES)[number];
+declare function isPipelineStage(value: unknown): value is PipelineStage;
+
 type AccessErrorCode = "unauthenticated" | "forbidden" | "unavailable" | "invalid_snapshot";
 /**
  * Typed failure for loading or validating an access snapshot. `unauthenticated`
@@ -145,4 +150,4 @@ interface FetchAccessSnapshotOptions {
  */
 declare function fetchAccessSnapshot(opts: FetchAccessSnapshotOptions): Promise<AccessSnapshot>;
 
-export { type AccessEntry, type AccessErrorCode, type AccessScopeType, type AccessSnapshot, AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, type DashPermissionKey, type DashRole, type FetchAccessSnapshotOptions, LEADBROKER_PERMISSIONS, type LeadBrokerPermissionKey, PLATFORM_PERMISSIONS, type PermissionCheckOptions, type PermissionKey, type PlatformPermissionKey, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, type WorkspacePermissionKey, type WorkspaceRole, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor };
+export { type AccessEntry, type AccessErrorCode, type AccessScopeType, type AccessSnapshot, AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, type DashPermissionKey, type DashRole, type FetchAccessSnapshotOptions, LEADBROKER_PERMISSIONS, type LeadBrokerPermissionKey, PIPELINE_STAGES, PLATFORM_PERMISSIONS, type PermissionCheckOptions, type PermissionKey, type PipelineStage, type PlatformPermissionKey, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, type WorkspacePermissionKey, type WorkspaceRole, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPipelineStage, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor };

package/dist/access/index.js

@@ -1,2 +1,2 @@
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-73ZH67GM.js';
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PIPELINE_STAGES, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPipelineStage, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-U67NBJND.js';
 import '../chunk-ZWSJVE5S.js';

package/dist/access/next.d.ts

@@ -1,6 +1,6 @@
 import { R as Resolvable } from '../internal-D6RafCm2.js';
 import { AccessSnapshot, PermissionCheckOptions } from './index.js';
-export { AccessEntry, AccessErrorCode, AccessScopeType, AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, DashPermissionKey, DashRole, FetchAccessSnapshotOptions, LEADBROKER_PERMISSIONS, LeadBrokerPermissionKey, PLATFORM_PERMISSIONS, PermissionKey, PlatformPermissionKey, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, WorkspacePermissionKey, WorkspaceRole, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from './index.js';
+export { AccessEntry, AccessErrorCode, AccessScopeType, AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, DashPermissionKey, DashRole, FetchAccessSnapshotOptions, LEADBROKER_PERMISSIONS, LeadBrokerPermissionKey, PIPELINE_STAGES, PLATFORM_PERMISSIONS, PermissionKey, PipelineStage, PlatformPermissionKey, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, WorkspacePermissionKey, WorkspaceRole, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPipelineStage, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from './index.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -1,6 +1,6 @@
 import { decodeTokenPayload } from '../chunk-FBC2NUH7.js';
-import { AccessSnapshotError, fetchAccessSnapshot, isAccessSnapshotError, hasAnyPermission, hasAllPermissions, hasWorkspacePermission } from '../chunk-73ZH67GM.js';
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-73ZH67GM.js';
+import { AccessSnapshotError, fetchAccessSnapshot, isAccessSnapshotError, hasAnyPermission, hasAllPermissions, hasWorkspacePermission } from '../chunk-U67NBJND.js';
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PIPELINE_STAGES, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPipelineStage, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-U67NBJND.js';
 import { resolveValue } from '../chunk-ZWSJVE5S.js';
 import 'server-only';
 import { cache } from 'react';

package/dist/{chunk-73ZH67GM.js → chunk-U67NBJND.js}

@@ -81,6 +81,12 @@ var WORKSPACE_ROLES = [
   "workspace.manager"
 ];
 
+// src/access/generated/stages.ts
+var PIPELINE_STAGES = ["created", "awaiting_payment", "provisioning", "attention", "active"];
+function isPipelineStage(value) {
+  return typeof value === "string" && PIPELINE_STAGES.includes(value);
+}
+
 // src/access/errors.ts
 var AccessSnapshotError = class extends Error {
   code;
@@ -258,4 +264,4 @@ async function fetchAccessSnapshot(opts) {
   return parseAccessSnapshot(body);
 }
 
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor };
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PIPELINE_STAGES, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPipelineStage, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor };

