@classic-homes/auth 1.22.2 → 1.23.0

package/dist/auth.svelte-T4LKTTDZ.js

@@ -0,0 +1,3 @@
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-KSOYQYUZ.js';
+import './chunk-ETKDIPD2.js';
+import './chunk-2CYGQUUY.js';

package/dist/{chunk-UJAJO5QJ.js → chunk-2CYGQUUY.js}

@@ -181,6 +181,7 @@ var ROLE_NAMES = [
   "stormwater_staff",
   "warranty_staff",
   "hotsheet_editor",
+  "office_admin",
   "employee",
   "user",
   "vendor",
@@ -195,7 +196,8 @@ var ROLE_HIERARCHY = {
   customer: 1,
   subcontractor: 1,
   // Staff tier (2): the read-only `employee` floor, the field-app clones of
-  // `agent`, every `<department>_staff` docs role, and `hotsheet_editor`.
+  // `agent`, every `<department>_staff` docs role, `hotsheet_editor` and
+  // `office_admin`.
   employee: 2,
   agent: 2,
   builder: 2,
@@ -216,6 +218,7 @@ var ROLE_HIERARCHY = {
   stormwater_staff: 2,
   warranty_staff: 2,
   hotsheet_editor: 2,
+  office_admin: 2,
   manager: 3,
   admin: 4
 };

package/dist/{chunk-2LRLMSOH.js → chunk-DFCBWKCU.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-SUW4DKKS.js';
-import { getUserRoles, hasAnyRole } from './chunk-UJAJO5QJ.js';
+import { authApi } from './chunk-ETKDIPD2.js';
+import { getUserRoles, hasAnyRole } from './chunk-2CYGQUUY.js';
 
 // src/core/guards.ts
 function isMfaChallengeResponse(response) {
@@ -59,7 +59,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false && !isMfaChallengeResponse(response)) {
       try {
-        const { authStore } = await import('./auth.svelte-PT27BLWR.js');
+        const { authStore } = await import('./auth.svelte-T4LKTTDZ.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,
@@ -245,7 +245,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false) {
       try {
-        const { authStore } = await import('./auth.svelte-PT27BLWR.js');
+        const { authStore } = await import('./auth.svelte-T4LKTTDZ.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,

package/dist/{chunk-SUW4DKKS.js → chunk-ETKDIPD2.js}

@@ -1,4 +1,4 @@
-import { getConfig, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-UJAJO5QJ.js';
+import { getConfig, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-2CYGQUUY.js';
 
 // src/core/client.ts
 var DEFAULT_REFRESH_RETRY_DELAYS = [1e3, 3e3];
@@ -58,7 +58,7 @@ function writeStoredTokens(accessToken, refreshToken) {
 }
 async function syncSvelteStore(apply) {
   try {
-    const { authStore } = await import('./auth.svelte-PT27BLWR.js');
+    const { authStore } = await import('./auth.svelte-T4LKTTDZ.js');
     apply(authStore);
   } catch {
   }

package/dist/{chunk-LA5DFBWP.js → chunk-KSOYQYUZ.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-SUW4DKKS.js';
-import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-UJAJO5QJ.js';
+import { authApi } from './chunk-ETKDIPD2.js';
+import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-2CYGQUUY.js';
 
 // src/svelte/stores/auth.svelte.ts
 var STORAGE_VERSION = 2;

package/dist/{chunk-SY6DG527.js → chunk-NLG6NSE4.js}

@@ -1,6 +1,6 @@
-import { authService } from './chunk-2LRLMSOH.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-LA5DFBWP.js';
-import { isInitialized, initAuth, getUserRoles } from './chunk-UJAJO5QJ.js';
+import { authService } from './chunk-DFCBWKCU.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-KSOYQYUZ.js';
+import { isInitialized, initAuth, getUserRoles } from './chunk-2CYGQUUY.js';
 
 // src/svelte/guards/auth-guard.ts
 function checkAuth(options = {}) {

package/dist/core/index.d.ts

@@ -532,7 +532,9 @@ declare function extractClaims<T extends string>(token: string, claims: T[]): Pi
  * `<department>_staff` roles are grant-on-top docs roles held alongside another
  * role, one per department the API lists in `DEPARTMENT_SCOPES`;
  * `hotsheet_editor` is a grant-on-top role for the Hotsheet hub's write
- * surface; `employee` is the read-only base staff
+ * surface; `office_admin` is a grant-on-top role for the office
+ * administrative assistant (home closing & financing fields, permits, walks,
+ * lenders); `employee` is the read-only base staff
  * floor (default for Authentik SSO); `vendor`/`customer`/`subcontractor` are
  * clones of `user`, row-scoped to their own homes.
  *
@@ -540,7 +542,7 @@ declare function extractClaims<T extends string>(token: string, claims: T[]): Pi
  * field app's clone of `agent`, the second is that department's docs role.
  * Someone on the stormwater team who also reads the docs holds both.
  */
-declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "stormwater", "accounting_staff", "architecture_staff", "construction_staff", "crl_staff", "design_staff", "hr_staff", "it_staff", "landdev_staff", "marketing_staff", "purchasing_staff", "sales_staff", "stormwater_staff", "warranty_staff", "hotsheet_editor", "employee", "user", "vendor", "customer", "subcontractor", "guest"];
+declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "stormwater", "accounting_staff", "architecture_staff", "construction_staff", "crl_staff", "design_staff", "hr_staff", "it_staff", "landdev_staff", "marketing_staff", "purchasing_staff", "sales_staff", "stormwater_staff", "warranty_staff", "hotsheet_editor", "office_admin", "employee", "user", "vendor", "customer", "subcontractor", "guest"];
 /**
  * A known role name.
  *

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-2LRLMSOH.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from '../chunk-SUW4DKKS.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-UJAJO5QJ.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-DFCBWKCU.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from '../chunk-ETKDIPD2.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-2CYGQUUY.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-SY6DG527.js';
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-2LRLMSOH.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-LA5DFBWP.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from './chunk-SUW4DKKS.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-UJAJO5QJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-NLG6NSE4.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-DFCBWKCU.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-KSOYQYUZ.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from './chunk-ETKDIPD2.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-2CYGQUUY.js';

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-SY6DG527.js';
-export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-2LRLMSOH.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-LA5DFBWP.js';
-import '../chunk-SUW4DKKS.js';
-export { initAuth, isInitialized } from '../chunk-UJAJO5QJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-NLG6NSE4.js';
+export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-DFCBWKCU.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-KSOYQYUZ.js';
+import '../chunk-ETKDIPD2.js';
+export { initAuth, isInitialized } from '../chunk-2CYGQUUY.js';

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-UJAJO5QJ.js';
+import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-2CYGQUUY.js';
 
 // src/testing/fixtures/users.ts
 var mockUser = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.22.2",
+  "version": "1.23.0",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",

package/dist/auth.svelte-PT27BLWR.js

@@ -1,3 +0,0 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-LA5DFBWP.js';
-import './chunk-SUW4DKKS.js';
-import './chunk-UJAJO5QJ.js';