@elevasis/ui 1.3.0 → 1.3.1

package/dist/CoreAuthKitInner-3J4RVQO6.js

@@ -0,0 +1,43 @@
+import { AuthProvider } from './chunk-7PLEQFHO.js';
+import { AuthKitProvider, useAuth } from '@workos-inc/authkit-react';
+import { useMemo } from 'react';
+import { jsx } from 'react/jsx-runtime';
+
+function CoreAuthKitInner({ auth, children }) {
+  return /* @__PURE__ */ jsx(
+    AuthKitProvider,
+    {
+      clientId: auth.clientId,
+      apiHostname: auth.apiHostname ?? "api.workos.com",
+      redirectUri: auth.redirectUri,
+      devMode: auth.devMode ?? false,
+      children: /* @__PURE__ */ jsx(WorkOSAuthAdapter, { children })
+    }
+  );
+}
+var WORKOS_REFRESH_TOKEN_KEY = "workos:refresh-token";
+function hasWorkOSRefreshToken() {
+  try {
+    return !!localStorage.getItem(WORKOS_REFRESH_TOKEN_KEY);
+  } catch {
+    return false;
+  }
+}
+function WorkOSAuthAdapter({ children }) {
+  const { user, isLoading, getAccessToken, organizationId, signIn } = useAuth();
+  const adaptedUser = useMemo(() => user ? { id: user.id } : null, [user?.id]);
+  const value = useMemo(
+    () => ({
+      user: adaptedUser,
+      isLoading,
+      getAccessToken,
+      organizationId: organizationId ?? null,
+      signIn,
+      canRecover: hasWorkOSRefreshToken
+    }),
+    [adaptedUser, isLoading, getAccessToken, organizationId, signIn]
+  );
+  return /* @__PURE__ */ jsx(AuthProvider, { value, children });
+}
+
+export { CoreAuthKitInner };

package/dist/api/index.d.ts

@@ -68,18 +68,17 @@ declare function useApiClientContext(): ApiClientContextValue;
  */
 declare function ApiClientProvider({ children, getAccessToken, organizationId, getOrganizationId: getOrganizationIdProp, isOrganizationReady, onError }: ApiClientProviderProps): react_jsx_runtime.JSX.Element;
 
-/**
- * Return type of useOrganizations hook (subset needed by the factory)
- */
-interface UseOrganizationsReturn {
-    isInitializing: boolean;
-    isOrgRefreshing: boolean;
-}
 /**
  * Hook that returns apiRequest and deferredApiRequest bound to the current
  * ApiClientContext. apiUrl is the only parameter because org ID is resolved
  * at call time via getOrganizationId() from context.
  *
+ * When OrganizationProvider is present in the tree, isOrganizationReady and
+ * isInitializing reflect the live org state (currentWorkOSOrganizationId,
+ * isInitializing, isOrgRefreshing). When OrganizationProvider is absent
+ * (e.g. theme-only mode, testing), the hook falls back to the values from
+ * ApiClientContext.
+ *
  * Usage:
  * ```typescript
  * import { useApiClient } from '@repo/ui/api'
@@ -97,29 +96,6 @@ declare function useApiClient(apiUrl: string): {
     isOrganizationReady: boolean;
     isInitializing: boolean;
 };
-/**
- * Factory function to create a useApiClient hook for your app.
- *
- * @deprecated Use the plain `useApiClient(apiUrl)` hook instead.
- * The factory pattern is no longer needed because org ID is resolved at
- * call time via getOrganizationId() from ApiClientContext.
