@classic-homes/auth 1.45.0 → 1.46.0

package/README.md

@@ -364,6 +364,13 @@ until installed and do nothing on the server.
   `has*`, `checkAuth` (`source: 'route'`), `filterByAccess`/`canAccess`
   (`'nav'`) and API 403s (`'http'`, path only, never the query string).
   Each event carries the requirement, `allowed` and what was `missing`.
+- While a probe is installed, requests to the API origin (never other hosts)
+  send `X-Access-Debug: 1`. CHAPI answers admin sessions with
+  `X-Access-Redacted: taxId=vendors:read:sensitive, notes=*`, reported as an
+  informational `source: 'redacted'` event (`allowed: true`, path only) with
+  `fields: { name, permission }[]`; `*` means no permission is configured
+  (default-deny). It reflects the real token, never "view as". No header, no
+  event. The custom header makes cross-origin API requests preflighted.
 - `setAccessSubject(userId, { roles, permissions })` previews the UI as another
   role set ("view as") for that user only. Checks for other users are
   unaffected, `authStore.user` is never changed, and the preview ends on any

package/dist/auth.svelte-IWSWWF6U.js

@@ -0,0 +1,3 @@
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-Q4Q3CJVC.js';
+import './chunk-7SFVHDFP.js';
+import './chunk-EFS272S3.js';

package/dist/{chunk-ADCPJOPQ.js → chunk-7SFVHDFP.js}

@@ -1,4 +1,4 @@
-import { isInitialized, getConfig, getUserRoles, clearAccessSubject, getStorage, isTokenExpired, getFetch, isAccessProbeActive, isValidRedirectUrl, requirementFromDenial, reportAccess, decodeJWT } from './chunk-5X6E5MZG.js';
+import { isInitialized, getConfig, getUserRoles, clearAccessSubject, getStorage, isTokenExpired, getFetch, isAccessProbeActive, isValidRedirectUrl, ACCESS_DEBUG_HEADER, ACCESS_REDACTED_HEADER, ACCESS_REDACTED_TRUNCATED_HEADER, parseRedactedHeader, reportAccess, requirementFromDenial, decodeJWT } from './chunk-EFS272S3.js';
 
 // src/core/sso-state.ts
 var SSO_CLIENT_STATE_PARAM = "client_state";
@@ -236,7 +236,7 @@ function writeStoredTokens(accessToken, refreshToken) {
 }
 async function syncSvelteStore(apply) {
   try {
-    const { authStore } = await import('./auth.svelte-AN7ZNZ2W.js');
+    const { authStore } = await import('./auth.svelte-IWSWWF6U.js');
     apply(authStore);
   } catch {
   }
@@ -392,12 +392,46 @@ function isApiOrigin(url, baseUrl) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function reportForbidden(method, endpoint, code, details) {
+function probePath(endpoint) {
   let path = endpoint.split(/[?#]/, 1)[0];
   try {
     if (/^https?:\/\//i.test(path)) path = new URL(path).pathname;
   } catch {
   }
+  return path;
+}
+function reportRedacted(method, endpoint, response) {
+  let header;
+  let truncated;
+  try {
+    header = response.headers.get(ACCESS_REDACTED_HEADER);
+    truncated = response.headers.get(ACCESS_REDACTED_TRUNCATED_HEADER);
+  } catch {
+    return;
+  }
+  const { fields, omitted } = parseRedactedHeader(header);
+  if (fields.length === 0) return;
+  const serverOmitted = Number.parseInt(truncated ?? "", 10);
+  const fieldsOmitted = omitted + (Number.isFinite(serverOmitted) && serverOmitted > 0 ? Math.min(serverOmitted, 1e6) : 0);
+  const permissions = [...new Set(fields.map((f) => f.permission).filter((p) => p !== "*"))];
+  const path = probePath(endpoint);
+  reportAccess({
+    source: "redacted",
+    requirement: permissions.length ? { permissions } : {},
+    // Informational: the request succeeded, the fields say what was withheld.
+    allowed: true,
+    missing: { roles: [], permissions: [] },
+    // The server redacted for the real token, never the "view as" preview.
+    subjectId: null,
+    simulated: false,
+    label: `${method} ${path}`,
+    http: { method, endpoint: path, status: response.status },
+    fields,
+    ...fieldsOmitted > 0 && { fieldsOmitted }
+  });
+}
+function reportForbidden(method, endpoint, code, details) {
+  const path = probePath(endpoint);
   const requirement = requirementFromDenial(code, details) ?? {};
   reportAccess({
     source: "http",
@@ -465,6 +499,8 @@ async function apiRequestInternal(endpoint, options, isRetry, startedIn) {
     "Content-Type": "application/json",
     ...fetchOptions.headers
   };
+  const accessDebug = isAccessProbeActive() && (!isAbsolute || isApiOrigin(url, config.baseUrl));
+  if (accessDebug) headers[ACCESS_DEBUG_HEADER] = "1";
   if (authenticated) {
     const accessToken = getAccessToken();
     const sessionToken = getSessionToken();
@@ -498,6 +534,9 @@ async function apiRequestInternal(endpoint, options, isRetry, startedIn) {
       }
       throw new Error("Authentication service unavailable. Please try again.");
     }
+    if (accessDebug && isAccessProbeActive()) {
+      reportRedacted((fetchOptions.method ?? "GET").toUpperCase(), endpoint, response);
+    }
     let data;
     const contentType = response.headers.get("content-type");
     if (contentType?.includes("application/json")) {

