@elevasis/ui 1.3.0 → 1.3.2

package/dist/CoreAuthKitInner-3J4RVQO6.js

@@ -0,0 +1,43 @@
+import { AuthProvider } from './chunk-7PLEQFHO.js';
+import { AuthKitProvider, useAuth } from '@workos-inc/authkit-react';
+import { useMemo } from 'react';
+import { jsx } from 'react/jsx-runtime';
+
+function CoreAuthKitInner({ auth, children }) {
+  return /* @__PURE__ */ jsx(
+    AuthKitProvider,
+    {
+      clientId: auth.clientId,
+      apiHostname: auth.apiHostname ?? "api.workos.com",
+      redirectUri: auth.redirectUri,
+      devMode: auth.devMode ?? false,
+      children: /* @__PURE__ */ jsx(WorkOSAuthAdapter, { children })
+    }
+  );
+}
+var WORKOS_REFRESH_TOKEN_KEY = "workos:refresh-token";
+function hasWorkOSRefreshToken() {
+  try {
+    return !!localStorage.getItem(WORKOS_REFRESH_TOKEN_KEY);
+  } catch {
+    return false;
+  }
+}
+function WorkOSAuthAdapter({ children }) {
+  const { user, isLoading, getAccessToken, organizationId, signIn } = useAuth();
+  const adaptedUser = useMemo(() => user ? { id: user.id } : null, [user?.id]);
+  const value = useMemo(
+    () => ({
+      user: adaptedUser,
+      isLoading,
+      getAccessToken,
+      organizationId: organizationId ?? null,
+      signIn,
+      canRecover: hasWorkOSRefreshToken
+    }),
+    [adaptedUser, isLoading, getAccessToken, organizationId, signIn]
+  );
+  return /* @__PURE__ */ jsx(AuthProvider, { value, children });
+}
+
+export { CoreAuthKitInner };

package/dist/api/index.d.ts

@@ -68,18 +68,17 @@ declare function useApiClientContext(): ApiClientContextValue;
  */
 declare function ApiClientProvider({ children, getAccessToken, organizationId, getOrganizationId: getOrganizationIdProp, isOrganizationReady, onError }: ApiClientProviderProps): react_jsx_runtime.JSX.Element;
 
-/**
- * Return type of useOrganizations hook (subset needed by the factory)
- */
-interface UseOrganizationsReturn {
-    isInitializing: boolean;
-    isOrgRefreshing: boolean;
-}
 /**
  * Hook that returns apiRequest and deferredApiRequest bound to the current
  * ApiClientContext. apiUrl is the only parameter because org ID is resolved
  * at call time via getOrganizationId() from context.
  *
+ * When OrganizationProvider is present in the tree, isOrganizationReady and
+ * isInitializing reflect the live org state (currentWorkOSOrganizationId,
+ * isInitializing, isOrgRefreshing). When OrganizationProvider is absent
+ * (e.g. theme-only mode, testing), the hook falls back to the values from
+ * ApiClientContext.
+ *
  * Usage:
  * ```typescript
  * import { useApiClient } from '@repo/ui/api'
@@ -97,29 +96,6 @@ declare function useApiClient(apiUrl: string): {
     isOrganizationReady: boolean;
     isInitializing: boolean;
 };
-/**
- * Factory function to create a useApiClient hook for your app.
- *
- * @deprecated Use the plain `useApiClient(apiUrl)` hook instead.
- * The factory pattern is no longer needed because org ID is resolved at
- * call time via getOrganizationId() from ApiClientContext.