package/dist/next.d.ts

@@ -128,6 +128,11 @@ interface SessionStoreConfig {
     /** Called when a cookie read/write fails outside a request (prerender); default swallows. */
     onError?: (error: unknown, operation: string) => void;
 }
+/** Per-call overrides: a multi-host surface picks the cookie domain per request. */
+interface SessionWriteOptions {
+    /** Ignored for `__Host-` names, which forbid Domain. */
+    cookieDomain?: string;
+}
 /**
  * Session cookies for a first-party Next.js platform surface, written once.
  *
@@ -148,24 +153,24 @@ interface SessionStoreConfig {
 declare function createSessionStore(config: SessionStoreConfig): {
     audience: string;
     cookieNames: SessionCookieNames;
-    cookieOptions: (rememberMe: boolean, token?: string) => CookieOptions & {
+    cookieOptions: (rememberMe: boolean, token?: string, options?: SessionWriteOptions) => CookieOptions & {
         httpOnly: true;
         sameSite: "lax";
         path: "/";
     };
-    createSession: (accessToken: string, refreshToken?: string, rememberMe?: boolean) => Promise<void>;
+    createSession: (accessToken: string, refreshToken?: string, rememberMe?: boolean, options?: SessionWriteOptions) => Promise<void>;
     writeSessionCookies: (response: Response, accessToken: string, refreshToken?: string, rememberMe?: boolean) => Response;
     getAccessToken: () => Promise<string | null>;
     getRefreshToken: () => Promise<string | null>;
     getSession: () => Promise<SessionData | null>;
     getSessionWithRefresh: () => Promise<SessionData | null>;
     isRememberMe: () => Promise<boolean>;
-    updateAccessToken: (accessToken: string, refreshToken?: string) => Promise<void>;
-    destroySession: () => Promise<void>;
+    updateAccessToken: (accessToken: string, refreshToken?: string, options?: SessionWriteOptions) => Promise<void>;
+    destroySession: (options?: SessionWriteOptions) => Promise<void>;
     clearSessionCookies: (response: Response) => Response;
     requireSession: () => Promise<SessionData>;
     isAuthenticated(): Promise<boolean>;
 };
 type SessionStore = ReturnType<typeof createSessionStore>;
 
-export { CookieOptions, type PlatformFetch, type PlatformFetchConfig, type PlatformFetchTimeouts, PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, type SessionCookieNames, SessionData, SessionExpiredError, type SessionStore, type SessionStoreConfig, type SessionStoreRefreshConfig, authenticationErrorFor, buildForwardedRequestHeaders, controlRequest, createPlatformFetch, createSessionStore, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, mapControlError };
+export { CookieOptions, type PlatformFetch, type PlatformFetchConfig, type PlatformFetchTimeouts, PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, type SessionCookieNames, SessionData, SessionExpiredError, type SessionStore, type SessionStoreConfig, type SessionStoreRefreshConfig, type SessionWriteOptions, authenticationErrorFor, buildForwardedRequestHeaders, controlRequest, createPlatformFetch, createSessionStore, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, mapControlError };

package/dist/next.js

@@ -176,15 +176,16 @@ function createSessionStore(config) {
     timeoutMs: config.refresh.timeoutMs,
     fetch: config.refresh.fetch
   }) : void 0;
-  function cookieOptions(rememberMe, token) {
+  function cookieOptions(rememberMe, token, options) {
     const maxAge = token ? tokenMaxAgeSeconds(token, maxAgeCap) : maxAgeCap;
+    const effectiveDomain = hostPrefixed ? void 0 : options?.cookieDomain ?? domain;
     return {
       httpOnly: true,
       secure,
       sameSite: "lax",
       path: "/",
       ...rememberMe ? { maxAge } : {},
-      ...domain ? { domain } : {}
+      ...effectiveDomain ? { domain: effectiveDomain } : {}
     };
   }
   function assertAudience(token) {
@@ -207,13 +208,13 @@ function createSessionStore(config) {
   function rememberedIn(store) {
     return store?.get(names.rememberMe)?.value === "true";
   }
-  async function createSession(accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
+  async function createSession(accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true, options) {
     assertAudience(accessToken);
     const store = await jar("createSession");
     if (!store) throw new Error("Cannot create a session outside a request");
-    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken));
-    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
-    store.set(names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe));
+    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken, options));
+    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken, options));
+    store.set(names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe, void 0, options));
   }
   function writeSessionCookies(response, accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
     assertAudience(accessToken);
@@ -238,13 +239,13 @@ function createSessionStore(config) {
   async function isRememberMe() {
     return rememberedIn(await jar("isRememberMe"));
   }
-  async function updateAccessToken(accessToken, refreshToken) {
+  async function updateAccessToken(accessToken, refreshToken, options) {
     assertAudience(accessToken);
     const store = await jar("updateAccessToken");
     if (!store) throw new Error("Cannot update a session outside a request");
     const rememberMe = rememberedIn(store);
-    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken));
-    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
+    store.set(names.session, accessToken, cookieOptions(rememberMe, accessToken, options));
+    if (refreshToken) store.set(names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken, options));
   }
   async function getSessionWithRefresh() {
     const store = await jar("getSessionWithRefresh");
@@ -264,12 +265,12 @@ function createSessionStore(config) {
   function clearOptions() {
     return { path: "/", secure };
   }
-  async function destroySession() {
+  async function destroySession(options) {
     const store = await jar("destroySession");
     if (!store) return;
     try {
-      const options = cookieOptions(false);
-      for (const name of [names.session, names.refreshToken, names.rememberMe]) store.delete({ name, ...options });
+      const attributes = cookieOptions(false, void 0, options);
+      for (const name of [names.session, names.refreshToken, names.rememberMe]) store.delete({ name, ...attributes });
     } catch (error) {
       onError(error, "destroySession");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.8.3",
+  "version": "0.9.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",