@shipfox/client-auth 3.0.1 → 5.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 36 files with swc (473.63ms)
+Successfully compiled: 39 files with swc (471.46ms)

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @shipfox/client-auth
 
+## 5.0.0
+
+### Major Changes
+
+- ffd727b: Converges auth session and invitation state onto shared camelCase domain types validated at the API boundary, replacing the raw snake_case DTOs previously returned by login, signup, password reset, email verification, workspace creation, and invitation preview. `AuthState.user`, `useRefreshAuth()`, and `usePreviewInvitation()` now resolve to `UserIdentity`/`AuthenticatedSession`/`InvitationPreview` shapes (for example `accessToken` instead of `token`, `workspaceName` instead of `workspace_name`). Also moves the shared `AuthShell` component and session mapping helpers into `@shipfox/client-shell`, breaking the former `client-auth` ↔ `client-invitations` circular dependency.
+
+### Patch Changes
+
+- Updated dependencies [ffd727b]
+- Updated dependencies [79df9d1]
+  - @shipfox/client-shell@5.0.0
+  - @shipfox/client-invitations@5.0.0
+
+## 4.0.0
+
+### Minor Changes
+
+- 20e4feb: Adds provider-neutral authentication continuation primitives for reusable shells, email-code verification, and redirect context.
+
+### Patch Changes
+
+- 11b10f7: Prevents private React Query data from persisting across logout and authenticated user changes.
+- Updated dependencies [2e5b718]
+- Updated dependencies [769d919]
+- Updated dependencies [6b4a575]
+- Updated dependencies [11b10f7]
+- Updated dependencies [781a45b]
+  - @shipfox/client-ui@4.0.0
+  - @shipfox/client-shell@4.0.0
+  - @shipfox/api-auth-dto@7.1.0
+  - @shipfox/client-api@4.0.0
+
 ## 3.0.1
 
 ### Patch Changes

package/dist/components/email-code-verification.d.ts

@@ -0,0 +1,20 @@
+import type { HeaderProps } from '@shipfox/react-ui/typography';
+import type { ReactNode, Ref } from 'react';
+export interface EmailCodeVerificationProps {
+    destination: string;
+    expiresAt?: string | undefined;
+    nextResendAvailableAt?: string | undefined;
+    isResending?: boolean;
+    isVerifying?: boolean;
+    error?: string | undefined;
+    title?: string;
+    description?: string;
+    children?: ReactNode;
+    headingProps?: Omit<HeaderProps, 'children' | 'id'> | undefined;
+    headingRef?: Ref<HTMLHeadingElement> | undefined;
+    onResend: () => void | Promise<void>;
+    onUseAnotherEmail: () => void;
+    onVerify: (code: string) => void | Promise<void>;
+}
+export declare function EmailCodeVerification({ destination, expiresAt, nextResendAvailableAt, isResending, isVerifying, error, title, description, children, headingProps, headingRef, onResend, onUseAnotherEmail, onVerify, }: EmailCodeVerificationProps): import("react").JSX.Element;
+//# sourceMappingURL=email-code-verification.d.ts.map

package/dist/components/email-code-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-code-verification.d.ts","sourceRoot":"","sources":["../../src/components/email-code-verification.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAY,SAAS,EAAE,GAAG,EAAC,MAAM,OAAO,CAAC;AAKrD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,YAAY,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IAChE,UAAU,CAAC,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAQD,wBAAgB,qBAAqB,CAAC,EACpC,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,WAAmB,EACnB,WAAmB,EACnB,KAAK,EACL,KAA0B,EAC1B,WAA2E,EAC3E,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,iBAAiB,EACjB,QAAQ,GACT,EAAE,0BAA0B,+BAgI5B"}

