@classic-homes/auth 1.8.0 → 1.14.0

package/README.md

@@ -270,6 +270,34 @@ Two server rules to design around:
 - The server refuses to remove a user's **last** role, or to grant a role at or
   above the acting user's own level. Both come back as errors.
 
+## Token refresh
+
+Access tokens are short-lived and refresh tokens rotate (single-use), so a
+refresh must never run twice for the same token. `refreshSession()` is the one
+refresh path — the client's own 401 retry uses it, and so should any code that
+refreshes proactively:
+
+```typescript
+import { refreshSession } from '@classic-homes/auth/core';
+
+// Before a route guard reads claims (roles/permissions live in the JWT):
+const outcome = await refreshSession({ onlyIfExpired: true });
+// 'fresh'       — token still valid, nothing sent
+// 'refreshed'   — tokens stored and the Svelte store already updated
+// 'rejected'    — session cleared (handleSessionExpired/onSessionExpired/onLogout ran)
+// 'unavailable' — server unreachable/5xx even after retries; session kept, try later
+```
+
+Guarantees: single-flight per tab (concurrent callers share one call),
+serialized across tabs with a Web Lock and reconciled if another tab rotated
+first, and transient failures retried with `refreshRetryDelays` backoff
+(default `[1000, 3000]`). Do not call `authApi.refreshToken` + `updateStoredTokens`
+yourself for this — that bypasses all of the above and can orphan a rotated
+token.
+
+Call `initCrossTabSync()` once at app start so a refresh or sign-out in another
+tab rehydrates this tab's Svelte store.
+
 ## API Reference
 
 ### Core Exports

package/dist/auth.svelte-AIRJEWTG.js

@@ -0,0 +1,3 @@
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-XWJ54R6J.js';
+import './chunk-4SLNFY2N.js';
+import './chunk-PYCXNOMA.js';

package/dist/{chunk-QTX7L4QY.js → chunk-2IEYKV42.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-HVOZBQIF.js';
-import { getUserRoles, hasAnyRole } from './chunk-X7KH4DDN.js';
+import { authApi } from './chunk-4SLNFY2N.js';
+import { getUserRoles, hasAnyRole } from './chunk-PYCXNOMA.js';
 
 // src/core/guards.ts
 function isMfaChallengeResponse(response) {
@@ -59,7 +59,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false && !isMfaChallengeResponse(response)) {
       try {
-        const { authStore } = await import('./auth.svelte-FIHKI5BD.js');
+        const { authStore } = await import('./auth.svelte-AIRJEWTG.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,
@@ -245,7 +245,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false) {
       try {
-        const { authStore } = await import('./auth.svelte-FIHKI5BD.js');
+        const { authStore } = await import('./auth.svelte-AIRJEWTG.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,

package/dist/{chunk-HVOZBQIF.js → chunk-4SLNFY2N.js}

@@ -1,36 +1,9 @@
-import { getConfig, getStorage, getFetch, isValidRedirectUrl } from './chunk-X7KH4DDN.js';
+import { getConfig, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-PYCXNOMA.js';
 
