@seamless-auth/svelte 0.0.0-stage → 0.1.0

package/dist/auth.svelte.js

@@ -0,0 +1,208 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { createAuthSession, createBrowserOAuthRedirect, createBrowserPasskeyPort, createMemoryStorage, detectPasskeySupport, loadLoginMethods, } from '@seamless-auth/client';
+const isBrowser = () => typeof window !== 'undefined' && typeof document !== 'undefined';
+/**
+ * Session state and auth actions for a Svelte application, from
+ * `createSeamlessAuth`.
+ *
+ * A thin binding over the framework-agnostic session store in
+ * `@seamless-auth/client`: the store owns the state machine, and this mirrors
+ * it into runes, so every property reads reactively in a component or an
+ * `$effect`. Change the session through the actions.
+ */
+export class SeamlessAuth {
+    #session;
+    // Assigned in the constructor, once the session exists.
+    #state = $state.raw(undefined);
+    #loginMethods = $state.raw(null);
+    #loginMethodsLoading = $state(true);
+    #passkeySupported = $state(false);
+    #passkeySupportLoading = $state(true);
+    #loginMethodsRequest = null;
+    #passkeySupportRequest = null;
+    #pendingSettles = new Set();
+    #unsubscribe;
+    #browser;
+    /** The platform ports the bundled screens go through. */
+    ports;
+    /** The client behind the session, for calls the session does not wrap. */
+    client;
+    /** How the bundled screens add their stylesheet. */
+    styles;
+    /** Where the bundled screens go once someone is signed in. */
+    signedInPath;
+    /** Where `requireAuth` sends someone who is signed out. */
+    loginPath;
+    constructor(config) {
+        this.#browser = isBrowser();
+        this.ports = {
+            passkeys: config.ports?.passkeys ?? createBrowserPasskeyPort(),
+            oauthRedirect: config.ports?.oauthRedirect ?? createBrowserOAuthRedirect(),
+        };
+        this.#session = createAuthSession({
+            apiHost: config.apiHost,
+            magicLinkRedirectUri: config.magicLinkRedirectUri,
+            // Cookie transport only. `mode` is deliberately not configurable here, so
+            // no token is ever handed to page scripts.
+            transport: {
+                basePath: config.basePath,
+                fetch: config.fetch,
+                trustedOrigins: config.trustedOrigins,
+            },
+            passkeys: this.ports.passkeys,
+            detectPreviousSignIn: config.autoDetectPreviousSignIn ?? true,
+            initialSession: config.initialSession,
+            // A server render has no browser storage to read.
+            storage: this.#browser ? undefined : createMemoryStorage(),
+        });
+        this.client = this.#session.client;
+        this.styles = { inject: config.injectStyles ?? true, nonce: config.cspNonce };
+        this.signedInPath = config.signedInPath ?? '/';
+        this.loginPath = config.loginPath ?? '/login';
+        // A server render shows what the server knows; the browser reads the rest
+        // as soon as it runs.
+        const read = this.#browser ? this.#session.getState : this.#session.getServerState;
+        this.#state = read();
+        this.#unsubscribe = this.#session.subscribe(() => {
+            this.#state = read();
+        });
+        if (this.#browser) {
+            void this.#session.actions.refreshSession({
+                background: config.initialSession !== undefined,
+            });
+        }
+    }
+    /** Everything the session knows. Replaced wholesale on every change. */
+    get state() {
+        return this.#state;
+    }
+    get user() {
+        return this.#state.user;
+    }
+    get isAuthenticated() {
+        return this.#state.isAuthenticated;
+    }
+    /** True until the session has been read. Guards wait on this. */
+    get loading() {
+        return this.#state.loading;
+    }
+    get credentials() {
+        return this.#state.credentials;
+    }
+    get organizations() {
+        return this.#state.organizations;
+    }
+    get activeOrganization() {
+        return this.#state.activeOrganization;
+    }
+    get stepUpStatus() {
+        return this.#state.stepUpStatus;
+    }
+    get hasSignedInBefore() {
+        return this.#state.hasSignedInBefore;
+    }
+    /**
+     * Sign-in methods this instance has enabled, once `loadLoginMethods()` has
+     * answered. Null means unknown, never "none".
+     */
+    get loginMethods() {
+        return this.#loginMethods;
+    }
