@c1m-public/platform-auth 0.8.4 → 0.9.1

package/dist/index.js

@@ -1,3 +1,534 @@
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath } from './chunk-Q7YI7RMG.js';
-export { decodeBase64Url, decodeDefaultSession, decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, tokenMaxAgeSeconds } from './chunk-FBC2NUH7.js';
-export { applyForwardedClientHeaders, forwardedRequestHeaders } from './chunk-ZWSJVE5S.js';
+// src/token.ts
+function readStringClaim(value, fallback = "") {
+  return typeof value === "string" ? value : fallback;
+}
+function readBooleanClaim(value, fallback) {
+  return typeof value === "boolean" ? value : fallback;
+}
+function decodeBase64Url(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+  try {
+    const binary = globalThis.atob(padded);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+  } catch {
+    return null;
+  }
+}
+function decodeTokenPayload(token) {
+  const payloadSegment = token.split(".")[1];
+  if (!payloadSegment) return null;
+  const decodedJson = decodeBase64Url(payloadSegment);
+  if (!decodedJson) return null;
+  try {
+    const parsed = JSON.parse(decodedJson);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function hasTokenAudience(token, requiredAudience) {
+  const audience = decodeTokenPayload(token)?.aud;
+  return typeof audience === "string" ? audience === requiredAudience : Array.isArray(audience) && audience.includes(requiredAudience);
+}
+function nowInSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function tokenMaxAgeSeconds(token, configuredMaxAge) {
+  const decoded = decodeTokenPayload(token);
+  if (!decoded?.exp) return configuredMaxAge;
+  return Math.max(0, Math.min(configuredMaxAge, decoded.exp - nowInSeconds()));
+}
+function isTokenExpired(token) {
+  const decoded = decodeTokenPayload(token);
+  if (!decoded?.exp) return true;
+  return decoded.exp <= nowInSeconds();
+}
+function isTokenExpiringSoon(token, bufferSeconds = 120) {
+  const decoded = decodeTokenPayload(token);
+  if (!decoded?.exp) return true;
+  return decoded.exp < nowInSeconds() + bufferSeconds;
+}
+function decodeDefaultSession(token) {
+  const decoded = decodeTokenPayload(token);
+  if (!decoded) return null;
+  const actorId = decoded.effective_user_id || decoded.actor_id || decoded.customer_id || decoded.user_id || (typeof decoded.sub === "string" ? decoded.sub : void 0);
+  if (!actorId) return null;
+  return {
+    user: {
+      id: String(actorId),
+      email: readStringClaim(decoded.email),
+      name: readStringClaim(decoded.name),
+      role: readStringClaim(decoded.role, "user"),
+      is_active: readBooleanClaim(decoded.is_active, true),
+      email_verified: readBooleanClaim(decoded.email_verified, false),
+      created_at: readStringClaim(decoded.created_at),
+      has_passkey: readBooleanClaim(decoded.has_passkeys, false)
+    },
+    token,
+    exp: decoded.exp || 0,
+    iat: decoded.iat || 0
+  };
+}
+function parseAuthResponse(value) {
+  if (!value || typeof value !== "object") return null;
+  const candidate = value;
+  if (typeof candidate.access_token !== "string" || typeof candidate.refresh_token !== "string" || typeof candidate.token_type !== "string" || typeof candidate.expires_at !== "string" || !candidate.user || typeof candidate.user !== "object") {
+    return null;
+  }
+  return candidate;
+}
+
+// src/return-path.ts
+function safeInternalPath(raw) {
+  if (raw == null) return null;
+  const candidate = raw.trim();
+  if (candidate.length === 0) return null;
+  if (!candidate.startsWith("/")) return null;
+  if (candidate.startsWith("//") || candidate.includes("://")) return null;
+  if (/%(?:2f|5c)/i.test(candidate)) return null;
+  if (/[\x00-\x1f\x7f]/.test(candidate)) return null;
+  try {
+    const parsed = new URL(candidate, "https://internal.invalid");
+    if (parsed.origin !== "https://internal.invalid") return null;
+    const roundtrip = `${parsed.pathname}${parsed.search}${parsed.hash}`;
+    if (roundtrip !== candidate) return null;
+    return candidate;
+  } catch {
+    return null;
+  }
+}
+
+// ../transport/src/forwarding.ts
+function applyForwardedClientHeaders(incoming, headers = new Headers()) {
+  const forwardedFor = incoming.get("x-forwarded-for");
+  const realIp = incoming.get("x-real-ip") ?? forwardedFor?.split(",")[0]?.trim();
+  if (realIp && !headers.has("X-Client-IP")) headers.set("X-Client-IP", realIp);
+  if (realIp && !headers.has("X-Real-IP")) headers.set("X-Real-IP", realIp);
+  if (forwardedFor && !headers.has("X-Forwarded-For")) headers.set("X-Forwarded-For", forwardedFor);