 // src/core/client.ts
-var isRefreshing = false;
-var refreshSubscribers = [];
-var MAX_REFRESH_SUBSCRIBERS = 100;
-function subscribeTokenRefresh(cb) {
-  if (refreshSubscribers.length >= MAX_REFRESH_SUBSCRIBERS) {
-    throw new Error("Too many concurrent requests waiting for token refresh. Please try again.");
-  }
-  refreshSubscribers.push(cb);
-  return () => {
-    const idx = refreshSubscribers.indexOf(cb);
-    if (idx > -1) refreshSubscribers.splice(idx, 1);
-  };
-}
-function flushRefreshSubscribers(token, terminal = false) {
-  const subs = refreshSubscribers;
-  refreshSubscribers = [];
-  subs.forEach((cb) => {
-    try {
-      cb(token, terminal);
-    } catch (e) {
-      console.error("Token refresh subscriber error:", e);
-    }
-  });
-}
-function onTokenRefreshed(token) {
-  flushRefreshSubscribers(token);
-}
-function onTokenRefreshFailed(terminal) {
-  flushRefreshSubscribers(null, terminal);
-}
+var DEFAULT_REFRESH_RETRY_DELAYS = [1e3, 3e3];
+var refreshInflight = null;
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 function getAccessToken() {
   const config = getConfig();
   const storage = getStorage();
@@ -65,6 +38,9 @@ function getSessionToken() {
   return storage.getItem(getSessionTokenKey());
 }
 function updateStoredTokens(accessToken, refreshToken) {
+  void writeStoredTokens(accessToken, refreshToken);
+}
+function writeStoredTokens(accessToken, refreshToken) {
   const config = getConfig();
   const storage = getStorage();
   const storageKey = config.storageKey ?? "classic_auth";
@@ -77,11 +53,15 @@ function updateStoredTokens(accessToken, refreshToken) {
   parsed.accessToken = accessToken;
   parsed.refreshToken = refreshToken;
   storage.setItem(storageKey, JSON.stringify(parsed));
-  import('./auth.svelte-FIHKI5BD.js').then(({ authStore }) => {
-    authStore.updateTokens(accessToken, refreshToken);
-  }).catch(() => {
-  });
   config.onTokenRefresh?.({ accessToken, refreshToken });
+  return syncSvelteStore((authStore) => authStore.updateTokens(accessToken, refreshToken));
+}
+async function syncSvelteStore(apply) {
+  try {
+    const { authStore } = await import('./auth.svelte-AIRJEWTG.js');
+    apply(authStore);
+  } catch {
+  }
 }
 function clearStoredAuth() {
   const config = getConfig();
@@ -91,20 +71,12 @@ function clearStoredAuth() {
 }
 async function expireSession() {
   clearStoredAuth();
-  try {
-    const { authStore } = await import('./auth.svelte-FIHKI5BD.js');
-    authStore.handleSessionExpired();
-  } catch {
-  }
+  await syncSvelteStore((authStore) => authStore.handleSessionExpired());
   getConfig().onLogout?.();
 }
-async function refreshAccessToken() {
-  const refreshToken = getRefreshToken();
+async function refreshOnce(refreshToken) {
   const config = getConfig();
   const fetchFn = getFetch();
-  if (!refreshToken) {
-    return "rejected";
-  }
   const timeoutMs = config.requestTimeout ?? 3e4;
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
@@ -119,41 +91,94 @@ async function refreshAccessToken() {
     });
     if (response.ok) {
       let apiResponse;
-      const contentType = response.headers.get("content-type");
-      if (contentType?.includes("application/json")) {
-        try {
-          apiResponse = await response.json();
-        } catch {
-          return "unavailable";
-        }
-      } else {
-        try {
-          apiResponse = await response.json();
-        } catch {
-          return "unavailable";
-        }
+      try {
+        apiResponse = await response.json();
+      } catch {
+        return { outcome: "unavailable" };
       }
       const data = apiResponse?.data;
       const tokens = data && typeof data === "object" && "data" in data ? data.data : data;
-      if (tokens?.accessToken) {
-        const newRefreshToken = tokens.refreshToken ?? refreshToken;
-        updateStoredTokens(tokens.accessToken, newRefreshToken);
-        onTokenRefreshed(tokens.accessToken);
-        return "refreshed";
+      if (typeof tokens?.accessToken === "string" && tokens.accessToken) {
+        return {
+          outcome: "refreshed",
+          accessToken: tokens.accessToken,
+          refreshToken: typeof tokens.refreshToken === "string" && tokens.refreshToken ? tokens.refreshToken : refreshToken
+        };
       }
-      return "unavailable";
+      return { outcome: "unavailable" };
     }
-    if (response.status >= 500) {
-      return "unavailable";
+    if (response.status >= 500 || response.status === 429 || response.status === 408) {
+      return { outcome: "unavailable" };
     }
-    return "rejected";
+    return { outcome: "rejected" };
   } catch (error) {
     config.onAuthError?.(error instanceof Error ? error : new Error("Token refresh failed"));
-    return "unavailable";
+    return { outcome: "unavailable" };
   } finally {
     clearTimeout(timeoutId);
   }
 }
+function withRefreshLock(fn) {
+  const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+  if (!locks) return fn();
+  const storageKey = getConfig().storageKey ?? "classic_auth";
+  return locks.request(`${storageKey}:refresh`, fn);
+}
+function refreshSession(options = {}) {
+  if (options.onlyIfExpired) {
+    const accessToken = getAccessToken();