- *
- * Migration:
- * ```typescript
- * // Before
- * export const useApiClient = createUseApiClient(useOrganizations, API_URL)
- *
- * // After
- * import { useApiClient } from '@repo/ui/api'
- * // call useApiClient(API_URL) directly in your hook/component
- * ```
- */
-declare function createUseApiClient(useOrganizations: () => UseOrganizationsReturn, apiUrl: string): () => {
-    apiRequest: <T>(endpoint: string, options?: RequestInit) => Promise<T>;
-    deferredApiRequest: <T>(endpoint: string, options?: RequestInit) => Promise<T>;
-    isOrganizationReady: boolean;
-    isInitializing: boolean;
-};
 
-export { ApiClientProvider, createUseApiClient, useApiClient, useApiClientContext };
+export { ApiClientProvider, useApiClient, useApiClientContext };
 export type { ApiClientContextValue, ApiClientProviderProps, ApiErrorDetails };

package/dist/api/index.js

@@ -1,4 +1,5 @@
 import '../chunk-XCYKC6OZ.js';
-export { ApiClientProvider, createUseApiClient, useApiClient, useApiClientContext } from '../chunk-BWCC6ZJC.js';
+export { ApiClientProvider, useApiClient, useApiClientContext } from '../chunk-XLV6LYN2.js';
 import '../chunk-JVAZHVNV.js';
 import '../chunk-4VGWQ5AN.js';
+import '../chunk-DD3CCMCZ.js';

package/dist/auth/context.d.ts

@@ -1,19 +1,37 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
 
-interface AuthAdapter {
+interface AuthContextValue {
     user: {
         id: string;
     } | null;
     isLoading: boolean;
     getAccessToken: () => Promise<string>;
     organizationId?: string | null;
+    /**
+     * Trigger WorkOS AuthKit's sign-in flow (redirect to WorkOS hosted auth page).
+     * Used by ProtectedRoute for auto-recovery when `canRecover()` returns true.
+     */
+    signIn: (options?: {
+        state?: {
+            returnTo?: string;
+        };
+    }) => void;
+    /**
+     * Returns true when a previous session can be recovered (refresh token
+     * exists in storage). ProtectedRoute calls `signIn()` only when this returns
+     * true; otherwise it navigates to the login page.
+     *
+     * Explicit logout clears the stored token, so canRecover() returns false
+     * and the user sees the login page as expected.
+     */
+    canRecover: () => boolean;
 }
-declare function useAuthContext(): AuthAdapter;
+declare function useAuthContext(): AuthContextValue;
 declare function AuthProvider({ value, children }: {
-    value: AuthAdapter;
+    value: AuthContextValue;
     children: ReactNode;
-}): react.FunctionComponentElement<react.ProviderProps<AuthAdapter | null>>;
+}): react.FunctionComponentElement<react.ProviderProps<AuthContextValue | null>>;
 
 export { AuthProvider, useAuthContext };
-export type { AuthAdapter };
+export type { AuthContextValue };

package/dist/auth/index.d.ts

@@ -2,43 +2,37 @@ import * as react from 'react';
 import { ReactNode } from 'react';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 
-interface AuthAdapter {
+interface AuthContextValue {
     user: {
         id: string;
     } | null;
     isLoading: boolean;
     getAccessToken: () => Promise<string>;
     organizationId?: string | null;
+    /**
+     * Trigger WorkOS AuthKit's sign-in flow (redirect to WorkOS hosted auth page).
+     * Used by ProtectedRoute for auto-recovery when `canRecover()` returns true.
+     */
+    signIn: (options?: {
+        state?: {
+            returnTo?: string;
+        };
+    }) => void;
+    /**
+     * Returns true when a previous session can be recovered (refresh token
+     * exists in storage). ProtectedRoute calls `signIn()` only when this returns
+     * true; otherwise it navigates to the login page.
+     *
+     * Explicit logout clears the stored token, so canRecover() returns false
+     * and the user sees the login page as expected.
+     */
+    canRecover: () => boolean;
 }
-declare function useAuthContext(): AuthAdapter;
+declare function useAuthContext(): AuthContextValue;
 declare function AuthProvider({ value, children }: {
-    value: AuthAdapter;
-    children: ReactNode;
-}): react.FunctionComponentElement<react.ProviderProps<AuthAdapter | null>>;
-
-/**
- * Bridge component that reads WorkOS AuthKit state and provides it
- * via the generic AuthContext. Place inside AuthKitProvider.
- *
- * Narrows WorkOS User to { id: string } -- @repo/ui hooks only need the ID.
- * Uses useMemo to stabilize the user object and prevent unnecessary
- * useEffect re-runs in downstream hooks.