package/dist/components/email-code-verification.js

@@ -0,0 +1,136 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { AuthShell } from '@shipfox/client-shell/runtime';
+import { Button } from '@shipfox/react-ui/button';
+import { Callout } from '@shipfox/react-ui/callout';
+import { FormField, FormFieldInput } from '@shipfox/react-ui/form-field';
+import { useCallback, useEffect, useRef, useState } from 'react';
+const EIGHT_DIGIT_CODE_RE = /^\d{8}$/u;
+function timestamp(value) {
+    if (!value) return undefined;
+    const parsed = Date.parse(value);
+    return Number.isNaN(parsed) ? undefined : parsed;
+}
+export function EmailCodeVerification({ destination, expiresAt, nextResendAvailableAt, isResending = false, isVerifying = false, error, title = 'Check your email', description = `We sent an eight-digit verification code to ${destination}.`, children, headingProps, headingRef, onResend, onUseAnotherEmail, onVerify }) {
+    const [code, setCode] = useState('');
+    const [now, setNow] = useState(()=>Date.now());
+    const [codeError, setCodeError] = useState();
+    const localHeadingRef = useRef(null);
+    const resendAvailableAt = timestamp(nextResendAvailableAt);
+    const expiration = timestamp(expiresAt);
+    const resendRemainingSeconds = resendAvailableAt ? Math.max(0, Math.ceil((resendAvailableAt - now) / 1_000)) : 0;
+    const isResendCoolingDown = resendRemainingSeconds > 0;
+    const isExpired = expiration !== undefined && expiration <= now;
+    const isPending = isResending || isVerifying;
+    useEffect(()=>{
+        const isPending = (tickNow)=>resendAvailableAt !== undefined && resendAvailableAt > tickNow || expiration !== undefined && expiration > tickNow;
+        const tickNow = Date.now();
+        setNow(tickNow);
+        if (!isPending(tickNow)) return;
+        const interval = window.setInterval(()=>{
+            const nextTick = Date.now();
+            setNow(nextTick);
+            if (!isPending(nextTick)) {
+                window.clearInterval(interval);
+            }
+        }, 1_000);
+        return ()=>window.clearInterval(interval);
+    }, [
+        expiration,
+        resendAvailableAt
+    ]);
+    useEffect(()=>{
+        localHeadingRef.current?.focus();
+    }, []);
+    const setHeadingRef = useCallback((heading)=>{
+        localHeadingRef.current = heading;
+        if (typeof headingRef === 'function') {
+            headingRef(heading);
+        } else if (headingRef) {
+            headingRef.current = heading;
+        }
+    }, [
+        headingRef
+    ]);
+    function submit(event) {
+        event.preventDefault();
+        if (isExpired || isVerifying) return;
+        if (!validateCode()) return;
+        void onVerify(code);
+    }
+    function validateCode() {
+        const error = EIGHT_DIGIT_CODE_RE.test(code) ? undefined : 'Enter the eight-digit verification code.';
+        setCodeError(error);
+        return error === undefined;
+    }
+    return /*#__PURE__*/ _jsxs(AuthShell, {
+        title: title,
+        description: description,
+        headingProps: headingProps,
+        headingRef: setHeadingRef,
+        children: [
+            error ? /*#__PURE__*/ _jsx(Callout, {
+                role: "alert",
+                type: "error",
+                children: error
+            }) : null,
+            isExpired ? /*#__PURE__*/ _jsx(Callout, {
+                role: "alert",
+                type: "error",
+                children: "This verification code has expired. Use another email to try again."
+            }) : null,
+            /*#__PURE__*/ _jsxs("form", {
+                className: "flex flex-col gap-8",
+                noValidate: true,
+                onSubmit: submit,
+                children: [
+                    /*#__PURE__*/ _jsx(FormField, {
+                        label: "Verification code",
+                        id: "verification-code",
+                        error: codeError,
+                        children: /*#__PURE__*/ _jsx(FormFieldInput, {
+                            autoComplete: "one-time-code",
+                            inputMode: "numeric",
+                            maxLength: 8,
+                            pattern: "[0-9]{8}",
+                            value: code,
+                            onChange: (event)=>{
+                                setCode(event.target.value.replace(/\D/gu, '').slice(0, 8));
+                                setCodeError(undefined);
+                            },
+                            onBlur: validateCode
+                        })
+                    }),
+                    /*#__PURE__*/ _jsx(Button, {
+                        className: "w-full",
+                        type: "submit",
+                        disabled: isExpired,
+                        isLoading: isVerifying,
+                        children: "Verify email"
+                    }),
+                    /*#__PURE__*/ _jsx(Button, {
+                        "aria-disabled": isResendCoolingDown ? true : undefined,
+                        className: "w-full aria-disabled:cursor-not-allowed aria-disabled:opacity-70",
+                        variant: "secondary",
+                        type: "button",
+                        isLoading: isResending,
+                        onClick: ()=>{
+                            if (!isResendCoolingDown && !isResending) void onResend();
+                        },
+                        children: isResending ? 'Sending email...' : isResendCoolingDown ? `Resend in ${resendRemainingSeconds}s` : 'Resend verification email'
+                    })
+                ]
+            }),
+            /*#__PURE__*/ _jsx(Button, {
+                className: "w-full",
+                variant: "transparent",
+                type: "button",
+                disabled: isPending,
+                onClick: onUseAnotherEmail,
+                children: "Use another email"
+            }),
+            children
+        ]
+    });
+}
+
+//# sourceMappingURL=email-code-verification.js.map

