@sourceregistry/sveltekit-oidc 1.3.0 → 1.3.1

package/README.md

@@ -129,6 +129,7 @@ export async function load(event) {
 	session={data.session}
 	config={data.sessionManagement}
 	logoutPath="/auth/logout"
+	monitorSession={false}
 	redirectIfUnauthenticated={false}
 >
 	<Account />
@@ -160,6 +161,10 @@ export async function load(event) {
 - periodic `invalidateAll()` revalidation so revoked server sessions are detected
 - a client context for nested auth-aware components through `useOIDC()` / `getOIDCContext()`
 
+Set `monitorSession={false}` when you want to keep the client context but leave remote session
+revocation checks to your server-side guard or another mechanism. This disables
+`check_session_iframe` polling without changing the provider metadata exposed through the context.
+
 ## Typed Custom Claims
 
 `createOIDC` infers a `TClaims` type from whatever `transformClaims` / `transformUser` / `transformSession` return, and threads it through the session, `event.locals.oidc`, `OIDCPublicSession`, and the client context — no casts needed.
@@ -302,6 +307,6 @@ Set these environment variables to enable it:
 - The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata.
 - `groups` are normalized onto the session from `groups` and `roles` claims when present.
 - Use `transformClaims`, `transformUser`, and `transformSession` to project provider-specific claims into your own session shape.
-- `check_session_iframe` monitoring only runs when the provider advertises that endpoint and the session includes `session_state`.
+- `check_session_iframe` monitoring only runs when `monitorSession` is enabled, the provider advertises that endpoint, and the session includes `session_state`.
 - Refresh token handling is automatic when a valid refresh token is present.
 - `event.locals.oidc` is attached by the hook and typed via `OIDCHandleLocals<TClaims>`; see [Typed Custom Claims](#typed-custom-claims) for wiring your own claim shapes through `app.d.ts`.

package/dist/client/OIDCContext.svelte

@@ -19,6 +19,7 @@
         loginPath,
         logoutPath = '/auth/logout',
         checkSessionIntervalMs = 5000,
+        monitorSession = true,
         revalidateIntervalMs = 30000,
         redirectOnExpired = 'login',
         redirectOnRevoked = 'login',
@@ -30,6 +31,7 @@
         loginPath?: string;
         logoutPath?: string;
         checkSessionIntervalMs?: number;
+        monitorSession?: boolean;
         revalidateIntervalMs?: number;
         redirectOnExpired?: RedirectMode;
         redirectOnRevoked?: RedirectMode;
@@ -47,7 +49,7 @@
         config.metadata.check_session_iframe ?? config.checkSessionIframe ?? undefined
     );
     const canMonitorIframe = $derived(
-        Boolean(session?.isAuthenticated && session?.sessionState && iframeUrl)
+        Boolean(monitorSession && session?.isAuthenticated && session?.sessionState && iframeUrl)
     );
 
     const context = setOIDCContext<TClaims>({

package/dist/client/OIDCContext.svelte.d.ts

@@ -7,6 +7,7 @@ declare function $$render<TClaims extends OIDCUserClaims = OIDCUserClaims>(): {
         loginPath?: string;
         logoutPath?: string;
         checkSessionIntervalMs?: number;
+        monitorSession?: boolean;
         revalidateIntervalMs?: number;
         redirectOnExpired?: "none" | "login" | "logout" | "reload";
         redirectOnRevoked?: "none" | "login" | "logout" | "reload";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.3.0",
-  "description": "OIDC authentication helpers for SvelteKit applications.",
+  "version": "1.3.1",
+  "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {
     "dev": "vite dev",