@c1m-public/platform-auth 0.9.0 → 0.9.2

package/dist/chunk-Q7YI7RMG.js

@@ -1,404 +0,0 @@
-import { parseAuthResponse, hasTokenAudience, decodeTokenPayload, isTokenExpired, isTokenExpiringSoon } from './chunk-FBC2NUH7.js';
-import { DEFAULT_FETCH_TIMEOUT_MS, forwardedRequestHeaders, timedFetch, resolveValue, resolveAll } from './chunk-ZWSJVE5S.js';
-
-// src/return-path.ts
-function safeInternalPath(raw) {
-  if (raw == null) return null;
-  const candidate = raw.trim();
-  if (candidate.length === 0) return null;
-  if (!candidate.startsWith("/")) return null;
-  if (candidate.startsWith("//") || candidate.includes("://")) return null;
-  if (/%(?:2f|5c)/i.test(candidate)) return null;
-  if (/[\x00-\x1f\x7f]/.test(candidate)) return null;
-  try {
-    const parsed = new URL(candidate, "https://internal.invalid");
-    if (parsed.origin !== "https://internal.invalid") return null;
-    const roundtrip = `${parsed.pathname}${parsed.search}${parsed.hash}`;
-    if (roundtrip !== candidate) return null;
-    return candidate;
-  } catch {
-    return null;
-  }
-}
-
-// src/cookies.ts
-function readCookie(request, name) {
-  const header = request.headers.get("cookie");
-  if (!header) return null;
-  for (const part of header.split(";")) {
-    const separator = part.indexOf("=");
-    if (separator < 0) continue;
-    if (part.slice(0, separator).trim() !== name) continue;
-    const raw = part.slice(separator + 1).trim();
-    try {
-      return decodeURIComponent(raw);
-    } catch {
-      return raw;
-    }
-  }
-  return null;
-}
-function serializeCookie(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  parts.push(`Path=${options.path ?? "/"}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${Math.max(0, Math.floor(options.maxAge))}`);
-  if (options.httpOnly ?? true) parts.push("HttpOnly");
-  if (options.secure ?? name.startsWith("__Host-")) parts.push("Secure");
-  const sameSite = options.sameSite ?? "lax";
-  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
-  return parts.join("; ");
-}
-function setCookie(response, name, value, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, value, options));
-  return response;
-}
-function deleteCookie(response, name, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, "", { ...options, maxAge: 0 }));
-  return response;
-}
-
-// src/device-cookie.ts
-var DEFAULT_DEVICE_MAX_AGE = 365 * 24 * 60 * 60;
-function createDeviceIdentity(config) {
-  const maxAge = config.maxAgeSeconds ?? DEFAULT_DEVICE_MAX_AGE;
-  return {
-    read(request) {
-      const existing = readCookie(request, config.cookieName)?.trim();
-      return existing ? { value: existing, created: false } : { value: crypto.randomUUID(), created: true };
-    },
-    persist(response, identity) {
-      if (!identity.created) return response;
-      return setCookie(response, config.cookieName, identity.value, {
-        httpOnly: true,
-        secure: config.secure ?? true,
-        sameSite: "lax",
-        path: "/",
-        maxAge
-      });
-    }
-  };
-}
-
-// src/handoff-errors.ts
-var HANDOFF_ERROR_MESSAGES = {
-  // backend — handoff broker
-  handoff_unknown_app: "That application is not registered for sign-in handoff.",
-  handoff_not_configured: "Sign-in handoff is not configured for this application yet.",
-  handoff_source_not_allowed: "Your current session cannot open that application. Sign in there directly.",
-  handoff_invalid: "That sign-in handoff expired or was already used. Start again from where you came from.",
-  handoff_device_required: "The handoff could not identify this browser. Please try again.",
-  handoff_request_invalid: "The sign-in handoff request was malformed. Please try again.",
-  handoff_failed: "Sign-in handoff failed. Sign in with an email code instead.",
-  // backend — target admission (same codes the target's own login returns)
-  knowledge_library_access_required: "Your account has not been granted Knowledge Library access. Ask a platform admin to enable it.",
-  admin_center_access_required: "Your account has not been granted Admin Center access.",
-  platform_admin_surface_required: "Platform operator accounts sign in through the Platform Admin Center.",
-  account_disabled: "This account is disabled.",
-  // BFF — target callback
-  handoff_state_invalid: "Sign-in attempt expired \u2014 please try again.",
-  handoff_exchange_failed: "Sign-in could not be completed. Please try again.",
-  // BFF — source start
-  handoff_start_failed: "Could not start the sign-in handoff. Please try again.",
-  handoff_redirect_invalid: "The sign-in handoff returned an unexpected destination and was stopped.",
-  // BFF — surface bounces
-  admin_surface: "Platform operators sign in here; SaaSDash sent you to the Admin Center."