package/dist/components/email-code-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/components/email-code-verification.tsx"],"sourcesContent":["import {AuthShell} from '@shipfox/client-shell/runtime';\nimport {Button} from '@shipfox/react-ui/button';\nimport {Callout} from '@shipfox/react-ui/callout';\nimport {FormField, FormFieldInput} from '@shipfox/react-ui/form-field';\nimport type {HeaderProps} from '@shipfox/react-ui/typography';\nimport type {FormEvent, ReactNode, Ref} from 'react';\nimport {useCallback, useEffect, useRef, useState} from 'react';\n\nconst EIGHT_DIGIT_CODE_RE = /^\\d{8}$/u;\n\nexport interface EmailCodeVerificationProps {\n  destination: string;\n  expiresAt?: string | undefined;\n  nextResendAvailableAt?: string | undefined;\n  isResending?: boolean;\n  isVerifying?: boolean;\n  error?: string | undefined;\n  title?: string;\n  description?: string;\n  children?: ReactNode;\n  headingProps?: Omit<HeaderProps, 'children' | 'id'> | undefined;\n  headingRef?: Ref<HTMLHeadingElement> | undefined;\n  onResend: () => void | Promise<void>;\n  onUseAnotherEmail: () => void;\n  onVerify: (code: string) => void | Promise<void>;\n}\n\nfunction timestamp(value: string | undefined): number | undefined {\n  if (!value) return undefined;\n  const parsed = Date.parse(value);\n  return Number.isNaN(parsed) ? undefined : parsed;\n}\n\nexport function EmailCodeVerification({\n  destination,\n  expiresAt,\n  nextResendAvailableAt,\n  isResending = false,\n  isVerifying = false,\n  error,\n  title = 'Check your email',\n  description = `We sent an eight-digit verification code to ${destination}.`,\n  children,\n  headingProps,\n  headingRef,\n  onResend,\n  onUseAnotherEmail,\n  onVerify,\n}: EmailCodeVerificationProps) {\n  const [code, setCode] = useState('');\n  const [now, setNow] = useState(() => Date.now());\n  const [codeError, setCodeError] = useState<string>();\n  const localHeadingRef = useRef<HTMLHeadingElement>(null);\n  const resendAvailableAt = timestamp(nextResendAvailableAt);\n  const expiration = timestamp(expiresAt);\n  const resendRemainingSeconds = resendAvailableAt\n    ? Math.max(0, Math.ceil((resendAvailableAt - now) / 1_000))\n    : 0;\n  const isResendCoolingDown = resendRemainingSeconds > 0;\n  const isExpired = expiration !== undefined && expiration <= now;\n  const isPending = isResending || isVerifying;\n\n  useEffect(() => {\n    const isPending = (tickNow: number) =>\n      (resendAvailableAt !== undefined && resendAvailableAt > tickNow) ||\n      (expiration !== undefined && expiration > tickNow);\n\n    const tickNow = Date.now();\n    setNow(tickNow);\n    if (!isPending(tickNow)) return;\n\n    const interval = window.setInterval(() => {\n      const nextTick = Date.now();\n      setNow(nextTick);\n      if (!isPending(nextTick)) {\n        window.clearInterval(interval);\n      }\n    }, 1_000);\n    return () => window.clearInterval(interval);\n  }, [expiration, resendAvailableAt]);\n\n  useEffect(() => {\n    localHeadingRef.current?.focus();\n  }, []);\n\n  const setHeadingRef = useCallback(\n    (heading: HTMLHeadingElement | null) => {\n      localHeadingRef.current = heading;\n      if (typeof headingRef === 'function') {\n        