@c1m-public/platform-auth 0.8.4 → 0.9.1

package/README.md

@@ -116,6 +116,14 @@ await access.requireAccess("platform.tenants.manage");
 Omit `getSubjectId` and the loader derives the cache-tag subject from the access
 token, so per-user tagging cannot silently collapse to one shared tag.
 
+### Pipeline stages
+
+`PIPELINE_STAGES` / `PipelineStage` / `isPipelineStage` under `./access` are
+the onboarding funnel strings in order (`created`, `awaiting_payment`,
+`provisioning`, `attention`, `active`), generated from the backend's
+`schemas/api/pipeline-stages.json` the same way the permission keys are.
+Labels and descriptions stay with the app; the strings are the backend's.
+
 ## Keys drift guard
 
 `src/access/generated/keys.ts` is generated from the backend authz catalog

package/dist/access/index.d.ts

@@ -1,148 +1 @@
-import { R as Resolvable } from '../internal-D6RafCm2.js';
-
-/** Platform-operator permission keys. */
-declare const PLATFORM_PERMISSIONS: readonly ["affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
-type PlatformPermissionKey = (typeof PLATFORM_PERMISSIONS)[number];
-/** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
-declare const DASH_PERMISSIONS: readonly ["dash.apps.manage", "dash.billing.manage", "dash.channels.manage", "dash.customers.manage", "dash.domains.manage", "dash.members.manage", "dash.ownership.transfer", "dash.plans.manage", "dash.publish", "dash.settings.manage", "dash.workspaces.admin", "dash.workspaces.manage"];
-type DashPermissionKey = (typeof DASH_PERMISSIONS)[number];
-/** Membership-mirrored dash role bundles (grant keys at dash scope). */
-declare const DASH_ROLES: readonly ["dash.admin", "dash.owner"];
-type DashRole = (typeof DASH_ROLES)[number];
-/** Lead-broker workload permission keys. */
-declare const LEADBROKER_PERMISSIONS: readonly ["leadbroker.finance.manage", "leadbroker.leads.dispatch", "leadbroker.leads.review", "leadbroker.leads.view", "leadbroker.policy.manage"];
-type LeadBrokerPermissionKey = (typeof LEADBROKER_PERMISSIONS)[number];
-/** Workspace-staff permission keys. */
-declare const WORKSPACE_PERMISSIONS: readonly ["workspace.channels.manage", "workspace.channels.secrets", "workspace.channels.view", "workspace.crm.manage", "workspace.crm.view", "workspace.customers.manage", "workspace.customers.view", "workspace.orders.manage", "workspace.orders.view", "workspace.payments.record", "workspace.site.edit", "workspace.site.view", "workspace.staff.manage"];
-type WorkspacePermissionKey = (typeof WORKSPACE_PERMISSIONS)[number];
-/** Assignable workspace-staff role bundles (grant keys at workspace scope). */
-declare const WORKSPACE_ROLES: readonly ["workspace.editor", "workspace.frontdesk", "workspace.manager"];
-type WorkspaceRole = (typeof WORKSPACE_ROLES)[number];
-/** Every permission key the backend can grant, across all scopes. */
-type PermissionKey = PlatformPermissionKey | DashPermissionKey | LeadBrokerPermissionKey | WorkspacePermissionKey;
-
-type AccessErrorCode = "unauthenticated" | "forbidden" | "unavailable" | "invalid_snapshot";
-/**
- * Typed failure for loading or validating an access snapshot. `unauthenticated`
- * = no/expired session (401); `forbidden` = the backend refused the snapshot
- * (403; e.g. wrong audience); `unavailable` = transport/5xx; `invalid_snapshot`
- * = the payload did not match the contract.