-};
-var HANDOFF_ERROR_FALLBACK = "Sign-in failed \u2014 please try again.";
-var SSO_ERROR_MESSAGES = {
-  sso_cancelled: "Sign-in was cancelled.",
-  sso_denied: "Sign-in was refused by the provider.",
-  sso_state_invalid: "Sign-in attempt expired \u2014 please try again.",
-  sso_start_failed: "Could not start sign-in with that provider. Please try again.",
-  sso_complete_failed: "Sign-in could not be completed. Please try again.",
-  sso_unknown_operator: "No operator account matches that identity. Ask an admin for an invite.",
-  sso_provider_not_found: "That sign-in provider is not available.",
-  sso_not_configured: "That sign-in provider is not fully configured."
-};
-var AUTH_ERROR_MESSAGES = {
-  ...HANDOFF_ERROR_MESSAGES,
-  ...SSO_ERROR_MESSAGES
-};
-function handoffErrorMessage(code) {
-  if (!code) return HANDOFF_ERROR_FALLBACK;
-  return HANDOFF_ERROR_MESSAGES[code] ?? HANDOFF_ERROR_FALLBACK;
-}
-function isHandoffErrorCode(code) {
-  return !!code && Object.prototype.hasOwnProperty.call(HANDOFF_ERROR_MESSAGES, code);
-}
-function authErrorMessage(code, overrides) {
-  if (!code) return HANDOFF_ERROR_FALLBACK;
-  return overrides?.[code] ?? AUTH_ERROR_MESSAGES[code] ?? HANDOFF_ERROR_FALLBACK;
-}
-function isAuthErrorCode(code, overrides) {
-  if (!code) return false;
-  return Object.prototype.hasOwnProperty.call(AUTH_ERROR_MESSAGES, code) || !!overrides && Object.prototype.hasOwnProperty.call(overrides, code);
-}
-
-// src/handoff.ts
-var HANDOFF_COOKIE_TTL_SECONDS = 120;
-var CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
-function sourceStartPath(app) {
-  return `/api/auth/handoffs/${encodeURIComponent(app)}/start`;
-}
-function brokerPaths(app) {
-  const key = encodeURIComponent(app);
-  return {
-    start: `/api/v1/platform/auth/handoffs/${key}/start`,
-    exchange: `/api/v1/platform/auth/handoffs/${key}/exchange`
-  };
-}
-function originOf(value) {
-  try {
-    return new URL(value).origin;
-  } catch {
-    return null;
-  }
-}
-function base64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return globalThis.btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function randomToken(bytes) {
-  const raw = new Uint8Array(bytes);
-  crypto.getRandomValues(raw);
-  return base64Url(raw);
-}
-async function s256(verifier) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return base64Url(new Uint8Array(digest));
-}
-function validState(state) {
-  return state.length >= 16 && state.length <= 256 && !/[\r\n]/.test(state);
-}
-function redirect(url, status = 302) {
-  return new Response(null, { status, headers: { Location: url.toString(), "Cache-Control": "no-store" } });
-}
-function loginErrorRedirect(origin, loginPath, code) {
-  const target = new URL(loginPath, origin);
-  target.searchParams.set("error", code);
-  return redirect(target);
-}
-function createHandoffTarget(config) {
-  const secure = config.secureCookies ?? true;
-  const prefix = `${secure ? "__Host-" : ""}${config.cookiePrefix}_handoff_`;
-  const cookies = { state: `${prefix}state`, verifier: `${prefix}verifier`, from: `${prefix}from` };
-  const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const clearHandoffCookies = (response) => {
-    for (const name of Object.values(cookies)) deleteCookie(response, name, { path: "/", secure });
-    return response;
-  };
-  const fail = (origin, code) => clearHandoffCookies(loginErrorRedirect(origin, config.loginPath, code));
-  return {
-    cookies,
-    /** GET `?source=&from=` */
-    async start(request) {
-      const url = new URL(request.url);
-      const sourceKey = url.searchParams.get("source")?.trim() || config.defaultSource;
-      const source = config.sources[sourceKey];
-      if (!source) return fail(url.origin, "handoff_request_invalid");
-      const sourceOrigin = originOf(resolveValue(source));
-      if (!sourceOrigin) return fail(url.origin, "handoff_not_configured");
-      const verifier = randomToken(48);
