@classic-homes/auth 0.1.55 → 0.1.56

package/README.md

@@ -37,6 +37,12 @@ initAuth({
     setItem: (key, value) => localStorage.setItem(key, value),
     removeItem: (key) => localStorage.removeItem(key),
   },
+  // ⚠️ SECURITY: localStorage (also the default when `storage` is omitted)
+  // persists the long-lived refresh token where any XSS can read it.
+  // Safer options exported from '@classic-homes/auth/core':
+  //   storage: createSessionStorage()  // per-tab, cleared on close
+  //   storage: createMemoryStorage()   // never persisted, lost on reload
+  // or keep tokens out of JS entirely with an httpOnly-cookie flow.
   // SSO configuration (optional)
   sso: {
     enabled: true,

package/dist/auth.svelte-WPCYPHEE.js

@@ -0,0 +1,3 @@
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-CPFM7JEI.js';
+import './chunk-2QYFVJEM.js';
+import './chunk-6NTZVDLW.js';

package/dist/{chunk-GRQL5FSH.js → chunk-2QYFVJEM.js}

@@ -1,4 +1,4 @@
-import { getConfig, getStorage, getFetch, isValidRedirectUrl } from './chunk-EM7PUNZB.js';
+import { getConfig, getStorage, getFetch, isValidRedirectUrl } from './chunk-6NTZVDLW.js';
 
 // src/core/client.ts
 var isRefreshing = false;
@@ -70,9 +70,8 @@ function updateStoredTokens(accessToken, refreshToken) {
   }
   parsed.accessToken = accessToken;
   parsed.refreshToken = refreshToken;
-  parsed._version = (parsed._version || 0) + 1;
   storage.setItem(storageKey, JSON.stringify(parsed));
-  import('./auth.svelte-BBLX2MKB.js').then(({ authStore }) => {
+  import('./auth.svelte-WPCYPHEE.js').then(({ authStore }) => {
     authStore.updateTokens(accessToken, refreshToken);
   }).catch(() => {
   });
@@ -91,13 +90,17 @@ async function refreshAccessToken() {
   if (!refreshToken) {
     return false;
   }
+  const timeoutMs = config.requestTimeout ?? 3e4;
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const response = await fetchFn(`${config.baseUrl}/auth/refresh`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({ refreshToken })
+      body: JSON.stringify({ refreshToken }),
+      signal: controller.signal
     });
     if (response.ok) {
       let apiResponse;
@@ -126,6 +129,8 @@ async function refreshAccessToken() {
     }
   } catch (error) {
     config.onAuthError?.(error instanceof Error ? error : new Error("Token refresh failed"));
+  } finally {
+    clearTimeout(timeoutId);
   }
   return false;
 }
@@ -141,7 +146,10 @@ function extractData(response) {
   }
   return response;
 }
-async function apiRequest(endpoint, options = {}) {
+function apiRequest(endpoint, options = {}) {
+  return apiRequestInternal(endpoint, options, false);
+}
+async function apiRequestInternal(endpoint, options, isRetry) {
   const { authenticated = false, customFetch, body, timeout, signal, ...fetchOptions } = options;
   const config = getConfig();
   const fetchFn = customFetch ?? getFetch();
@@ -179,12 +187,21 @@ async function apiRequest(endpoint, options = {}) {
     });
     clearTimeout(timeoutId);
     if (response.status === 401 && authenticated && typeof window !== "undefined") {
+      if (isRetry) {
+        clearStoredAuth();
+        config.onLogout?.();
+        throw new Error("Authentication failed. Please sign in again.");
+      }
       if (!isRefreshing) {
         isRefreshing = true;
-        const refreshed = await refreshAccessToken();
-        isRefreshing = false;
+        let refreshed = false;
+        try {
+          refreshed = await refreshAccessToken();
+        } finally {
+          isRefreshing = false;
+        }
         if (refreshed) {
-          return apiRequest(endpoint, options);
+          return apiRequestInternal(endpoint, options, true);
         } else {
           clearStoredAuth();
           config.onLogout?.();
@@ -194,21 +211,29 @@ async function apiRequest(endpoint, options = {}) {
         const REFRESH_TIMEOUT_MS = 3e4;
         return new Promise((resolve, reject) => {
           let settled = false;
-          let unsubscribe = null;
-          const timeoutId2 = setTimeout(() => {
+          const refreshTimeoutId = setTimeout(() => {
             if (!settled) {
               settled = true;
               unsubscribe?.();
               reject(new Error("Token refresh timed out. Please sign in again."));
             }
           }, REFRESH_TIMEOUT_MS);
-          unsubscribe = subscribeTokenRefresh(() => {
+          let unsubscribe = null;
+          try {
+            unsubscribe = subscribeTokenRefresh(() => {
+              if (!settled) {
+                settled = true;
+                clearTimeout(refreshTimeoutId);
+                apiRequestInternal(endpoint, options, true).then(resolve).catch(reject);
+              }
+            });
+          } catch (subscribeError) {
+            clearTimeout(refreshTimeoutId);
             if (!settled) {
               settled = true;
-              clearTimeout(timeoutId2);
-              apiRequest(endpoint, options).then(resolve).catch(reject);
+              reject(subscribeError);
             }
-          });
+          }
         });
       }
     }
@@ -294,6 +319,23 @@ var api = {
 };
 