- */
-declare class AccessSnapshotError extends Error {
-    readonly code: AccessErrorCode;
-    readonly status: number | undefined;
-    constructor(code: AccessErrorCode, message: string, status?: number);
-}
-declare function isAccessSnapshotError(error: unknown, code?: AccessErrorCode): error is AccessSnapshotError;
-
-/** Scope a permission entry applies to. Mirrors c1m-server authz.Scope*. */
-type AccessScopeType = "platform" | "saas_app" | "workspace";
-interface AccessEntry {
-    /** Permission key, e.g. "platform.users.manage_access". */
-    key: string;
-    scope_type: AccessScopeType;
-    /** "" for platform scope; saas_app slug or "*" for saas_app scope; workspace id for workspace scope. */
-    scope_id: string;
-}
-/**
- * The resolved authorization snapshot for one subject, as returned by
- * `GET /api/v1/platform/access`. This is the *output* of the backend resolver
- * (base-role grant ∪ scoped grants), never the grant rows themselves.
- */
-interface AccessSnapshot {
-    subject_id: string;
-    /** Monotonic; bumps on any grant/role change. Use for optimistic concurrency and cache keys. */
-    access_version: number;
-    is_owner: boolean;
-    active: boolean;
-    /** Platform operator base role (derived; display only — never authorize on it). */
-    platform_role: string;
-    permissions: AccessEntry[];
-    /**
-     * Dash bundle (`dash.owner` / `dash.admin`) per saas_app id, mirrored from
-     * the subject's dash membership. This is the admission list for the dash
-     * area: the dashes this subject runs. What they may *do* on one is a normal
-     * `hasPermission(snapshot, key, { saasApp })` check — platform managers hold
-     * their authority platform-wide and so appear here not at all.
-     */
-    dash_roles: Record<string, string>;
-    /** Effective workspace-staff permission keys per workspace id. */
-    workspace_permissions: Record<string, string[]>;
-    /** Workspace-staff role bundle per workspace id (display only). */
-    workspace_roles: Record<string, string>;
-}
-declare function emptySnapshot(subjectId?: string): AccessSnapshot;
-/** Runtime validator for the wire payload. Throws AccessSnapshotError("invalid_snapshot"). */
-declare function parseAccessSnapshot(input: unknown): AccessSnapshot;
-
-interface PermissionCheckOptions {
-    /**
-     * SaaS app (dash) slug the check is about. Omit for "anywhere": platform
-     * entries and any saas_app entry satisfy the check.
-     */
-    saasApp?: string;
-}
-/**
- * Mirrors c1m-server authz.entryCoversApp: platform scope covers every app;
- * saas_app scope covers "*" or a case-insensitive slug match; workspace-scoped
- * entries never satisfy an app-level check.
- */
-declare function entryCoversApp(entry: AccessEntry, saasApp: string | undefined): boolean;
-/** True when the subject is active and holds `key` for the given app (or anywhere). */
-declare function hasPermission(snapshot: AccessSnapshot, key: string, opts?: PermissionCheckOptions): boolean;
-declare function hasAnyPermission(snapshot: AccessSnapshot, keys: readonly string[], opts?: PermissionCheckOptions): boolean;
-declare function hasAllPermissions(snapshot: AccessSnapshot, keys: readonly string[], opts?: PermissionCheckOptions): boolean;
-/**
- * Workspace-staff check. Platform owners always pass (they own every
- * workspace); otherwise the workspace's effective permission list decides.
- * Platform/saas_app entries never confer workspace-staff permissions.
- */
-declare function hasWorkspacePermission(snapshot: AccessSnapshot, workspaceId: string, key: string): boolean;
-/**
- * The dashes this subject runs, from the mirrored dash bundle grants — the
- * admission list for the Admin Center's dash area. Platform managers are not
- * listed: their reach is platform-wide, so admit them with
- * `hasPermission(snapshot, "platform.tenants.manage")` instead.
- */
-declare function managedDashes(snapshot: AccessSnapshot): Array<{
-    saasApp: string;
-    role: string;
-}>;
-/** The dash bundle held on one dash, or "" when the subject holds none there. */
-declare function dashRole(snapshot: AccessSnapshot, saasApp: string): string;
-declare function isPlatformOwner(snapshot: AccessSnapshot): boolean;
-/**
- * The saas_app scopes under which `key` is held. Returns `{ all: true }` when a
- * platform-scoped or "*" entry grants it everywhere; otherwise the explicit
- * app slugs (empty = nowhere). Mirrors authz.AppPermissionScope.