+    get loginMethodsLoading() {
+        return this.#loginMethodsLoading;
+    }
+    /** Whether this device can use a passkey, once `checkPasskeySupport()` has answered. */
+    get passkeySupported() {
+        return this.#passkeySupported;
+    }
+    get passkeySupportLoading() {
+        return this.#passkeySupportLoading;
+    }
+    /** Reads the instance's sign-in methods once and caches the answer. */
+    loadLoginMethods() {
+        this.#loginMethodsRequest ??= loadLoginMethods(this.client).then(methods => {
+            this.#loginMethods = methods;
+            this.#loginMethodsLoading = false;
+            return methods;
+        });
+        return this.#loginMethodsRequest;
+    }
+    /** Detects passkey support once and caches the answer. */
+    checkPasskeySupport() {
+        this.#passkeySupportRequest ??= (this.#browser ? detectPasskeySupport(this.ports.passkeys) : Promise.resolve(false)).then(supported => {
+            this.#passkeySupported = supported;
+            this.#passkeySupportLoading = false;
+            return supported;
+        });
+        return this.#passkeySupportRequest;
+    }
+    /**
+     * Resolves with the state once the session has been read. During a server
+     * render the session is never read there, so this resolves at once with what
+     * the server knows. It also resolves if the session is destroyed first.
+     */
+    whenSettled() {
+        const current = this.#state;
+        if (!current.loading || !this.#browser) {
+            return Promise.resolve(current);
+        }
+        return new Promise(resolve => {
+            const settle = (next) => {
+                stop();
+                this.#pendingSettles.delete(abandon);
+                resolve(next);
+            };
+            const abandon = () => settle(this.#state);
+            const stop = this.#session.subscribe(() => {
+                const next = this.#session.getState();
+                if (!next.loading)
+                    settle(next);
+            });
+            this.#pendingSettles.add(abandon);
+        });
+    }
+    /**
+     * A fetch for the application's own API that carries the session cookies.
+     * A path resolves on `apiHost`. Only `apiHost` and `trustedOrigins` receive
+     * the session; any other origin rejects with `UntrustedOriginError`.
+     */
+    authorizedFetch = (input, init) => this.client.authorizedFetch(input, init);
+    login = (...args) => this.#session.actions.login(...args);
+    handlePasskeyLogin = () => this.#session.actions.handlePasskeyLogin();
+    registerPasskey = input => this.#session.actions.registerPasskey(input);
+    refreshSession = options => this.#session.actions.refreshSession(options);
+    logout = () => this.#session.actions.logout();
+    logoutAllSessions = () => this.#session.actions.logoutAllSessions();
+    deleteUser = () => this.#session.actions.deleteUser();
+    updateCredential = credential => this.#session.actions.updateCredential(credential);
+    deleteCredential = id => this.#session.actions.deleteCredential(id);
+    switchOrganization = id => this.#session.actions.switchOrganization(id);
+    listOAuthProviders = () => this.#session.actions.listOAuthProviders();
+    startOAuthLogin = input => this.#session.actions.startOAuthLogin(input);
+    finishOAuthLogin = input => this.#session.actions.finishOAuthLogin(input);
+    refreshStepUpStatus = () => this.#session.actions.refreshStepUpStatus();
+    verifyStepUpWithPasskey = () => this.#session.actions.verifyStepUpWithPasskey();
+    verifyStepUpWithPasskeyPrf = input => this.#session.actions.verifyStepUpWithPasskeyPrf(input);
+    verifyStepUpWithTotp = code => this.#session.actions.verifyStepUpWithTotp(code);
+    hasRole = role => this.#session.actions.hasRole(role);
+    hasScopedRole = role => this.#session.actions.hasScopedRole(role);
+    markSignedIn = () => this.#session.actions.markSignedIn();
+    /** Stops the session. Pending `whenSettled()` calls resolve with the last state. */
+    destroy() {
+        [...this.#pendingSettles].forEach(abandon => abandon());
+        this.#unsubscribe();
+        this.#session.destroy();
+    }
+}
+/**
+ * Creates the session for an application. In the browser it is read straight
+ * away. Create one per application (one per request when rendering on a
+ * server), and hand it to the screens with `setSeamlessAuth`.
+ */
+export function createSeamlessAuth(config) {
+    return new SeamlessAuth(config);
+}