 // src/core/api.ts
+async function fetchWithTimeout(url, init) {
+  const config = getConfig();
+  const fetchFn = config.fetch ?? fetch;
+  const timeoutMs = config.requestTimeout ?? 3e4;
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetchFn(url, { ...init, signal: controller.signal });
+  } catch (error) {
+    if (error instanceof DOMException && error.name === "AbortError") {
+      throw new Error(`Request timed out after ${timeoutMs}ms`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
 var authApi = {
   // ============================================================================
   // Authentication
@@ -318,8 +360,9 @@ var authApi = {
       return extractData(response);
     } catch (error) {
       const config = getConfig();
-      config.onAuthError?.(error instanceof Error ? error : new Error("Logout API call failed"));
-      return { success: true };
+      const err = error instanceof Error ? error : new Error("Logout API call failed");
+      config.onAuthError?.(err);
+      return { success: true, serverError: err.message };
     }
   },
   /**
@@ -515,13 +558,12 @@ var authApi = {
    */
   async verifyMFAChallenge(data) {
     const config = getConfig();
-    const fetchFn = config.fetch ?? fetch;
     const requestBody = {
       code: data.code,
       type: data.method === "backup" ? "backup" : "totp",
       trustDevice: data.trustDevice
     };
-    const response = await fetchFn(`${config.baseUrl}/auth/mfa/challenge`, {
+    const response = await fetchWithTimeout(`${config.baseUrl}/auth/mfa/challenge`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -650,8 +692,7 @@ var authApi = {
       throw new Error("Not authenticated");
     }
     const config = getConfig();
-    const fetchFn = config.fetch ?? fetch;
-    const response = await fetchFn(`${config.baseUrl}/auth/sso/link`, {
+    const response = await fetchWithTimeout(`${config.baseUrl}/auth/sso/link`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",

package/dist/{chunk-EM7PUNZB.js → chunk-6NTZVDLW.js}

@@ -36,6 +36,34 @@ function getDefaultStorage() {
     }
   };
 }
+function createSessionStorage() {
+  if (typeof window !== "undefined" && window.sessionStorage) {
+    return {
+      getItem: (key) => sessionStorage.getItem(key),
+      setItem: (key, value) => sessionStorage.setItem(key, value),
+      removeItem: (key) => sessionStorage.removeItem(key)
+    };
+  }
+  return {
+    getItem: () => null,
+    setItem: () => {
+    },
+    removeItem: () => {
+    }
+  };
+}
+function createMemoryStorage() {
+  const store = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => store.get(key) ?? null,
+    setItem: (key, value) => {
+      store.set(key, value);
+    },
+    removeItem: (key) => {
+      store.delete(key);
+    }
+  };
+}
 function getStorage() {
   const cfg = getConfig();
   return cfg.storage ?? getDefaultStorage();
@@ -91,7 +119,8 @@ function isTokenExpired(token) {
   if (!payload || !payload.exp) {
     return true;
   }
-  return payload.exp * 1e3 < Date.now();
+  const CLOCK_SKEW_MS = 3e4;
+  return payload.exp * 1e3 < Date.now() - CLOCK_SKEW_MS;
 }
 function getTokenRemainingTime(token) {
   const payload = decodeJWT(token);
@@ -122,4 +151,4 @@ function extractClaims(token, claims) {
   return result;
 }
 
-export { decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, isValidRedirectUrl, resetConfig };
+export { createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, isValidRedirectUrl, resetConfig };

package/dist/{chunk-BK34CVH5.js → chunk-CPFM7JEI.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-GRQL5FSH.js';
-import { decodeJWT, isInitialized, getConfig, getStorage, getDefaultStorage } from './chunk-EM7PUNZB.js';
+import { authApi } from './chunk-2QYFVJEM.js';
+import { decodeJWT, isInitialized, getConfig, getStorage, getDefaultStorage } from './chunk-6NTZVDLW.js';
 
 // src/svelte/stores/auth.svelte.ts
 function getStorageKey() {

package/dist/{chunk-TUHQ4FHC.js → chunk-MPPV5S7S.js}

@@ -1,4 +1,4 @@
-import { authApi } from './chunk-GRQL5FSH.js';
+import { authApi } from './chunk-2QYFVJEM.js';
 
