@elevasis/ui 2.64.1 → 2.66.0

package/dist/execution/index.d.ts

@@ -205,110 +205,6 @@ interface ExecutionLogMessage {
     context?: LogContext;
 }
 
-/**
- * Serialized Registry Types
- *
- * Pre-computed JSON-safe types for API responses and Command View.
- * Serialization happens once at API startup, enabling instant response times.
- */
-
-/**
- * Serialized agent definition (JSON-safe)
- * Result of serializeDefinition(AgentDefinition)
- */
-interface SerializedAgentDefinition {
-    config: {
-        resourceId: string;
-        name: string;
-        description: string;
-        version: string;
-        type: 'agent';
-        kind: 'orchestrator' | 'specialist' | 'utility' | 'system';
-        status: 'dev' | 'prod';
-        links?: ResourceLink[];
-        category?: ResourceCategory;
-        /** Whether this resource is archived and should be excluded from registration and deployment */
-        archived?: boolean;
-        systemPrompt: string;
-        constraints?: {
-            maxIterations?: number;
-            timeout?: number;
-            maxSessionMemoryKeys?: number;
-            maxMemoryTokens?: number;
-        };
-        sessionCapable?: boolean;
-        memoryPreferences?: string;
-    };
-    modelConfig: {
-        provider: string;
-        model: string;
-        apiKey: string;
-        temperature: number;
-        maxOutputTokens: number;
-        topP?: number;
-        modelOptions?: Record<string, unknown>;
-    };
-    contract: {
-        inputSchema: object;
-        outputSchema?: object;
-    };
-    tools: Array<{
-        name: string;
-        description: string;
-        inputSchema?: object;
-        outputSchema?: object;
-    }>;
-    knowledgeMap?: {
-        nodeCount: number;
-        nodes: Array<{
-            id: string;
-            description: string;
-            loaded: boolean;
-            hasPrompt: boolean;
-        }>;
-    };
-    metricsConfig?: object;
-}
-/**
- * Serialized workflow definition (JSON-safe)
- * Result of serializeDefinition(WorkflowDefinition)
- */
-interface SerializedWorkflowDefinition {
-    config: {
-        resourceId: string;
-        name: string;
-        description: string;
-        version: string;
-        type: 'workflow';
-        status: 'dev' | 'prod';
-        links?: ResourceLink[];
-        category?: ResourceCategory;
-        /** Whether this resource is archived and should be excluded from registration and deployment */
-        archived?: boolean;
-    };
-    entryPoint: string;
-    steps: Array<{
-        id: string;
-        name: string;
-        description: string;
-        inputSchema?: object;
-        outputSchema?: object;
-        next: {
-            type: 'linear' | 'conditional';
-            target?: string;
-            routes?: Array<{
-                target: string;
-            }>;
-            default?: string;
-        } | null;
-    }>;
-    contract: {
-        inputSchema: object;
-        outputSchema?: object;
-    };
-    metricsConfig?: object;
-}
-
 /**
  * Workflow step state
  * Aggregates step context events with timing and logs
@@ -462,6 +358,121 @@ declare const LinkSchema: z.ZodObject<{
 }, z.core.$strip>;
 type Link = z.infer<typeof LinkSchema>;
 
