@classic-homes/auth 1.41.0 → 1.42.1

package/dist/{auth.svelte-DSE2NZMP.js → auth.svelte-FUCU4DYP.js}

@@ -1,3 +1,3 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-HMZRBRIU.js';
-import './chunk-QLEEAHJJ.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-IR6DVUUF.js';
+import './chunk-QV3DUSP5.js';
 import './chunk-K6TV3ZVS.js';

package/dist/{chunk-BMCGFHVM.js → chunk-A6JJQCBU.js}

@@ -1,4 +1,4 @@
-import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-QLEEAHJJ.js';
+import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-QV3DUSP5.js';
 import { hasAnyRole, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/core/guards.ts
@@ -19,7 +19,7 @@ function getAvailableMethods(response) {
 async function setStoreAuth(response) {
   let store;
   try {
-    store = (await import('./auth.svelte-DSE2NZMP.js')).authStore;
+    store = (await import('./auth.svelte-FUCU4DYP.js')).authStore;
   } catch {
     return;
   }

package/dist/{chunk-5SZT7GKG.js → chunk-G6UH4HBI.js}

@@ -1,5 +1,5 @@
-import { authService } from './chunk-BMCGFHVM.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-HMZRBRIU.js';
+import { authService } from './chunk-A6JJQCBU.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-IR6DVUUF.js';
 import { isInitialized, initAuth, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/guards/auth-guard.ts

package/dist/{chunk-HMZRBRIU.js → chunk-IR6DVUUF.js}

@@ -1,4 +1,4 @@
-import { InvalidAuthResponseError, authApi } from './chunk-QLEEAHJJ.js';
+import { InvalidAuthResponseError, bumpSessionGeneration, authApi } from './chunk-QV3DUSP5.js';
 import { isInitialized, getConfig, isValidSSOLogoutUrl, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/stores/auth.svelte.ts
@@ -111,6 +111,7 @@ var AuthStore = class {
       throw new InvalidAuthResponseError("setAuth requires an access token and a user");
     }
     const userWithPermissions = normalizeUser(user, accessToken);
+    bumpSessionGeneration();
     this.state = {
       accessToken,
       refreshToken,
@@ -174,6 +175,7 @@ var AuthStore = class {
    * Clear auth state (logout).
    */
   logout() {
+    bumpSessionGeneration();
     this.state = {
       accessToken: null,
       refreshToken: null,
@@ -222,6 +224,7 @@ var AuthStore = class {
    */
   handleSessionExpired() {
     const currentPath = typeof window !== "undefined" ? window.location.pathname : "/";
+    bumpSessionGeneration();
     this.state = {
       accessToken: null,
       refreshToken: null,
@@ -303,6 +306,7 @@ var AuthStore = class {
    * ```
    */
   reset() {
+    bumpSessionGeneration();
     this.state = {
       accessToken: null,
       refreshToken: null,

package/dist/{chunk-QLEEAHJJ.js → chunk-QV3DUSP5.js}

@@ -1,4 +1,4 @@
-import { isInitialized, getConfig, getUserRoles, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-K6TV3ZVS.js';
+import { isInitialized, getConfig, getUserRoles, getStorage, isTokenExpired, getFetch, isValidRedirectUrl, decodeJWT } from './chunk-K6TV3ZVS.js';
 
 // src/core/sso-state.ts
 var SSO_CLIENT_STATE_PARAM = "client_state";
@@ -96,6 +96,18 @@ var InvalidAuthResponseError = class _InvalidAuthResponseError extends Error {
     }
   }
 };
+var SessionChangedError = class _SessionChangedError extends Error {
+  constructor(message = "The session changed while this request was in flight; it was not retried.") {
+    super(message);
+    this.name = "SessionChangedError";
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _SessionChangedError);
+    }
+  }
+};
+function isSessionChangedError(error) {
+  return error instanceof SessionChangedError || error?.name === "SessionChangedError";
+}
 var MFAChallengeEmailError = class _MFAChallengeEmailError extends Error {
   constructor(message, status, retryAfterSeconds) {
     super(message);
@@ -108,6 +120,46 @@ var MFAChallengeEmailError = class _MFAChallengeEmailError extends Error {
   }
 };
 