- */
-declare function appScopes(snapshot: AccessSnapshot, key: string): {
-    all: boolean;
-    apps: string[];
-};
-/** Distinct permission keys held for `saasApp` (or anywhere). Handy for nav/badges. */
-declare function permissionsFor(snapshot: AccessSnapshot, opts?: PermissionCheckOptions): string[];
-
-declare const DEFAULT_ACCESS_ENDPOINT_PATH = "/api/v1/platform/access";
-interface FetchAccessSnapshotOptions {
-    /** Backend origin, e.g. https://api.example.com (no trailing slash needed). */
-    apiUrl: Resolvable;
-    /** Bearer access token for the platform surface. */
-    accessToken: string;
-    /** Defaults to /api/v1/platform/access. */
-    endpointPath?: string;
-    fetchTimeoutMs?: number;
-    fetchImpl?: typeof fetch;
-    /** Extra headers. Authorization and Accept are always set here. */
-    headers?: HeadersInit;
-    /** Incoming BFF request; its client identity (IP, geo, UA) is forwarded to the backend. */
-    request?: Request;
-}
-/**
- * Framework-neutral fetch of the resolved access snapshot. Throws
- * AccessSnapshotError: 401 → unauthenticated, 403 → forbidden, other non-2xx or
- * network failure → unavailable, malformed body → invalid_snapshot.
- */
-declare function fetchAccessSnapshot(opts: FetchAccessSnapshotOptions): Promise<AccessSnapshot>;
-
-export { type AccessEntry, type AccessErrorCode, type AccessScopeType, type AccessSnapshot, AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, type DashPermissionKey, type DashRole, type FetchAccessSnapshotOptions, LEADBROKER_PERMISSIONS, type LeadBrokerPermissionKey, PLATFORM_PERMISSIONS, type PermissionCheckOptions, type PermissionKey, type PlatformPermissionKey, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, type WorkspacePermissionKey, type WorkspaceRole, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor };
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-CbsCWtku.js';

package/dist/access/index.js

@@ -1,2 +1,307 @@
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from '../chunk-73ZH67GM.js';
-import '../chunk-ZWSJVE5S.js';
+// src/access/generated/keys.ts
+var PLATFORM_PERMISSIONS = [
+  "affiliates.finance.manage",
+  "affiliates.partners.manage",
+  "affiliates.programmes.manage",
+  "affiliates.view",
+  "linkservice.domains.manage",
+  "linkservice.links.manage",
+  "linkservice.qr.manage",
+  "linkservice.view",
+  "platform.admin.view",
+  "platform.audit.view",
+  "platform.auth.manage",
+  "platform.billing.manage",
+  "platform.channels.manage",
+  "platform.channels.view",
+  "platform.config.manage",
+  "platform.docs.manage",
+  "platform.docs.view",
+  "platform.observability.manage",
+  "platform.observability.view",
+  "platform.offboarding.view",
+  "platform.ops.manage",
+  "platform.support.impersonate",
+  "platform.support.sessions",
+  "platform.tenants.archive",
+  "platform.tenants.manage",
+  "platform.tenants.restore",
+  "platform.users.deactivate",
+  "platform.users.delete",
+  "platform.users.invite",
+  "platform.users.manage_access",
+  "platform.users.reactivate",
+  "platform.users.view"
+];
+var DASH_PERMISSIONS = [
+  "dash.apps.manage",
+  "dash.billing.manage",
+  "dash.channels.manage",
+  "dash.customers.manage",
+  "dash.domains.manage",
+  "dash.members.manage",
+  "dash.ownership.transfer",
+  "dash.plans.manage",
+  "dash.publish",
+  "dash.settings.manage",
+  "dash.workspaces.admin",
+  "dash.workspaces.manage"
+];
+var DASH_ROLES = [
+  "dash.admin",
+  "dash.owner"
+];
+var LEADBROKER_PERMISSIONS = [
+  "leadbroker.finance.manage",
+  "leadbroker.leads.dispatch",
+  "leadbroker.leads.review",
+  "leadbroker.leads.view",
+  "leadbroker.policy.manage"
+];
+var WORKSPACE_PERMISSIONS = [