- *
- * Migration:
- * ```typescript
- * // Before
- * export const useApiClient = createUseApiClient(useOrganizations, API_URL)
- *
- * // After
- * import { useApiClient } from '@repo/ui/api'
- * // call useApiClient(API_URL) directly in your hook/component
- * ```
- */
-declare function createUseApiClient(useOrganizations: () => UseOrganizationsReturn, apiUrl: string): () => {
-    apiRequest: <T>(endpoint: string, options?: RequestInit) => Promise<T>;
-    deferredApiRequest: <T>(endpoint: string, options?: RequestInit) => Promise<T>;
-    isOrganizationReady: boolean;
-    isInitializing: boolean;
-};
 
-export { ApiClientProvider, createUseApiClient, useApiClient, useApiClientContext };
+export { ApiClientProvider, useApiClient, useApiClientContext };
 export type { ApiClientContextValue, ApiClientProviderProps, ApiErrorDetails };

package/dist/api/index.js

@@ -1,4 +1,5 @@
 import '../chunk-XCYKC6OZ.js';
-export { ApiClientProvider, createUseApiClient, useApiClient, useApiClientContext } from '../chunk-BWCC6ZJC.js';
-import '../chunk-JVAZHVNV.js';
+export { ApiClientProvider, useApiClient, useApiClientContext } from '../chunk-XLV6LYN2.js';
+import '../chunk-LFYO3MDC.js';
 import '../chunk-4VGWQ5AN.js';
+import '../chunk-DD3CCMCZ.js';

package/dist/auth/context.d.ts

@@ -1,19 +1,37 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
 
-interface AuthAdapter {
+interface AuthContextValue {
     user: {
         id: string;
     } | null;
     isLoading: boolean;
     getAccessToken: () => Promise<string>;
     organizationId?: string | null;
+    /**
+     * Trigger WorkOS AuthKit's sign-in flow (redirect to WorkOS hosted auth page).
+     * Used by ProtectedRoute for auto-recovery when `canRecover()` returns true.
+     */
+    signIn: (options?: {
+        state?: {
+            returnTo?: string;
+        };
+    }) => void;
+    /**
+     * Returns true when a previous session can be recovered (refresh token
+     * exists in storage). ProtectedRoute calls `signIn()` only when this returns
+     * true; otherwise it navigates to the login page.
+     *
+     * Explicit logout clears the stored token, so canRecover() returns false
+     * and the user sees the login page as expected.
+     */
+    canRecover: () => boolean;
 }
-declare function useAuthContext(): AuthAdapter;
+declare function useAuthContext(): AuthContextValue;
 declare function AuthProvider({ value, children }: {
-    value: AuthAdapter;
+    value: AuthContextValue;
     children: ReactNode;
-}): react.FunctionComponentElement<react.ProviderProps<AuthAdapter | null>>;
+}): react.FunctionComponentElement<react.ProviderProps<AuthContextValue | null>>;
 
 export { AuthProvider, useAuthContext };
-export type { AuthAdapter };
+export type { AuthContextValue };

package/dist/auth/guards/AdminGuard.d.ts

@@ -0,0 +1,32 @@
+import { type ReactNode } from 'react';
+export interface AdminGuardProps {
+    children: ReactNode;
+    /**
+     * Path to redirect non-admin users to.
+     * @default '/'
+     */
+    redirectTo?: string;
+    /**
+     * Rendered while user readiness is being determined.
+     * When not provided, nothing is rendered during initialization.
+     */
+    fallback?: ReactNode;
+}
+/**
+ * Headless route guard for platform admin pages.
+ *
+ * Reads `profile.is_platform_admin` from the nearest InitializationProvider.
+ * Non-admin users are redirected to `redirectTo` (default: '/').
+ *
+ * Must be nested inside a ProtectedRoute (or equivalent) so that
+ * `userReady` is guaranteed to be true when this guard runs.
+ *
+ * @example
+ * <ProtectedRoute>
+ *   <AdminGuard fallback={<AppShellLoader />}>
+ *     <AdminDashboard />
+ *   </AdminGuard>
+ * </ProtectedRoute>
+ */
+export declare function AdminGuard({ children, redirectTo, fallback }: AdminGuardProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=AdminGuard.d.ts.map

package/dist/auth/guards/AdminGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminGuard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/AdminGuard.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,OAAO,CAAA;AAIjD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,SAAS,CAAA;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAA;CACrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,EAAE,QAAQ,EAAE,UAAgB,EAAE,QAAe,EAAE,EAAE,eAAe,kDA0B1F"}

package/dist/auth/guards/ProtectedRoute.d.ts

@@ -0,0 +1,60 @@
+import { type ReactNode } from 'react';
+import type { InitializationError } from '../../initialization/hooks/useAppInitialization';
+export interface ProtectedRouteProps {
+    children: ReactNode;
+    /**
+     * Path to redirect to when user is unauthenticated and the auth adapter
+     * does not provide a `signIn` function.