 // src/core/guards.ts
 function isMfaChallengeResponse(response) {
@@ -60,7 +60,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false && !isMfaChallengeResponse(response)) {
       try {
-        const { authStore } = await import('./auth.svelte-BBLX2MKB.js');
+        const { authStore } = await import('./auth.svelte-WPCYPHEE.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,
@@ -246,7 +246,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false) {
       try {
-        const { authStore } = await import('./auth.svelte-BBLX2MKB.js');
+        const { authStore } = await import('./auth.svelte-WPCYPHEE.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,

package/dist/{chunk-RKSETJ4V.js → chunk-UG4GSPGL.js}

@@ -1,6 +1,6 @@
-import { authService } from './chunk-TUHQ4FHC.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-BK34CVH5.js';
-import { isInitialized, initAuth } from './chunk-EM7PUNZB.js';
+import { authService } from './chunk-MPPV5S7S.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-CPFM7JEI.js';
+import { isInitialized, initAuth } from './chunk-6NTZVDLW.js';
 
 // src/svelte/guards/auth-guard.ts
 function checkAuth(options = {}) {

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, p as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from '../types-BRxyphcX.js';
-export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, q as getConfig, r as getDefaultStorage, s as getFetch, t as getStorage, u as initAuth, v as isInitialized, w as resetConfig } from '../types-BRxyphcX.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-BSbNN3Hb.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, p as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from '../types-Di6SR1q5.js';
+export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, q as createMemoryStorage, r as createSessionStorage, s as getConfig, t as getDefaultStorage, u as getFetch, v as getStorage, w as initAuth, x as isInitialized, y as resetConfig } from '../types-Di6SR1q5.js';
+export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-C-JbXqbj.js';
 
 /**
  * HTTP Client
@@ -47,9 +47,10 @@ declare function getSessionToken(): string | null;
  * Update stored tokens.
  * Also updates the Svelte auth store if available.
  *
- * Note: The read-modify-write on localStorage is not atomic across tabs.
- * A version counter is used to detect and discard stale writes from other tabs.
- * The `storage` event listener (set up via `initCrossTabSync`) keeps tabs in sync.
+ * Note: The read-modify-write on localStorage is not atomic across tabs —
+ * concurrent refreshes in two tabs are last-write-wins. The `storage` event
+ * listener (set up via `initCrossTabSync`) propagates whichever write landed
+ * last, so tabs converge on the same tokens.
  */
 declare function updateStoredTokens(accessToken: string, refreshToken: string): void;
 /**

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-TUHQ4FHC.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-GRQL5FSH.js';
-export { decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-EM7PUNZB.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-MPPV5S7S.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-2QYFVJEM.js';
+export { createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-6NTZVDLW.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as User, p as UserPreferences, q as getConfig, r as getDefaultStorage, s as getFetch, t as getStorage, u as initAuth, v as isInitialized, w as resetConfig } from './types-BRxyphcX.js';
+export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as User, p as UserPreferences, q as createMemoryStorage, r as createSessionStorage, s as getConfig, t as getDefaultStorage, u as getFetch, v as getStorage, w as initAuth, x as isInitialized, y as resetConfig } from './types-Di6SR1q5.js';
 export { ApiRequestOptions, ApiResponse, JWTPayload, api, apiRequest, authApi, clearStoredAuth, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, updateStoredTokens } from './core/index.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-BSbNN3Hb.js';
+export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-C-JbXqbj.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-RKSETJ4V.js';
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-TUHQ4FHC.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-BK34CVH5.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from './chunk-GRQL5FSH.js';
-export { decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-EM7PUNZB.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-UG4GSPGL.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-MPPV5S7S.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-CPFM7JEI.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from './chunk-2QYFVJEM.js';
+export { createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-6NTZVDLW.js';

package/dist/svelte/index.d.ts

@@ -1,7 +1,7 @@
-import { b as AuthState, U as User, a as AuthConfig } from '../types-BRxyphcX.js';
-export { u as initAuth, v as isInitialized } from '../types-BRxyphcX.js';
-import { a as authService } from '../user-utils-BSbNN3Hb.js';
-export { R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-BSbNN3Hb.js';
+import { b as AuthState, U as User, a as AuthConfig } from '../types-Di6SR1q5.js';
+export { w as initAuth, x as isInitialized } from '../types-Di6SR1q5.js';
+import { a as authService } from '../user-utils-C-JbXqbj.js';
+export { R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-C-JbXqbj.js';
 
 /**
  * Auth Store

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-RKSETJ4V.js';
-export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-TUHQ4FHC.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-BK34CVH5.js';
-import '../chunk-GRQL5FSH.js';
-export { initAuth, isInitialized } from '../chunk-EM7PUNZB.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-UG4GSPGL.js';
+export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-MPPV5S7S.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-CPFM7JEI.js';
+import '../chunk-2QYFVJEM.js';
+export { initAuth, isInitialized } from '../chunk-6NTZVDLW.js';