+  "workspace.channels.manage",
+  "workspace.channels.secrets",
+  "workspace.channels.view",
+  "workspace.crm.manage",
+  "workspace.crm.view",
+  "workspace.customers.manage",
+  "workspace.customers.view",
+  "workspace.orders.manage",
+  "workspace.orders.view",
+  "workspace.payments.record",
+  "workspace.site.edit",
+  "workspace.site.view",
+  "workspace.staff.manage"
+];
+var WORKSPACE_ROLES = [
+  "workspace.editor",
+  "workspace.frontdesk",
+  "workspace.manager"
+];
+
+// src/access/generated/stages.ts
+var PIPELINE_STAGES = ["created", "awaiting_payment", "provisioning", "attention", "active"];
+function isPipelineStage(value) {
+  return typeof value === "string" && PIPELINE_STAGES.includes(value);
+}
+
+// src/access/errors.ts
+var AccessSnapshotError = class extends Error {
+  code;
+  status;
+  constructor(code, message, status) {
+    super(message);
+    this.name = "AccessSnapshotError";
+    this.code = code;
+    this.status = status;
+  }
+};
+function isAccessSnapshotError(error, code) {
+  return error instanceof AccessSnapshotError && (code === void 0 || error.code === code);
+}
+
+// src/access/snapshot.ts
+var SCOPE_TYPES = /* @__PURE__ */ new Set(["platform", "saas_app", "workspace"]);
+function emptySnapshot(subjectId = "") {
+  return {
+    subject_id: subjectId,
+    access_version: 0,
+    is_owner: false,
+    active: false,
+    platform_role: "",
+    permissions: [],
+    dash_roles: {},
+    workspace_permissions: {},
+    workspace_roles: {}
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fail(field, why) {
+  throw new AccessSnapshotError("invalid_snapshot", `access snapshot: ${field} ${why}`);
+}
+function parseAccessSnapshot(input) {
+  if (!isRecord(input)) fail("payload", "is not an object");
+  const { subject_id, access_version, is_owner, active, platform_role, permissions, dash_roles, workspace_permissions, workspace_roles } = input;
+  if (typeof subject_id !== "string" || subject_id === "") fail("subject_id", "must be a non-empty string");
+  if (typeof access_version !== "number" || !Number.isInteger(access_version) || access_version < 0) fail("access_version", "must be a non-negative integer");
+  if (typeof is_owner !== "boolean") fail("is_owner", "must be a boolean");
+  if (typeof active !== "boolean") fail("active", "must be a boolean");
+  if (platform_role !== void 0 && platform_role !== null && typeof platform_role !== "string") fail("platform_role", "must be a string");
+  if (!Array.isArray(permissions)) fail("permissions", "must be an array");
+  const entries = permissions.map((raw, i) => {
+    if (!isRecord(raw)) fail(`permissions[${i}]`, "is not an object");
+    const { key, scope_type, scope_id } = raw;
+    if (typeof key !== "string" || key === "") fail(`permissions[${i}].key`, "must be a non-empty string");
+    if (typeof scope_type !== "string" || !SCOPE_TYPES.has(scope_type)) fail(`permissions[${i}].scope_type`, "must be platform|saas_app|workspace");
+    if (scope_id !== void 0 && scope_id !== null && typeof scope_id !== "string") fail(`permissions[${i}].scope_id`, "must be a string");
+    return { key, scope_type, scope_id: typeof scope_id === "string" ? scope_id : "" };
+  });
+  const dashRoles = {};
+  if (dash_roles !== void 0 && dash_roles !== null) {
+    if (!isRecord(dash_roles)) fail("dash_roles", "must be an object");
+    for (const [dash, role] of Object.entries(dash_roles)) {
+      if (typeof role !== "string") fail(`dash_roles[${dash}]`, "must be a string");
+      dashRoles[dash] = role;
+    }
+  }
+  const wsPerms = {};
+  if (workspace_permissions !== void 0 && workspace_permissions !== null) {