+     * @default '/login'
+     */
+    redirectTo?: string;
+    /**
+     * Rendered while initialization is in progress.
+     * When not provided, nothing is rendered during initialization.
+     */
+    fallback?: ReactNode;
+    /**
+     * Rendered when initialization fails with a non-organization error.
+     * Receives the error and a retry callback.
+     * When not provided, the error is silently swallowed (children not rendered).
+     */
+    errorFallback?: (error: InitializationError, retry: () => void) => ReactNode;
+    /**
+     * When true (default), waits for both user AND organization to be ready
+     * before rendering children. When false, only waits for user readiness.
+     * @default true
+     */
+    waitForOrganization?: boolean;
+}
+/**
+ * Headless route guard for authenticated pages.
+ *
+ * Reads initialization state from the nearest InitializationProvider.
+ *
+ * When `canRecover()` returns true (refresh token exists), unauthenticated users
+ * are sent directly to WorkOS AuthKit via `signIn()`. WorkOS checks its
+ * server-side session and either signs the user in immediately (page-reload case)
+ * or shows a login form (logged-out case). Explicit logout destroys the
+ * server-side session, so the next auto-signIn correctly presents a login form
+ * rather than looping.
+ *
+ * When `canRecover()` returns false, falls back to navigating to `redirectTo`
+ * (default: '/login') with a `returnTo` search param.
+ *
+ * Organization-layer errors are allowed through -- routes like /invitations
+ * must be accessible even when the user has no org membership.
+ *
+ * @example
+ * // With custom fallback (your Mantine loader):
+ * <ProtectedRoute fallback={<AppShellLoader />}>
+ *   <DashboardPage />
+ * </ProtectedRoute>
+ *
+ * @example
+ * // Wait only for user, not org (e.g. /invitations route):
+ * <ProtectedRoute waitForOrganization={false}>
+ *   <InvitationsPage />
+ * </ProtectedRoute>
+ */
+export declare function ProtectedRoute({ children, redirectTo, fallback, errorFallback, waitForOrganization }: ProtectedRouteProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=ProtectedRoute.d.ts.map

package/dist/auth/guards/ProtectedRoute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProtectedRoute.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/ProtectedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAA;AAIzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAA;AAE1F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,SAAS,CAAA;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAA;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,IAAI,KAAK,SAAS,CAAA;IAC5E;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,UAAqB,EACrB,QAAe,EACf,aAAa,EACb,mBAA0B,EAC3B,EAAE,mBAAmB,kDAyDrB"}

package/dist/auth/guards/__tests__/AdminGuard.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * AdminGuard Tests (shared @repo/ui guard)
+ *
+ * Tests role-based access control for platform admin pages:
+ * - Shows fallback while user is not ready
+ * - Renders children for platform admin users
+ * - Redirects non-admin users to redirectTo (default: '/')
+ * - Handles missing profile gracefully
+ * - Supports custom redirectTo
+ */
+export {};
+//# sourceMappingURL=AdminGuard.test.d.ts.map

package/dist/auth/guards/__tests__/AdminGuard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminGuard.test.d.ts","sourceRoot":"","sources":["../../../../src/auth/guards/__tests__/AdminGuard.test.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/auth/guards/__tests__/ProtectedRoute.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * ProtectedRoute Tests (shared @repo/ui guard)
+ *
+ * Tests headless authentication guard behavior:
+ * - Shows fallback while initializing
+ * - Redirects unauthenticated users to login with returnTo
+ * - Renders children when user is ready
+ * - Renders children when org error (allows /invitations route pattern)
+ * - Shows errorFallback for non-organization errors
+ * - Waits for org readiness when waitForOrganization=true (default)
+ * - Renders after user ready when waitForOrganization=false
+ */
+export {};
+//# sourceMappingURL=ProtectedRoute.test.d.ts.map

package/dist/auth/guards/__tests__/ProtectedRoute.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProtectedRoute.test.d.ts","sourceRoot":"","sources":["../../../../src/auth/guards/__tests__/ProtectedRoute.test.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/auth/index.d.ts

@@ -1,173 +1,16 @@
-import * as react from 'react';
-import { ReactNode } from 'react';
-import * as react_jsx_runtime from 'react/jsx-runtime';
-
-interface AuthAdapter {
-    user: {
-        id: string;
-    } | null;
-    isLoading: boolean;
-    getAccessToken: () => Promise<string>;
-    organizationId?: string | null;
-}
-declare function useAuthContext(): AuthAdapter;
-declare function AuthProvider({ value, children }: {
-    value: AuthAdapter;
-    children: ReactNode;
-}): react.FunctionComponentElement<react.ProviderProps<AuthAdapter | null>>;
-
 /**
- * Bridge component that reads WorkOS AuthKit state and provides it
- * via the generic AuthContext. Place inside AuthKitProvider.