+// src/core/session.ts
+var generation = 0;
+function bumpSessionGeneration() {
+  generation += 1;
+}
+function readIdentity() {
+  let parsed = {};
+  try {
+    const raw = getStorage().getItem(getConfig().storageKey ?? "classic_auth");
+    if (raw) parsed = JSON.parse(raw) ?? {};
+  } catch {
+  }
+  const accessToken = typeof parsed.accessToken === "string" ? parsed.accessToken : "";
+  const refreshToken = typeof parsed.refreshToken === "string" ? parsed.refreshToken : "";
+  const sub = accessToken ? decodeJWT(accessToken)?.sub : void 0;
+  const userId = parsed.user?.id;
+  return {
+    signedIn: accessToken !== "" || refreshToken !== "",
+    sub: typeof sub === "string" || typeof sub === "number" ? String(sub) : void 0,
+    userId: typeof userId === "string" || typeof userId === "number" ? String(userId) : void 0
+  };
+}
+function captureSession() {
+  return { generation, identity: readIdentity() };
+}
+function getSessionGeneration() {
+  return generation;
+}
+function isCurrentSession(snapshot) {
+  if (snapshot.generation !== generation) return false;
+  const then = snapshot.identity;
+  const now = readIdentity();
+  if (then.signedIn !== now.signedIn) return false;
+  if (then.sub !== void 0 && now.sub !== void 0 && then.sub !== now.sub) return false;
+  if (then.userId !== void 0 && now.userId !== void 0 && then.userId !== now.userId) {
+    return false;
+  }
+  return true;
+}
+
 // src/core/client.ts
 var DEFAULT_REFRESH_RETRY_DELAYS = [1e3, 3e3];
 var refreshInflight = null;
@@ -166,7 +218,7 @@ function writeStoredTokens(accessToken, refreshToken) {
 }
 async function syncSvelteStore(apply) {
   try {
-    const { authStore } = await import('./auth.svelte-DSE2NZMP.js');
+    const { authStore } = await import('./auth.svelte-FUCU4DYP.js');
     apply(authStore);
   } catch {
   }
@@ -176,6 +228,7 @@ function clearStoredAuth() {
   const storage = getStorage();
   storage.removeItem(config.storageKey ?? "classic_auth");
   storage.removeItem(getSessionTokenKey());
+  bumpSessionGeneration();
 }
 async function expireSession() {
   clearStoredAuth();
@@ -245,6 +298,8 @@ function refreshSession(options = {}) {
   return refreshInflight;
 }
 async function runRefresh(options) {
+  const generation2 = getSessionGeneration();
+  const sameGeneration = () => generation2 === getSessionGeneration();
   const presented = getRefreshToken();
   if (!presented) {
     await expireSession();
@@ -254,6 +309,7 @@ async function runRefresh(options) {
     const current = getRefreshToken();
     if (current !== presented) {
       if (!current) {
+        if (!sameGeneration()) return "rejected";
         await expireSession();
         return "rejected";
       }
@@ -278,6 +334,7 @@ async function runRefresh(options) {
         await syncSvelteStore((authStore) => authStore.rehydrate());
         return "refreshed";
       }
+      if (!sameGeneration()) return "rejected";
       await writeStoredTokens(attempt.accessToken, attempt.refreshToken);
       return "refreshed";
     }
@@ -287,6 +344,7 @@ async function runRefresh(options) {
         await syncSvelteStore((authStore) => authStore.rehydrate());
         return "refreshed";
       }
+      if (!sameGeneration()) return "rejected";
       await expireSession();
       return "rejected";
     }
@@ -316,7 +374,7 @@ function isApiOrigin(url, baseUrl) {
 function apiRequest(endpoint, options = {}) {
   return apiRequestInternal(endpoint, options, false);
 }