headingRef(heading);\n      } else if (headingRef) {\n        headingRef.current = heading;\n      }\n    },\n    [headingRef],\n  );\n\n  function submit(event: FormEvent<HTMLFormElement>) {\n    event.preventDefault();\n    if (isExpired || isVerifying) return;\n    if (!validateCode()) return;\n    void onVerify(code);\n  }\n\n  function validateCode() {\n    const error = EIGHT_DIGIT_CODE_RE.test(code)\n      ? undefined\n      : 'Enter the eight-digit verification code.';\n    setCodeError(error);\n    return error === undefined;\n  }\n\n  return (\n    <AuthShell\n      title={title}\n      description={description}\n      headingProps={headingProps}\n      headingRef={setHeadingRef}\n    >\n      {error ? (\n        <Callout role=\"alert\" type=\"error\">\n          {error}\n        </Callout>\n      ) : null}\n      {isExpired ? (\n        <Callout role=\"alert\" type=\"error\">\n          This verification code has expired. Use another email to try again.\n        </Callout>\n      ) : null}\n      <form className=\"flex flex-col gap-8\" noValidate onSubmit={submit}>\n        <FormField label=\"Verification code\" id=\"verification-code\" error={codeError}>\n          <FormFieldInput\n            autoComplete=\"one-time-code\"\n            inputMode=\"numeric\"\n            maxLength={8}\n            pattern=\"[0-9]{8}\"\n            value={code}\n            onChange={(event) => {\n              setCode(event.target.value.replace(/\\D/gu, '').slice(0, 8));\n              setCodeError(undefined);\n            }}\n            onBlur={validateCode}\n          />\n        </FormField>\n        <Button className=\"w-full\" type=\"submit\" disabled={isExpired} isLoading={isVerifying}>\n          Verify email\n        </Button>\n        <Button\n          aria-disabled={isResendCoolingDown ? true : undefined}\n          className=\"w-full aria-disabled:cursor-not-allowed aria-disabled:opacity-70\"\n          variant=\"secondary\"\n          type=\"button\"\n          isLoading={isResending}\n          onClick={() => {\n            if (!isResendCoolingDown && !isResending) void onResend();\n          }}\n        >\n          {isResending\n            ? 'Sending email...'\n            : isResendCoolingDown\n              ? `Resend in ${resendRemainingSeconds}s`\n              : 'Resend verification email'}\n        </Button>\n      </form>\n      <Button\n        className=\"w-full\"\n        variant=\"transparent\"\n        type=\"button\"\n        disabled={isPending}\n        onClick={onUseAnotherEmail}\n      >\n        Use another email\n      </Button>\n      {children}\n    </AuthShell>\n  );\n}\n"],"names":["AuthShell","Button","Callout","FormField","FormFieldInput","useCallback","useEffect","useRef","useState","EIGHT_DIGIT_CODE_RE","timestamp","value","undefined","parsed","Date","parse","Number","isNaN","EmailCodeVerification","destination","expiresAt","nextResendAvailableAt","isResending","isVerifying","error","title","description","children","headingProps","headingRef","onResend","onUseAnotherEmail","onVerify","code","setCode","now","setNow","codeError","setCodeError","localHeadingRef","resendAvailableAt","expiration","resendRemainingSeconds","Math","max