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { U as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, p as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-BRxyphcX.js';
+import { U as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, p as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-Di6SR1q5.js';
 
 /**
  * User Fixtures

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { initAuth, resetConfig, isTokenExpired, decodeJWT } from '../chunk-EM7PUNZB.js';
+import { initAuth, resetConfig, isTokenExpired, decodeJWT } from '../chunk-6NTZVDLW.js';
 
 // src/testing/fixtures/users.ts
 var mockUser = {

package/dist/{types-BRxyphcX.d.ts → types-Di6SR1q5.d.ts}

@@ -105,8 +105,29 @@ declare function resetConfig(): void;
 /**
  * Get the default storage adapter.
  * Returns localStorage in browser, or a no-op adapter in SSR.
+ *
+ * SECURITY NOTE: localStorage persists tokens (including the long-lived
+ * refresh token) where any XSS on the page can read them. It is the default
+ * for cross-tab session continuity, but consider the safer alternatives:
+ * `createSessionStorage()` (per-tab, cleared on close),
+ * `createMemoryStorage()` (never persisted, lost on reload), or an
+ * httpOnly-cookie flow on your backend so tokens never reach JS at all.
+ * Pass the adapter via `initAuth({ storage: ... })`.
  */
 declare function getDefaultStorage(): StorageAdapter;
+/**
+ * Storage adapter backed by sessionStorage: tokens live per-tab and are
+ * cleared when the tab closes. Safer than localStorage against persistent
+ * token theft, at the cost of cross-tab session continuity.
+ * Falls back to no-op in SSR.
+ */
+declare function createSessionStorage(): StorageAdapter;
+/**
+ * In-memory storage adapter: tokens are never persisted and are lost on
+ * page reload (the user re-authenticates or a silent SSO flow restores the
+ * session). The safest JS-side option against token exfiltration.
+ */
+declare function createMemoryStorage(): StorageAdapter;
 /**
  * Get the storage adapter from config or use default.
  */
@@ -174,6 +195,12 @@ interface LogoutResponse {
     message?: string;
     ssoLogout?: boolean;
     logoutUrl?: string;
+    /**
+     * Set when the server-side logout call failed. `success` stays true so
+     * callers clear local state, but the server session may still be alive —
+     * check this to warn the user or retry revocation.
+     */
+    serverError?: string;
 }
 interface RegisterResponse {
     message: string;
@@ -320,4 +347,4 @@ interface ResetPasswordData {
     newPassword: string;
 }
 
-export { type ApiKey as A, type ChangePasswordData as C, type Device as D, type LinkedAccount as L, type MFAChallengeData as M, type Pagination as P, type RegisterData as R, type SSOConfig as S, type User as U, type AuthConfig as a, type AuthState as b, type CreateApiKeyRequest as c, type CreateApiKeyResponse as d, type LoginCredentials as e, type LoginResponse as f, type LogoutResponse as g, type MFASetupResponse as h, type MFAStatus as i, type ProfileUpdateData as j, type RegisterResponse as k, type ResetPasswordData as l, type SecurityEvent as m, type Session as n, type StorageAdapter as o, type UserPreferences as p, getConfig as q, getDefaultStorage as r, getFetch as s, getStorage as t, initAuth as u, isInitialized as v, resetConfig as w };
+export { type ApiKey as A, type ChangePasswordData as C, type Device as D, type LinkedAccount as L, type MFAChallengeData as M, type Pagination as P, type RegisterData as R, type SSOConfig as S, type User as U, type AuthConfig as a, type AuthState as b, type CreateApiKeyRequest as c, type CreateApiKeyResponse as d, type LoginCredentials as e, type LoginResponse as f, type LogoutResponse as g, type MFASetupResponse as h, type MFAStatus as i, type ProfileUpdateData as j, type RegisterResponse as k, type ResetPasswordData as l, type SecurityEvent as m, type Session as n, type StorageAdapter as o, type UserPreferences as p, createMemoryStorage as q, createSessionStorage as r, getConfig as s, getDefaultStorage as t, getFetch as u, getStorage as v, initAuth as w, isInitialized as x, resetConfig as y };

package/dist/{user-utils-BSbNN3Hb.d.ts → user-utils-C-JbXqbj.d.ts}

@@ -1,4 +1,4 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, p as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-BRxyphcX.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, p as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-Di6SR1q5.js';
 
 /**
  * Auth Service

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "0.1.55",
+  "version": "0.1.56",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",

package/dist/auth.svelte-BBLX2MKB.js

@@ -1,3 +0,0 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-BK34CVH5.js';
-import './chunk-GRQL5FSH.js';
-import './chunk-EM7PUNZB.js';