-async function apiRequestInternal(endpoint, options, isRetry) {
+async function apiRequestInternal(endpoint, options, isRetry, startedIn) {
   const {
     authenticated: wantsAuth = false,
     customFetch,
@@ -331,6 +389,14 @@ async function apiRequestInternal(endpoint, options, isRetry) {
   const isAbsolute = /^https?:\/\//i.test(endpoint);
   const url = isAbsolute ? endpoint : `${config.baseUrl}${endpoint}`;
   const authenticated = wantsAuth && (!isAbsolute || isApiOrigin(url, config.baseUrl));
+  const session = startedIn ?? captureSession();
+  const assertSameSession = async () => {
+    if (isCurrentSession(session)) return;
+    if (session.generation === getSessionGeneration()) {
+      await syncSvelteStore((authStore) => authStore.rehydrate());
+    }
+    throw new SessionChangedError();
+  };
   if (authenticated && noAuthRetry && !isRetry && typeof window !== "undefined") {
     const accessToken = getAccessToken();
     if (accessToken && isTokenExpired(accessToken)) {
@@ -338,6 +404,7 @@ async function apiRequestInternal(endpoint, options, isRetry) {
       if (outcome === "rejected") {
         throw new Error("Authentication failed. Please sign in again.");
       }
+      if (authenticated) await assertSameSession();
     }
   }
   const timeoutMs = timeout ?? config.requestTimeout ?? 3e4;
@@ -372,15 +439,16 @@ async function apiRequestInternal(endpoint, options, isRetry) {
       body: body ? JSON.stringify(body) : void 0,
       signal: controller.signal
     });
-    clearTimeout(timeoutId);
     if (response.status === 401 && authenticated && !noAuthRetry && typeof window !== "undefined") {
+      await assertSameSession();
       if (isRetry) {
         await expireSession();
         throw new Error("Authentication failed. Please sign in again.");
       }
       const outcome = await refreshSession();
       if (outcome === "refreshed") {
-        return apiRequestInternal(endpoint, options, true);
+        await assertSameSession();
+        return apiRequestInternal(endpoint, options, true, session);
       }
       if (outcome === "rejected") {
         throw new Error("Authentication failed. Please sign in again.");
@@ -393,13 +461,17 @@ async function apiRequestInternal(endpoint, options, isRetry) {
       try {
         data = await response.json();
       } catch (parseError) {
+        if (controller.signal.aborted) throw parseError;
         if (!response.ok) {
           throw new Error(`Server error (${response.status}): Invalid JSON response`);
         }
         throw parseError;
       }
     } else {
-      const responseText = await response.text().catch(() => "");
+      const responseText = await response.text().catch((readError) => {
+        if (controller.signal.aborted) throw readError;
+        return "";
+      });
       if (responseText) {
         try {
           data = JSON.parse(responseText);
@@ -430,7 +502,6 @@ async function apiRequestInternal(endpoint, options, isRetry) {
     }
     return data;
   } catch (error) {
-    clearTimeout(timeoutId);
     if (error instanceof DOMException && error.name === "AbortError") {
       if (signal?.aborted) throw error;
       throw new Error(`Request timed out after ${timeoutMs}ms`);
@@ -440,6 +511,7 @@ async function apiRequestInternal(endpoint, options, isRetry) {
     }
     throw new Error("API request failed");
   } finally {
+    clearTimeout(timeoutId);
     signal?.removeEventListener("abort", onCallerAbort);
   }
 }
@@ -484,16 +556,19 @@ var api = {
 };
 