+  const country = incoming.get("cf-ipcountry") ?? incoming.get("x-vercel-ip-country") ?? incoming.get("x-geo-country") ?? incoming.get("x-country-code");
+  if (country && country !== "XX" && !headers.has("X-Geo-Country")) {
+    headers.set("X-Geo-Country", country);
+  }
+  const host = incoming.get("host");
+  if (host && !headers.has("X-Forwarded-Host")) headers.set("X-Forwarded-Host", host);
+  const proto = incoming.get("x-forwarded-proto");
+  if (proto && !headers.has("X-Forwarded-Proto")) headers.set("X-Forwarded-Proto", proto);
+  const userAgent = incoming.get("user-agent");
+  if (userAgent && !headers.has("X-Client-User-Agent")) headers.set("X-Client-User-Agent", userAgent);
+  return headers;
+}
+function forwardedRequestHeaders(request, init) {
+  return applyForwardedClientHeaders(request.headers, new Headers(init));
+}
+
+// src/cookies.ts
+function readCookie(request, name) {
+  const header = request.headers.get("cookie");
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0) continue;
+    if (part.slice(0, separator).trim() !== name) continue;
+    const raw = part.slice(separator + 1).trim();
+    try {
+      return decodeURIComponent(raw);
+    } catch {
+      return raw;
+    }
+  }
+  return null;
+}
+function serializeCookie(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  parts.push(`Path=${options.path ?? "/"}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${Math.max(0, Math.floor(options.maxAge))}`);
+  if (options.httpOnly ?? true) parts.push("HttpOnly");
+  if (options.secure ?? name.startsWith("__Host-")) parts.push("Secure");
+  const sameSite = options.sameSite ?? "lax";
+  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+  return parts.join("; ");
+}
+function setCookie(response, name, value, options) {
+  response.headers.append("Set-Cookie", serializeCookie(name, value, options));
+  return response;
+}
+function deleteCookie(response, name, options) {
+  response.headers.append("Set-Cookie", serializeCookie(name, "", { ...options, maxAge: 0 }));
+  return response;
+}
+
+// src/device-cookie.ts
+var DEFAULT_DEVICE_MAX_AGE = 365 * 24 * 60 * 60;
+function createDeviceIdentity(config) {
+  const maxAge = config.maxAgeSeconds ?? DEFAULT_DEVICE_MAX_AGE;
+  return {
+    read(request) {
+      const existing = readCookie(request, config.cookieName)?.trim();
+      return existing ? { value: existing, created: false } : { value: crypto.randomUUID(), created: true };
+    },
+    persist(response, identity) {
+      if (!identity.created) return response;
+      return setCookie(response, config.cookieName, identity.value, {
+        httpOnly: true,
+        secure: config.secure ?? true,
+        sameSite: "lax",
+        path: "/",
+        maxAge
+      });
+    }
+  };
+}
+
+// src/handoff-errors.ts
+var HANDOFF_ERROR_MESSAGES = {
+  // backend — handoff broker
+  handoff_unknown_app: "That application is not registered for sign-in handoff.",
+  handoff_not_configured: "Sign-in handoff is not configured for this application yet.",
+  handoff_source_not_allowed: "Your current session cannot open that application. Sign in there directly.",
+  handoff_invalid: "That sign-in handoff expired or was already used. Start again from where you came from.",
+  handoff_device_required: "The handoff could not identify this browser. Please try again.",
+  handoff_request_invalid: "The sign-in handoff request was malformed. Please try again.",
+  handoff_failed: "Sign-in handoff failed. Sign in with an email code instead.",
+  // backend — target admission (same codes the target's own login returns)
+  knowledge_library_access_required: "Your account has not been granted Knowledge Library access. Ask a platform admin to enable it.",
+  admin_center_access_required: "Your account has not been granted Admin Center access.",
+  platform_admin_surface_required: "Platform operator accounts sign in through the Platform Admin Center.",
+  account_disabled: "This account is disabled.",
+  // BFF — target callback
+  handoff_state_invalid: "Sign-in attempt expired \u2014 please try again.",
+  handoff_exchange_failed: "Sign-in could not be completed. Please try again.",
+  // BFF — source start
+  handoff_start_failed: "Could not start the sign-in handoff. Please try again.",
+  handoff_redirect_invalid: "The sign-in handoff returned an unexpected destination and was stopped.",
+  // BFF — surface bounces
+  admin_surface: "Platform operators sign in here; SaaSDash sent you to the Admin Center."