package/dist/{chunk-42EO3FSU.js → chunk-BGQVBSXN.js}

@@ -1,5 +1,5 @@
-import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-ADCPJOPQ.js';
-import { getUserRoles } from './chunk-5X6E5MZG.js';
+import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-7SFVHDFP.js';
+import { getUserRoles } from './chunk-EFS272S3.js';
 
 // src/core/guards.ts
 function isMfaChallengeResponse(response) {
@@ -19,7 +19,7 @@ function getAvailableMethods(response) {
 async function setStoreAuth(response) {
   let store;
   try {
-    store = (await import('./auth.svelte-AN7ZNZ2W.js')).authStore;
+    store = (await import('./auth.svelte-IWSWWF6U.js')).authStore;
   } catch {
     return;
   }

package/dist/{chunk-5X6E5MZG.js → chunk-EFS272S3.js}

@@ -287,6 +287,26 @@ function requirementFromDenial(code, details) {
   const requireAll = mode === "any" ? false : mode === "all" ? true : isPermission;
   return isPermission ? { permissions: list, requireAllPermissions: requireAll } : { roles: list, requireAllRoles: requireAll };
 }
+var ACCESS_DEBUG_HEADER = "X-Access-Debug";
+var ACCESS_REDACTED_HEADER = "X-Access-Redacted";
+var ACCESS_REDACTED_TRUNCATED_HEADER = "X-Access-Redacted-Truncated";
+var MAX_REDACTED_FIELDS = 100;
+var MAX_REDACTED_HEADER = 16384;
+var REDACTED_ENTRY = /^([A-Za-z0-9_.:*-]{1,128})=([A-Za-z0-9_.:*-]{1,128})$/;
+function parseRedactedHeader(value) {
+  const fields = [];
+  let omitted = 0;
+  if (!value) return { fields, omitted };
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of value.slice(0, MAX_REDACTED_HEADER).split(",")) {
+    const match = REDACTED_ENTRY.exec(raw.trim());
+    if (!match || seen.has(match[1])) continue;
+    seen.add(match[1]);
+    if (fields.length >= MAX_REDACTED_FIELDS) omitted += 1;
+    else fields.push({ name: match[1], permission: match[2] });
+  }
+  return { fields, omitted };
+}
 
 // src/core/roles.ts
 var ROLE_NAMES = [
@@ -387,4 +407,4 @@ function hasAllRoles(user, roles) {
   return allowed;
 }
 