+    if (accessToken && !isTokenExpired(accessToken)) return Promise.resolve("fresh");
+  }
+  if (!refreshInflight) {
+    refreshInflight = runRefresh(options).finally(() => {
+      refreshInflight = null;
+    });
+  }
+  return refreshInflight;
+}
+async function runRefresh(options) {
+  const presented = getRefreshToken();
+  if (!presented) {
+    await expireSession();
+    return "rejected";
+  }
+  return withRefreshLock(async () => {
+    const current = getRefreshToken();
+    if (current !== presented) {
+      if (!current) {
+        await expireSession();
+        return "rejected";
+      }
+      await syncSvelteStore((authStore) => authStore.rehydrate());
+      return "refreshed";
+    }
+    if (options.onlyIfExpired) {
+      const accessToken = getAccessToken();
+      if (accessToken && !isTokenExpired(accessToken)) return "fresh";
+    }
+    const delays = getConfig().refreshRetryDelays ?? DEFAULT_REFRESH_RETRY_DELAYS;
+    let attempt = await refreshOnce(current);
+    for (const delay of delays) {
+      if (attempt.outcome !== "unavailable") break;
+      await sleep(delay);
+      attempt = await refreshOnce(current);
+    }
+    if (attempt.outcome === "refreshed") {
+      await writeStoredTokens(attempt.accessToken, attempt.refreshToken);
+      return "refreshed";
+    }
+    if (attempt.outcome === "rejected") {
+      const stored = getRefreshToken();
+      if (stored && stored !== current) {
+        await syncSvelteStore((authStore) => authStore.rehydrate());
+        return "refreshed";
+      }
+      await expireSession();
+      return "rejected";
+    }
+    return "unavailable";
+  });
+}
 function extractData(response) {
   if (response && typeof response === "object" && "data" in response) {
     const dataField = response.data;
@@ -211,61 +236,14 @@ async function apiRequestInternal(endpoint, options, isRetry) {
         await expireSession();
         throw new Error("Authentication failed. Please sign in again.");
       }
-      if (!isRefreshing) {
-        isRefreshing = true;
-        let refreshResult = "unavailable";
-        try {
-          refreshResult = await refreshAccessToken();
-        } finally {
-          isRefreshing = false;
-        }
-        if (refreshResult === "refreshed") {
-          return apiRequestInternal(endpoint, options, true);
-        }
-        if (refreshResult === "rejected") {
-          onTokenRefreshFailed(true);
-          await expireSession();
-          throw new Error("Authentication failed. Please sign in again.");
-        }
-        onTokenRefreshFailed(false);
-        throw new Error("Authentication service unavailable. Please try again.");
-      } else {
-        const REFRESH_TIMEOUT_MS = 3e4;
-        return new Promise((resolve, reject) => {
-          let settled = false;
-          const refreshTimeoutId = setTimeout(() => {
-            if (!settled) {
-              settled = true;
-              unsubscribe?.();
-              reject(new Error("Token refresh timed out. Please sign in again."));
-            }
-          }, REFRESH_TIMEOUT_MS);
-          let unsubscribe = null;
-          try {
-            unsubscribe = subscribeTokenRefresh((token, terminal) => {
-              if (!settled) {
-                settled = true;
-                clearTimeout(refreshTimeoutId);
-                if (token) {
-                  apiRequestInternal(endpoint, options, true).then(resolve).catch(reject);
-                } else {
-                  reject(
-                    new Error(
-                      terminal ? "Authentication failed. Please sign in again." : "Authentication service unavailable. Please try again."
-                    )
-                  );
-                }
-              }
-            });
-          } catch (subscribeError) {
-            clearTimeout(refreshTimeoutId);
-            if (!settled) {
-              settled = true;
-              reject(subscribeError);
-            }
-          }
-        });
+      const outcome = await refreshSession();
+      if (outcome === "refreshed") {
+        return apiRequestInternal(endpoint, options, true);
+      }
+      if (outcome === "rejected") {
+        throw new Error("Authentication failed. Please sign in again.");
       }
+      throw new Error("Authentication service unavailable. Please try again.");
     }
     let data;
     const contentType = response.headers.get("content-type");
@@ -320,6 +298,18 @@ async function apiRequestInternal(endpoint, options, isRetry) {
     throw new Error("API request failed");
   }
 }
+function initCrossTabSync() {
+  if (typeof window === "undefined") return () => {
+  };
+  const config = getConfig();
+  const storageKey = config.storageKey ?? "classic_auth";
+  function handleStorage(event) {
+    if (event.key !== storageKey) return;
+    void syncSvelteStore((authStore) => authStore.rehydrate());
+  }
+  window.addEventListener("storage", handleStorage);
+  return () => window.removeEventListener("storage", handleStorage);
+}
 var api = {
   get: (endpoint, authenticated = false, customFetch) => apiRequest(endpoint, { method: "GET", authenticated, customFetch }),
   post: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
@@ -830,4 +820,4 @@ var authApi = {
   }
 };
 