package/dist/config.d.ts

@@ -0,0 +1,49 @@
+import type { InitialSession, OAuthRedirectPort, PasskeyPort } from '@seamless-auth/client';
+/**
+ * What a browser application configures. There is no transport mode: a Svelte
+ * application runs in the browser, where the server adapter holds the tokens
+ * and the browser holds only its HttpOnly cookies.
+ */
+export interface SeamlessAuthConfig {
+    /** Origin of the server adapter, for example `https://app.example.com`. */
+    apiHost: string;
+    /** Where the adapter is mounted on `apiHost`. Defaults to `/auth`. */
+    basePath?: string;
+    /** Where a magic link sent by the bundled screens should land. */
+    magicLinkRedirectUri?: string;
+    /**
+     * Whether `hasSignedInBefore` reports a previous sign-in from this browser,
+     * which the bundled login screen uses to open on Sign In rather than Create
+     * Account. Defaults to true.
+     */
+    autoDetectPreviousSignIn?: boolean;
+    /**
+     * The session a server already resolved for this request, or `null` when it
+     * found none. The first render is then settled rather than loading.
+     */
+    initialSession?: InitialSession | null;
+    /** Platform ports. Each one left out falls back to the browser's. */
+    ports?: Partial<SeamlessAuthPorts>;
+    /** A fetch to send auth requests with. Defaults to the global one. */
+    fetch?: typeof fetch;
+    /**
+     * Origins besides `apiHost` that `authorizedFetch` may send the session
+     * cookies to. Every other origin is refused.
+     */
+    trustedOrigins?: string[];
+    /**
+     * Whether the bundled screens add their stylesheet to the page. Defaults to
+     * true. Set false to link `@seamless-auth/svelte/seamless-auth.css` yourself.
+     */
+    injectStyles?: boolean;
+    /** A CSP nonce for the stylesheet the screens add, when `injectStyles` is on. */
+    cspNonce?: string;
+    /** Where the bundled screens go once someone is signed in. Defaults to `/`. */
+    signedInPath?: string;
+    /** Where `requireAuth` sends someone who is signed out. Defaults to `/login`. */
+    loginPath?: string;
+}
+export interface SeamlessAuthPorts {
+    passkeys: PasskeyPort;
+    oauthRedirect: OAuthRedirectPort;
+}

package/dist/config.js

@@ -0,0 +1,6 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+export {};

package/dist/context.d.ts

@@ -0,0 +1,13 @@
+import type { SeamlessAuth } from './auth.svelte.js';
+import type { AuthNavigator } from './navigation.js';
+/**
+ * Makes the session available to the components below, the bundled screens
+ * included. Call it while a root component (a SvelteKit `+layout.svelte`, or
+ * `App.svelte`) initialises.
+ */
+export declare function setSeamlessAuth(auth: SeamlessAuth): SeamlessAuth;
+/** The session set by `setSeamlessAuth`. Call it while a component initialises. */
+export declare function getSeamlessAuth(): SeamlessAuth;
+/** Tells the bundled screens how to navigate. See `AuthNavigator`. */
+export declare function setAuthNavigator(navigator: AuthNavigator): AuthNavigator;
+export declare function getAuthNavigator(): AuthNavigator;