- */
-declare function WorkOSAuthBridge({ children }: {
+    value: AuthContextValue;
     children: ReactNode;
-}): react_jsx_runtime.JSX.Element;
-
-interface OAuthContextValue {
-    user: {
-        id: string;
-    } | null;
-    isLoading: boolean;
-    organizationId: string | null;
-    getAccessToken: () => Promise<string>;
-    error: string | null;
-    initiateOAuthFlow: () => void;
-}
-declare function useOAuthContext(): OAuthContextValue;
+}): react.FunctionComponentElement<react.ProviderProps<AuthContextValue | null>>;
 
 /**
  * Returns a stable reference to getAccessToken that won't change between renders
@@ -92,7 +86,8 @@ interface InitializationError {
 interface ProtectedRouteProps {
     children: ReactNode;
     /**
-     * Path to redirect to when user is unauthenticated.
+     * Path to redirect to when user is unauthenticated and the auth adapter
+     * does not provide a `signIn` function.
      * @default '/login'
      */
     redirectTo?: string;
@@ -118,10 +113,18 @@ interface ProtectedRouteProps {
  * Headless route guard for authenticated pages.
  *
  * Reads initialization state from the nearest InitializationProvider.
- * Redirects unauthenticated users to `redirectTo` (default: '/login')
- * with a `returnTo` search param preserving the current location.
  *
- * Organization-layer errors are allowed through — routes like /invitations
+ * When `canRecover()` returns true (refresh token exists), unauthenticated users
+ * are sent directly to WorkOS AuthKit via `signIn()`. WorkOS checks its
+ * server-side session and either signs the user in immediately (page-reload case)
+ * or shows a login form (logged-out case). Explicit logout destroys the
+ * server-side session, so the next auto-signIn correctly presents a login form
+ * rather than looping.
+ *
+ * When `canRecover()` returns false, falls back to navigating to `redirectTo`
+ * (default: '/login') with a `returnTo` search param.
+ *
+ * Organization-layer errors are allowed through -- routes like /invitations
  * must be accessible even when the user has no org membership.
  *
  * @example
@@ -169,5 +172,5 @@ interface AdminGuardProps {
  */
 declare function AdminGuard({ children, redirectTo, fallback }: AdminGuardProps): react_jsx_runtime.JSX.Element | null;
 
-export { AdminGuard, AuthProvider, ProtectedRoute, WorkOSAuthBridge, useAuthContext, useOAuthContext, useSessionCheck as useRefocusSessionCheck, useSessionCheck, useStableAccessToken };
-export type { AdminGuardProps, AuthAdapter, OAuthContextValue, ProtectedRouteProps };
+export { AdminGuard, AuthProvider, ProtectedRoute, useAuthContext, useSessionCheck as useRefocusSessionCheck, useSessionCheck, useStableAccessToken };
+export type { AdminGuardProps, AuthContextValue, ProtectedRouteProps };

package/dist/auth/index.js

@@ -1,8 +1,7 @@
-export { AdminGuard, ProtectedRoute, useSessionCheck as useRefocusSessionCheck, useSessionCheck, useStableAccessToken } from '../chunk-FDCVFCOQ.js';
-export { WorkOSAuthBridge } from '../chunk-NIAVTSMB.js';
-export { useOAuthContext } from '../chunk-QSVZP2NU.js';
-import '../chunk-QQOLC46E.js';
+export { AdminGuard, ProtectedRoute, useSessionCheck as useRefocusSessionCheck, useSessionCheck } from '../chunk-2JBWPFHF.js';
+export { useStableAccessToken } from '../chunk-FWZJH3TL.js';
+import '../chunk-NEK6JKPW.js';
+import '../chunk-L2CM2CUA.js';
 import '../chunk-DD3CCMCZ.js';
-import '../chunk-4KAG5U7A.js';
 import '../chunk-KA7LO7U5.js';
 export { AuthProvider, useAuthContext } from '../chunk-7PLEQFHO.js';

package/dist/{chunk-FDCVFCOQ.js → chunk-2JBWPFHF.js}

@@ -1,22 +1,18 @@
-import { useInitialization } from './chunk-QQOLC46E.js';
+import { useInitialization } from './chunk-NEK6JKPW.js';
