@classic-homes/auth 1.0.2 → 1.2.0

package/dist/auth.svelte-MGVCAICX.js

@@ -0,0 +1,3 @@
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-LMFSLTIV.js';
+import './chunk-GKS5EDOT.js';
+import './chunk-VFEGS6FR.js';

package/dist/{chunk-LIRO3PU2.js → chunk-7OXE7SAW.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-7DW44JGU.js';
-import { getUserRoles, hasAnyRole } from './chunk-S4TOKARB.js';
+import { authApi } from './chunk-GKS5EDOT.js';
+import { getUserRoles, hasAnyRole } from './chunk-VFEGS6FR.js';
 
 // src/core/guards.ts
 function isMfaChallengeResponse(response) {
@@ -59,7 +59,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false && !isMfaChallengeResponse(response)) {
       try {
-        const { authStore } = await import('./auth.svelte-FUE2KVI4.js');
+        const { authStore } = await import('./auth.svelte-MGVCAICX.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,
@@ -186,10 +186,12 @@ var AuthService = class {
     await authApi.revokeApiKey(keyId);
   }
   /**
-   * Update an API key's name.
+   * Update an API key. Accepts a plain string as a name-only update for
+   * backward compatibility, or an UpdateApiKeyRequest to change name,
+   * description, role, or permissions.
    */
-  async updateApiKey(keyId, name) {
-    await authApi.updateApiKey(keyId, { name });
+  async updateApiKey(keyId, data) {
+    await authApi.updateApiKey(keyId, typeof data === "string" ? { name: data } : data);
   }
   // ============================================================================
   // MFA Management
@@ -243,7 +245,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false) {
       try {
-        const { authStore } = await import('./auth.svelte-FUE2KVI4.js');
+        const { authStore } = await import('./auth.svelte-MGVCAICX.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,

package/dist/{chunk-6VABYYP2.js → chunk-FTHQBYF2.js}

@@ -1,6 +1,6 @@
-import { authService } from './chunk-LIRO3PU2.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-GWOTYGQI.js';
-import { isInitialized, initAuth, getUserRoles } from './chunk-S4TOKARB.js';
+import { authService } from './chunk-7OXE7SAW.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-LMFSLTIV.js';
+import { isInitialized, initAuth, getUserRoles } from './chunk-VFEGS6FR.js';
 
 // src/svelte/guards/auth-guard.ts
 function checkAuth(options = {}) {

package/dist/{chunk-7DW44JGU.js → chunk-GKS5EDOT.js}

@@ -1,4 +1,4 @@
-import { getConfig, getStorage, getFetch, isValidRedirectUrl } from './chunk-S4TOKARB.js';
+import { getConfig, getStorage, getFetch, isValidRedirectUrl } from './chunk-VFEGS6FR.js';
 
 // src/core/client.ts
 var isRefreshing = false;
@@ -77,7 +77,7 @@ function updateStoredTokens(accessToken, refreshToken) {
   parsed.accessToken = accessToken;
   parsed.refreshToken = refreshToken;
   storage.setItem(storageKey, JSON.stringify(parsed));
-  import('./auth.svelte-FUE2KVI4.js').then(({ authStore }) => {
+  import('./auth.svelte-MGVCAICX.js').then(({ authStore }) => {
     authStore.updateTokens(accessToken, refreshToken);
   }).catch(() => {
   });
@@ -92,7 +92,7 @@ function clearStoredAuth() {
 async function expireSession() {
   clearStoredAuth();
   try {
-    const { authStore } = await import('./auth.svelte-FUE2KVI4.js');
+    const { authStore } = await import('./auth.svelte-MGVCAICX.js');
     authStore.handleSessionExpired();
   } catch {
   }
@@ -538,7 +538,7 @@ var authApi = {
     await api.delete(`/auth/api-keys/${keyId}`, true);
   },
   /**
-   * Update an API key's name.
+   * Update an API key's name, description, role, or permissions.
    */
   async updateApiKey(keyId, data) {
     await api.put(`/auth/api-keys/${keyId}`, data, true);

package/dist/{chunk-GWOTYGQI.js → chunk-LMFSLTIV.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-7DW44JGU.js';
-import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-S4TOKARB.js';
+import { authApi } from './chunk-GKS5EDOT.js';
+import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-VFEGS6FR.js';
 