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens };
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens };

package/dist/{chunk-X7KH4DDN.js → chunk-PYCXNOMA.js}

@@ -173,6 +173,7 @@ var ROLE_NAMES = [
   "sales_staff",
   "stormwater_staff",
   "warranty_staff",
+  "hotsheet_editor",
   "employee",
   "user",
   "vendor",
@@ -187,7 +188,7 @@ var ROLE_HIERARCHY = {
   customer: 1,
   subcontractor: 1,
   // Staff tier (2): the read-only `employee` floor, the field-app clones of
-  // `agent`, and every `<department>_staff` docs role.
+  // `agent`, every `<department>_staff` docs role, and `hotsheet_editor`.
   employee: 2,
   agent: 2,
   builder: 2,
@@ -207,6 +208,7 @@ var ROLE_HIERARCHY = {
   sales_staff: 2,
   stormwater_staff: 2,
   warranty_staff: 2,
+  hotsheet_editor: 2,
   manager: 3,
   admin: 4
 };

package/dist/{chunk-UGD4PNYI.js → chunk-VLDCDFEN.js}

@@ -1,6 +1,6 @@
-import { authService } from './chunk-QTX7L4QY.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-EBTCVIUQ.js';
-import { isInitialized, initAuth, getUserRoles } from './chunk-X7KH4DDN.js';
+import { authService } from './chunk-2IEYKV42.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-XWJ54R6J.js';
+import { isInitialized, initAuth, getUserRoles } from './chunk-PYCXNOMA.js';
 
 // src/svelte/guards/auth-guard.ts
 function checkAuth(options = {}) {

package/dist/{chunk-EBTCVIUQ.js → chunk-XWJ54R6J.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-HVOZBQIF.js';
-import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-X7KH4DDN.js';
+import { authApi } from './chunk-4SLNFY2N.js';
+import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-PYCXNOMA.js';
 
 // src/svelte/stores/auth.svelte.ts
 var STORAGE_VERSION = 2;

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination, r as UserRolesResponse } from '../types-C6MqT3DB.js';
-export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from '../types-C6MqT3DB.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-Dla77tvM.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination, r as UserRolesResponse } from '../types-Bqh2gkvu.js';
+export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from '../types-Bqh2gkvu.js';
+export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-92PeSjcw.js';
 