package/dist/context.js

@@ -0,0 +1,35 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { getContext, setContext } from 'svelte';
+const AUTH_KEY = Symbol('seamless-auth');
+const NAVIGATOR_KEY = Symbol('seamless-auth-navigator');
+/**
+ * Makes the session available to the components below, the bundled screens
+ * included. Call it while a root component (a SvelteKit `+layout.svelte`, or
+ * `App.svelte`) initialises.
+ */
+export function setSeamlessAuth(auth) {
+    return setContext(AUTH_KEY, auth);
+}
+/** The session set by `setSeamlessAuth`. Call it while a component initialises. */
+export function getSeamlessAuth() {
+    const auth = getContext(AUTH_KEY);
+    if (!auth) {
+        throw new Error('Seamless Auth is not set. Call setSeamlessAuth(createSeamlessAuth({ apiHost })) in a root component.');
+    }
+    return auth;
+}
+/** Tells the bundled screens how to navigate. See `AuthNavigator`. */
+export function setAuthNavigator(navigator) {
+    return setContext(NAVIGATOR_KEY, navigator);
+}
+export function getAuthNavigator() {
+    const navigator = getContext(NAVIGATOR_KEY);
+    if (!navigator) {
+        throw new Error('The Seamless Auth screens need a navigator. In SvelteKit, call setAuthNavigator(createKitNavigator(auth)) in your root layout.');
+    }
+    return navigator;
+}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+export { createSeamlessAuth, SeamlessAuth } from './auth.svelte.js';
+export type { SeamlessAuthConfig, SeamlessAuthPorts } from './config.js';
+export { getAuthNavigator, getSeamlessAuth, setAuthNavigator, setSeamlessAuth, } from './context.js';
+export { authRoutePaths } from './navigation.js';
+export type { AuthNavigator, AuthScreen } from './navigation.js';
+export { default as SaAuthLayout } from './screens/AuthLayout.svelte';
+export { default as SaFallbackOptions } from './screens/FallbackOptions.svelte';
+export { default as SaLogin } from './screens/Login.svelte';
+export { default as SaMagicLinkSent } from './screens/MagicLinkSent.svelte';
+export { default as SaOAuthCallback } from './screens/OAuthCallback.svelte';
+export { default as SaOAuthProviderButtons } from './screens/OAuthProviderButtons.svelte';
+export { default as SaOtpInput } from './screens/OtpInput.svelte';
+export { default as SaPasskeyLogin } from './screens/PasskeyLogin.svelte';
+export { default as SaRegisterPasskey } from './screens/RegisterPasskey.svelte';
+export { default as SaVerifyMagicLink } from './screens/VerifyMagicLink.svelte';
+export { default as SaVerifyOtp } from './screens/VerifyOtp.svelte';
+export { getOAuthErrorCode, getPasskeyPolicyErrorCode, getWebAuthnErrorDetail, hasScopedRole, isUnauthenticated, roleGrantsAccess, SeamlessAuthError, UntrustedOriginError, } from '@seamless-auth/client';
+export type { AuthSessionState, Credential, CurrentUserResult, InitialSession, LoginMethod, OAuthProvider, OAuthRedirectPort, Organization, PasskeyPort, RefreshSessionOptions, SeamlessAuthClient, SeamlessAuthResult, StepUpStatus, User, } from '@seamless-auth/client';

package/dist/index.js

@@ -0,0 +1,21 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+export { createSeamlessAuth, SeamlessAuth } from './auth.svelte.js';
+export { getAuthNavigator, getSeamlessAuth, setAuthNavigator, setSeamlessAuth, } from './context.js';
+export { authRoutePaths } from './navigation.js';
+export { default as SaAuthLayout } from './screens/AuthLayout.svelte';
+export { default as SaFallbackOptions } from './screens/FallbackOptions.svelte';
+export { default as SaLogin } from './screens/Login.svelte';
+export { default as SaMagicLinkSent } from './screens/MagicLinkSent.svelte';
+export { default as SaOAuthCallback } from './screens/OAuthCallback.svelte';
+export { default as SaOAuthProviderButtons } from './screens/OAuthProviderButtons.svelte';
+export { default as SaOtpInput } from './screens/OtpInput.svelte';
+export { default as SaPasskeyLogin } from './screens/PasskeyLogin.svelte';
+export { default as SaRegisterPasskey } from './screens/RegisterPasskey.svelte';
+export { default as SaVerifyMagicLink } from './screens/VerifyMagicLink.svelte';
+export { default as SaVerifyOtp } from './screens/VerifyOtp.svelte';
+// The client core, re-exported so an application imports from one package.
+export { getOAuthErrorCode, getPasskeyPolicyErrorCode, getWebAuthnErrorDetail, hasScopedRole, isUnauthenticated, roleGrantsAccess, SeamlessAuthError, UntrustedOriginError, } from '@seamless-auth/client';