+/**
+ * Agent-specific type definitions
+ * Types for autonomous agents with tools, memory, and constraints
+ */
+
+type AgentKind = 'orchestrator' | 'specialist' | 'utility' | 'platform';
+
+/**
+ * Serialized Registry Types
+ *
+ * Pre-computed JSON-safe types for API responses and Command View.
+ * Serialization happens once at API startup, enabling instant response times.
+ */
+
+/**
+ * Serialized agent definition (JSON-safe)
+ * Result of serializeDefinition(AgentDefinition)
+ */
+interface SerializedAgentDefinition {
+    config: {
+        resourceId: string;
+        name: string;
+        description: string;
+        version: string;
+        type: 'agent';
+        /**
+         * Imported from the runtime type instead of hand-copied. It used to be a hand-written literal
+         * union that said `'system'` where `AgentKind`'s fourth member is `'platform'` -- undetected
+         * because `serializeDefinition` returns `any` and every call site casts the result to this
+         * interface, so the literal union was never actually checked against real data. Deriving from
+         * the source of truth makes that class of drift a type error instead of a silent typo.
+         */
+        kind: AgentKind;
+        status: 'dev' | 'prod';
+        links?: ResourceLink[];
+        category?: ResourceCategory;
+        /** Whether this resource is archived and should be excluded from registration and deployment */
+        archived?: boolean;
+        systemPrompt: string;
+        constraints?: {
+            maxIterations?: number;
+            timeout?: number;
+            maxSessionMemoryKeys?: number;
+            maxMemoryTokens?: number;
+        };
+        sessionCapable?: boolean;
+        memoryPreferences?: string;
+    };
+    modelConfig: {
+        provider: string;
+        model: string;
+        apiKey: string;
+        /**
+         * Optional here, matching `ModelConfig` -- this used to be required even though neither real
+         * agent literal in the monorepo (`local-test-agent`, the `createPlatformToolAgent` test fixture)
+         * sets it, and nothing caught the mismatch for the same `serializeDefinition`-returns-`any`
+         * reason `kind` drifted above.
+         */
+        temperature?: number;
+        maxOutputTokens?: number;
+        topP?: number;
+        modelOptions?: Record<string, unknown>;
+    };
+    contract: {
+        inputSchema: object;
+        outputSchema?: object;
+    };
+    tools: Array<{
+        name: string;
+        description: string;
+        inputSchema?: object;
+        outputSchema?: object;
+    }>;
+    metricsConfig?: object;
+}
+/**
+ * Serialized workflow definition (JSON-safe)
+ * Result of serializeDefinition(WorkflowDefinition)
+ */
+interface SerializedWorkflowDefinition {
+    config: {
+        resourceId: string;
+        name: string;
+        description: string;
+        version: string;
+        type: 'workflow';
+        status: 'dev' | 'prod';
+        links?: ResourceLink[];
+        category?: ResourceCategory;
+        /** Whether this resource is archived and should be excluded from registration and deployment */
+        archived?: boolean;
+    };
+    entryPoint: string;
+    steps: Array<{
+        id: string;
+        name: string;
+        description: string;
+        inputSchema?: object;
+        outputSchema?: object;
+        next: {
+            type: 'linear' | 'conditional';
+            target?: string;
+            routes?: Array<{
+                target: string;
+            }>;
+            default?: string;
+        } | null;
+    }>;
+    contract: {
+        inputSchema: object;
+        outputSchema?: object;
+    };
+    metricsConfig?: object;
+}
+
 /**
  * Resource Registry type definitions
  */

package/dist/execution/index.js

@@ -1,3 +1,3 @@
-export { AGENT_CONSTANTS, CONTAINER_CONSTANTS, SHARED_VIZ_CONSTANTS, STATUS_COLORS, TIMELINE_CONSTANTS, WORKFLOW_CONSTANTS, calculateBarPosition, formatDuration, getEdgeColor, getEdgeOpacity, getResourceStatusColor, getStatusColors, getStatusIcon, shouldAnimateEdge, useAgentIterationData, useExecutionPath, useMergedExecution, useReactFlowAgent, useTimelineData, useUnifiedWorkflowLayout, useWorkflowStepsLayout } from '../chunk-I3CFGE3N.js';
-import '../chunk-KRWALB24.js';
+export { AGENT_CONSTANTS, CONTAINER_CONSTANTS, SHARED_VIZ_CONSTANTS, STATUS_COLORS, TIMELINE_CONSTANTS, WORKFLOW_CONSTANTS, calculateBarPosition, formatDuration, getEdgeColor, getEdgeOpacity, getResourceStatusColor, getStatusColors, getStatusIcon, shouldAnimateEdge, useAgentIterationData, useExecutionPath, useMergedExecution, useReactFlowAgent, useTimelineData, useUnifiedWorkflowLayout, useWorkflowStepsLayout } from '../chunk-BLXJEIQS.js';
+import '../chunk-6SSQGWK7.js';
 import '../chunk-I2KLQ2HA.js';