 /**
  * HTTP Client
@@ -39,6 +39,26 @@ interface ApiResponse<T = unknown> {
         code?: string;
     };
 }
+/**
+ * Outcome of {@link refreshSession}:
+ * - `refreshed`: the stored tokens are new — either this call refreshed them
+ *   or another tab/caller did while this call waited its turn.
+ * - `fresh`: nothing to do — `onlyIfExpired` was set and the stored access
+ *   token is still valid.
+ * - `rejected`: the server definitively rejected the refresh token (4xx) —
+ *   the session is unrecoverable and has been cleared.
+ * - `unavailable`: the server could not be reached or errored (network
+ *   failure, timeout, 5xx, 429) even after retries — the refresh token may
+ *   still be perfectly good, so the session is kept and the caller can retry.
+ */
+type RefreshOutcome = 'refreshed' | 'fresh' | 'rejected' | 'unavailable';
+interface RefreshSessionOptions {
+    /**
+     * Skip the network call (→ `fresh`) when the stored access token has not
+     * expired yet. Default `false`: refresh unconditionally.
+     */
+    onlyIfExpired?: boolean;
+}
 /**
  * Get the current access token from storage.
  */
@@ -53,18 +73,39 @@ declare function getRefreshToken(): string | null;
 declare function getSessionToken(): string | null;
 /**
  * Update stored tokens.
- * Also updates the Svelte auth store if available.
+ * Also updates the Svelte auth store if available (asynchronously).
  *
- * Note: The read-modify-write on localStorage is not atomic across tabs —
- * concurrent refreshes in two tabs are last-write-wins. The `storage` event
- * listener (set up via `initCrossTabSync`) propagates whichever write landed
- * last, so tabs converge on the same tokens.
+ * Prefer {@link refreshSession} over calling this with tokens obtained from a
+ * hand-rolled `/auth/refresh` call: that path bypasses the single-flight and
+ * cross-tab serialization, so it can race the client's own refresh and
+ * orphan a rotated token.
  */
 declare function updateStoredTokens(accessToken: string, refreshToken: string): void;
 /**
  * Clear stored auth data.
  */
 declare function clearStoredAuth(): void;
+/**
+ * Refresh the session's tokens. The single refresh path for the whole client:
+ *
+ * - **Single-flight per tab.** Concurrent callers (several 401s, a proactive
+ *   refresh before navigation, an upload client) share one in-flight call.
+ * - **Serialized across tabs** via a Web Lock, and reconciled: if another tab
+ *   rotated the token while this call waited, the stored tokens are adopted
+ *   (`refreshed`) instead of re-presenting a token the server has retired.
+ * - **Transient failures retried** with `AuthConfig.refreshRetryDelays`
+ *   backoff, re-presenting the same token (a failed attempt never reached the
+ *   rotation write).
+ * - **Consequences applied here.** `refreshed` → tokens stored and the Svelte
+ *   store updated before this resolves; `rejected` → the session is cleared
+ *   (`handleSessionExpired`, `onSessionExpired`, `onLogout`); `unavailable` →
+ *   the session is left intact for a later retry.
+ *
+ * Apps that refresh proactively (e.g. before a route guard reads claims)
+ * should call this rather than `authApi.refreshToken`, which bypasses all of
+ * the above.
+ */
+declare function refreshSession(options?: RefreshSessionOptions): Promise<RefreshOutcome>;
 /**
  * Helper to extract data from CHAPI response wrapper.
  *
@@ -81,6 +122,17 @@ declare function extractData<T>(response: {
  * Make an API request.
  */
 declare function apiRequest<T = unknown>(endpoint: string, options?: ApiRequestOptions): Promise<T>;
+/**
+ * Set up cross-tab session synchronization via the `storage` event.
+ * When another tab refreshes tokens or signs out, this tab's Svelte store
+ * (when present) is rehydrated from storage so its claims and
+ * `isAuthenticated` follow. Requests already read tokens from storage on
+ * every call, so they pick up the change without this; the store is what
+ * would otherwise go stale.
+ *
+ * Call once during app initialization.
+ */
+declare function initCrossTabSync(): () => void;
 /**
  * Convenience methods for common HTTP methods.
  */
@@ -475,10 +527,12 @@ declare function extractClaims<T extends string>(token: string, claims: T[]): Pi
  * the first match, which is what makes the result deterministic when several
  * roles share a tier (e.g. `agent` + `builder`).
  *
- * Mirrors `ROLE_NAMES` in the API. `builder`/`customer_service`/`demo`/
- * `stormwater` are staff-tier clones of `agent`; the `<department>_staff` roles
- * are grant-on-top docs roles held alongside another role, one per department
- * the API lists in `DEPARTMENT_SCOPES`; `employee` is the read-only base staff
+ * Mirrors `ROLE_NAMES` in the API. `builder`/`customer_service`/`stormwater`
+ * are staff-tier clones of `agent` and `demo` a read-only one; the
+ * `<department>_staff` roles are grant-on-top docs roles held alongside another
+ * role, one per department the API lists in `DEPARTMENT_SCOPES`;
+ * `hotsheet_editor` is a grant-on-top role for the Hotsheet hub's write
+ * surface; `employee` is the read-only base staff
  * floor (default for Authentik SSO); `vendor`/`customer`/`subcontractor` are
  * clones of `user`, row-scoped to their own homes.
  *
@@ -486,7 +540,7 @@ declare function extractClaims<T extends string>(token: string, claims: T[]): Pi
  * field app's clone of `agent`, the second is that department's docs role.
  * Someone on the stormwater team who also reads the docs holds both.
  */
-declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "stormwater", "accounting_staff", "architecture_staff", "construction_staff", "crl_staff", "design_staff", "hr_staff", "it_staff", "landdev_staff", "marketing_staff", "purchasing_staff", "sales_staff", "stormwater_staff", "warranty_staff", "employee", "user", "vendor", "customer", "subcontractor", "guest"];
+declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "stormwater", "accounting_staff", "architecture_staff", "construction_staff", "crl_staff", "design_staff", "hr_staff", "it_staff", "landdev_staff", "marketing_staff", "purchasing_staff", "sales_staff", "stormwater_staff", "warranty_staff", "hotsheet_editor", "employee", "user", "vendor", "customer", "subcontractor", "guest"];
 /**
  * A known role name.
  *
@@ -565,4 +619,4 @@ declare function hasAnyRole(user: Pick<User, 'roles'> | null | undefined, roles:
  */
 declare function hasAllRoles(user: Pick<User, 'roles'> | null | undefined, roles: readonly string[]): boolean;
 