 // src/core/api.ts
-async function fetchWithTimeout(url, init) {
+async function fetchWithTimeout(url, init, read) {
   const config = getConfig();
   const fetchFn = config.fetch ?? fetch;
   const timeoutMs = config.requestTimeout ?? 3e4;
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    return await fetchFn(url, { ...init, signal: controller.signal });
+    const response = await fetchFn(url, { ...init, signal: controller.signal });
+    const result = await read(response);
+    if (controller.signal.aborted) throw new Error("aborted");
+    return result;
   } catch (error) {
-    if (error instanceof DOMException && error.name === "AbortError") {
+    if (controller.signal.aborted) {
       throw new Error(`Request timed out after ${timeoutMs}ms`);
     }
     throw error;
@@ -745,19 +820,24 @@ var authApi = {
       type: data.method === "backup" || data.method === "email" ? data.method : "totp",
       trustDevice: data.trustDevice
     };
-    const response = await fetchWithTimeout(`${config.baseUrl}/auth/mfa/challenge`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${data.mfaToken}`
+    const result = await fetchWithTimeout(
+      `${config.baseUrl}/auth/mfa/challenge`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${data.mfaToken}`
+        },
+        body: JSON.stringify(requestBody)
       },
-      body: JSON.stringify(requestBody)
-    });
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({ message: "Verification failed" }));
-      throw new Error(error.error?.message || error.message || "Invalid verification code");
-    }
-    const result = await response.json();
+      async (response) => {
+        if (!response.ok) {
+          const error = await response.json().catch(() => ({ message: "Verification failed" }));
+          throw new Error(error.error?.message || error.message || "Invalid verification code");
+        }
+        return response.json();
+      }
+    );
     return extractData(result);
   },
   /**
@@ -768,11 +848,14 @@ var authApi = {
    */
   async sendMFAChallengeEmail(mfaToken) {
     const config = getConfig();
-    const response = await fetchWithTimeout(`${config.baseUrl}/auth/mfa/challenge/email/send`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${mfaToken}` }
-    });
-    const body = await response.json().catch(() => ({}));
+    const { response, body } = await fetchWithTimeout(
+      `${config.baseUrl}/auth/mfa/challenge/email/send`,
+      {
+        method: "POST",
+        headers: { Authorization: `Bearer ${mfaToken}` }
+      },
+      async (response2) => ({ response: response2, body: await response2.json().catch(() => ({})) })
+    );
     if (!response.ok) {
       const details = body?.error?.details;
       const retryAfter = typeof details?.retryAfterSeconds === "number" ? details.retryAfterSeconds : typeof body?.retryAfterSeconds === "number" ? body.retryAfterSeconds : void 0;
@@ -900,19 +983,24 @@ var authApi = {
       throw new Error("Not authenticated");
     }
     const config = getConfig();
-    const response = await fetchWithTimeout(`${config.baseUrl}/auth/sso/link`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${accessToken}`
+    const result = await fetchWithTimeout(
+      `${config.baseUrl}/auth/sso/link`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${accessToken}`
+        },
+        body: JSON.stringify({ provider })
       },
-      body: JSON.stringify({ provider })
-    });
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({ message: "Failed to link SSO account" }));
-      throw new Error(error.error?.message || error.message || "Failed to link SSO account");
-    }
-    const result = await response.json();
+      async (response) => {
+        if (!response.ok) {
+          const error = await response.json().catch(() => ({ message: "Failed to link SSO account" }));
+          throw new Error(error.error?.message || error.message || "Failed to link SSO account");
+        }
+        return response.json();
+      }
+    );
     const authorizationUrl = extractData(result).authorizationUrl;
     if (authorizationUrl) {
       if (!isValidRedirectUrl(authorizationUrl)) {
@@ -1012,4 +1100,4 @@ var authApi = {
   }
 };
 