package/dist/features/auth/index.d.ts

@@ -1,6 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
 import { z } from 'zod';
+import { QueryKey } from '@tanstack/react-query';
 
 type Json = string | number | boolean | null | {
     [key: string]: Json | undefined;
@@ -2746,6 +2747,7 @@ type Database = {
                     deleted_at: string | null;
                     ended_at: string | null;
                     memory_snapshot: Json;
+                    memory_version: number;
                     metadata: Json | null;
                     organization_id: string;
                     resource_id: string;
@@ -2762,6 +2764,7 @@ type Database = {
                     deleted_at?: string | null;
                     ended_at?: string | null;
                     memory_snapshot: Json;
+                    memory_version?: number;
                     metadata?: Json | null;
                     organization_id: string;
                     resource_id: string;
@@ -2778,6 +2781,7 @@ type Database = {
                     deleted_at?: string | null;
                     ended_at?: string | null;
                     memory_snapshot?: Json;
+                    memory_version?: number;
                     metadata?: Json | null;
                     organization_id?: string;
                     resource_id?: string;
@@ -3115,9 +3119,14 @@ type Database = {
                     p_session_id: string;
                 };
                 Returns: {
+                    context_window_size: number;
                     created_at: string;
+                    cumulative_input_tokens: number;
+                    cumulative_output_tokens: number;
+                    deleted_at: string;
                     ended_at: string;
                     memory_snapshot: Json;
+                    memory_version: number;
                     metadata: Json;
                     organization_id: string;
                     resource_id: string;
@@ -3159,6 +3168,18 @@ type Database = {
                 };
                 Returns: boolean;
             };
+            increment_session_tokens: {
+                Args: {
+                    p_input_tokens: number;
+                    p_output_tokens: number;
+                    p_session_id: string;
+                };
+                Returns: {
+                    context_window_size: number;
+                    cumulative_input_tokens: number;
+                    cumulative_output_tokens: number;
+                }[];
+            };
             is_org_member: {
                 Args: {
                     org_id: string;
@@ -3270,6 +3291,12 @@ interface AccessAnswer {
     reason: AccessReason;
 }
 