","ceil","isResendCoolingDown","isExpired","isPending","tickNow","interval","window","setInterval","nextTick","clearInterval","current","focus","setHeadingRef","heading","submit","event","preventDefault","validateCode","test","role","type","form","className","noValidate","onSubmit","label","id","autoComplete","inputMode","maxLength","pattern","onChange","target","replace","slice","onBlur","disabled","isLoading","aria-disabled","variant","onClick"],"mappings":";AAAA,SAAQA,SAAS,QAAO,gCAAgC;AACxD,SAAQC,MAAM,QAAO,2BAA2B;AAChD,SAAQC,OAAO,QAAO,4BAA4B;AAClD,SAAQC,SAAS,EAAEC,cAAc,QAAO,+BAA+B;AAGvE,SAAQC,WAAW,EAAEC,SAAS,EAAEC,MAAM,EAAEC,QAAQ,QAAO,QAAQ;AAE/D,MAAMC,sBAAsB;AAmB5B,SAASC,UAAUC,KAAyB;IAC1C,IAAI,CAACA,OAAO,OAAOC;IACnB,MAAMC,SAASC,KAAKC,KAAK,CAACJ;IAC1B,OAAOK,OAAOC,KAAK,CAACJ,UAAUD,YAAYC;AAC5C;AAEA,OAAO,SAASK,sBAAsB,EACpCC,WAAW,EACXC,SAAS,EACTC,qBAAqB,EACrBC,cAAc,KAAK,EACnBC,cAAc,KAAK,EACnBC,KAAK,EACLC,QAAQ,kBAAkB,EAC1BC,cAAc,CAAC,4CAA4C,EAAEP,YAAY,CAAC,CAAC,EAC3EQ,QAAQ,EACRC,YAAY,EACZC,UAAU,EACVC,QAAQ,EACRC,iBAAiB,EACjBC,QAAQ,EACmB;IAC3B,MAAM,CAACC,MAAMC,QAAQ,GAAG1B,SAAS;IACjC,MAAM,CAAC2B,KAAKC,OAAO,GAAG5B,SAAS,IAAMM,KAAKqB,GAAG;IAC7C,MAAM,CAACE,WAAWC,aAAa,GAAG9B;IAClC,MAAM+B,kBAAkBhC,OAA2B;IACnD,MAAMiC,oBAAoB9B,UAAUW;IACpC,MAAMoB,aAAa/B,UAAUU;IAC7B,MAAMsB,yBAAyBF,oBAC3BG,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAAC,AAACL,CAAAA,oBAAoBL,GAAE,IAAK,UAClD;IACJ,MAAMW,sBAAsBJ,yBAAyB;IACrD,MAAMK,YAAYN,eAAe7B,aAAa6B,cAAcN;IAC5D,MAAMa,YAAY1B,eAAeC;IAEjCjB,UAAU;QACR,MAAM0C,YAAY,CAACC,UACjB,AAACT,sBAAsB5B,aAAa4B,oBAAoBS,WACvDR,eAAe7B,aAAa6B,aAAaQ;QAE5C,MAAMA,UAAUnC,KAAKqB,GAAG;QACxBC,OAAOa;QACP,IAAI,CAACD,UAAUC,UAAU;QAEzB,MAAMC,WAAWC,OAAOC,WAAW,CAAC;YAClC,MAAMC,WAAWvC,KAAKqB,GAAG;YACzBC,OAAOiB;YACP,IAAI,CAACL,UAAUK,WAAW;gBACxBF,OAAOG,aAAa,CAACJ;YACvB;QACF,GAAG;QACH,OAAO,IAAMC,OAAOG,aAAa,CAACJ;IACpC,GAAG;QAACT;QAAYD;KAAkB;IAElClC,UAAU;QACRiC,gBAAgBgB,OAAO,EAAEC;IAC3B,GAAG,EAAE;IAEL,MAAMC,gBAAgBpD,YACpB,CAACqD;QACCnB,gBAAgBgB,OAAO,GAAGG;QAC1B,IAAI,OAAO7B,eAAe,YAAY;YACpCA,WAAW6B;QACb,OAAO,IAAI7B,YAAY;YACrBA,WAAW0B,OAAO,GAAGG;QACvB;IACF,GACA;QAAC7B;KAAW;IAGd,SAAS8B,OAAOC,KAAiC;QAC/CA,MAAMC,cAAc;QACpB,IAAId,aAAaxB,aAAa;QAC9B,IAAI,CAACuC,gBAAgB;QACrB,KAAK9B,SAASC;IAChB;IAEA,SAAS6B;QACP,MAAMtC,QAAQf,oBAAoBsD,IAAI,CAAC9B,QACnCrB,YACA;QACJ0B,aAAad;QACb,OAAOA,UAAUZ;IACnB;IAEA,qBACE,MAACZ;QACCyB,OAAOA;QACPC,aAAaA;QACbE,cAAcA;QACdC,YAAY4B;;YAEXjC,sBACC,KAACtB;gBAAQ8D,MAAK;gBAAQC,MAAK;0BACxBzC;iBAED;YACHuB,0BACC,KAAC7C;gBAAQ8D,MAAK;gBAAQC,MAAK;0BAAQ;iBAGjC;0BACJ,MAACC;gBAAKC,WAAU;gBAAsBC,UAAU;gBAACC,UAAUV;;kCACzD,KAACxD;wBAAUmE,OAAM;wBAAoBC,IAAG;wBAAoB/C,OAAOa;kCACjE,cAAA,KAACjC;4BACCoE,cAAa;4BACbC,WAAU;4BACVC,WAAW;4BACXC,SAAQ;4BACRhE,OAAOsB;4BACP2C,UAAU,CAAChB;gCACT1B,QAAQ0B,MAAMiB,MAAM,CAAClE,KAAK,CAACmE,OAAO,CAAC,QAAQ,IAAIC,KAAK,CAAC,GAAG;gCACxDzC,aAAa1B;4BACf;4BACAoE,QAAQlB;;;kCAGZ,KAAC7D;wBAAOkE,WAAU;wBAASF,MAAK;wBAASgB,UAAUlC;wBAAWmC,WAAW3D;kCAAa;;kCAGtF,KAACtB;wBACCkF,iBAAerC,sBAAsB,OAAOlC;wBAC5CuD,WAAU;wBACViB,SAAQ;wBACRnB,MAAK;wBACLiB,WAAW5D;wBACX+D,SAAS;4BACP,IAAI,CAACvC,uBAAuB,CAACxB,aAAa,KAAKQ;wBACjD;kCAECR,cACG,qBACAwB,sBACE,CAAC,UAAU,EAAEJ,uBAAuB,CAAC,CAAC,GACtC;;;;0BAGV,KAACzC;gBACCkE,WAAU;gBACViB,SAAQ;gBACRnB,MAAK;gBACLgB,UAAUjC;gBACVqC,SAAStD;0BACV;;YAGAJ;;;AAGP"}