 import { useAuthContext } from './chunk-7PLEQFHO.js';
-import { useRef, useCallback, useEffect } from 'react';
+import { useRef, useEffect } from 'react';
 import { useQueryClient } from '@tanstack/react-query';
 import { useNavigate, useLocation } from '@tanstack/react-router';
 import { jsx, Fragment } from 'react/jsx-runtime';
 
-function useStableAccessToken() {
-  const { getAccessToken } = useAuthContext();
-  const getAccessTokenRef = useRef(getAccessToken);
-  getAccessTokenRef.current = getAccessToken;
-  return useCallback(() => {
-    return getAccessTokenRef.current();
-  }, []);
-}
 function useSessionCheck() {
   const { user } = useAuthContext();
   const queryClient = useQueryClient();
   const isCheckingRef = useRef(false);
+  const hadUserRef = useRef(false);
+  if (user) {
+    hadUserRef.current = true;
+  }
   useEffect(() => {
     const handleVisibilityChange = async () => {
       if (isCheckingRef.current || document.visibilityState !== "visible") {
@@ -24,12 +20,14 @@ function useSessionCheck() {
       }
       isCheckingRef.current = true;
       try {
-        if (!user) {
+        if (!user && hadUserRef.current) {
           window.location.replace("/login");
           return;
         }
-        await queryClient.cancelQueries();
-        queryClient.invalidateQueries();
+        if (user) {
+          await queryClient.cancelQueries();
+          queryClient.invalidateQueries();
+        }
       } finally {
         isCheckingRef.current = false;
       }
@@ -50,6 +48,7 @@ function ProtectedRoute({
   waitForOrganization = true
 }) {
   const { userReady, allReady, isInitializing, error, retry } = useInitialization();
+  const { signIn, canRecover } = useAuthContext();
   const navigate = useNavigate();
   const location = useLocation();
   const hasRedirected = useRef(false);
@@ -59,12 +58,16 @@ function ProtectedRoute({
       hasRedirected.current = true;
       const searchStr = location.searchStr ?? "";
       const returnTo = location.pathname + searchStr;
-      navigate({
-        to: redirectTo,
-        search: returnTo !== "/" ? { returnTo } : {}
-      });
+      if (canRecover()) {
+        signIn({ state: { returnTo: returnTo !== "/" ? returnTo : void 0 } });
+      } else {
+        navigate({
+          to: redirectTo,
+          search: returnTo !== "/" ? { returnTo } : {}
+        });
+      }
     }
-  }, [unauthenticated, navigate, redirectTo, location]);
+  }, [unauthenticated, signIn, canRecover, navigate, redirectTo, location]);
   if (isInitializing) {
     return /* @__PURE__ */ jsx(Fragment, { children: fallback });
   }
@@ -75,7 +78,7 @@ function ProtectedRoute({
     return null;
   }
   if (unauthenticated) {
-    return null;
+    return /* @__PURE__ */ jsx(Fragment, { children: fallback });
   }
   if (waitForOrganization && !allReady && error?.layer !== "organization") {
     return /* @__PURE__ */ jsx(Fragment, { children: fallback });
@@ -102,4 +105,4 @@ function AdminGuard({ children, redirectTo = "/", fallback = null }) {
   return /* @__PURE__ */ jsx(Fragment, { children });
 }
 
-export { AdminGuard, ProtectedRoute, useSessionCheck, useStableAccessToken };
+export { AdminGuard, ProtectedRoute, useSessionCheck };

package/dist/{chunk-OLD3NQLI.js → chunk-72HOBFMP.js}

@@ -1,17 +1,16 @@
-import { OrganizationProvider } from './chunk-FLJXZ7YC.js';
-import { ApiClientProvider, createUseApiClient } from './chunk-BWCC6ZJC.js';
+import { OrganizationProvider } from './chunk-UMXDDEAG.js';
+import { ApiClientProvider, useApiClient } from './chunk-XLV6LYN2.js';
 import { NotificationProvider } from './chunk-TIRMFDM4.js';
-import { OAuthProvider } from './chunk-QSVZP2NU.js';
-import { InitializationProvider } from './chunk-QQOLC46E.js';