+/**
+ * Canonical initialization types, owned here next to {@link InitializationProvider}
+ * (the live, wired implementation). The legacy `createUseAppInitialization`
+ * factory in `./hooks/useAppInitialization.ts` imports these rather than
+ * declaring its own copy, so the two implementations can never drift on shape.
+ */
 interface InitializationError {
     layer: 'auth' | 'profile' | 'organization';
     message: string;
@@ -3298,8 +3325,9 @@ interface ProtectedRouteProps {
     /**
      * When true, waits for both user AND organization to be ready before
      * rendering children. When false, only waits for user readiness.
-     * Standalone apps typically use false; multi-tenant apps use true.
-     * @default false — CC overrides to true in its wrapper
+     * @default true -- see {@link DEFAULT_WAIT_FOR_ORGANIZATION}. The same
+     * default is used by the base `@repo/ui/auth` guard this component wraps,
+     * so behavior is identical regardless of which of the two you import.
      */
     waitForOrganization?: boolean;
 }
@@ -3307,10 +3335,13 @@ interface ProtectedRouteProps {
  * Shared ProtectedRoute — thin wrapper around the base guard from @repo/ui/auth.
  *
  * Renders an animated full-screen loader (fade-out on completion) and forwards
- * errorFallback to the base guard. When waitForOrganization is false (default),
- * the loader dismisses as soon as user auth is ready, allowing pages to handle
- * the no-org state themselves. When true, the loader persists until both user
- * and organization are ready.
+ * errorFallback to the base guard. Loader visibility is derived from
+ * {@link computeProtectedRouteGate} — the same predicate the base guard uses
+ * to decide whether to render children — so the loader and the guard's
+ * render decision cannot drift apart. When waitForOrganization is true
+ * (default), the loader persists until both user and organization are ready;
+ * when false, it dismisses as soon as user auth is ready, leaving pages to
+ * handle the no-org state themselves.
  *
  * Intentionally excludes onboarding gate logic — apps that need it (e.g.
  * Command Center) should wrap this component and add their own gate inside.
@@ -3369,18 +3400,103 @@ interface UseUserProfileReturn {
     error: Error | null;
     refetch: () => Promise<void>;
 }
+/**
+ * Canonical TanStack Query key for the current user's profile.
+ *
+ * Every consumer (ProfileProvider, Command Center's root layout, the
+ * onboarding gate, the welcome flow, account settings, ...) reads and writes
+ * this exact key, so they share one cache entry instead of each issuing an
+ * independent `/users/me/sync` call. Not user-scoped: a full sign-out /
+ * sign-in cycle in this app navigates through WorkOS (a real page load),
+ * which tears down the QueryClient, so no explicit user id is needed to
+ * avoid stale cross-user reads within a single session.
+ */
+declare const USER_PROFILE_QUERY_KEY: QueryKey;
 /**
  * Hook for managing user profile data with automatic WorkOS -> Supabase sync
  *
- * This hook:
+ * Backed by a single shared TanStack Query cache entry keyed on
+ * {@link USER_PROFILE_QUERY_KEY}. This hook:
  * 1. Automatically syncs WorkOS user data to Supabase on authentication
  * 2. Provides access to the user's Supabase profile data
  * 3. Handles loading states and errors
  * 4. Includes a refetch function for manual updates
  *
+ * Because every consumer queries the same key, calling this hook from
+ * multiple places in the tree (directly or via `useProfile()`) triggers at
+ * most one `/users/me/sync` request per session — later mounts simply read
+ * the cached result. Call `refetch()` (or invalidate {@link USER_PROFILE_QUERY_KEY}
+ * via `useQueryClient()`) to force a fresh sync after a mutation that changes
+ * the profile, e.g. completing onboarding.
+ *
  * @param options - Optional configuration including error handler and apiRequest
  */
 declare const useUserProfile: (options?: UseUserProfileOptions) => UseUserProfileReturn;
 