package/dist/components/redirect-context.d.ts

@@ -0,0 +1,11 @@
+export interface RedirectContext {
+    invitationToken?: string;
+    returnTo?: string;
+}
+/**
+ * Separates a safe post-authentication destination from an invitation token.
+ * The token never remains in `returnTo`, so callers can keep it in their
+ * short-lived invitation flow instead of forwarding it through generic redirects.
+ */
+export declare function parseRedirectContext(value: unknown): RedirectContext;
+//# sourceMappingURL=redirect-context.d.ts.map

package/dist/components/redirect-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-context.d.ts","sourceRoot":"","sources":["../../src/components/redirect-context.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAWpE"}

package/dist/components/redirect-context.js

@@ -0,0 +1,22 @@
+import { sanitizeRedirectPath } from './redirect-target.js';
+const INVITATION_ACCEPT_PATH = '/invitations/accept';
+/**
+ * Separates a safe post-authentication destination from an invitation token.
+ * The token never remains in `returnTo`, so callers can keep it in their
+ * short-lived invitation flow instead of forwarding it through generic redirects.
+ */ export function parseRedirectContext(value) {
+    const redirect = sanitizeRedirectPath(value);
+    if (!redirect) return {};
+    const decoded = decodeURIComponent(redirect);
+    const [path, queryString = ''] = decoded.split('?', 2);
+    if (path !== INVITATION_ACCEPT_PATH) return {
+        returnTo: redirect
+    };
+    const params = new URLSearchParams(queryString);
+    const invitationToken = params.get('token');
+    return invitationToken ? {
+        invitationToken
+    } : {};
+}
+
+//# sourceMappingURL=redirect-context.js.map

package/dist/components/redirect-context.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/components/redirect-context.ts"],"sourcesContent":["import {sanitizeRedirectPath} from './redirect-target.js';\n\nconst INVITATION_ACCEPT_PATH = '/invitations/accept';\n\nexport interface RedirectContext {\n  invitationToken?: string;\n  returnTo?: string;\n}\n\n/**\n * Separates a safe post-authentication destination from an invitation token.\n * The token never remains in `returnTo`, so callers can keep it in their\n * short-lived invitation flow instead of forwarding it through generic redirects.\n */\nexport function parseRedirectContext(value: unknown): RedirectContext {\n  const redirect = sanitizeRedirectPath(value);\n  if (!redirect) return {};\n\n  const decoded = decodeURIComponent(redirect);\n  const [path, queryString = ''] = decoded.split('?', 2);\n  if (path !== INVITATION_ACCEPT_PATH) return {returnTo: redirect};\n\n  const params = new URLSearchParams(queryString);\n  const invitationToken = params.get('token');\n  return invitationToken ? {invitationToken} : {};\n}\n"],"names":["sanitizeRedirectPath","INVITATION_ACCEPT_PATH","parseRedirectContext","value","redirect","decoded","decodeURIComponent","path","queryString","split","returnTo","params","URLSearchParams","invitationToken","get"],"mappings":"AAAA,SAAQA,oBAAoB,QAAO,uBAAuB;AAE1D,MAAMC,yBAAyB;AAO/B;;;;CAIC,GACD,OAAO,SAASC,qBAAqBC,KAAc;IACjD,MAAMC,WAAWJ,qBAAqBG;IACtC,IAAI,CAACC,UAAU,OAAO,CAAC;IAEvB,MAAMC,UAAUC,mBAAmBF;IACnC,MAAM,CAACG,MAAMC,cAAc,EAAE,CAAC,GAAGH,QAAQI,KAAK,CAAC,KAAK;IACpD,IAAIF,SAASN,wBAAwB,OAAO;QAACS,UAAUN;IAAQ;IAE/D,MAAMO,SAAS,IAAIC,gBAAgBJ;IACnC,MAAMK,kBAAkBF,OAAOG,GAAG,CAAC;IACnC,OAAOD,kBAAkB;QAACA;IAAe,IAAI,CAAC;AAChD"}