-export { ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, RegisterData, RegisterResponse, type RoleName, SecurityEvent, Session, UpdateApiKeyRequest, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, updateStoredTokens };
+export { ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, type RefreshOutcome, type RefreshSessionOptions, RegisterData, RegisterResponse, type RoleName, SecurityEvent, Session, UpdateApiKeyRequest, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens };

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-QTX7L4QY.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-HVOZBQIF.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-X7KH4DDN.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-2IEYKV42.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from '../chunk-4SLNFY2N.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-PYCXNOMA.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as UpdateApiKeyRequest, p as User, q as UserPreferences, r as UserRolesResponse, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from './types-C6MqT3DB.js';
-export { ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RoleName, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, updateStoredTokens } from './core/index.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-Dla77tvM.js';
+export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as UpdateApiKeyRequest, p as User, q as UserPreferences, r as UserRolesResponse, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from './types-Bqh2gkvu.js';
+export { ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RefreshOutcome, RefreshSessionOptions, RoleName, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens } from './core/index.js';
+export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-92PeSjcw.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-UGD4PNYI.js';
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-QTX7L4QY.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-EBTCVIUQ.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from './chunk-HVOZBQIF.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-X7KH4DDN.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-VLDCDFEN.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-2IEYKV42.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-XWJ54R6J.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from './chunk-4SLNFY2N.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-PYCXNOMA.js';

package/dist/svelte/index.d.ts

@@ -1,7 +1,7 @@
-import { b as AuthState, p as User, a as AuthConfig } from '../types-C6MqT3DB.js';
-export { y as initAuth, z as isInitialized } from '../types-C6MqT3DB.js';
-import { a as authService } from '../user-utils-Dla77tvM.js';
-export { R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-Dla77tvM.js';
+import { b as AuthState, p as User, a as AuthConfig } from '../types-Bqh2gkvu.js';
+export { y as initAuth, z as isInitialized } from '../types-Bqh2gkvu.js';
+import { a as authService } from '../user-utils-92PeSjcw.js';
+export { R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-92PeSjcw.js';
 
 /**
  * Auth Store

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-UGD4PNYI.js';
-export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-QTX7L4QY.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-EBTCVIUQ.js';
-import '../chunk-HVOZBQIF.js';
-export { initAuth, isInitialized } from '../chunk-X7KH4DDN.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-VLDCDFEN.js';
+export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-2IEYKV42.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-XWJ54R6J.js';
+import '../chunk-4SLNFY2N.js';
+export { initAuth, isInitialized } from '../chunk-PYCXNOMA.js';

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { p as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, q as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-C6MqT3DB.js';
+import { p as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, q as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-Bqh2gkvu.js';
 
 /**
  * User Fixtures

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-X7KH4DDN.js';
+import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-PYCXNOMA.js';
 
 // src/testing/fixtures/users.ts
 var mockUser = {

package/dist/{types-C6MqT3DB.d.ts → types-Bqh2gkvu.d.ts}

@@ -52,6 +52,12 @@ interface AuthConfig {
     onSessionExpired?: (currentPath: string) => void;
     /** Request timeout in milliseconds (default: 30000) */
     requestTimeout?: number;
+    /**
+     * Backoff (ms) between retries of a token refresh that failed transiently
+     * (network error, timeout, 5xx, 429). One retry per entry; `[]` disables
+     * retries. Default: `[1000, 3000]` — three attempts in all.
+     */
+    refreshRetryDelays?: number[];
     /** SSO configuration */
     sso?: SSOConfig;
     /**

package/dist/{user-utils-Dla77tvM.d.ts → user-utils-92PeSjcw.d.ts}

@@ -1,4 +1,4 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-C6MqT3DB.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-Bqh2gkvu.js';
 
 /**
  * Auth Service

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.8.0",
+  "version": "1.14.0",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",

package/dist/auth.svelte-FIHKI5BD.js

@@ -1,3 +0,0 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-EBTCVIUQ.js';
-import './chunk-HVOZBQIF.js';
-import './chunk-X7KH4DDN.js';