 // src/svelte/stores/auth.svelte.ts
 var STORAGE_VERSION = 2;

package/dist/{chunk-S4TOKARB.js → chunk-VFEGS6FR.js}

@@ -159,6 +159,20 @@ var ROLE_NAMES = [
   "builder",
   "customer_service",
   "demo",
+  "stormwater",
+  "accounting_staff",
+  "architecture_staff",
+  "construction_staff",
+  "crl_staff",
+  "design_staff",
+  "hr_staff",
+  "it_staff",
+  "landdev_staff",
+  "marketing_staff",
+  "purchasing_staff",
+  "sales_staff",
+  "warranty_staff",
+  "employee",
   "user",
   "vendor",
   "customer",
@@ -171,10 +185,26 @@ var ROLE_HIERARCHY = {
   vendor: 1,
   customer: 1,
   subcontractor: 1,
+  // Staff tier (2): the read-only `employee` floor, the field-app clones of
+  // `agent`, and every `<department>_staff` docs role.
+  employee: 2,
   agent: 2,
   builder: 2,
   customer_service: 2,
   demo: 2,
+  stormwater: 2,
+  accounting_staff: 2,
+  architecture_staff: 2,
+  construction_staff: 2,
+  crl_staff: 2,
+  design_staff: 2,
+  hr_staff: 2,
+  it_staff: 2,
+  landdev_staff: 2,
+  marketing_staff: 2,
+  purchasing_staff: 2,
+  sales_staff: 2,
+  warranty_staff: 2,
   manager: 3,
   admin: 4
 };

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, p as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination, q as UserRolesResponse } from '../types-DXLdCdNC.js';
-export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, r as createMemoryStorage, s as createSessionStorage, t as getConfig, u as getDefaultStorage, v as getFetch, w as getStorage, x as initAuth, y as isInitialized, z as resetConfig } from '../types-DXLdCdNC.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-mQMLo7Il.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination, r as UserRolesResponse } from '../types-C6MqT3DB.js';
+export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from '../types-C6MqT3DB.js';
+export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-Dla77tvM.js';
 
 /**
  * HTTP Client
@@ -185,11 +185,9 @@ declare const authApi: {
      */
     revokeApiKey(keyId: string): Promise<void>;
     /**
-     * Update an API key's name.
+     * Update an API key's name, description, role, or permissions.
      */
-    updateApiKey(keyId: string, data: {
-        name: string;
-    }): Promise<void>;
+    updateApiKey(keyId: string, data: UpdateApiKeyRequest): Promise<void>;
     /**
      * Get MFA status for the current user.
      */
@@ -469,11 +467,13 @@ declare function extractClaims<T extends string>(token: string, claims: T[]): Pi
  * the first match, which is what makes the result deterministic when several
  * roles share a tier (e.g. `agent` + `builder`).
  *
- * Mirrors `ROLE_NAMES` in the API. `builder`/`customer_service`/`demo` are
- * staff-tier clones of `agent`; `vendor`/`customer`/`subcontractor` are clones
- * of `user`, row-scoped to their own homes.
+ * Mirrors `ROLE_NAMES` in the API. `builder`/`customer_service`/`demo`/
+ * `stormwater` are staff-tier clones of `agent`; the `<department>_staff` roles
+ * are grant-on-top docs roles held alongside another role; `employee` is the
+ * read-only base staff floor (default for Authentik SSO); `vendor`/`customer`/
+ * `subcontractor` are clones of `user`, row-scoped to their own homes.
  */
-declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "user", "vendor", "customer", "subcontractor", "guest"];
+declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "stormwater", "accounting_staff", "architecture_staff", "construction_staff", "crl_staff", "design_staff", "hr_staff", "it_staff", "landdev_staff", "marketing_staff", "purchasing_staff", "sales_staff", "warranty_staff", "employee", "user", "vendor", "customer", "subcontractor", "guest"];
 /**
  * A known role name.
  *
@@ -552,4 +552,4 @@ declare function hasAnyRole(user: Pick<User, 'roles'> | null | undefined, roles:
  */
 declare function hasAllRoles(user: Pick<User, 'roles'> | null | undefined, roles: readonly string[]): boolean;
 
-export { ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, RegisterData, RegisterResponse, type RoleName, SecurityEvent, Session, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, updateStoredTokens };
+export { ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, RegisterData, RegisterResponse, type RoleName, SecurityEvent, Session, UpdateApiKeyRequest, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, updateStoredTokens };

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-LIRO3PU2.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-7DW44JGU.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-S4TOKARB.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-7OXE7SAW.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-GKS5EDOT.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-VFEGS6FR.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as User, p as UserPreferences, q as UserRolesResponse, r as createMemoryStorage, s as createSessionStorage, t as getConfig, u as getDefaultStorage, v as getFetch, w as getStorage, x as initAuth, y as isInitialized, z as resetConfig } from './types-DXLdCdNC.js';
+export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as UpdateApiKeyRequest, p as User, q as UserPreferences, r as UserRolesResponse, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from './types-C6MqT3DB.js';
 export { ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RoleName, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, updateStoredTokens } from './core/index.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-mQMLo7Il.js';
+export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-Dla77tvM.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-6VABYYP2.js';
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-LIRO3PU2.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-GWOTYGQI.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from './chunk-7DW44JGU.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-S4TOKARB.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-FTHQBYF2.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-7OXE7SAW.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-LMFSLTIV.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from './chunk-GKS5EDOT.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-VFEGS6FR.js';

package/dist/svelte/index.d.ts

@@ -1,7 +1,7 @@
-import { b as AuthState, U as User, a as AuthConfig } from '../types-DXLdCdNC.js';
-export { x as initAuth, y as isInitialized } from '../types-DXLdCdNC.js';
-import { a as authService } from '../user-utils-mQMLo7Il.js';
-export { R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-mQMLo7Il.js';
+import { b as AuthState, p as User, a as AuthConfig } from '../types-C6MqT3DB.js';
+export { y as initAuth, z as isInitialized } from '../types-C6MqT3DB.js';
+import { a as authService } from '../user-utils-Dla77tvM.js';
+export { R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-Dla77tvM.js';
 