-export { ROLE_HIERARCHY, ROLE_NAMES, clearAccessSubject, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, getAccessSubjectOverride, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isAccessProbeActive, isInitialized, isTokenExpired, isValidRedirectUrl, isValidSSOLogoutUrl, onAccessSubjectChange, reportAccess, reportDecision, requirementFromDenial, resetConfig, setAccessProbe, setAccessSubject };
+export { ACCESS_DEBUG_HEADER, ACCESS_REDACTED_HEADER, ACCESS_REDACTED_TRUNCATED_HEADER, ROLE_HIERARCHY, ROLE_NAMES, clearAccessSubject, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, getAccessSubjectOverride, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isAccessProbeActive, isInitialized, isTokenExpired, isValidRedirectUrl, isValidSSOLogoutUrl, onAccessSubjectChange, parseRedactedHeader, reportAccess, reportDecision, requirementFromDenial, resetConfig, setAccessProbe, setAccessSubject };

package/dist/{chunk-W2ASN4NE.js → chunk-Q4Q3CJVC.js}

@@ -1,5 +1,5 @@
-import { InvalidAuthResponseError, bumpSessionGeneration, authApi } from './chunk-ADCPJOPQ.js';
-import { onAccessSubjectChange, isInitialized, getConfig, isValidSSOLogoutUrl, hasRole, hasAnyRole, hasAllRoles, effectiveSubject, reportDecision, decodeJWT, getStorage, getDefaultStorage } from './chunk-5X6E5MZG.js';
+import { InvalidAuthResponseError, bumpSessionGeneration, authApi } from './chunk-7SFVHDFP.js';
+import { onAccessSubjectChange, isInitialized, getConfig, isValidSSOLogoutUrl, hasRole, hasAnyRole, hasAllRoles, effectiveSubject, reportDecision, decodeJWT, getStorage, getDefaultStorage } from './chunk-EFS272S3.js';
 
 // src/svelte/stores/auth.svelte.ts
 var STORAGE_VERSION = 2;

package/dist/{chunk-J2WAFXA6.js → chunk-TJRFP24M.js}

@@ -1,6 +1,6 @@
-import { authService } from './chunk-42EO3FSU.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-W2ASN4NE.js';
-import { evaluateAccess, effectiveSubject, isAccessProbeActive, reportDecision, isInitialized, initAuth } from './chunk-5X6E5MZG.js';
+import { authService } from './chunk-BGQVBSXN.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-Q4Q3CJVC.js';
+import { evaluateAccess, effectiveSubject, isAccessProbeActive, reportDecision, isInitialized, initAuth } from './chunk-EFS272S3.js';
 
 // src/svelte/guards/auth-guard.ts
 function checkAuth(options = {}) {

package/dist/core/index.d.ts

@@ -762,7 +762,18 @@ type AccessCheckSource =
 /** A 403 from the API. */
  | 'http'
 /** A UI element (the inspector's own `RequireAccess` / `requires`). */
- | 'element';
+ | 'element'
+/**
+ * Fields the API left out of a response (`X-Access-Redacted`). Informational,
+ * not a denial: `allowed` is true and `missing` is empty; see `fields`.
+ */
+ | 'redacted';
+/** A top-level response field the API withheld, and the permission that would reveal it. */
+interface RedactedField {
+    name: string;
+    /** `*` = the field has no permission configured and is dropped by default-deny. */
+    permission: string;
+}
 interface AccessCheckEvent extends AccessEvaluation {
     source: AccessCheckSource;
     requirement: AccessRequirement;
@@ -772,13 +783,17 @@ interface AccessCheckEvent extends AccessEvaluation {
     simulated: boolean;
     /** Human-readable context: a nav item id/href, or `METHOD /path` for HTTP. */
     label?: string;
-    /** Present for `http` events. */
+    /** Present for `http` and `redacted` events. */
     http?: {
         method: string;
         endpoint: string;
         status: number;
         code?: string;
     };
+    /** Present for `redacted` events: the withheld fields, in the order the server listed them. */
+    fields?: RedactedField[];
+    /** `redacted` events: entries the server (or the parser's cap) left out of `fields`. */
+    fieldsOmitted?: number;
 }
 type AccessProbe = (event: AccessCheckEvent) => void;
 type SubjectUser = {
@@ -835,5 +850,21 @@ declare function reportDecision(source: AccessCheckSource, user: SubjectUser | n
  * optional `mode: 'any' | 'all'` overrides the defaults (permissions: all).
  */
 declare function requirementFromDenial(code: string | undefined, details: unknown): AccessRequirement | null;
+/** Request header asking CHAPI to say which fields it redacted (admin sessions only). */
+declare const ACCESS_DEBUG_HEADER = "X-Access-Debug";
+/** Response header: `name=permission` entries joined by `", "`. */
+declare const ACCESS_REDACTED_HEADER = "X-Access-Redacted";
+/** Response header: how many entries the server left out of {@link ACCESS_REDACTED_HEADER}. */
+declare const ACCESS_REDACTED_TRUNCATED_HEADER = "X-Access-Redacted-Truncated";
+/**
+ * Parse an `X-Access-Redacted` value (`taxId=vendors:read:sensitive, notes=*`).
+ * Malformed entries are skipped, a repeated name keeps its first permission,
+ * and at most 100 fields are kept; `omitted` counts the valid ones dropped by
+ * that cap. A missing or empty header yields no fields.
+ */
+declare function parseRedactedHeader(value: string | null | undefined): {
+    fields: RedactedField[];
+    omitted: number;
+};
 