-      const state = randomToken(32);
-      const start = new URL(sourceStartPath(config.app), sourceOrigin);
-      start.searchParams.set("code_challenge", await s256(verifier));
-      start.searchParams.set("state", state);
-      const response = redirect(start);
-      setCookie(response, cookies.verifier, verifier, cookieOptions);
-      setCookie(response, cookies.state, state, cookieOptions);
-      const from = safeInternalPath(url.searchParams.get("from"));
-      if (from) setCookie(response, cookies.from, from, cookieOptions);
-      return response;
-    },
-    /** GET `?code=&state=` */
-    async callback(request) {
-      const url = new URL(request.url);
-      const code = url.searchParams.get("code") ?? "";
-      const state = url.searchParams.get("state") ?? "";
-      const expectedState = readCookie(request, cookies.state) ?? "";
-      const verifier = readCookie(request, cookies.verifier) ?? "";
-      if (!code || !state || !expectedState || state !== expectedState || !verifier) {
-        return fail(url.origin, "handoff_state_invalid");
-      }
-      const device = config.device.read(request);
-      const respond = (response) => config.device.persist(response, device);
-      try {
-        const headers = forwardedRequestHeaders(request, {
-          "Content-Type": "application/json",
-          "X-Client-Type": config.clientType,
-          "X-Client-Device-ID": device.value
-        });
-        const response = await timedFetch(`${resolveValue(config.apiUrl)}${brokerPaths(config.app).exchange}`, { init: { method: "POST", headers, body: JSON.stringify({ code, code_verifier: verifier }) }, timeoutMs: timeout, fetch: config.fetch });
-        const payload = await response.json().catch(() => ({}));
-        if (!response.ok) {
-          const backendCode = payload?.code;
-          return respond(fail(url.origin, typeof backendCode === "string" ? backendCode : "handoff_exchange_failed"));
-        }
-        const session = parseAuthResponse(payload);
-        if (!session || !hasTokenAudience(session.access_token, config.audience)) {
-          return respond(fail(url.origin, "handoff_exchange_failed"));
-        }
-        const from = safeInternalPath(readCookie(request, cookies.from)) ?? config.defaultReturnPath;
-        const established = await config.establishSession(session, redirect(new URL(from, url.origin)), request) ?? redirect(new URL(from, url.origin));
-        return respond(clearHandoffCookies(established));
-      } catch {
-        return respond(fail(url.origin, "handoff_exchange_failed"));
-      }
-    }
-  };
-}
-var DEFAULT_TARGET_CALLBACK = "/api/auth/platform-sso/callback";
-var DEFAULT_TARGET_LOGIN = "/login";
-function createHandoffSource(config) {
-  const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  return {
-    /** GET `/api/auth/handoffs/{app}/start?code_challenge=&state=` */
-    async start(request, app) {
-      const target = config.targets[app];
-      if (!target) return new Response("unknown handoff application", { status: 404, headers: { "Cache-Control": "no-store" } });
-      const targetOrigin = originOf(resolveValue(target.origin));
-      const targetLogin = target.loginPath ?? DEFAULT_TARGET_LOGIN;
-      if (!targetOrigin) return new Response("handoff target not configured", { status: 503, headers: { "Cache-Control": "no-store" } });
-      const targetError = (code) => loginErrorRedirect(targetOrigin, targetLogin, code);
-      const url = new URL(request.url);
-      const challenge = url.searchParams.get("code_challenge")?.trim() ?? "";
-      const state = url.searchParams.get("state")?.trim() ?? "";
-      if (!CHALLENGE_PATTERN.test(challenge) || !validState(state)) return targetError("handoff_request_invalid");
-      const sourceLogin = () => {
-        const login = new URL(config.loginPath, url.origin);
-        login.searchParams.set("from", `${url.pathname}${url.search}`);