package/dist/components/redirect-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-target.d.ts","sourceRoot":"","sources":["../../src/components/redirect-target.ts"],"names":[],"mappings":"AAKA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAevE"}
+{"version":3,"file":"redirect-target.d.ts","sourceRoot":"","sources":["../../src/components/redirect-target.ts"],"names":[],"mappings":"AAIA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAiBvE"}

package/dist/components/redirect-target.js

@@ -1,22 +1,23 @@
-const SEARCH_OR_HASH_RE = /[?#]/u;
-// Returns the input string only if it is a same-origin internal path safe to
-// navigate to after authentication. We decode before checking so percent-encoded
-// variants like `/%61uth/login` cannot bypass the `/auth/*` rejection.
+const REDIRECT_ORIGIN = 'https://shipfox-redirect.invalid';
+// Resolves and canonicalizes an internal path before returning it, so browser URL
+// parsing cannot turn a seemingly safe path into an external or auth route.
 export function sanitizeRedirectPath(value) {
-    if (typeof value !== 'string') return undefined;
+    if (typeof value !== 'string' || !value.startsWith('/')) return undefined;
     let decoded;
     try {
         decoded = decodeURIComponent(value);
     } catch  {
         return undefined;
     }
-    if (!decoded.startsWith('/')) return undefined;
-    if (decoded.startsWith('//')) return undefined;
-    // Strip search/hash before the /auth check so /auth?token=x and /auth#x
-    // cannot bypass the prefix match.
-    const pathOnly = decoded.split(SEARCH_OR_HASH_RE, 1)[0] ?? decoded;
-    if (pathOnly === '/auth' || pathOnly.startsWith('/auth/')) return undefined;
-    return value;
+    let target;
+    try {
+        target = new URL(decoded, REDIRECT_ORIGIN);
+    } catch  {
+        return undefined;
+    }
+    if (target.origin !== REDIRECT_ORIGIN) return undefined;
+    if (target.pathname === '/auth' || target.pathname.startsWith('/auth/')) return undefined;
+    return `${target.pathname}${target.search}${target.hash}`;
 }
 