-export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState };
+export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, bumpSessionGeneration, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState };

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
 import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, l as RegisterResponse, q as User, k as ProfileUpdateData, C as ChangePasswordData, o as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, j as MFAStatus, i as MFASetupResponse, M as MFAChallengeData, h as MFAChallengeEmailResponse, D as Device, r as UserPreferences, L as LinkedAccount, n as SecurityEvent, P as Pagination, s as UserRolesResponse } from '../types-DF5Ny2IA.js';
 export { a as AuthConfig, b as AuthState, m as ResetPasswordData, S as SSOConfig, p as StorageAdapter, t as createMemoryStorage, u as createSessionStorage, v as getConfig, w as getDefaultStorage, x as getFetch, y as getStorage, z as initAuth, B as isInitialized, E as resetConfig } from '../types-DF5Ny2IA.js';
-export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError } from '../user-utils-B6BNJzF2.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, S as SessionChangedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError, j as isSessionChangedError } from '../user-utils-Bo3lMsuT.js';
 
 /**
  * SSO client state

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-BMCGFHVM.js';
-export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState } from '../chunk-QLEEAHJJ.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-A6JJQCBU.js';
+export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from '../chunk-QV3DUSP5.js';
 export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-K6TV3ZVS.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
 export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFAChallengeEmailResponse, i as MFASetupResponse, j as MFAStatus, P as Pagination, k as ProfileUpdateData, R as RegisterData, l as RegisterResponse, m as ResetPasswordData, S as SSOConfig, n as SecurityEvent, o as Session, p as StorageAdapter, U as UpdateApiKeyRequest, q as User, r as UserPreferences, s as UserRolesResponse, t as createMemoryStorage, u as createSessionStorage, v as getConfig, w as getDefaultStorage, x as getFetch, y as getStorage, z as initAuth, B as isInitialized, E as resetConfig } from './types-DF5Ny2IA.js';
 export { ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RefreshOutcome, RefreshSessionOptions, RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SsoClientStateResult, SsoClientStateVerification, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens, verifySsoClientState } from './core/index.js';
-export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError } from './user-utils-B6BNJzF2.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, S as SessionChangedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError, j as isSessionChangedError } from './user-utils-Bo3lMsuT.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-5SZT7GKG.js';
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-BMCGFHVM.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-HMZRBRIU.js';
-export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState } from './chunk-QLEEAHJJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-G6UH4HBI.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-A6JJQCBU.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-IR6DVUUF.js';
+export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from './chunk-QV3DUSP5.js';
 export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-K6TV3ZVS.js';

package/dist/svelte/index.d.ts

@@ -1,7 +1,7 @@
 import { b as AuthState, q as User, a as AuthConfig } from '../types-DF5Ny2IA.js';
 export { z as initAuth, B as isInitialized } from '../types-DF5Ny2IA.js';
-import { b as authService } from '../user-utils-B6BNJzF2.js';
-export { I as InvalidAuthResponseError, R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError } from '../user-utils-B6BNJzF2.js';
+import { b as authService } from '../user-utils-Bo3lMsuT.js';
+export { I as InvalidAuthResponseError, R as RoleDeniedError, S as SessionChangedError, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError, j as isSessionChangedError } from '../user-utils-Bo3lMsuT.js';
 
 /**
  * Auth Store

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-5SZT7GKG.js';
-export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-BMCGFHVM.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-HMZRBRIU.js';
-export { InvalidAuthResponseError, RoleDeniedError, isRoleDeniedError } from '../chunk-QLEEAHJJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-G6UH4HBI.js';
+export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-A6JJQCBU.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-IR6DVUUF.js';
+export { InvalidAuthResponseError, RoleDeniedError, SessionChangedError, isRoleDeniedError, isSessionChangedError } from '../chunk-QV3DUSP5.js';
 export { initAuth, isInitialized } from '../chunk-K6TV3ZVS.js';

package/dist/{user-utils-B6BNJzF2.d.ts → user-utils-Bo3lMsuT.d.ts}

@@ -326,6 +326,22 @@ declare class InvalidAuthResponseError extends Error {
     readonly name = "InvalidAuthResponseError";
     constructor(message?: string);
 }
+/**
+ * Error thrown when the session changed (logout, login as another account,
+ * expiry) while a request was in flight, and the request needed the session
+ * to continue (a 401 that would have been refreshed and retried). The request
+ * is not refreshed, retried or allowed to expire the new session: replaying it
+ * would send the previous account's request with the next account's
+ * credentials.
+ */
+declare class SessionChangedError extends Error {
+    readonly name = "SessionChangedError";
+    constructor(message?: string);
+}
+/**
+ * Type guard to check if an error is a SessionChangedError.
+ */
+declare function isSessionChangedError(error: unknown): error is SessionChangedError;
 /**
  * Error thrown when CHAPI won't send an MFA challenge email code: the
  * challenge token is invalid or expired (401), the account has no email MFA
@@ -444,4 +460,4 @@ declare function formatUserRoles(user: User | null | undefined, options?: {
     capitalize?: boolean;
 }): string;
 
-export { AuthService as A, InvalidAuthResponseError as I, type LoginOptions as L, MFAChallengeEmailError as M, RoleDeniedError as R, type MFAVerifyOptions as a, authService as b, getDisplayName as c, getGreeting as d, getUserEmail as e, formatUserRoles as f, getAvatarFallback as g, getUserInitials as h, isRoleDeniedError as i };
+export { AuthService as A, InvalidAuthResponseError as I, type LoginOptions as L, MFAChallengeEmailError as M, RoleDeniedError as R, SessionChangedError as S, type MFAVerifyOptions as a, authService as b, getDisplayName as c, getGreeting as d, getUserEmail as e, formatUserRoles as f, getAvatarFallback as g, getUserInitials as h, isRoleDeniedError as i, isSessionChangedError as j };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.41.0",
+  "version": "1.42.1",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",