-export { type AccessCheckEvent, type AccessCheckSource, type AccessEvaluation, type AccessProbe, type AccessRequirement, type AccessSubject, ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFAChallengeEmailResponse, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, type RefreshOutcome, type RefreshSessionOptions, RegisterData, RegisterResponse, type RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SecurityEvent, Session, type SsoClientStateResult, type SsoClientStateVerification, UpdateApiKeyRequest, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearAccessSubject, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, extractData, getAccessSubjectOverride, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isAccessProbeActive, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, onAccessSubjectChange, refreshSession, reportAccess, reportDecision, requirementFromDenial, setAccessProbe, setAccessSubject, updateStoredTokens, verifySsoClientState };
+export { ACCESS_DEBUG_HEADER, ACCESS_REDACTED_HEADER, ACCESS_REDACTED_TRUNCATED_HEADER, type AccessCheckEvent, type AccessCheckSource, type AccessEvaluation, type AccessProbe, type AccessRequirement, type AccessSubject, ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFAChallengeEmailResponse, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, type RedactedField, type RefreshOutcome, type RefreshSessionOptions, RegisterData, RegisterResponse, type RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SecurityEvent, Session, type SsoClientStateResult, type SsoClientStateVerification, UpdateApiKeyRequest, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearAccessSubject, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, extractData, getAccessSubjectOverride, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isAccessProbeActive, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, onAccessSubjectChange, parseRedactedHeader, refreshSession, reportAccess, reportDecision, requirementFromDenial, setAccessProbe, setAccessSubject, updateStoredTokens, verifySsoClientState };

