hazo_auth 10.4.11 → 10.4.13

package/README.md

@@ -2,6 +2,10 @@
 
 A reusable authentication UI component package powered by Next.js, TailwindCSS, and shadcn. It integrates `hazo_config` for configuration management and `hazo_connect` for data access, enabling future components to stay aligned with platform conventions.
 
+### What's New in v10.4.13
+
+- **`validate_session_secret_config()`** exported from `hazo_auth/server-lib` — hard startup validator that throws `HazoConfigError` (code `HAZO_AUTH_CONFIG`) when `JWT_SECRET` is unset or shorter than 32 chars. Call it from a Next.js `instrumentation.ts` `register()` hook to fail boot loudly instead of hitting the silent split-brain a bad/missing secret otherwise causes (edge proxy bounces to `/login` while server-side auth falls back to unsigned cookies and still considers the user authenticated).
+
 ### What's New in v10.4.5
 
 - **Pre-fill login credentials** — `LoginPage`, `LoginClientWrapper`, and `LoginLayout` now accept a `default_values` / `defaultValues` prop (`{ email?: string; password?: string }`) to pre-populate the login form. Useful for demo and test environments (gate with `process.env.DEMO_EMAIL` etc.).

package/SETUP_CHECKLIST.md

@@ -424,9 +424,10 @@ from_name = Your App Name
 **Checklist:**
 - [ ] `.env.local` file created
 - [ ] `HAZO_AUTH_COOKIE_PREFIX` set (REQUIRED - must match config file)
-- [ ] `JWT_SECRET` set (required for JWT session tokens)
+- [ ] `JWT_SECRET` set (required for JWT session tokens, >= 32 chars)
 - [ ] `ZEPTOMAIL_API_KEY` set (or email will not work)
 - [ ] `from_email` configured in `hazo_notify_config.ini`
+- [ ] Call `validate_session_secret_config()` (from `hazo_auth/server-lib`) in your `instrumentation.ts` `register()` hook — hard-fails boot with a descriptive banner if `JWT_SECRET` is missing or too short, instead of the silent split-brain (logged-in on `/login` but bounced on every protected route) that a bad secret otherwise causes.
 
 ---
 

package/cli-src/cli/generate.ts

@@ -64,6 +64,10 @@ const ROUTES: RouteDefinition[] = [
   { name: "nextauth_post", path: "api/auth/[...nextauth]", method: "POST", export_name: "nextauthPOST" },
   { name: "oauth_google_callback", path: "api/hazo_auth/oauth/google/callback", method: "GET", export_name: "oauthGoogleCallbackGET" },
   { name: "set_password", path: "api/hazo_auth/set_password", method: "POST", export_name: "setPasswordPOST" },
+  // Static assets (default auth-page images served from the package's dist/assets/images).
+  // Without this route the default image_src (/api/hazo_auth/assets/login_default.jpg) 404s
+  // and login/register/etc. render with an empty image panel.
+  { name: "assets", path: "api/hazo_auth/assets/[name]", method: "GET", export_name: "assetGET" },
 ];
 