-export { AccessGuard, AuthRedirectLoadingScreen, ProtectedRoute, useUserProfile };
-export type { AccessGuardProps, AuthRedirectLoadingScreenProps, ProtectedRouteProps, UseUserProfileReturn };
+/**
+ * Which WorkOS hosted screen an invited user should land on. Set by the platform's
+ * invite router (`GET /api/invite`), which looks the email up in WorkOS at click
+ * time and appends the answer to this route's URL.
+ */
+type AuthMode = 'signin' | 'signup';
+interface LoginSearchParams {
+    returnTo?: string;
+    context?: string;
+    invitation_token?: string;
+    mode?: AuthMode;
+}
+/**
+ * TanStack Router `validateSearch` for the `/login` route. Export it alongside
+ * `LoginScreen` so every project's route file can wire both in directly:
+ *
+ * ```tsx
+ * export const Route = createFileRoute('/login')({
+ *   component: () => <LoginScreen ... />,
+ *   validateSearch: validateLoginSearch
+ * })
+ * ```
+ */
+declare function validateLoginSearch(search: Record<string, unknown>): LoginSearchParams;
+interface LoginScreenAppConfig {
+    /**
+     * WorkOS organization id for single-org deployments. Tenant route stubs pass
+     * `__ELEVASIS_WORKOS_ORG_ID__` — the build-time constant the `elevasisVite()`
+     * plugin injects from the project's `.elevasis` marker. Command Center omits
+     * this prop entirely, matching its existing login route, which never binds a
+     * single WorkOS organization.
+     */
+    workosOrganizationId?: string;
+}
+interface LoginScreenProps {
+    /** Logo shown when the active Mantine color scheme is light. */
+    lightModeLogo: string;
+    /** Logo shown when the active Mantine color scheme is dark. */
+    darkModeLogo: string;
+    /** Application or company name shown in the heading and used for the logo alt text. */
+    appName: string;
+    /**
+     * Project-specific auth configuration that is not presentation. Currently
+     * only carries the WorkOS organization id — see `LoginScreenAppConfig`.
+     */
+    appConfig?: LoginScreenAppConfig;
+}
+/**
+ * Shared login screen: the WorkOS-hosted sign-in/sign-up entry point.
+ *
+ * Owns the invitation-token branch, the WorkOS `context` branch, `returnTo`
+ * state handling, and the authenticated-user redirect — logic that was
+ * previously duplicated verbatim across five project-local `login.tsx` route
+ * files. Each project keeps only a thin route stub that supplies branding and
+ * registers the route:
+ *
+ * ```tsx
+ * export const Route = createFileRoute('/login')({
+ *   component: () => <LoginScreen lightModeLogo={...} darkModeLogo={...} appName={...} />,
+ *   validateSearch: validateLoginSearch
+ * })
+ * ```
+ */