+};
+var HANDOFF_ERROR_FALLBACK = "Sign-in failed \u2014 please try again.";
+var SSO_ERROR_MESSAGES = {
+  sso_cancelled: "Sign-in was cancelled.",
+  sso_denied: "Sign-in was refused by the provider.",
+  sso_state_invalid: "Sign-in attempt expired \u2014 please try again.",
+  sso_start_failed: "Could not start sign-in with that provider. Please try again.",
+  sso_complete_failed: "Sign-in could not be completed. Please try again.",
+  sso_unknown_operator: "No operator account matches that identity. Ask an admin for an invite.",
+  sso_provider_not_found: "That sign-in provider is not available.",
+  sso_not_configured: "That sign-in provider is not fully configured."
+};
+var AUTH_ERROR_MESSAGES = {
+  ...HANDOFF_ERROR_MESSAGES,
+  ...SSO_ERROR_MESSAGES
+};
+function handoffErrorMessage(code) {
+  if (!code) return HANDOFF_ERROR_FALLBACK;
+  return HANDOFF_ERROR_MESSAGES[code] ?? HANDOFF_ERROR_FALLBACK;
+}
+function isHandoffErrorCode(code) {
+  return !!code && Object.prototype.hasOwnProperty.call(HANDOFF_ERROR_MESSAGES, code);
+}
+function authErrorMessage(code, overrides) {
+  if (!code) return HANDOFF_ERROR_FALLBACK;
+  return overrides?.[code] ?? AUTH_ERROR_MESSAGES[code] ?? HANDOFF_ERROR_FALLBACK;
+}
+function isAuthErrorCode(code, overrides) {
+  if (!code) return false;
+  return Object.prototype.hasOwnProperty.call(AUTH_ERROR_MESSAGES, code) || !!overrides && Object.prototype.hasOwnProperty.call(overrides, code);
+}
+
+// src/internal.ts
+function resolveValue(value) {
+  return typeof value === "function" ? value() : value;
+}
+function resolveAsync(value) {
+  return typeof value === "function" ? value() : value;
+}
+var isPromise = (value) => typeof value === "object" && value !== null && typeof value.then === "function";
+function resolveAll(...values) {
+  const resolved = values.map((value) => resolveAsync(value));
+  return resolved.some(isPromise) ? Promise.all(resolved) : resolved;
+}
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function timedFetch(url, options = {}) {
+  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const controller = options.timeoutMs ? new AbortController() : void 0;
+  const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
+  try {
+    return await doFetch(url, {
+      ...options.init,
+      cache: "no-store",
+      ...controller ? { signal: controller.signal } : {}
+    });
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+// src/handoff.ts
+var HANDOFF_COOKIE_TTL_SECONDS = 120;
+var CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+function sourceStartPath(app) {
+  return `/api/auth/handoffs/${encodeURIComponent(app)}/start`;
+}
+function brokerPaths(app) {
+  const key = encodeURIComponent(app);
+  return {
+    start: `/api/v1/platform/auth/handoffs/${key}/start`,
+    exchange: `/api/v1/platform/auth/handoffs/${key}/exchange`
+  };
+}
+function originOf(value) {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+}
+function base64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return globalThis.btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken(bytes) {
+  const raw = new Uint8Array(bytes);
+  crypto.getRandomValues(raw);
+  return base64Url(raw);
+}
+async function s256(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64Url(new Uint8Array(digest));
+}
+function validState(state) {
+  return state.length >= 16 && state.length <= 256 && !/[\r\n]/.test(state);
+}
+function redirect(url, status = 302) {
+  return new Response(null, { status, headers: { Location: url.toString(), "Cache-Control": "no-store" } });
+}
+function loginErrorRedirect(origin, loginPath, code) {
+  const target = new URL(loginPath, origin);
+  target.searchParams.set("error", code);
+  return redirect(target);
+}
+function createHandoffTarget(config) {
+  const secure = config.secureCookies ?? true;
+  const prefix = `${secure ? "__Host-" : ""}${config.cookiePrefix}_handoff_`;
+  const cookies = { state: `${prefix}state`, verifier: `${prefix}verifier`, from: `${prefix}from` };
+  const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