package/dist/kit/index.d.ts

@@ -0,0 +1,55 @@
+import type { SeamlessAuth } from '../auth.svelte.js';
+import { type AuthNavigator, type AuthScreen } from '../navigation.js';
+/** The parts of a SvelteKit load event the guards use, in both Kit 2 and 3. */
+export interface GuardLoadEvent {
+    url: URL;
+    depends(...deps: `${string}:${string}`[]): void;
+}
+export interface KitNavigatorOptions {
+    /** Where each bundled screen is mounted, when not at its default path. */
+    paths?: Partial<Record<AuthScreen, string>>;
+}
+/**
+ * The bundled screens' navigator for SvelteKit, from `$app/navigation`. Create
+ * it while the root layout initialises, so it can also re-run the `load` guards
+ * whenever the session changes:
+ *
+ * ```svelte
+ * setSeamlessAuth(auth);
+ * setAuthNavigator(createKitNavigator(auth));
+ * ```
+ */
+export declare function createKitNavigator(auth: SeamlessAuth, options?: KitNavigatorOptions): AuthNavigator;
+export interface RequireAuthOptions {
+    /** Where to send someone who is signed out. Defaults to the configured `loginPath`. */
+    redirectTo?: string;
+    /**
+     * Roles the user needs, matched the way the auth API matches them (scoped
+     * roles such as `org:admin` included). Any one of a list is enough.
+     */
+    roles?: string | string[];
+    /** Where to send a signed-in user without the role. Defaults to `signedInPath`. */
+    forbiddenRedirectTo?: string;
+}
+/**
+ * A `load` function that admits a signed-in user, for a `+layout.ts` or
+ * `+page.ts`:
+ *
+ * ```ts
+ * export const load = requireAuth(auth);
+ * ```
+ *
+ * It waits for the session to be read, so reloading a protected page does not
+ * bounce a signed-in user, and runs again whenever the session changes. A
+ * server render that was not handed an `initialSession` cannot see the session
+ * and treats the visitor as signed out, so set `export const ssr = false` on
+ * protected routes, which suits a backend-for-frontend application anyway.
+ */
+export declare function requireAuth(auth: SeamlessAuth, options?: RequireAuthOptions): (event: GuardLoadEvent) => Promise<void>;
+/**
+ * A `load` function that admits someone who is signed out, and sends a signed-in
+ * user to `signedInPath`. For the screens that start a sign-in.
+ */
+export declare function requireGuest(auth: SeamlessAuth, options?: {
+    redirectTo?: string;
+}): (event: GuardLoadEvent) => Promise<void>;