+declare function LoginScreen({ lightModeLogo, darkModeLogo, appName, appConfig }: LoginScreenProps): react_jsx_runtime.JSX.Element;
+
+export { AccessGuard, AuthRedirectLoadingScreen, LoginScreen, ProtectedRoute, USER_PROFILE_QUERY_KEY, useUserProfile, validateLoginSearch };
+export type { AccessGuardProps, AuthMode, AuthRedirectLoadingScreenProps, LoginScreenAppConfig, LoginScreenProps, LoginSearchParams, ProtectedRouteProps, UseUserProfileReturn };

package/dist/features/auth/index.js

@@ -1,35 +1,38 @@
-import { ProtectedRoute, AppearanceContext, AppShellError, useAppearance } from '../../chunk-PGAA4G3T.js';
-export { AccessGuard } from '../../chunk-PGAA4G3T.js';
+import { computeProtectedRouteGate, DEFAULT_WAIT_FOR_ORGANIZATION, ProtectedRoute, AppearanceContext, useAppearance, AppShellError } from '../../chunk-ANNM5R7S.js';
+export { AccessGuard } from '../../chunk-ANNM5R7S.js';
 import '../../chunk-4OEVLV66.js';
 import '../../chunk-RBGVNPA6.js';
-import '../../chunk-ZTWA5H77.js';
+import '../../chunk-6ZAP3FOA.js';
 import '../../chunk-AUDNF2Q7.js';
 import '../../chunk-6M6OLGQY.js';
 import '../../chunk-MKH2KOAO.js';
 import '../../chunk-XNW3O6QW.js';
-import '../../chunk-T4LA4RY2.js';
+import '../../chunk-L7BZZ4SI.js';
 import '../../chunk-GMXGDO3I.js';
 import '../../chunk-62GVNH5U.js';
-import { useInitialization } from '../../chunk-LO7GWG24.js';
+import { useInitialization } from '../../chunk-P45GQ3ZW.js';
 import '../../chunk-DD3CCMCZ.js';
 import '../../chunk-M7WWRZ5Z.js';
 import '../../chunk-JFBZ6XDW.js';
 import '../../chunk-2IFYDILW.js';
 import '../../chunk-Q7DJKLEN.js';
 import '../../chunk-HENXLGVD.js';
-import '../../chunk-I3CFGE3N.js';
+import '../../chunk-BLXJEIQS.js';
 import '../../chunk-RNP5R5I3.js';
-export { useUserProfile } from '../../chunk-EIXSQONC.js';
+export { USER_PROFILE_QUERY_KEY, useUserProfile } from '../../chunk-RT4KRGZT.js';
 import '../../chunk-I7BZVVVU.js';
-import '../../chunk-FVOMKZ7S.js';
-import '../../chunk-KRWALB24.js';
+import '../../chunk-Y6I3IC45.js';
+import '../../chunk-6SSQGWK7.js';
 import '../../chunk-BI5VDO2K.js';
 import '../../chunk-MQZE7SUI.js';
 import '../../chunk-TVTSASST.js';
 import '../../chunk-BRJ3QZ4E.js';
 import '../../chunk-I2KLQ2HA.js';
-import { useContext, useState, useRef, useEffect, useCallback } from 'react';
+import { useContext, useEffect, useState, useRef, useCallback } from 'react';
 import { jsxs, Fragment, jsx } from 'react/jsx-runtime';
+import { useRouter, useSearch } from '@tanstack/react-router';
+import { useAuth } from '@workos-inc/authkit-react';
+import { useMantineColorScheme, Container, Center, Paper, Stack, Text, Button, Image } from '@mantine/core';
 