 const PAGES: PageDefinition[] = [

package/cli-src/lib/validate_session_secret.server.ts

@@ -0,0 +1,83 @@
+// file_description: startup validator for the JWT session signing secret — hard-fails boot with a descriptive banner if JWT_SECRET is missing or too short
+// section: server-only-guard
+import "server-only";
+
+// section: imports
+import { HazoConfigError } from "hazo_core";
+
+// section: constants
+/**
+ * Minimum acceptable length for JWT_SECRET. jose/HS256 accepts shorter keys,
+ * but anything under 32 chars is trivially brute-forceable for a session
+ * signing secret. Matches the threshold the validate CLI enforces.
+ */
+const MIN_JWT_SECRET_LEN = 32;
+
+// section: validate
+/**
+ * Validates the JWT session signing secret at startup.
+ *
+ * Throws HazoConfigError with a descriptive banner if JWT_SECRET is unset or
+ * shorter than 32 chars. Call this in your instrumentation `register()` hook to
+ * hard-fail boot instead of the silent failure mode it otherwise causes:
+ *
+ *   - The edge proxy validator (`validate_session_cookie`) returns
+ *     `{ valid: false }` when JWT_SECRET is missing → logged-in users get
+ *     bounced to /login.
+ *   - The server resolver (`hazo_get_auth`) falls back to unsigned simple
+ *     cookies and considers the same user authenticated.
+ *
+ * The two disagree, so the app looks "logged in" on the login page yet bounces
+ * on every protected route. Failing at boot turns that silent split-brain into
+ * an obvious, actionable error.
+ */
+export function validate_session_secret_config(): void {
+  const jwt_secret = process.env.JWT_SECRET;
+
+  if (!jwt_secret || jwt_secret.trim().length === 0) {
+    console.error("=".repeat(60));
+    console.error("FATAL: JWT_SECRET is not set");
+    console.error("=".repeat(60));
+    console.error("hazo_auth signs session cookies with JWT_SECRET. Without it:");
+    console.error("  - the edge proxy rejects every session and bounces");
+    console.error("    logged-in users to /login;");
+    console.error("  - server-side auth silently falls back to unsigned");
+    console.error("    cookies, so the app looks logged in but every");
+    console.error("    protected route bounces.");
+    console.error("");
+    console.error("Fix — add to .env.local:");
+    console.error("  JWT_SECRET=<random string, at least 32 chars>");
+    console.error("Generate one:");
+    console.error("  node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"");
+    console.error("=".repeat(60));
+
+    throw new HazoConfigError({
+      code: "HAZO_AUTH_CONFIG",
+      pkg: "hazo_auth",
+      message:
+        "JWT_SECRET environment variable is required to sign session cookies. " +
+        "Without it the edge proxy bounces authenticated users to /login while " +
+        "server-side auth falls back to unsigned cookies. Set JWT_SECRET (>= 32 chars) in .env.local.",
+    });
+  }
+
+  if (jwt_secret.trim().length < MIN_JWT_SECRET_LEN) {
+    console.error("=".repeat(60));
+    console.error("FATAL: JWT_SECRET is too short");
+    console.error("=".repeat(60));
+    console.error(
+      `JWT_SECRET is ${jwt_secret.trim().length} chars; at least ${MIN_JWT_SECRET_LEN} are required.`,
+    );
+    console.error("Generate a strong one:");
+    console.error("  node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"");
+    console.error("=".repeat(60));
+
+    throw new HazoConfigError({
+      code: "HAZO_AUTH_CONFIG",
+      pkg: "hazo_auth",
+      message:
+        `JWT_SECRET is too short (${jwt_secret.trim().length} chars). ` +
+        `Use at least ${MIN_JWT_SECRET_LEN} characters for the session signing secret.`,
+    });
+  }
+}

package/dist/cli/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/cli/generate.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAiMF,wBAAgB,eAAe,CAAC,OAAO,GAAE,eAAoB,GAAG,IAAI,CA8DnE"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/cli/generate.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAqMF,wBAAgB,eAAe,CAAC,OAAO,GAAE,eAAoB,GAAG,IAAI,CA8DnE"}

package/dist/cli/generate.js

@@ -41,6 +41,10 @@ const ROUTES = [
     { name: "nextauth_post", path: "api/auth/[...nextauth]", method: "POST", export_name: "nextauthPOST" },
     { name: "oauth_google_callback", path: "api/hazo_auth/oauth/google/callback", method: "GET", export_name: "oauthGoogleCallbackGET" },
     { name: "set_password", path: "api/hazo_auth/set_password", method: "POST", export_name: "setPasswordPOST" },
+    // Static assets (default auth-page images served from the package's dist/assets/images).
+    // Without this route the default image_src (/api/hazo_auth/assets/login_default.jpg) 404s
+    // and login/register/etc. render with an empty image panel.
+    { name: "assets", path: "api/hazo_auth/assets/[name]", method: "GET", export_name: "assetGET" },
 ];
 const PAGES = [
     { name: "login", path: "hazo_auth/login", component_name: "LoginPage", import_path: "hazo_auth/pages/login" },

package/dist/lib/validate_session_secret.server.d.ts

@@ -0,0 +1,20 @@
+import "server-only";
+/**
+ * Validates the JWT session signing secret at startup.
+ *
+ * Throws HazoConfigError with a descriptive banner if JWT_SECRET is unset or
+ * shorter than 32 chars. Call this in your instrumentation `register()` hook to
+ * hard-fail boot instead of the silent failure mode it otherwise causes:
+ *
+ *   - The edge proxy validator (`validate_session_cookie`) returns
+ *     `{ valid: false }` when JWT_SECRET is missing → logged-in users get
+ *     bounced to /login.
+ *   - The server resolver (`hazo_get_auth`) falls back to unsigned simple
+ *     cookies and considers the same user authenticated.
+ *
+ * The two disagree, so the app looks "logged in" on the login page yet bounces
+ * on every protected route. Failing at boot turns that silent split-brain into
+ * an obvious, actionable error.
+ */
+export declare function validate_session_secret_config(): void;
+//# sourceMappingURL=validate_session_secret.server.d.ts.map

package/dist/lib/validate_session_secret.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate_session_secret.server.d.ts","sourceRoot":"","sources":["../../src/lib/validate_session_secret.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAcrB;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAiDrD"}

package/dist/lib/validate_session_secret.server.js

@@ -0,0 +1,72 @@
+// file_description: startup validator for the JWT session signing secret — hard-fails boot with a descriptive banner if JWT_SECRET is missing or too short
+// section: server-only-guard
+import "server-only";
+// section: imports
+import { HazoConfigError } from "hazo_core";
+// section: constants
+/**
+ * Minimum acceptable length for JWT_SECRET. jose/HS256 accepts shorter keys,
+ * but anything under 32 chars is trivially brute-forceable for a session
+ * signing secret. Matches the threshold the validate CLI enforces.
+ */
+const MIN_JWT_SECRET_LEN = 32;
+// section: validate
+/**
+ * Validates the JWT session signing secret at startup.
+ *
+ * Throws HazoConfigError with a descriptive banner if JWT_SECRET is unset or
+ * shorter than 32 chars. Call this in your instrumentation `register()` hook to
+ * hard-fail boot instead of the silent failure mode it otherwise causes:
+ *
+ *   - The edge proxy validator (`validate_session_cookie`) returns
+ *     `{ valid: false }` when JWT_SECRET is missing → logged-in users get
+ *     bounced to /login.
+ *   - The server resolver (`hazo_get_auth`) falls back to unsigned simple
+ *     cookies and considers the same user authenticated.
+ *
+ * The two disagree, so the app looks "logged in" on the login page yet bounces
+ * on every protected route. Failing at boot turns that silent split-brain into
+ * an obvious, actionable error.
+ */
+export function validate_session_secret_config() {
+    const jwt_secret = process.env.JWT_SECRET;
+    if (!jwt_secret || jwt_secret.trim().length === 0) {
+        console.error("=".repeat(60));
+        console.error("FATAL: JWT_SECRET is not set");
+        console.error("=".repeat(60));
+        console.error("hazo_auth signs session cookies with JWT_SECRET. Without it:");
+        console.error("  - the edge proxy rejects every session and bounces");
+        console.error("    logged-in users to /login;");
+        console.error("  - server-side auth silently falls back to unsigned");
+        console.error("    cookies, so the app looks logged in but every");
+        console.error("    protected route bounces.");
+        console.error("");
+        console.error("Fix — add to .env.local:");
+        console.error("  JWT_SECRET=<random string, at least 32 chars>");
+        console.error("Generate one:");
+        console.error("  node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"");
+        console.error("=".repeat(60));
+        throw new HazoConfigError({
+            code: "HAZO_AUTH_CONFIG",
+            pkg: "hazo_auth",
+            message: "JWT_SECRET environment variable is required to sign session cookies. " +
+                "Without it the edge proxy bounces authenticated users to /login while " +
+                "server-side auth falls back to unsigned cookies. Set JWT_SECRET (>= 32 chars) in .env.local.",
+        });
+    }
+    if (jwt_secret.trim().length < MIN_JWT_SECRET_LEN) {
+        console.error("=".repeat(60));
+        console.error("FATAL: JWT_SECRET is too short");
+        console.error("=".repeat(60));
+        console.error(`JWT_SECRET is ${jwt_secret.trim().length} chars; at least ${MIN_JWT_SECRET_LEN} are required.`);
+        console.error("Generate a strong one:");
+        console.error("  node -e \"console.log(require('crypto').randomBytes(32).toString('base64'))\"");
+        console.error("=".repeat(60));
+        throw new HazoConfigError({
+            code: "HAZO_AUTH_CONFIG",
+            pkg: "hazo_auth",
+            message: `JWT_SECRET is too short (${jwt_secret.trim().length} chars). ` +
+                `Use at least ${MIN_JWT_SECRET_LEN} characters for the session signing secret.`,
+        });
+    }
+}

package/dist/server/routes/user_management_users.d.ts

@@ -26,7 +26,7 @@ export declare function GET(request: NextRequest): Promise<NextResponse<{
         profile_source: {} | null;
         user_type: string | null;
         app_user_data: Record<string, unknown> | null;
-        legal_acceptance_status: "current" | "none" | "outdated";
+        legal_acceptance_status: "current" | "outdated" | "none";
     }[];
 }>>;
 /**

package/dist/server-lib.d.ts

@@ -26,6 +26,7 @@ export { get_branding_config, is_branding_enabled, is_allowed_logo_format, get_m
 export type { FirmBrandingConfig } from "./lib/branding_config.server";
 export { create_sqlite_hazo_connect } from "./lib/hazo_connect_setup.js";
 export { validate_hazo_connect_config } from "./lib/validate_hazo_connect_config.server.js";
+export { validate_session_secret_config } from "./lib/validate_session_secret.server.js";
 export { get_hazo_connect_instance, set_hazo_connect_instance, reset_hazo_connect_instance, } from "./lib/hazo_connect_instance.server.js";
 export { create_app_logger } from "./lib/app_logger.js";
 export { sanitize_error_for_user } from "./lib/utils/error_sanitizer.js";

package/dist/server-lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-lib.d.ts","sourceRoot":"","sources":["../src/server-lib.ts"],"names":[],"mappings":"AAYA,OAAO,aAAa,CAAC;AAGrB,cAAc,kBAAkB,CAAC;AAGjC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAGrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,cAAc,+BAA+B,CAAC;AAG9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAK7E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"server-lib.d.ts","sourceRoot":"","sources":["../src/server-lib.ts"],"names":[],"mappings":"AAYA,OAAO,aAAa,CAAC;AAGrB,cAAc,kBAAkB,CAAC;AAGjC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAGrF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,cAAc,+BAA+B,CAAC;AAG9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAK7E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,8BAA8B,CAAC"}

package/dist/server-lib.js

@@ -40,6 +40,7 @@ export { get_branding_config, is_branding_enabled, is_allowed_logo_format, get_m
 // section: hazo_connect_exports
 export { create_sqlite_hazo_connect } from "./lib/hazo_connect_setup.js";
 export { validate_hazo_connect_config } from "./lib/validate_hazo_connect_config.server.js";
+export { validate_session_secret_config } from "./lib/validate_session_secret.server.js";
 export { get_hazo_connect_instance, set_hazo_connect_instance, reset_hazo_connect_instance, } from "./lib/hazo_connect_instance.server.js";
 // section: logger_exports
 export { create_app_logger } from "./lib/app_logger.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "10.4.11",
+  "version": "10.4.13",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",
@@ -408,7 +408,7 @@
     "hazo_core": "^1.2.1",
     "hazo_logs": "^2.1.1",
     "hazo_notify": "^6.1.4",
-    "hazo_ui": "^4.6.2",
+    "hazo_ui": "^4.7.0",
     "input-otp": "^1.4.0",
     "jest": "^30.2.0",
     "jest-environment-jsdom": "^30.0.0",