- *
- * Narrows WorkOS User to { id: string } -- @repo/ui hooks only need the ID.
- * Uses useMemo to stabilize the user object and prevent unnecessary
- * useEffect re-runs in downstream hooks.
- */
-declare function WorkOSAuthBridge({ children }: {
-    children: ReactNode;
-}): react_jsx_runtime.JSX.Element;
-
-interface OAuthContextValue {
-    user: {
-        id: string;
-    } | null;
-    isLoading: boolean;
-    organizationId: string | null;
-    getAccessToken: () => Promise<string>;
-    error: string | null;
-    initiateOAuthFlow: () => void;
-}
-declare function useOAuthContext(): OAuthContextValue;
-
-/**
- * Returns a stable reference to getAccessToken that won't change between renders
- *
- * This prevents SSE connections from reconnecting unnecessarily when the
- * WorkOS useAuth hook returns a new getAccessToken function reference
- *
- * @example
- * ```tsx
- * const getAccessToken = useStableAccessToken()
- *
- * useEffect(() => {
- *   fetchEventSourceWithTokenRefresh({
- *     getToken: getAccessToken,
- *     // ...
- *   })
- * }, [getAccessToken]) // Won't re-run on every render
- * ```
- */
-declare function useStableAccessToken(): () => Promise<string>;
-
-/**
- * Checks WorkOS session validity when window/tab regains focus
- *
- * When window or tab becomes visible after inactivity, validates session
- * by attempting to get access token. If session expired (WorkOS inactivity
- * timeout exceeded), signs out user and redirects to login.
- *
- * How it works:
- * 1. Window/tab regains focus after inactivity
- * 2. Cancel all pending queries to prevent 401 error cascade
- * 3. Attempt to get access token from WorkOS
- * 4. If successful: Resume queries with fresh token
- * 5. If failed (session expired): Sign out and redirect to login
- *
- * @example
- * // In __root.tsx
- * export function RootLayoutComponent() {
- *   useSessionCheck()
- *   return <YourApp />
- * }
- */
-declare function useSessionCheck(): void;
-
-interface InitializationError {
-    layer: 'auth' | 'profile' | 'organization';
-    message: string;
-    originalError?: Error;
-}
-
-interface ProtectedRouteProps {
-    children: ReactNode;
-    /**
-     * Path to redirect to when user is unauthenticated.
-     * @default '/login'
-     */
-    redirectTo?: string;
-    /**
-     * Rendered while initialization is in progress.
-     * When not provided, nothing is rendered during initialization.
-     */
-    fallback?: ReactNode;
-    /**
-     * Rendered when initialization fails with a non-organization error.
-     * Receives the error and a retry callback.
-     * When not provided, the error is silently swallowed (children not rendered).
-     */
-    errorFallback?: (error: InitializationError, retry: () => void) => ReactNode;
-    /**
-     * When true (default), waits for both user AND organization to be ready
-     * before rendering children. When false, only waits for user readiness.