+    if (!isRecord(workspace_permissions)) fail("workspace_permissions", "must be an object");
+    for (const [ws, keys] of Object.entries(workspace_permissions)) {
+      if (!Array.isArray(keys) || keys.some((k) => typeof k !== "string")) fail(`workspace_permissions[${ws}]`, "must be a string array");
+      wsPerms[ws] = [...keys];
+    }
+  }
+  const wsRoles = {};
+  if (workspace_roles !== void 0 && workspace_roles !== null) {
+    if (!isRecord(workspace_roles)) fail("workspace_roles", "must be an object");
+    for (const [ws, role] of Object.entries(workspace_roles)) {
+      if (typeof role !== "string") fail(`workspace_roles[${ws}]`, "must be a string");
+      wsRoles[ws] = role;
+    }
+  }
+  return {
+    subject_id,
+    access_version,
+    is_owner,
+    active,
+    platform_role: typeof platform_role === "string" ? platform_role : "",
+    permissions: entries,
+    dash_roles: dashRoles,
+    workspace_permissions: wsPerms,
+    workspace_roles: wsRoles
+  };
+}
+
+// src/access/predicates.ts
+function entryCoversApp(entry, saasApp) {
+  switch (entry.scope_type) {
+    case "platform":
+      return true;
+    case "saas_app":
+      if (saasApp === void 0) return true;
+      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === saasApp.toLowerCase();
+    default:
+      return false;
+  }
+}
+function hasPermission(snapshot, key, opts = {}) {
+  if (!snapshot.active) return false;
+  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.saasApp));
+}
+function hasAnyPermission(snapshot, keys, opts = {}) {
+  return keys.some((key) => hasPermission(snapshot, key, opts));
+}
+function hasAllPermissions(snapshot, keys, opts = {}) {
+  return keys.every((key) => hasPermission(snapshot, key, opts));
+}
+function hasWorkspacePermission(snapshot, workspaceId, key) {
+  if (!snapshot.active) return false;
+  if (snapshot.is_owner) return true;
+  return (snapshot.workspace_permissions[workspaceId] ?? []).includes(key);
+}
+function managedDashes(snapshot) {
+  if (!snapshot.active) return [];
+  return Object.entries(snapshot.dash_roles).map(([saasApp, role]) => ({ saasApp, role })).sort((a, b) => a.saasApp.localeCompare(b.saasApp));
+}
+function dashRole(snapshot, saasApp) {
+  if (!snapshot.active) return "";
+  return snapshot.dash_roles[saasApp] ?? "";
+}
+function isPlatformOwner(snapshot) {
+  return snapshot.active && snapshot.is_owner;
+}
+function appScopes(snapshot, key) {
+  if (!snapshot.active) return { all: false, apps: [] };
+  const apps = /* @__PURE__ */ new Set();
+  for (const entry of snapshot.permissions) {
+    if (entry.key !== key) continue;
+    if (entry.scope_type === "platform") return { all: true, apps: [] };
+    if (entry.scope_type === "saas_app") {
+      if (entry.scope_id === "*") return { all: true, apps: [] };
+      apps.add(entry.scope_id.toLowerCase());
+    }
+  }
+  return { all: false, apps: [...apps].sort() };
+}
+function permissionsFor(snapshot, opts = {}) {
+  if (!snapshot.active) return [];
+  const keys = /* @__PURE__ */ new Set();
+  for (const entry of snapshot.permissions) if (entryCoversApp(entry, opts.saasApp)) keys.add(entry.key);
+  return [...keys].sort();
+}
+
+// ../transport/src/forwarding.ts
+function applyForwardedClientHeaders(incoming, headers = new Headers()) {
+  const forwardedFor = incoming.get("x-forwarded-for");
+  const realIp = incoming.get("x-real-ip") ?? forwardedFor?.split(",")[0]?.trim();
+  if (realIp && !headers.has("X-Client-IP")) headers.set("X-Client-IP", realIp);
+  if (realIp && !headers.has("X-Real-IP")) headers.set("X-Real-IP", realIp);
+  if (forwardedFor && !headers.has("X-Forwarded-For")) headers.set("X-Forwarded-For", forwardedFor);