 function FullScreenLoader({ hiding, onHidden }) {
   const { background, loader } = useAppearance();
@@ -82,11 +85,16 @@ function ProtectedRoute2({
   redirectTo = "/login",
   fallback,
   errorFallback,
-  waitForOrganization = false
+  waitForOrganization = DEFAULT_WAIT_FOR_ORGANIZATION
 }) {
   const { isInitializing, userReady, allReady, error } = useInitialization();
-  const orgSettled = allReady || error?.layer === "organization";
-  const showLoader = !error && (isInitializing || !userReady || waitForOrganization && !orgSettled);
+  const { showFallback: showLoader } = computeProtectedRouteGate({
+    isInitializing,
+    userReady,
+    allReady,
+    error,
+    waitForOrganization
+  });
   const resolvedErrorFallback = errorFallback ?? ((err, retry) => /* @__PURE__ */ jsx(AppShellError, { message: err.message, retry }));
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     fallback ? showLoader ? fallback : null : /* @__PURE__ */ jsx(AnimatedLoader, { showLoader }),
@@ -139,5 +147,137 @@ function AuthRedirectLoadingScreen({
     }
   );
 }
+function getStringSearchParam(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function getAuthModeSearchParam(value) {
+  return value === "signin" || value === "signup" ? value : void 0;
+}
+function validateLoginSearch(search) {
+  return {
+    returnTo: getStringSearchParam(search.returnTo),
+    context: getStringSearchParam(search.context),
+    invitation_token: getStringSearchParam(search.invitation_token),
+    mode: getAuthModeSearchParam(search.mode)
+  };
+}
+function LoginScreen({ lightModeLogo, darkModeLogo, appName, appConfig }) {
+  const { user, isLoading, signIn, signUp } = useAuth();
+  const { colorScheme } = useMantineColorScheme();
+  const router = useRouter();
+  const {
+    returnTo,
+    context,
+    invitation_token: invitationToken,
+    mode
+  } = useSearch({
+    strict: false
+  });
+  const { background, loader } = useAppearance();
+  const workosOrganizationId = appConfig?.workosOrganizationId;
+  useEffect(() => {
+    if (invitationToken) {
+      const startAuth = mode === "signin" ? signIn : signUp;
+      startAuth({
+        invitationToken,
+        state: returnTo ? { returnTo } : void 0,
+        ...workosOrganizationId && { organizationId: workosOrganizationId }
+      });
+      return;
+    }
+    if (context) {
+      signIn({
+        context,
+        state: returnTo ? { returnTo } : void 0,
+        ...workosOrganizationId && { organizationId: workosOrganizationId }
+      });
+      return;
+    }
+  }, [invitationToken, context, mode, signIn, signUp, returnTo, workosOrganizationId]);
+  useEffect(() => {
+    if (user && !isLoading) {
+      const destination = returnTo || "/";
+      router.navigate({ to: destination });
+    }
+  }, [user, isLoading, router, returnTo]);
+  if (invitationToken) {
+    return /* @__PURE__ */ jsx(AuthRedirectLoadingScreen, { testId: "invitation-redirect-loading" });
+  }
+  if (user) {
+    return /* @__PURE__ */ jsx(Container, { size: "sm", style: { minHeight: "100vh", display: "flex", alignItems: "center" }, children: /* @__PURE__ */ jsx(Center, { style: { width: "100%" }, children: /* @__PURE__ */ jsx(Paper, { shadow: "sm", style: { minWidth: "400px" }, children: /* @__PURE__ */ jsxs(Stack, { align: "center", children: [
+      /* @__PURE__ */ jsx(Text, { size: "lg", fw: 600, style: { fontFamily: "var(--mantine-font-family-headings)" }, children: "Welcome back!" }),
+      /* @__PURE__ */ jsxs(Text, { c: "dimmed", ta: "center", children: [
+        "You are already signed in as ",
+        user.email
+      ] }),
+      /* @__PURE__ */ jsx(Button, { onClick: () => router.navigate({ to: "/" }), variant: "filled", children: "Continue to App" })
+    ] }) }) }) });
+  }
+  if (isLoading) {
+    return /* @__PURE__ */ jsxs(
+      "div",
+      {
+        style: {
+          height: "100vh",
+          display: "flex",
+          alignItems: "center",
+          justifyContent: "center",
+          backgroundColor: "var(--color-background)",
+          position: "relative"
+        },
+        children: [
+          background,
+          /* @__PURE__ */ jsx("div", { style: { zIndex: 1 }, children: loader })
+        ]
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxs(
+    "div",
+    {
+      style: {
+        height: "100vh",
+        display: "flex",
+        alignItems: "center",
+        justifyContent: "center",
+        backgroundColor: "var(--color-background)",
+        position: "relative"
+      },
+      children: [
+        background,
+        /* @__PURE__ */ jsx(Center, { style: { width: "100%", zIndex: 1 }, children: /* @__PURE__ */ jsx(Paper, { shadow: "sm", style: { minWidth: "400px" }, children: /* @__PURE__ */ jsxs(Stack, { align: "center", children: [
+          /* @__PURE__ */ jsx(
+            Image,
+            {
+              src: colorScheme === "dark" ? darkModeLogo : lightModeLogo,
+              alt: `${appName} Logo`,
+              h: 50,
+              w: "auto",
+              fit: "contain"
+            }
+          ),
+          /* @__PURE__ */ jsxs(Text, { size: "xl", fw: 600, style: { fontFamily: "var(--mantine-font-family-headings)" }, children: [
+            "Sign In to ",
+            appName
+          ] }),
+          /* @__PURE__ */ jsx(
+            Button,
+            {
+              onClick: () => signIn({
+                state: returnTo ? { returnTo } : void 0,
+                ...workosOrganizationId && { organizationId: workosOrganizationId }
+              }),
+              variant: "filled",
+              size: "md",
+              fullWidth: true,
+              children: "Sign In"
+            }
+          ),
+          /* @__PURE__ */ jsx(Text, { c: "dimmed", ta: "center", size: "sm", children: "Powered by WorkOS for enterprise-grade security" })
+        ] }) }) })
+      ]
+    }
+  );
+}
 
-export { AuthRedirectLoadingScreen, ProtectedRoute2 as ProtectedRoute };
+export { AuthRedirectLoadingScreen, LoginScreen, ProtectedRoute2 as ProtectedRoute, validateLoginSearch };