+  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const clearHandoffCookies = (response) => {
+    for (const name of Object.values(cookies)) deleteCookie(response, name, { path: "/", secure });
+    return response;
+  };
+  const fail = (origin, code) => clearHandoffCookies(loginErrorRedirect(origin, config.loginPath, code));
+  return {
+    cookies,
+    /** GET `?source=&from=` */
+    async start(request) {
+      const url = new URL(request.url);
+      const sourceKey = url.searchParams.get("source")?.trim() || config.defaultSource;
+      const source = config.sources[sourceKey];
+      if (!source) return fail(url.origin, "handoff_request_invalid");
+      const sourceOrigin = originOf(resolveValue(source));
+      if (!sourceOrigin) return fail(url.origin, "handoff_not_configured");
+      const verifier = randomToken(48);
+      const state = randomToken(32);
+      const start = new URL(sourceStartPath(config.app), sourceOrigin);
+      start.searchParams.set("code_challenge", await s256(verifier));
+      start.searchParams.set("state", state);
+      const response = redirect(start);
+      setCookie(response, cookies.verifier, verifier, cookieOptions);
+      setCookie(response, cookies.state, state, cookieOptions);
+      const from = safeInternalPath(url.searchParams.get("from"));
+      if (from) setCookie(response, cookies.from, from, cookieOptions);
+      return response;
+    },
+    /** GET `?code=&state=` */
+    async callback(request) {
+      const url = new URL(request.url);
+      const code = url.searchParams.get("code") ?? "";
+      const state = url.searchParams.get("state") ?? "";
+      const expectedState = readCookie(request, cookies.state) ?? "";
+      const verifier = readCookie(request, cookies.verifier) ?? "";
+      if (!code || !state || !expectedState || state !== expectedState || !verifier) {
+        return fail(url.origin, "handoff_state_invalid");
+      }
+      const device = config.device.read(request);
+      const respond = (response) => config.device.persist(response, device);
+      try {
+        const headers = forwardedRequestHeaders(request, {
+          "Content-Type": "application/json",
+          "X-Client-Type": config.clientType,
+          "X-Client-Device-ID": device.value
+        });
+        const response = await timedFetch(`${resolveValue(config.apiUrl)}${brokerPaths(config.app).exchange}`, { init: { method: "POST", headers, body: JSON.stringify({ code, code_verifier: verifier }) }, timeoutMs: timeout, fetch: config.fetch });
+        const payload = await response.json().catch(() => ({}));
+        if (!response.ok) {
+          const backendCode = payload?.code;
+          return respond(fail(url.origin, typeof backendCode === "string" ? backendCode : "handoff_exchange_failed"));
+        }
+        const session = parseAuthResponse(payload);
+        if (!session || !hasTokenAudience(session.access_token, config.audience)) {
+          return respond(fail(url.origin, "handoff_exchange_failed"));
+        }
+        const from = safeInternalPath(readCookie(request, cookies.from)) ?? config.defaultReturnPath;
+        const established = await config.establishSession(session, redirect(new URL(from, url.origin)), request) ?? redirect(new URL(from, url.origin));
+        return respond(clearHandoffCookies(established));
+      } catch {
+        return respond(fail(url.origin, "handoff_exchange_failed"));
+      }
+    }
+  };
+}
+var DEFAULT_TARGET_CALLBACK = "/api/auth/platform-sso/callback";
+var DEFAULT_TARGET_LOGIN = "/login";
+function createHandoffSource(config) {
+  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  return {
+    /** GET `/api/auth/handoffs/{app}/start?code_challenge=&state=` */
+    async start(request, app) {
+      const target = config.targets[app];
+      if (!target) return new Response("unknown handoff application", { status: 404, headers: { "Cache-Control": "no-store" } });
+      const targetOrigin = originOf(resolveValue(target.origin));