 /**
  * Auth Store

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-6VABYYP2.js';
-export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-LIRO3PU2.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-GWOTYGQI.js';
-import '../chunk-7DW44JGU.js';
-export { initAuth, isInitialized } from '../chunk-S4TOKARB.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-FTHQBYF2.js';
+export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-7OXE7SAW.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-LMFSLTIV.js';
+import '../chunk-GKS5EDOT.js';
+export { initAuth, isInitialized } from '../chunk-VFEGS6FR.js';

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { U as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, p as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-DXLdCdNC.js';
+import { p as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, q as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-C6MqT3DB.js';
 
 /**
  * User Fixtures

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-S4TOKARB.js';
+import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-VFEGS6FR.js';
 
 // src/testing/fixtures/users.ts
 var mockUser = {

package/dist/{types-DXLdCdNC.d.ts → types-C6MqT3DB.d.ts}

@@ -258,6 +258,21 @@ interface ApiKey {
     createdAt: string;
     usageCount?: number;
 }
+/**
+ * Payload for updating an existing API key. All fields optional; at least one
+ * must be provided. Role/permission changes are validated server-side against
+ * the editor's own grants (same escalation guards as create) and take effect
+ * on the key's next request — enforcement reads the stored row live.
+ */
+interface UpdateApiKeyRequest {
+    name?: string;
+    /** null clears the description */
+    description?: string | null;
+    /** Changing the role without `permissions` re-inherits the new role's full set */
+    role?: string;
+    /** Replacement permission set; must be a subset of the editor's own permissions */
+    permissions?: string[];
+}
 interface CreateApiKeyRequest {
     name: string;
     description?: string;
@@ -371,4 +386,4 @@ interface ResetPasswordData {
     newPassword: string;
 }
 
-export { type ApiKey as A, type ChangePasswordData as C, type Device as D, type LinkedAccount as L, type MFAChallengeData as M, type Pagination as P, type RegisterData as R, type SSOConfig as S, type User as U, type AuthConfig as a, type AuthState as b, type CreateApiKeyRequest as c, type CreateApiKeyResponse as d, type LoginCredentials as e, type LoginResponse as f, type LogoutResponse as g, type MFASetupResponse as h, type MFAStatus as i, type ProfileUpdateData as j, type RegisterResponse as k, type ResetPasswordData as l, type SecurityEvent as m, type Session as n, type StorageAdapter as o, type UserPreferences as p, type UserRolesResponse as q, createMemoryStorage as r, createSessionStorage as s, getConfig as t, getDefaultStorage as u, getFetch as v, getStorage as w, initAuth as x, isInitialized as y, resetConfig as z };
+export { type ApiKey as A, resetConfig as B, type ChangePasswordData as C, type Device as D, type LinkedAccount as L, type MFAChallengeData as M, type Pagination as P, type RegisterData as R, type SSOConfig as S, type UpdateApiKeyRequest as U, type AuthConfig as a, type AuthState as b, type CreateApiKeyRequest as c, type CreateApiKeyResponse as d, type LoginCredentials as e, type LoginResponse as f, type LogoutResponse as g, type MFASetupResponse as h, type MFAStatus as i, type ProfileUpdateData as j, type RegisterResponse as k, type ResetPasswordData as l, type SecurityEvent as m, type Session as n, type StorageAdapter as o, type User as p, type UserPreferences as q, type UserRolesResponse as r, createMemoryStorage as s, createSessionStorage as t, getConfig as u, getDefaultStorage as v, getFetch as w, getStorage as x, initAuth as y, isInitialized as z };

package/dist/{user-utils-mQMLo7Il.d.ts → user-utils-Dla77tvM.d.ts}

@@ -1,4 +1,4 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, p as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-DXLdCdNC.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-C6MqT3DB.js';
 
 /**
  * Auth Service
@@ -158,9 +158,11 @@ declare class AuthService {
      */
     revokeApiKey(keyId: string): Promise<void>;
     /**
-     * Update an API key's name.
+     * Update an API key. Accepts a plain string as a name-only update for
+     * backward compatibility, or an UpdateApiKeyRequest to change name,
+     * description, role, or permissions.
      */
-    updateApiKey(keyId: string, name: string): Promise<void>;
+    updateApiKey(keyId: string, data: string | UpdateApiKeyRequest): Promise<void>;
     /**
      * Get MFA status for the current user.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.0.2",
+  "version": "1.2.0",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",

package/dist/auth.svelte-FUE2KVI4.js

@@ -1,3 +0,0 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-GWOTYGQI.js';
-import './chunk-7DW44JGU.js';
-import './chunk-S4TOKARB.js';