package/dist/kit/index.js

@@ -0,0 +1,121 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { redirect } from '@sveltejs/kit';
+import { afterNavigate, goto } from '$app/navigation';
+import { resolve as resolveRoute } from '$app/paths';
+import { page } from '$app/state';
+import { authRoutePaths } from '../navigation.js';
+import { invalidateOnSessionChange, SESSION_DEPENDENCY } from './watch.svelte.js';
+// Kit types `resolve` against the application's own route ids, which a library
+// cannot know, so it is called as the plain pathname resolver it also is.
+const resolve = resolveRoute;
+/**
+ * The bundled screens' navigator for SvelteKit, from `$app/navigation`. Create
+ * it while the root layout initialises, so it can also re-run the `load` guards
+ * whenever the session changes:
+ *
+ * ```svelte
+ * setSeamlessAuth(auth);
+ * setAuthNavigator(createKitNavigator(auth));
+ * ```
+ */
+export function createKitNavigator(auth, options = {}) {
+    const pathOf = (screen) => resolve(options.paths?.[screen] ?? authRoutePaths[screen]);
+    const base = resolve('/').replace(/\/+$/, '');
+    // A screen mounts while Kit is still hydrating the first page, before its
+    // router has started, and a navigation then fails. The first afterNavigate
+    // marks the end of hydration.
+    let markReady = () => undefined;
+    const ready = new Promise(resolveReady => {
+        markReady = resolveReady;
+    });
+    try {
+        afterNavigate(() => markReady());
+        invalidateOnSessionChange(auth);
+    }
+    catch {
+        // Created outside a component, so there is no hydration to wait for.
+        markReady();
+    }
+    const toApp = (path) => goto(resolve(path ?? auth.signedInPath));
+    return {
+        toScreen: (screen, state) => goto(pathOf(screen), { state: state ?? {} }),
+        toApp,
+        // A browser path already carries the base. One outside it (the '/' an OAuth
+        // sign-in falls back to, under a base path) is not in this application, so
+        // it goes to signedInPath instead.
+        toLocation: async (browserPath) => {
+            if (base && browserPath !== base && !browserPath.startsWith(`${base}/`)) {
+                return toApp();
+            }
+            try {
+                await goto(browserPath);
+            }
+            catch {
+                await toApp();
+            }
+        },
+        state: () => (page.state ?? {}),
+        query: name => page.url.searchParams.get(name),
+        // A real replace navigation to the same screen, which stays mounted. Shallow
+        // routing would only change the address bar: Kit keeps the old URL in
+        // page.url and in the history entry, where Back would bring the secret back.
+        dropQuery: async () => {
+            await ready;
+            // afterNavigate runs just before Kit marks its router started.
+            await Promise.resolve();
+            await goto(page.url.pathname, { replaceState: true, state: page.state });
+        },
+        absoluteUrl: screen => new URL(pathOf(screen), window.location.origin).toString(),
+    };
+}
+/**
+ * Makes Kit run a guard again on every navigation and whenever the session
+ * changes, instead of once per layout. Cheap: a settled session answers at once.
+ */
+function track(event) {
+    event.depends(SESSION_DEPENDENCY);
+    void event.url.pathname;
+}
+/**
+ * A `load` function that admits a signed-in user, for a `+layout.ts` or
+ * `+page.ts`:
+ *
+ * ```ts
+ * export const load = requireAuth(auth);
+ * ```
+ *
+ * It waits for the session to be read, so reloading a protected page does not
+ * bounce a signed-in user, and runs again whenever the session changes. A
+ * server render that was not handed an `initialSession` cannot see the session
+ * and treats the visitor as signed out, so set `export const ssr = false` on
+ * protected routes, which suits a backend-for-frontend application anyway.
+ */
+export function requireAuth(auth, options = {}) {
+    return async (event) => {
+        track(event);
+        const state = await auth.whenSettled();
+        if (state.loading || !state.isAuthenticated) {
+            redirect(307, resolve(options.redirectTo ?? auth.loginPath));
+        }
+        if (options.roles !== undefined && !auth.hasScopedRole(options.roles)) {
+            redirect(307, resolve(options.forbiddenRedirectTo ?? auth.signedInPath));
+        }
+    };
+}
+/**
+ * A `load` function that admits someone who is signed out, and sends a signed-in
+ * user to `signedInPath`. For the screens that start a sign-in.
+ */
+export function requireGuest(auth, options = {}) {
+    return async (event) => {
+        track(event);
+        const state = await auth.whenSettled();
+        if (state.isAuthenticated) {
+            redirect(307, resolve(options.redirectTo ?? auth.signedInPath));
+        }
+    };
+}