-        return redirect(login);
-      };
-      const token = await config.getAccessToken(request);
-      if (!token) return sourceLogin();
-      try {
-        const headers = forwardedRequestHeaders(request, {
-          "Content-Type": "application/json",
-          "X-Client-Type": config.clientType,
-          Authorization: `Bearer ${token}`
-        });
-        const response = await timedFetch(`${resolveValue(config.apiUrl)}${brokerPaths(app).start}`, { init: { method: "POST", headers, body: JSON.stringify({ code_challenge: challenge, state }) }, timeoutMs: timeout, fetch: config.fetch });
-        if (response.status === 401) return sourceLogin();
-        const payload = await response.json().catch(() => ({}));
-        if (!response.ok) {
-          const backendCode = payload?.code;
-          return targetError(typeof backendCode === "string" ? backendCode : "handoff_start_failed");
-        }
-        const redirectUrl = payload?.redirect_url;
-        if (typeof redirectUrl !== "string") return targetError("handoff_start_failed");
-        let destination;
-        try {
-          destination = new URL(redirectUrl);
-        } catch {
-          return targetError("handoff_redirect_invalid");
-        }
-        if (destination.origin !== targetOrigin || destination.pathname !== (target.callbackPath ?? DEFAULT_TARGET_CALLBACK)) {
-          return targetError("handoff_redirect_invalid");
-        }
-        return redirect(destination);
-      } catch {
-        return targetError("handoff_start_failed");
-      }
-    }
-  };
-}
-
-// src/session-refresh.ts
-var DEFAULT_TTL_MS = 5e3;
-var DEFAULT_MAX = 1e3;
-function parseRefreshEnvelope(value) {
-  if (!value || typeof value !== "object") return null;
-  const outer = value;
-  const payload = outer.data && typeof outer.data === "object" ? outer.data : value;
-  if (typeof payload.access_token !== "string" || !payload.access_token) return null;
-  return {
-    accessToken: payload.access_token,
-    refreshToken: typeof payload.refresh_token === "string" && payload.refresh_token ? payload.refresh_token : void 0
-  };
-}
-function createSessionRefresher(config) {
-  const ttl = config.singleflightTtlMs ?? DEFAULT_TTL_MS;
-  const max = config.maxSingleflights ?? DEFAULT_MAX;
-  const timeoutMs = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const inflight = /* @__PURE__ */ new Map();
-  async function perform(refreshToken) {
-    try {
-      const pending = resolveAll(config.apiUrl, config.headers);
-      const [origin, extra] = pending instanceof Promise ? await pending : pending;
-      const headers = new Headers(extra);
-      headers.set("Content-Type", "application/json");
-      headers.set("X-Client-Type", config.clientType);
-      const response = await timedFetch(`${origin}${config.refreshPath}`, {
-        init: {
-          method: "POST",
-          headers,
-          body: JSON.stringify({ refresh_token: refreshToken })
-        },
-        timeoutMs,
-        fetch: config.fetch
-      });
-      if (!response.ok) return null;
-      const refreshed = parseRefreshEnvelope(await response.json());
-      return refreshed && hasTokenAudience(refreshed.accessToken, config.audience) ? refreshed : null;
-    } catch {
-      return null;
-    }
-  }
-  function prune(now) {
-    for (const [token, entry] of inflight) {
-      if (entry.expiresAt <= now) inflight.delete(token);
-    }
-    while (inflight.size >= max) {
-      const oldest = inflight.keys().next().value;
-      if (typeof oldest !== "string") break;
-      inflight.delete(oldest);
-    }
-  }
-  return {
-    refresh(refreshToken) {
-      const now = Date.now();
-      prune(now);
-      const existing = inflight.get(refreshToken);
-      if (existing && existing.expiresAt > now) return existing.promise;
-      const promise = perform(refreshToken).then((result) => {
-        if (!result) inflight.delete(refreshToken);