+      const targetLogin = target.loginPath ?? DEFAULT_TARGET_LOGIN;
+      if (!targetOrigin) return new Response("handoff target not configured", { status: 503, headers: { "Cache-Control": "no-store" } });
+      const targetError = (code) => loginErrorRedirect(targetOrigin, targetLogin, code);
+      const url = new URL(request.url);
+      const challenge = url.searchParams.get("code_challenge")?.trim() ?? "";
+      const state = url.searchParams.get("state")?.trim() ?? "";
+      if (!CHALLENGE_PATTERN.test(challenge) || !validState(state)) return targetError("handoff_request_invalid");
+      const sourceLogin = () => {
+        const login = new URL(config.loginPath, url.origin);
+        login.searchParams.set("from", `${url.pathname}${url.search}`);
+        return redirect(login);
+      };
+      const token = await config.getAccessToken(request);
+      if (!token) return sourceLogin();
+      try {
+        const headers = forwardedRequestHeaders(request, {
+          "Content-Type": "application/json",
+          "X-Client-Type": config.clientType,
+          Authorization: `Bearer ${token}`
+        });
+        const response = await timedFetch(`${resolveValue(config.apiUrl)}${brokerPaths(app).start}`, { init: { method: "POST", headers, body: JSON.stringify({ code_challenge: challenge, state }) }, timeoutMs: timeout, fetch: config.fetch });
+        if (response.status === 401) return sourceLogin();
+        const payload = await response.json().catch(() => ({}));
+        if (!response.ok) {
+          const backendCode = payload?.code;
+          return targetError(typeof backendCode === "string" ? backendCode : "handoff_start_failed");
+        }
+        const redirectUrl = payload?.redirect_url;
+        if (typeof redirectUrl !== "string") return targetError("handoff_start_failed");
+        let destination;
+        try {
+          destination = new URL(redirectUrl);
+        } catch {
+          return targetError("handoff_redirect_invalid");
+        }
+        if (destination.origin !== targetOrigin || destination.pathname !== (target.callbackPath ?? DEFAULT_TARGET_CALLBACK)) {
+          return targetError("handoff_redirect_invalid");
+        }
+        return redirect(destination);
+      } catch {
+        return targetError("handoff_start_failed");
+      }
+    }
+  };
+}
+
+// src/session-refresh.ts
+var DEFAULT_TTL_MS = 5e3;
+var DEFAULT_MAX = 1e3;
+function parseRefreshEnvelope(value) {
+  if (!value || typeof value !== "object") return null;
+  const outer = value;
+  const payload = outer.data && typeof outer.data === "object" ? outer.data : value;
+  if (typeof payload.access_token !== "string" || !payload.access_token) return null;
+  return {
+    accessToken: payload.access_token,
+    refreshToken: typeof payload.refresh_token === "string" && payload.refresh_token ? payload.refresh_token : void 0
+  };
+}
+function createSessionRefresher(config) {
+  const ttl = config.singleflightTtlMs ?? DEFAULT_TTL_MS;
+  const max = config.maxSingleflights ?? DEFAULT_MAX;
+  const timeoutMs = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const inflight = /* @__PURE__ */ new Map();
+  async function perform(refreshToken) {
+    try {
+      const pending = resolveAll(config.apiUrl, config.headers);
+      const [origin, extra] = pending instanceof Promise ? await pending : pending;
+      const headers = new Headers(extra);
+      headers.set("Content-Type", "application/json");
+      headers.set("X-Client-Type", config.clientType);
+      const response = await timedFetch(`${origin}${config.refreshPath}`, {
+        init: {
+          method: "POST",
+          headers,
+          body: JSON.stringify({ refresh_token: refreshToken })
+        },
+        timeoutMs,
+        fetch: config.fetch
+      });
+      if (!response.ok) return null;
+      const refreshed = parseRefreshEnvelope(await response.json());
+      return refreshed && hasTokenAudience(refreshed.accessToken, config.audience) ? refreshed : null;
+    } catch {
+      return null;
+    }
+  }