-     * @default true
-     */
-    waitForOrganization?: boolean;
-}
-/**
- * Headless route guard for authenticated pages.
- *
- * Reads initialization state from the nearest InitializationProvider.
- * Redirects unauthenticated users to `redirectTo` (default: '/login')
- * with a `returnTo` search param preserving the current location.
- *
- * Organization-layer errors are allowed through — routes like /invitations
- * must be accessible even when the user has no org membership.
- *
- * @example
- * // With custom fallback (your Mantine loader):
- * <ProtectedRoute fallback={<AppShellLoader />}>
- *   <DashboardPage />
- * </ProtectedRoute>
- *
- * @example
- * // Wait only for user, not org (e.g. /invitations route):
- * <ProtectedRoute waitForOrganization={false}>
- *   <InvitationsPage />
- * </ProtectedRoute>
- */
-declare function ProtectedRoute({ children, redirectTo, fallback, errorFallback, waitForOrganization }: ProtectedRouteProps): react_jsx_runtime.JSX.Element | null;
-
-interface AdminGuardProps {
-    children: ReactNode;
-    /**
-     * Path to redirect non-admin users to.
-     * @default '/'
-     */
-    redirectTo?: string;
-    /**
-     * Rendered while user readiness is being determined.
-     * When not provided, nothing is rendered during initialization.
-     */
-    fallback?: ReactNode;
-}
-/**
- * Headless route guard for platform admin pages.
- *
- * Reads `profile.is_platform_admin` from the nearest InitializationProvider.
- * Non-admin users are redirected to `redirectTo` (default: '/').
- *
- * Must be nested inside a ProtectedRoute (or equivalent) so that
- * `userReady` is guaranteed to be true when this guard runs.
- *
- * @example
- * <ProtectedRoute>
- *   <AdminGuard fallback={<AppShellLoader />}>
- *     <AdminDashboard />
- *   </AdminGuard>
- * </ProtectedRoute>
+ * Auth module - Pure authentication concerns
+ *
+ * Exports:
+ * - AuthContextValue: Interface for auth state (user, isLoading, getAccessToken, organizationId, signIn, canRecover)
+ * - AuthProvider: React context provider for AuthContextValue
+ * - useAuthContext: Hook to consume AuthContextValue from context
+ * - useStableAccessToken: Stable reference to getAccessToken for SSE connections
+ * - useSessionCheck: Validates session on tab refocus
  */
-declare function AdminGuard({ children, redirectTo, fallback }: AdminGuardProps): react_jsx_runtime.JSX.Element | null;
-
-export { AdminGuard, AuthProvider, ProtectedRoute, WorkOSAuthBridge, useAuthContext, useOAuthContext, useSessionCheck as useRefocusSessionCheck, useSessionCheck, useStableAccessToken };
-export type { AdminGuardProps, AuthAdapter, OAuthContextValue, ProtectedRouteProps };
+export { AuthProvider, useAuthContext, type AuthContextValue } from './context';
+export * from './hooks/useStableAccessToken';
+export * from './hooks/useSessionCheck';
+export { ProtectedRoute, type ProtectedRouteProps } from './guards/ProtectedRoute';
+export { AdminGuard, type AdminGuardProps } from './guards/AdminGuard';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC/E,cAAc,8BAA8B,CAAA;AAC5C,cAAc,yBAAyB,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/auth/index.js

@@ -1,8 +1,7 @@
-export { AdminGuard, ProtectedRoute, useSessionCheck as useRefocusSessionCheck, useSessionCheck, useStableAccessToken } from '../chunk-FDCVFCOQ.js';
-export { WorkOSAuthBridge } from '../chunk-NIAVTSMB.js';
-export { useOAuthContext } from '../chunk-QSVZP2NU.js';
-import '../chunk-QQOLC46E.js';
-import '../chunk-DD3CCMCZ.js';
-import '../chunk-4KAG5U7A.js';
+export { AdminGuard, ProtectedRoute, useSessionCheck as useRefocusSessionCheck, useSessionCheck } from '../chunk-2JBWPFHF.js';