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-42EO3FSU.js';
-export { ApiError, InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isApiError, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from '../chunk-ADCPJOPQ.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, clearAccessSubject, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, getAccessSubjectOverride, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isAccessProbeActive, isInitialized, isTokenExpired, onAccessSubjectChange, reportAccess, reportDecision, requirementFromDenial, resetConfig, setAccessProbe, setAccessSubject } from '../chunk-5X6E5MZG.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-BGQVBSXN.js';
+export { ApiError, InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isApiError, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from '../chunk-7SFVHDFP.js';
+export { ACCESS_DEBUG_HEADER, ACCESS_REDACTED_HEADER, ACCESS_REDACTED_TRUNCATED_HEADER, ROLE_HIERARCHY, ROLE_NAMES, clearAccessSubject, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, getAccessSubjectOverride, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isAccessProbeActive, isInitialized, isTokenExpired, onAccessSubjectChange, parseRedactedHeader, reportAccess, reportDecision, requirementFromDenial, resetConfig, setAccessProbe, setAccessSubject } from '../chunk-EFS272S3.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
 export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFAChallengeEmailResponse, i as MFASetupResponse, j as MFAStatus, P as Pagination, k as ProfileUpdateData, R as RegisterData, l as RegisterResponse, m as ResetPasswordData, S as SSOConfig, n as SecurityEvent, o as Session, p as StorageAdapter, U as UpdateApiKeyRequest, q as User, r as UserPreferences, s as UserRolesResponse, t as createMemoryStorage, u as createSessionStorage, v as getConfig, w as getDefaultStorage, x as getFetch, y as getStorage, z as initAuth, B as isInitialized, E as resetConfig } from './types-DF5Ny2IA.js';
-export { AccessCheckEvent, AccessCheckSource, AccessEvaluation, AccessProbe, AccessRequirement, AccessSubject, ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RefreshOutcome, RefreshSessionOptions, RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SsoClientStateResult, SsoClientStateVerification, api, apiRequest, authApi, clearAccessSubject, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, extractData, getAccessSubjectOverride, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isAccessProbeActive, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, onAccessSubjectChange, refreshSession, reportAccess, reportDecision, requirementFromDenial, setAccessProbe, setAccessSubject, updateStoredTokens, verifySsoClientState } from './core/index.js';
+export { ACCESS_DEBUG_HEADER, ACCESS_REDACTED_HEADER, ACCESS_REDACTED_TRUNCATED_HEADER, AccessCheckEvent, AccessCheckSource, AccessEvaluation, AccessProbe, AccessRequirement, AccessSubject, ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RedactedField, RefreshOutcome, RefreshSessionOptions, RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SsoClientStateResult, SsoClientStateVerification, api, apiRequest, authApi, clearAccessSubject, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, extractData, getAccessSubjectOverride, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isAccessProbeActive, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, onAccessSubjectChange, parseRedactedHeader, refreshSession, reportAccess, reportDecision, requirementFromDenial, setAccessProbe, setAccessSubject, updateStoredTokens, verifySsoClientState } from './core/index.js';
 export { A as ApiError, a as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, b as MFAVerifyOptions, R as RoleDeniedError, S as SessionChangedError, c as authService, f as formatUserRoles, g as getAvatarFallback, d as getDisplayName, e as getGreeting, h as getUserEmail, i as getUserInitials, j as isApiError, k as isRoleDeniedError, l as isSessionChangedError } from './user-utils-DYyljbJR.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-J2WAFXA6.js';
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-42EO3FSU.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-W2ASN4NE.js';
-export { ApiError, InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isApiError, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from './chunk-ADCPJOPQ.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, clearAccessSubject, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, getAccessSubjectOverride, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isAccessProbeActive, isInitialized, isTokenExpired, onAccessSubjectChange, reportAccess, reportDecision, requirementFromDenial, resetConfig, setAccessProbe, setAccessSubject } from './chunk-5X6E5MZG.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-TJRFP24M.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-BGQVBSXN.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-Q4Q3CJVC.js';
+export { ApiError, InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isApiError, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from './chunk-7SFVHDFP.js';
+export { ACCESS_DEBUG_HEADER, ACCESS_REDACTED_HEADER, ACCESS_REDACTED_TRUNCATED_HEADER, ROLE_HIERARCHY, ROLE_NAMES, clearAccessSubject, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, effectiveSubject, evaluateAccess, extractClaims, getAccessSubjectOverride, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isAccessProbeActive, isInitialized, isTokenExpired, onAccessSubjectChange, parseRedactedHeader, reportAccess, reportDecision, requirementFromDenial, resetConfig, setAccessProbe, setAccessSubject } from './chunk-EFS272S3.js';

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-J2WAFXA6.js';
-export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-42EO3FSU.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-W2ASN4NE.js';
-export { InvalidAuthResponseError, RoleDeniedError, SessionChangedError, isRoleDeniedError, isSessionChangedError } from '../chunk-ADCPJOPQ.js';
-export { initAuth, isInitialized } from '../chunk-5X6E5MZG.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-TJRFP24M.js';
+export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-BGQVBSXN.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-Q4Q3CJVC.js';
+export { InvalidAuthResponseError, RoleDeniedError, SessionChangedError, isRoleDeniedError, isSessionChangedError } from '../chunk-7SFVHDFP.js';
+export { initAuth, isInitialized } from '../chunk-EFS272S3.js';

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-5X6E5MZG.js';
+import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-EFS272S3.js';
 
 // src/testing/fixtures/users.ts
 var mockUser = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.45.0",
+  "version": "1.46.0",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",

package/dist/auth.svelte-AN7ZNZ2W.js

@@ -1,3 +0,0 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-W2ASN4NE.js';
-import './chunk-ADCPJOPQ.js';
-import './chunk-5X6E5MZG.js';