-        return result;
-      });
-      inflight.set(refreshToken, { expiresAt: now + ttl, promise });
-      return promise;
-    },
-    size() {
-      return inflight.size;
-    }
-  };
-}
-
-// src/session-gate.ts
-function hasSessionShape(token) {
-  if (!token) return false;
-  const payload = decodeTokenPayload(token);
-  return Boolean(payload?.user_id || payload?.actor_id || payload?.customer_id || payload?.sub);
-}
-async function evaluateSessionGate(input) {
-  const { accessToken, refreshToken, audience, refresher, isPublic, isLoginPath, isApiPath } = input;
-  const live = !!accessToken && hasSessionShape(accessToken) && hasTokenAudience(accessToken, audience) && !isTokenExpired(accessToken);
-  if (live) {
-    if (isPublic && isLoginPath) return { kind: "redirect_home" };
-    if (refreshToken && isTokenExpiringSoon(accessToken, input.expiringSoonBufferSeconds)) {
-      const refreshed = await refresher.refresh(refreshToken);
-      if (refreshed) return { kind: "pass", refreshed };
-    }
-    return { kind: "pass" };
-  }
-  if (refreshToken) {
-    const refreshed = await refresher.refresh(refreshToken);
-    if (refreshed) return isPublic ? { kind: "redirect_home", refreshed } : { kind: "pass", refreshed };
-  }
-  if (isPublic) return { kind: "anonymous_public" };
-  if (isApiPath) return { kind: "unauthorized_api" };
-  return { kind: "redirect_login" };
-}
-
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, deleteCookie, evaluateSessionGate, handoffErrorMessage, hasSessionShape, isAuthErrorCode, isHandoffErrorCode, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath };

package/dist/chunk-U67NBJND.js

@@ -1,267 +0,0 @@
-import { resolveValue, forwardedRequestHeaders, timedFetch } from './chunk-ZWSJVE5S.js';
-
-// src/access/generated/keys.ts
-var PLATFORM_PERMISSIONS = [
-  "affiliates.finance.manage",
-  "affiliates.partners.manage",
-  "affiliates.programmes.manage",
-  "affiliates.view",
-  "linkservice.domains.manage",
-  "linkservice.links.manage",
-  "linkservice.qr.manage",
-  "linkservice.view",
-  "platform.admin.view",
-  "platform.audit.view",
-  "platform.auth.manage",
-  "platform.billing.manage",
-  "platform.channels.manage",
-  "platform.channels.view",
-  "platform.config.manage",
-  "platform.docs.manage",
-  "platform.docs.view",
-  "platform.observability.manage",
-  "platform.observability.view",
-  "platform.offboarding.view",
-  "platform.ops.manage",
-  "platform.support.impersonate",
-  "platform.support.sessions",
-  "platform.tenants.archive",
-  "platform.tenants.manage",
-  "platform.tenants.restore",
-  "platform.users.deactivate",
-  "platform.users.delete",
-  "platform.users.invite",
-  "platform.users.manage_access",
-  "platform.users.reactivate",
-  "platform.users.view"
-];
-var DASH_PERMISSIONS = [
-  "dash.apps.manage",
-  "dash.billing.manage",
-  "dash.channels.manage",
-  "dash.customers.manage",
-  "dash.domains.manage",
-  "dash.members.manage",
-  "dash.ownership.transfer",
-  "dash.plans.manage",
-  "dash.publish",
-  "dash.settings.manage",
-  "dash.workspaces.admin",
-  "dash.workspaces.manage"
-];
-var DASH_ROLES = [
-  "dash.admin",
-  "dash.owner"
-];
-var LEADBROKER_PERMISSIONS = [
-  "leadbroker.finance.manage",
-  "leadbroker.leads.dispatch",
-  "leadbroker.leads.review",
-  "leadbroker.leads.view",
-  "leadbroker.policy.manage"
-];
-var WORKSPACE_PERMISSIONS = [
-  "workspace.channels.manage",
-  "workspace.channels.secrets",
-  "workspace.channels.view",
-  "workspace.crm.manage",
-  "workspace.crm.view",
-  "workspace.customers.manage",
-  "workspace.customers.view",
-  "workspace.orders.manage",
-  "workspace.orders.view",
-  "workspace.payments.record",
-  "workspace.site.edit",
-  "workspace.site.view",
-  "workspace.staff.manage"
-];
-var WORKSPACE_ROLES = [
-  "workspace.editor",
-  "workspace.frontdesk",
-  "workspace.manager"
-];
-
-// src/access/generated/stages.ts