package/dist/kit/watch.svelte.d.ts

@@ -0,0 +1,10 @@
+import type { SeamlessAuth } from '../auth.svelte.js';
+/** What the guards register, so a change in the session runs them again. */
+export declare const SESSION_DEPENDENCY = "seamless-auth:session";
+/**
+ * Re-runs every `load` guard when who is signed in, or as which organization,
+ * changes: a sign-out in another tab, an expired session, a switched
+ * organization. Without it a layout's guard runs once and its child pages keep
+ * rendering. Call it while a component initialises.
+ */
+export declare function invalidateOnSessionChange(auth: SeamlessAuth): void;

package/dist/kit/watch.svelte.js

@@ -0,0 +1,28 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { invalidate } from '$app/navigation';
+/** What the guards register, so a change in the session runs them again. */
+export const SESSION_DEPENDENCY = 'seamless-auth:session';
+/**
+ * Re-runs every `load` guard when who is signed in, or as which organization,
+ * changes: a sign-out in another tab, an expired session, a switched
+ * organization. Without it a layout's guard runs once and its child pages keep
+ * rendering. Call it while a component initialises.
+ */
+export function invalidateOnSessionChange(auth) {
+    let first = true;
+    $effect(() => {
+        // Read for tracking: these are what a guard decides on.
+        void auth.isAuthenticated;
+        void auth.user;
+        void auth.activeOrganization;
+        if (first) {
+            first = false;
+            return;
+        }
+        void invalidate(SESSION_DEPENDENCY);
+    });
+}

package/dist/navigation.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The bundled screens, by key, and their default paths.
+ *
+ * Two paths are set by contracts outside this package: `verifyMagicLink` is the
+ * URL the auth API builds when it emails a magic link, and `oauthCallback` is
+ * registered with OAuth providers as an allowed redirect URI.
+ */
+export declare const authRoutePaths: {
+    readonly login: "/login";
+    readonly passkeyLogin: "/passkey-login";
+    readonly verifyPhoneOtp: "/verify-phone-otp";
+    readonly verifyEmailOtp: "/verify-email-otp";
+    readonly verifyMagicLink: "/verify-magiclink";
+    readonly oauthCallback: "/oauth/callback";
+    readonly registerPasskey: "/register-passkey";
+    readonly magicLinkSent: "/magic-link-sent";
+};
+export type AuthScreen = keyof typeof authRoutePaths;
+/**
+ * How the bundled screens move, supplied by the application's router. The
+ * screens never import a router themselves, so they work in SvelteKit (see
+ * `createKitNavigator` in `@seamless-auth/svelte/kit`) or with any other router
+ * that can implement this.
+ */
+export interface AuthNavigator {
+    /** Go to another bundled screen, handing it some navigation state. */
+    toScreen(screen: AuthScreen, state?: Record<string, string>): Promise<void>;
+    /** Go to an in-app path, or to the configured `signedInPath`. */
+    toApp(path?: string): Promise<void>;
+    /** Go to a path as the browser sees it, base path included. */
+    toLocation(browserPath: string): Promise<void>;
+    /** The navigation state the previous screen handed over. */
+    state(): Record<string, unknown>;
+    /** A query parameter of the current URL. */
+    query(name: string): string | null;
+    /** Drop the query from the current URL in place, without leaving the screen. */
+    dropQuery(): Promise<void>;
+    /** A screen's absolute URL, for a redirect URI. */
+    absoluteUrl(screen: AuthScreen): string;
+}

package/dist/navigation.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+/**
+ * The bundled screens, by key, and their default paths.
+ *
+ * Two paths are set by contracts outside this package: `verifyMagicLink` is the
+ * URL the auth API builds when it emails a magic link, and `oauthCallback` is
+ * registered with OAuth providers as an allowed redirect URI.
+ */
+export const authRoutePaths = {
+    login: '/login',
+    passkeyLogin: '/passkey-login',
+    verifyPhoneOtp: '/verify-phone-otp',
+    verifyEmailOtp: '/verify-email-otp',
+    verifyMagicLink: '/verify-magiclink',
+    oauthCallback: '/oauth/callback',
+    registerPasskey: '/register-passkey',
+    magicLinkSent: '/magic-link-sent',
+};