+import { InitializationProvider } from './chunk-NEK6JKPW.js';
+import { ProfileProvider } from './chunk-L2CM2CUA.js';
 import { useOrganization } from './chunk-DD3CCMCZ.js';
-import { ProfileProvider } from './chunk-4KAG5U7A.js';
-import { ElevasisServiceProvider } from './chunk-KA7LO7U5.js';
+import { ElevasisServiceProvider, useElevasisServices } from './chunk-KA7LO7U5.js';
 import { useAuthContext } from './chunk-7PLEQFHO.js';
 import { lazy, Suspense, useRef } from 'react';
 import { QueryClientProvider, QueryClient } from '@tanstack/react-query';
 import { jsx, Fragment } from 'react/jsx-runtime';
 
-var LazyCoreAuthKitInner = lazy(() => import('./CoreAuthKitInner-KM72EYJS.js').then((m) => ({ default: m.CoreAuthKitInner })));
+var LazyCoreAuthKitInner = lazy(() => import('./CoreAuthKitInner-3J4RVQO6.js').then((m) => ({ default: m.CoreAuthKitInner })));
 var defaultQueryClient = null;
 function getDefaultQueryClient() {
   if (!defaultQueryClient) {
@@ -21,7 +20,6 @@ function getDefaultQueryClient() {
   }
   return defaultQueryClient;
 }
-var defaultUseOrganizations = () => ({ isInitializing: false, isOrgRefreshing: false });
 function ElevasisCoreProvider({
   auth,
   queryClient,
@@ -32,17 +30,14 @@ function ElevasisCoreProvider({
 }) {
   if (auth.mode === "apiKey") {
     throw new Error(
-      `ElevasisCoreProvider: auth mode 'apiKey' is not yet implemented. Only 'authkit' and 'oauth' modes are supported.`
+      `ElevasisCoreProvider: auth mode 'apiKey' is not yet implemented. Only 'authkit' mode is supported.`
     );
   }
   const resolvedQueryClient = queryClient ?? getDefaultQueryClient();
   const content = apiUrl ? /* @__PURE__ */ jsx(CoreServiceBridge, { apiUrl, onError, notifications, children }) : children;
-  const AuthInner = auth.mode === "authkit" ? /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(LazyCoreAuthKitInner, { auth, children: content }) }) : /* @__PURE__ */ jsx(CoreOAuthInner, { auth, children: content });
+  const AuthInner = /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(LazyCoreAuthKitInner, { auth, children: content }) });
   return /* @__PURE__ */ jsx(QueryClientProvider, { client: resolvedQueryClient, children: AuthInner });
 }
-function CoreOAuthInner({ auth, children }) {
-  return /* @__PURE__ */ jsx(OAuthProvider, { config: auth, children });
-}
 function CoreServiceBridge({
   apiUrl,
   onError,
@@ -69,14 +64,15 @@ function CoreServiceBridgeInner({
   notifications,
   children
 }) {
-  const useApiClient = useRef(createUseApiClient(defaultUseOrganizations, apiUrl)).current;
-  const { apiRequest } = useApiClient();
+  const { apiRequest } = useApiClient(apiUrl);
   return /* @__PURE__ */ jsx(ElevasisServiceProvider, { apiRequest, organizationId: null, isReady: false, children: /* @__PURE__ */ jsx(ProfileProvider, { children: /* @__PURE__ */ jsx(OrganizationProvider, { children: /* @__PURE__ */ jsx(OrgIdBridge, { orgIdRef, children: /* @__PURE__ */ jsx(CoreNotificationLayer, { notifications, children: /* @__PURE__ */ jsx(InitializationProvider, { children }) }) }) }) }) });
 }
 function OrgIdBridge({ orgIdRef, children }) {
-  const { currentWorkOSOrganizationId } = useOrganization();
+  const { currentWorkOSOrganizationId, isInitializing, isOrgRefreshing } = useOrganization();
+  const { apiRequest } = useElevasisServices();
   orgIdRef.current = currentWorkOSOrganizationId;
-  return /* @__PURE__ */ jsx(Fragment, { children });
+  const isReady = !!currentWorkOSOrganizationId && !isInitializing && !isOrgRefreshing;
+  return /* @__PURE__ */ jsx(ElevasisServiceProvider, { apiRequest, organizationId: currentWorkOSOrganizationId, isReady, children });
 }
 function CoreNotificationLayer({
   notifications,