-var PIPELINE_STAGES = ["created", "awaiting_payment", "provisioning", "attention", "active"];
-function isPipelineStage(value) {
-  return typeof value === "string" && PIPELINE_STAGES.includes(value);
-}
-
-// src/access/errors.ts
-var AccessSnapshotError = class extends Error {
-  code;
-  status;
-  constructor(code, message, status) {
-    super(message);
-    this.name = "AccessSnapshotError";
-    this.code = code;
-    this.status = status;
-  }
-};
-function isAccessSnapshotError(error, code) {
-  return error instanceof AccessSnapshotError && (code === void 0 || error.code === code);
-}
-
-// src/access/snapshot.ts
-var SCOPE_TYPES = /* @__PURE__ */ new Set(["platform", "saas_app", "workspace"]);
-function emptySnapshot(subjectId = "") {
-  return {
-    subject_id: subjectId,
-    access_version: 0,
-    is_owner: false,
-    active: false,
-    platform_role: "",
-    permissions: [],
-    dash_roles: {},
-    workspace_permissions: {},
-    workspace_roles: {}
-  };
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function fail(field, why) {
-  throw new AccessSnapshotError("invalid_snapshot", `access snapshot: ${field} ${why}`);
-}
-function parseAccessSnapshot(input) {
-  if (!isRecord(input)) fail("payload", "is not an object");
-  const { subject_id, access_version, is_owner, active, platform_role, permissions, dash_roles, workspace_permissions, workspace_roles } = input;
-  if (typeof subject_id !== "string" || subject_id === "") fail("subject_id", "must be a non-empty string");
-  if (typeof access_version !== "number" || !Number.isInteger(access_version) || access_version < 0) fail("access_version", "must be a non-negative integer");
-  if (typeof is_owner !== "boolean") fail("is_owner", "must be a boolean");
-  if (typeof active !== "boolean") fail("active", "must be a boolean");
-  if (platform_role !== void 0 && platform_role !== null && typeof platform_role !== "string") fail("platform_role", "must be a string");
-  if (!Array.isArray(permissions)) fail("permissions", "must be an array");
-  const entries = permissions.map((raw, i) => {
-    if (!isRecord(raw)) fail(`permissions[${i}]`, "is not an object");
-    const { key, scope_type, scope_id } = raw;
-    if (typeof key !== "string" || key === "") fail(`permissions[${i}].key`, "must be a non-empty string");
-    if (typeof scope_type !== "string" || !SCOPE_TYPES.has(scope_type)) fail(`permissions[${i}].scope_type`, "must be platform|saas_app|workspace");
-    if (scope_id !== void 0 && scope_id !== null && typeof scope_id !== "string") fail(`permissions[${i}].scope_id`, "must be a string");
-    return { key, scope_type, scope_id: typeof scope_id === "string" ? scope_id : "" };
-  });
-  const dashRoles = {};
-  if (dash_roles !== void 0 && dash_roles !== null) {
-    if (!isRecord(dash_roles)) fail("dash_roles", "must be an object");
-    for (const [dash, role] of Object.entries(dash_roles)) {
-      if (typeof role !== "string") fail(`dash_roles[${dash}]`, "must be a string");
-      dashRoles[dash] = role;
-    }
-  }
-  const wsPerms = {};
-  if (workspace_permissions !== void 0 && workspace_permissions !== null) {
-    if (!isRecord(workspace_permissions)) fail("workspace_permissions", "must be an object");
-    for (const [ws, keys] of Object.entries(workspace_permissions)) {
-      if (!Array.isArray(keys) || keys.some((k) => typeof k !== "string")) fail(`workspace_permissions[${ws}]`, "must be a string array");
-      wsPerms[ws] = [...keys];
-    }
-  }
-  const wsRoles = {};
-  if (workspace_roles !== void 0 && workspace_roles !== null) {
-    if (!isRecord(workspace_roles)) fail("workspace_roles", "must be an object");
-    for (const [ws, role] of Object.entries(workspace_roles)) {
-      if (typeof role !== "string") fail(`workspace_roles[${ws}]`, "must be a string");
-      wsRoles[ws] = role;
-    }
-  }
-  return {
-    subject_id,
-    access_version,
-    is_owner,
-    active,