+  const country = incoming.get("cf-ipcountry") ?? incoming.get("x-vercel-ip-country") ?? incoming.get("x-geo-country") ?? incoming.get("x-country-code");
+  if (country && country !== "XX" && !headers.has("X-Geo-Country")) {
+    headers.set("X-Geo-Country", country);
+  }
+  const host = incoming.get("host");
+  if (host && !headers.has("X-Forwarded-Host")) headers.set("X-Forwarded-Host", host);
+  const proto = incoming.get("x-forwarded-proto");
+  if (proto && !headers.has("X-Forwarded-Proto")) headers.set("X-Forwarded-Proto", proto);
+  const userAgent = incoming.get("user-agent");
+  if (userAgent && !headers.has("X-Client-User-Agent")) headers.set("X-Client-User-Agent", userAgent);
+  return headers;
+}
+function forwardedRequestHeaders(request, init) {
+  return applyForwardedClientHeaders(request.headers, new Headers(init));
+}
+
+// src/internal.ts
+function resolveValue(value) {
+  return typeof value === "function" ? value() : value;
+}
+async function timedFetch(url, options = {}) {
+  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const controller = options.timeoutMs ? new AbortController() : void 0;
+  const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
+  try {
+    return await doFetch(url, {
+      ...options.init,
+      cache: "no-store",
+      ...controller ? { signal: controller.signal } : {}
+    });
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+// src/access/fetch.ts
+var DEFAULT_ACCESS_ENDPOINT_PATH = "/api/v1/platform/access";
+async function fetchAccessSnapshot(opts) {
+  const url = `${resolveValue(opts.apiUrl).replace(/\/$/, "")}${opts.endpointPath ?? DEFAULT_ACCESS_ENDPOINT_PATH}`;
+  const headers = opts.request ? forwardedRequestHeaders(opts.request, opts.headers) : new Headers(opts.headers);
+  headers.set("Authorization", `Bearer ${opts.accessToken}`);
+  headers.set("Accept", "application/json");
+  let response;
+  try {
+    response = await timedFetch(url, {
+      init: { method: "GET", headers },
+      timeoutMs: opts.fetchTimeoutMs,
+      fetchImpl: opts.fetchImpl
+    });
+  } catch (error) {
+    throw new AccessSnapshotError("unavailable", `access snapshot request failed: ${error.message}`);
+  }
+  if (response.status === 401) throw new AccessSnapshotError("unauthenticated", "session expired", 401);
+  if (response.status === 403) throw new AccessSnapshotError("forbidden", "access snapshot refused", 403);
+  if (!response.ok) throw new AccessSnapshotError("unavailable", `access snapshot returned ${response.status}`, response.status);
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new AccessSnapshotError("invalid_snapshot", "access snapshot body is not JSON", response.status);
+  }
+  return parseAccessSnapshot(body);
+}
+
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PIPELINE_STAGES, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPipelineStage, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor };

package/dist/access/next.d.ts

@@ -1,6 +1,5 @@
-import { R as Resolvable } from '../internal-D6RafCm2.js';
-import { AccessSnapshot, PermissionCheckOptions } from './index.js';
-export { AccessEntry, AccessErrorCode, AccessScopeType, AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, DashPermissionKey, DashRole, FetchAccessSnapshotOptions, LEADBROKER_PERMISSIONS, LeadBrokerPermissionKey, PLATFORM_PERMISSIONS, PermissionKey, PlatformPermissionKey, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, WorkspacePermissionKey, WorkspaceRole, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor } from './index.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-CbsCWtku.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-CbsCWtku.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;