+  function prune(now) {
+    for (const [token, entry] of inflight) {
+      if (entry.expiresAt <= now) inflight.delete(token);
+    }
+    while (inflight.size >= max) {
+      const oldest = inflight.keys().next().value;
+      if (typeof oldest !== "string") break;
+      inflight.delete(oldest);
+    }
+  }
+  return {
+    refresh(refreshToken) {
+      const now = Date.now();
+      prune(now);
+      const existing = inflight.get(refreshToken);
+      if (existing && existing.expiresAt > now) return existing.promise;
+      const promise = perform(refreshToken).then((result) => {
+        if (!result) inflight.delete(refreshToken);
+        return result;
+      });
+      inflight.set(refreshToken, { expiresAt: now + ttl, promise });
+      return promise;
+    },
+    size() {
+      return inflight.size;
+    }
+  };
+}
+
+// src/session-gate.ts
+function hasSessionShape(token) {
+  if (!token) return false;
+  const payload = decodeTokenPayload(token);
+  return Boolean(payload?.user_id || payload?.actor_id || payload?.customer_id || payload?.sub);
+}
+async function evaluateSessionGate(input) {
+  const { accessToken, refreshToken, audience, refresher, isPublic, isLoginPath, isApiPath } = input;
+  const live = !!accessToken && hasSessionShape(accessToken) && hasTokenAudience(accessToken, audience) && !isTokenExpired(accessToken);
+  if (live) {
+    if (isPublic && isLoginPath) return { kind: "redirect_home" };
+    if (refreshToken && isTokenExpiringSoon(accessToken, input.expiringSoonBufferSeconds)) {
+      const refreshed = await refresher.refresh(refreshToken);
+      if (refreshed) return { kind: "pass", refreshed };
+    }
+    return { kind: "pass" };
+  }
+  if (refreshToken) {
+    const refreshed = await refresher.refresh(refreshToken);
+    if (refreshed) return isPublic ? { kind: "redirect_home", refreshed } : { kind: "pass", refreshed };
+  }
+  if (isPublic) return { kind: "anonymous_public" };
+  if (isApiPath) return { kind: "unauthorized_api" };
+  return { kind: "redirect_login" };
+}
+
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, applyForwardedClientHeaders, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, forwardedRequestHeaders, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds };

package/dist/next.d.ts

@@ -1,7 +1,6 @@
-import { SessionData, CookieOptions } from './index.js';
-export { AUTH_ERROR_MESSAGES, AuthResponse, DeviceIdentity, DeviceIdentityConfig, DeviceIdentityStore, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, HandoffSource, HandoffSourceConfig, HandoffSourceTarget, HandoffTarget, HandoffTargetConfig, RefreshedSession, SSO_ERROR_MESSAGES, SessionGateDecision, SessionGateInput, SessionRefresher, SessionRefresherConfig, SessionUser, TokenPayload, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds } from './index.js';
+import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-BnchfjP_.js';
+export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshedSession, l as SSO_ERROR_MESSAGES, m as SessionGateDecision, n as SessionGateInput, o as SessionRefresher, p as SessionRefresherConfig, q as SessionUser, T as TokenPayload, r as authErrorMessage, s as brokerPaths, t as createDeviceIdentity, u as createHandoffSource, v as createHandoffTarget, w as createSessionRefresher, x as decodeBase64Url, y as decodeDefaultSession, z as decodeTokenPayload, B as deleteCookie, E as evaluateSessionGate, F as handoffErrorMessage, G as hasSessionShape, I as hasTokenAudience, J as isAuthErrorCode, K as isHandoffErrorCode, L as isTokenExpired, M as isTokenExpiringSoon, N as parseAuthResponse, O as parseRefreshEnvelope, P as readCookie, Q as safeInternalPath, U as serializeCookie, V as setCookie, W as sourceStartPath, X as tokenMaxAgeSeconds } from './index-BnchfjP_.js';
 export { applyForwardedClientHeaders, forwardedRequestHeaders } from '@c1m-public/transport';
-import { R as Resolvable, A as AsyncResolvable } from './internal-D6RafCm2.js';
 
 /**
  * The error vocabulary every first-party platform surface uses at its edge.