+export { useStableAccessToken } from '../chunk-FWZJH3TL.js';
+import '../chunk-NEK6JKPW.js';
+import '../chunk-L2CM2CUA.js';
 import '../chunk-KA7LO7U5.js';
+import '../chunk-DD3CCMCZ.js';
 export { AuthProvider, useAuthContext } from '../chunk-7PLEQFHO.js';

package/dist/{chunk-FDCVFCOQ.js → chunk-2JBWPFHF.js}

@@ -1,22 +1,18 @@
-import { useInitialization } from './chunk-QQOLC46E.js';
+import { useInitialization } from './chunk-NEK6JKPW.js';
 import { useAuthContext } from './chunk-7PLEQFHO.js';
-import { useRef, useCallback, useEffect } from 'react';
+import { useRef, useEffect } from 'react';
 import { useQueryClient } from '@tanstack/react-query';
 import { useNavigate, useLocation } from '@tanstack/react-router';
 import { jsx, Fragment } from 'react/jsx-runtime';
 
-function useStableAccessToken() {
-  const { getAccessToken } = useAuthContext();
-  const getAccessTokenRef = useRef(getAccessToken);
-  getAccessTokenRef.current = getAccessToken;
-  return useCallback(() => {
-    return getAccessTokenRef.current();
-  }, []);
-}
 function useSessionCheck() {
   const { user } = useAuthContext();
   const queryClient = useQueryClient();
   const isCheckingRef = useRef(false);
+  const hadUserRef = useRef(false);
+  if (user) {
+    hadUserRef.current = true;
+  }
   useEffect(() => {
     const handleVisibilityChange = async () => {
       if (isCheckingRef.current || document.visibilityState !== "visible") {
@@ -24,12 +20,14 @@ function useSessionCheck() {
       }
       isCheckingRef.current = true;
       try {
-        if (!user) {
+        if (!user && hadUserRef.current) {
           window.location.replace("/login");
           return;
         }
-        await queryClient.cancelQueries();
-        queryClient.invalidateQueries();
+        if (user) {
+          await queryClient.cancelQueries();
+          queryClient.invalidateQueries();
+        }
       } finally {
         isCheckingRef.current = false;
       }
@@ -50,6 +48,7 @@ function ProtectedRoute({
   waitForOrganization = true
 }) {
   const { userReady, allReady, isInitializing, error, retry } = useInitialization();
+  const { signIn, canRecover } = useAuthContext();
   const navigate = useNavigate();
   const location = useLocation();
   const hasRedirected = useRef(false);
@@ -59,12 +58,16 @@ function ProtectedRoute({
       hasRedirected.current = true;
       const searchStr = location.searchStr ?? "";
       const returnTo = location.pathname + searchStr;
-      navigate({
-        to: redirectTo,
-        search: returnTo !== "/" ? { returnTo } : {}
-      });
+      if (canRecover()) {
+        signIn({ state: { returnTo: returnTo !== "/" ? returnTo : void 0 } });
+      } else {
+        navigate({
+          to: redirectTo,
+          search: returnTo !== "/" ? { returnTo } : {}
+        });
+      }
     }
-  }, [unauthenticated, navigate, redirectTo, location]);
+  }, [unauthenticated, signIn, canRecover, navigate, redirectTo, location]);
   if (isInitializing) {
     return /* @__PURE__ */ jsx(Fragment, { children: fallback });
   }
@@ -75,7 +78,7 @@ function ProtectedRoute({
     return null;
   }
   if (unauthenticated) {
-    return null;
+    return /* @__PURE__ */ jsx(Fragment, { children: fallback });
   }
   if (waitForOrganization && !allReady && error?.layer !== "organization") {
     return /* @__PURE__ */ jsx(Fragment, { children: fallback });
@@ -102,4 +105,4 @@ function AdminGuard({ children, redirectTo = "/", fallback = null }) {
   return /* @__PURE__ */ jsx(Fragment, { children });
 }
 
-export { AdminGuard, ProtectedRoute, useSessionCheck, useStableAccessToken };
+export { AdminGuard, ProtectedRoute, useSessionCheck };