-    platform_role: typeof platform_role === "string" ? platform_role : "",
-    permissions: entries,
-    dash_roles: dashRoles,
-    workspace_permissions: wsPerms,
-    workspace_roles: wsRoles
-  };
-}
-
-// src/access/predicates.ts
-function entryCoversApp(entry, saasApp) {
-  switch (entry.scope_type) {
-    case "platform":
-      return true;
-    case "saas_app":
-      if (saasApp === void 0) return true;
-      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === saasApp.toLowerCase();
-    default:
-      return false;
-  }
-}
-function hasPermission(snapshot, key, opts = {}) {
-  if (!snapshot.active) return false;
-  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.saasApp));
-}
-function hasAnyPermission(snapshot, keys, opts = {}) {
-  return keys.some((key) => hasPermission(snapshot, key, opts));
-}
-function hasAllPermissions(snapshot, keys, opts = {}) {
-  return keys.every((key) => hasPermission(snapshot, key, opts));
-}
-function hasWorkspacePermission(snapshot, workspaceId, key) {
-  if (!snapshot.active) return false;
-  if (snapshot.is_owner) return true;
-  return (snapshot.workspace_permissions[workspaceId] ?? []).includes(key);
-}
-function managedDashes(snapshot) {
-  if (!snapshot.active) return [];
-  return Object.entries(snapshot.dash_roles).map(([saasApp, role]) => ({ saasApp, role })).sort((a, b) => a.saasApp.localeCompare(b.saasApp));
-}
-function dashRole(snapshot, saasApp) {
-  if (!snapshot.active) return "";
-  return snapshot.dash_roles[saasApp] ?? "";
-}
-function isPlatformOwner(snapshot) {
-  return snapshot.active && snapshot.is_owner;
-}
-function appScopes(snapshot, key) {
-  if (!snapshot.active) return { all: false, apps: [] };
-  const apps = /* @__PURE__ */ new Set();
-  for (const entry of snapshot.permissions) {
-    if (entry.key !== key) continue;
-    if (entry.scope_type === "platform") return { all: true, apps: [] };
-    if (entry.scope_type === "saas_app") {
-      if (entry.scope_id === "*") return { all: true, apps: [] };
-      apps.add(entry.scope_id.toLowerCase());
-    }
-  }
-  return { all: false, apps: [...apps].sort() };
-}
-function permissionsFor(snapshot, opts = {}) {
-  if (!snapshot.active) return [];
-  const keys = /* @__PURE__ */ new Set();
-  for (const entry of snapshot.permissions) if (entryCoversApp(entry, opts.saasApp)) keys.add(entry.key);
-  return [...keys].sort();
-}
-
-// src/access/fetch.ts
-var DEFAULT_ACCESS_ENDPOINT_PATH = "/api/v1/platform/access";
-async function fetchAccessSnapshot(opts) {
-  const url = `${resolveValue(opts.apiUrl).replace(/\/$/, "")}${opts.endpointPath ?? DEFAULT_ACCESS_ENDPOINT_PATH}`;
-  const headers = opts.request ? forwardedRequestHeaders(opts.request, opts.headers) : new Headers(opts.headers);
-  headers.set("Authorization", `Bearer ${opts.accessToken}`);
-  headers.set("Accept", "application/json");
-  let response;
-  try {
-    response = await timedFetch(url, {
-      init: { method: "GET", headers },
-      timeoutMs: opts.fetchTimeoutMs,
-      fetchImpl: opts.fetchImpl
-    });
-  } catch (error) {
-    throw new AccessSnapshotError("unavailable", `access snapshot request failed: ${error.message}`);
-  }
-  if (response.status === 401) throw new AccessSnapshotError("unauthenticated", "session expired", 401);
-  if (response.status === 403) throw new AccessSnapshotError("forbidden", "access snapshot refused", 403);
-  if (!response.ok) throw new AccessSnapshotError("unavailable", `access snapshot returned ${response.status}`, response.status);
-  let body;
-  try {
-    body = await response.json();
-  } catch {
-    throw new AccessSnapshotError("invalid_snapshot", "access snapshot body is not JSON", response.status);
-  }
-  return parseAccessSnapshot(body);
-}
-
-export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PIPELINE_STAGES, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPipelineStage, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor };