@classic-homes/auth 1.41.0 → 1.42.0

package/dist/{auth.svelte-DSE2NZMP.js → auth.svelte-XY4FQFZQ.js}

@@ -1,3 +1,3 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-HMZRBRIU.js';
-import './chunk-QLEEAHJJ.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-MBVOLE5U.js';
+import './chunk-7AQYLLTA.js';
 import './chunk-K6TV3ZVS.js';

package/dist/{chunk-QLEEAHJJ.js → chunk-7AQYLLTA.js}

@@ -1,4 +1,4 @@
-import { isInitialized, getConfig, getUserRoles, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-K6TV3ZVS.js';
+import { isInitialized, getConfig, getUserRoles, getStorage, isTokenExpired, getFetch, isValidRedirectUrl, decodeJWT } from './chunk-K6TV3ZVS.js';
 
 // src/core/sso-state.ts
 var SSO_CLIENT_STATE_PARAM = "client_state";
@@ -96,6 +96,18 @@ var InvalidAuthResponseError = class _InvalidAuthResponseError extends Error {
     }
   }
 };
+var SessionChangedError = class _SessionChangedError extends Error {
+  constructor(message = "The session changed while this request was in flight; it was not retried.") {
+    super(message);
+    this.name = "SessionChangedError";
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _SessionChangedError);
+    }
+  }
+};
+function isSessionChangedError(error) {
+  return error instanceof SessionChangedError || error?.name === "SessionChangedError";
+}
 var MFAChallengeEmailError = class _MFAChallengeEmailError extends Error {
   constructor(message, status, retryAfterSeconds) {
     super(message);
@@ -108,6 +120,46 @@ var MFAChallengeEmailError = class _MFAChallengeEmailError extends Error {
   }
 };
 
+// src/core/session.ts
+var generation = 0;
+function bumpSessionGeneration() {
+  generation += 1;
+}
+function readIdentity() {
+  let parsed = {};
+  try {
+    const raw = getStorage().getItem(getConfig().storageKey ?? "classic_auth");
+    if (raw) parsed = JSON.parse(raw) ?? {};
+  } catch {
+  }
+  const accessToken = typeof parsed.accessToken === "string" ? parsed.accessToken : "";
+  const refreshToken = typeof parsed.refreshToken === "string" ? parsed.refreshToken : "";
+  const sub = accessToken ? decodeJWT(accessToken)?.sub : void 0;
+  const userId = parsed.user?.id;
+  return {
+    signedIn: accessToken !== "" || refreshToken !== "",
+    sub: typeof sub === "string" || typeof sub === "number" ? String(sub) : void 0,
+    userId: typeof userId === "string" || typeof userId === "number" ? String(userId) : void 0
+  };
+}
+function captureSession() {
+  return { generation, identity: readIdentity() };
+}
+function getSessionGeneration() {
+  return generation;
+}
+function isCurrentSession(snapshot) {
+  if (snapshot.generation !== generation) return false;
+  const then = snapshot.identity;
+  const now = readIdentity();
+  if (then.signedIn !== now.signedIn) return false;
+  if (then.sub !== void 0 && now.sub !== void 0 && then.sub !== now.sub) return false;
+  if (then.userId !== void 0 && now.userId !== void 0 && then.userId !== now.userId) {
+    return false;
+  }
+  return true;
+}
+
 // src/core/client.ts
 var DEFAULT_REFRESH_RETRY_DELAYS = [1e3, 3e3];
 var refreshInflight = null;
@@ -166,7 +218,7 @@ function writeStoredTokens(accessToken, refreshToken) {
 }
 async function syncSvelteStore(apply) {
   try {
-    const { authStore } = await import('./auth.svelte-DSE2NZMP.js');
+    const { authStore } = await import('./auth.svelte-XY4FQFZQ.js');
     apply(authStore);
   } catch {
   }
@@ -176,6 +228,7 @@ function clearStoredAuth() {
   const storage = getStorage();
   storage.removeItem(config.storageKey ?? "classic_auth");
   storage.removeItem(getSessionTokenKey());
+  bumpSessionGeneration();
 }
 async function expireSession() {
   clearStoredAuth();
@@ -245,6 +298,8 @@ function refreshSession(options = {}) {
   return refreshInflight;
 }
 async function runRefresh(options) {
+  const generation2 = getSessionGeneration();
+  const sameGeneration = () => generation2 === getSessionGeneration();
   const presented = getRefreshToken();
   if (!presented) {
     await expireSession();
@@ -254,6 +309,7 @@ async function runRefresh(options) {
     const current = getRefreshToken();
     if (current !== presented) {
       if (!current) {
+        if (!sameGeneration()) return "rejected";
         await expireSession();
         return "rejected";
       }
@@ -278,6 +334,7 @@ async function runRefresh(options) {
         await syncSvelteStore((authStore) => authStore.rehydrate());
         return "refreshed";
       }
+      if (!sameGeneration()) return "rejected";
       await writeStoredTokens(attempt.accessToken, attempt.refreshToken);
       return "refreshed";
     }
@@ -287,6 +344,7 @@ async function runRefresh(options) {
         await syncSvelteStore((authStore) => authStore.rehydrate());
         return "refreshed";
       }
+      if (!sameGeneration()) return "rejected";
       await expireSession();
       return "rejected";
     }
@@ -316,7 +374,7 @@ function isApiOrigin(url, baseUrl) {
 function apiRequest(endpoint, options = {}) {
   return apiRequestInternal(endpoint, options, false);
 }
-async function apiRequestInternal(endpoint, options, isRetry) {
+async function apiRequestInternal(endpoint, options, isRetry, startedIn) {
   const {
     authenticated: wantsAuth = false,
     customFetch,
@@ -331,6 +389,14 @@ async function apiRequestInternal(endpoint, options, isRetry) {
   const isAbsolute = /^https?:\/\//i.test(endpoint);
   const url = isAbsolute ? endpoint : `${config.baseUrl}${endpoint}`;
   const authenticated = wantsAuth && (!isAbsolute || isApiOrigin(url, config.baseUrl));
+  const session = startedIn ?? captureSession();
+  const assertSameSession = async () => {
+    if (isCurrentSession(session)) return;
+    if (session.generation === getSessionGeneration()) {
+      await syncSvelteStore((authStore) => authStore.rehydrate());
+    }
+    throw new SessionChangedError();
+  };
   if (authenticated && noAuthRetry && !isRetry && typeof window !== "undefined") {
     const accessToken = getAccessToken();
     if (accessToken && isTokenExpired(accessToken)) {
@@ -338,6 +404,7 @@ async function apiRequestInternal(endpoint, options, isRetry) {
       if (outcome === "rejected") {
         throw new Error("Authentication failed. Please sign in again.");
       }
+      if (authenticated) await assertSameSession();
     }
   }
   const timeoutMs = timeout ?? config.requestTimeout ?? 3e4;
@@ -374,13 +441,15 @@ async function apiRequestInternal(endpoint, options, isRetry) {
     });
     clearTimeout(timeoutId);
     if (response.status === 401 && authenticated && !noAuthRetry && typeof window !== "undefined") {
+      await assertSameSession();
       if (isRetry) {
         await expireSession();
         throw new Error("Authentication failed. Please sign in again.");
       }
       const outcome = await refreshSession();
       if (outcome === "refreshed") {
-        return apiRequestInternal(endpoint, options, true);
+        await assertSameSession();
+        return apiRequestInternal(endpoint, options, true, session);
       }
       if (outcome === "rejected") {
         throw new Error("Authentication failed. Please sign in again.");
@@ -1012,4 +1081,4 @@ var authApi = {
   }
 };
 
-export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState };
+export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, bumpSessionGeneration, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState };

package/dist/{chunk-5SZT7GKG.js → chunk-7JLCFRUU.js}

@@ -1,5 +1,5 @@
-import { authService } from './chunk-BMCGFHVM.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-HMZRBRIU.js';
+import { authService } from './chunk-LPQKZRPC.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-MBVOLE5U.js';
 import { isInitialized, initAuth, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/guards/auth-guard.ts

package/dist/{chunk-BMCGFHVM.js → chunk-LPQKZRPC.js}

@@ -1,4 +1,4 @@
-import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-QLEEAHJJ.js';
+import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-7AQYLLTA.js';
 import { hasAnyRole, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/core/guards.ts
@@ -19,7 +19,7 @@ function getAvailableMethods(response) {
 async function setStoreAuth(response) {
   let store;
   try {
-    store = (await import('./auth.svelte-DSE2NZMP.js')).authStore;
+    store = (await import('./auth.svelte-XY4FQFZQ.js')).authStore;
   } catch {
     return;
   }

package/dist/{chunk-HMZRBRIU.js → chunk-MBVOLE5U.js}

@@ -1,4 +1,4 @@
-import { InvalidAuthResponseError, authApi } from './chunk-QLEEAHJJ.js';
+import { InvalidAuthResponseError, bumpSessionGeneration, authApi } from './chunk-7AQYLLTA.js';
 import { isInitialized, getConfig, isValidSSOLogoutUrl, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/stores/auth.svelte.ts
@@ -111,6 +111,7 @@ var AuthStore = class {
       throw new InvalidAuthResponseError("setAuth requires an access token and a user");
     }
     const userWithPermissions = normalizeUser(user, accessToken);
+    bumpSessionGeneration();
     this.state = {
       accessToken,
       refreshToken,
@@ -174,6 +175,7 @@ var AuthStore = class {
    * Clear auth state (logout).
    */
   logout() {
+    bumpSessionGeneration();
     this.state = {
       accessToken: null,
       refreshToken: null,
@@ -222,6 +224,7 @@ var AuthStore = class {
    */
   handleSessionExpired() {
     const currentPath = typeof window !== "undefined" ? window.location.pathname : "/";
+    bumpSessionGeneration();
     this.state = {
       accessToken: null,
       refreshToken: null,
@@ -303,6 +306,7 @@ var AuthStore = class {
    * ```
    */
   reset() {
+    bumpSessionGeneration();
     this.state = {
       accessToken: null,
       refreshToken: null,

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
 import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, l as RegisterResponse, q as User, k as ProfileUpdateData, C as ChangePasswordData, o as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, j as MFAStatus, i as MFASetupResponse, M as MFAChallengeData, h as MFAChallengeEmailResponse, D as Device, r as UserPreferences, L as LinkedAccount, n as SecurityEvent, P as Pagination, s as UserRolesResponse } from '../types-DF5Ny2IA.js';
 export { a as AuthConfig, b as AuthState, m as ResetPasswordData, S as SSOConfig, p as StorageAdapter, t as createMemoryStorage, u as createSessionStorage, v as getConfig, w as getDefaultStorage, x as getFetch, y as getStorage, z as initAuth, B as isInitialized, E as resetConfig } from '../types-DF5Ny2IA.js';
-export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError } from '../user-utils-B6BNJzF2.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, S as SessionChangedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError, j as isSessionChangedError } from '../user-utils-Bo3lMsuT.js';
 
 /**
  * SSO client state

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-BMCGFHVM.js';
-export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState } from '../chunk-QLEEAHJJ.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-LPQKZRPC.js';
+export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from '../chunk-7AQYLLTA.js';
 export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-K6TV3ZVS.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
 export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFAChallengeEmailResponse, i as MFASetupResponse, j as MFAStatus, P as Pagination, k as ProfileUpdateData, R as RegisterData, l as RegisterResponse, m as ResetPasswordData, S as SSOConfig, n as SecurityEvent, o as Session, p as StorageAdapter, U as UpdateApiKeyRequest, q as User, r as UserPreferences, s as UserRolesResponse, t as createMemoryStorage, u as createSessionStorage, v as getConfig, w as getDefaultStorage, x as getFetch, y as getStorage, z as initAuth, B as isInitialized, E as resetConfig } from './types-DF5Ny2IA.js';
 export { ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RefreshOutcome, RefreshSessionOptions, RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SsoClientStateResult, SsoClientStateVerification, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens, verifySsoClientState } from './core/index.js';
-export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError } from './user-utils-B6BNJzF2.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, S as SessionChangedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError, j as isSessionChangedError } from './user-utils-Bo3lMsuT.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-5SZT7GKG.js';
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-BMCGFHVM.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-HMZRBRIU.js';
-export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState } from './chunk-QLEEAHJJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-7JLCFRUU.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-LPQKZRPC.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-MBVOLE5U.js';
+export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from './chunk-7AQYLLTA.js';
 export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-K6TV3ZVS.js';

package/dist/svelte/index.d.ts

@@ -1,7 +1,7 @@
 import { b as AuthState, q as User, a as AuthConfig } from '../types-DF5Ny2IA.js';
 export { z as initAuth, B as isInitialized } from '../types-DF5Ny2IA.js';
-import { b as authService } from '../user-utils-B6BNJzF2.js';
-export { I as InvalidAuthResponseError, R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError } from '../user-utils-B6BNJzF2.js';
+import { b as authService } from '../user-utils-Bo3lMsuT.js';
+export { I as InvalidAuthResponseError, R as RoleDeniedError, S as SessionChangedError, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError, j as isSessionChangedError } from '../user-utils-Bo3lMsuT.js';
 
 /**
  * Auth Store

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-5SZT7GKG.js';
-export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-BMCGFHVM.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-HMZRBRIU.js';
-export { InvalidAuthResponseError, RoleDeniedError, isRoleDeniedError } from '../chunk-QLEEAHJJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-7JLCFRUU.js';
+export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-LPQKZRPC.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-MBVOLE5U.js';
+export { InvalidAuthResponseError, RoleDeniedError, SessionChangedError, isRoleDeniedError, isSessionChangedError } from '../chunk-7AQYLLTA.js';
 export { initAuth, isInitialized } from '../chunk-K6TV3ZVS.js';

package/dist/{user-utils-B6BNJzF2.d.ts → user-utils-Bo3lMsuT.d.ts}

@@ -326,6 +326,22 @@ declare class InvalidAuthResponseError extends Error {
     readonly name = "InvalidAuthResponseError";
     constructor(message?: string);
 }
+/**
+ * Error thrown when the session changed (logout, login as another account,
+ * expiry) while a request was in flight, and the request needed the session
+ * to continue (a 401 that would have been refreshed and retried). The request
+ * is not refreshed, retried or allowed to expire the new session: replaying it
+ * would send the previous account's request with the next account's
+ * credentials.
+ */
+declare class SessionChangedError extends Error {
+    readonly name = "SessionChangedError";
+    constructor(message?: string);
+}
+/**
+ * Type guard to check if an error is a SessionChangedError.
+ */
+declare function isSessionChangedError(error: unknown): error is SessionChangedError;
 /**
  * Error thrown when CHAPI won't send an MFA challenge email code: the
  * challenge token is invalid or expired (401), the account has no email MFA
@@ -444,4 +460,4 @@ declare function formatUserRoles(user: User | null | undefined, options?: {
     capitalize?: boolean;
 }): string;
 
-export { AuthService as A, InvalidAuthResponseError as I, type LoginOptions as L, MFAChallengeEmailError as M, RoleDeniedError as R, type MFAVerifyOptions as a, authService as b, getDisplayName as c, getGreeting as d, getUserEmail as e, formatUserRoles as f, getAvatarFallback as g, getUserInitials as h, isRoleDeniedError as i };
+export { AuthService as A, InvalidAuthResponseError as I, type LoginOptions as L, MFAChallengeEmailError as M, RoleDeniedError as R, SessionChangedError as S, type MFAVerifyOptions as a, authService as b, getDisplayName as c, getGreeting as d, getUserEmail as e, formatUserRoles as f, getAvatarFallback as g, getUserInitials as h, isRoleDeniedError as i, isSessionChangedError as j };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.41.0",
+  "version": "1.42.0",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",