 //# sourceMappingURL=redirect-target.js.map

package/dist/components/redirect-target.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/redirect-target.ts"],"sourcesContent":["const SEARCH_OR_HASH_RE = /[?#]/u;\n\n// Returns the input string only if it is a same-origin internal path safe to\n// navigate to after authentication. We decode before checking so percent-encoded\n// variants like `/%61uth/login` cannot bypass the `/auth/*` rejection.\nexport function sanitizeRedirectPath(value: unknown): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(value);\n  } catch {\n    return undefined;\n  }\n  if (!decoded.startsWith('/')) return undefined;\n  if (decoded.startsWith('//')) return undefined;\n  // Strip search/hash before the /auth check so /auth?token=x and /auth#x\n  // cannot bypass the prefix match.\n  const pathOnly = decoded.split(SEARCH_OR_HASH_RE, 1)[0] ?? decoded;\n  if (pathOnly === '/auth' || pathOnly.startsWith('/auth/')) return undefined;\n  return value;\n}\n"],"names":["SEARCH_OR_HASH_RE","sanitizeRedirectPath","value","undefined","decoded","decodeURIComponent","startsWith","pathOnly","split"],"mappings":"AAAA,MAAMA,oBAAoB;AAE1B,6EAA6E;AAC7E,iFAAiF;AACjF,uEAAuE;AACvE,OAAO,SAASC,qBAAqBC,KAAc;IACjD,IAAI,OAAOA,UAAU,UAAU,OAAOC;IACtC,IAAIC;IACJ,IAAI;QACFA,UAAUC,mBAAmBH;IAC/B,EAAE,OAAM;QACN,OAAOC;IACT;IACA,IAAI,CAACC,QAAQE,UAAU,CAAC,MAAM,OAAOH;IACrC,IAAIC,QAAQE,UAAU,CAAC,OAAO,OAAOH;IACrC,wEAAwE;IACxE,kCAAkC;IAClC,MAAMI,WAAWH,QAAQI,KAAK,CAACR,mBAAmB,EAAE,CAAC,EAAE,IAAII;IAC3D,IAAIG,aAAa,WAAWA,SAASD,UAAU,CAAC,WAAW,OAAOH;IAClE,OAAOD;AACT"}
+{"version":3,"sources":["../../src/components/redirect-target.ts"],"sourcesContent":["const REDIRECT_ORIGIN = 'https://shipfox-redirect.invalid';\n\n// Resolves and canonicalizes an internal path before returning it, so browser URL\n// parsing cannot turn a seemingly safe path into an external or auth route.\nexport function sanitizeRedirectPath(value: unknown): string | undefined {\n  if (typeof value !== 'string' || !value.startsWith('/')) return undefined;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(value);\n  } catch {\n    return undefined;\n  }\n  let target: URL;\n  try {\n    target = new URL(decoded, REDIRECT_ORIGIN);\n  } catch {\n    return undefined;\n  }\n  if (target.origin !== REDIRECT_ORIGIN) return undefined;\n  if (target.pathname === '/auth' || target.pathname.startsWith('/auth/')) return undefined;\n  return `${target.pathname}${target.search}${target.hash}`;\n}\n"],"names":["REDIRECT_ORIGIN","sanitizeRedirectPath","value","startsWith","undefined","decoded","decodeURIComponent","target","URL","origin","pathname","search","hash"],"mappings":"AAAA,MAAMA,kBAAkB;AAExB,kFAAkF;AAClF,4EAA4E;AAC5E,OAAO,SAASC,qBAAqBC,KAAc;IACjD,IAAI,OAAOA,UAAU,YAAY,CAACA,MAAMC,UAAU,CAAC,MAAM,OAAOC;IAChE,IAAIC;IACJ,IAAI;QACFA,UAAUC,mBAAmBJ;IAC/B,EAAE,OAAM;QACN,OAAOE;IACT;IACA,IAAIG;IACJ,IAAI;QACFA,SAAS,IAAIC,IAAIH,SAASL;IAC5B,EAAE,OAAM;QACN,OAAOI;IACT;IACA,IAAIG,OAAOE,MAAM,KAAKT,iBAAiB,OAAOI;IAC9C,IAAIG,OAAOG,QAAQ,KAAK,WAAWH,OAAOG,QAAQ,CAACP,UAAU,CAAC,WAAW,OAAOC;IAChF,OAAO,GAAGG,OAAOG,QAAQ,GAAGH,OAAOI,MAAM,GAAGJ,OAAOK,IAAI,EAAE;AAC3D"}

package/dist/components/workspace-switcher.stories.d.ts

@@ -13,7 +13,7 @@ declare const meta: {
     };
     args: {
         activeWorkspaceId: string;
-        workspaces: Workspace[];
+        workspaces: import("@shipfox/client-shell/runtime").WorkspaceSummary[];
     };
 };
 export default meta;

package/dist/continuation.d.ts

@@ -0,0 +1,4 @@
+export { AuthActions, AuthShell, type AuthShellProps } from '@shipfox/client-shell/runtime';
+export { EmailCodeVerification, type EmailCodeVerificationProps, } from './components/email-code-verification.js';
+export { parseRedirectContext, type RedirectContext } from './components/redirect-context.js';
+//# sourceMappingURL=continuation.d.ts.map

package/dist/continuation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"continuation.d.ts","sourceRoot":"","sources":["../src/continuation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAE,SAAS,EAAE,KAAK,cAAc,EAAC,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAC,oBAAoB,EAAE,KAAK,eAAe,EAAC,MAAM,kCAAkC,CAAC"}

package/dist/continuation.js

@@ -0,0 +1,5 @@
+export { AuthActions, AuthShell } from '@shipfox/client-shell/runtime';
+export { EmailCodeVerification } from './components/email-code-verification.js';
+export { parseRedirectContext } from './components/redirect-context.js';
+
+//# sourceMappingURL=continuation.js.map

package/dist/continuation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/continuation.ts"],"sourcesContent":["export {AuthActions, AuthShell, type AuthShellProps} from '@shipfox/client-shell/runtime';\nexport {\n  EmailCodeVerification,\n  type EmailCodeVerificationProps,\n} from './components/email-code-verification.js';\nexport {parseRedirectContext, type RedirectContext} from './components/redirect-context.js';\n"],"names":["AuthActions","AuthShell","EmailCodeVerification","parseRedirectContext"],"mappings":"AAAA,SAAQA,WAAW,EAAEC,SAAS,QAA4B,gCAAgC;AAC1F,SACEC,qBAAqB,QAEhB,0CAA0C;AACjD,SAAQC,oBAAoB,QAA6B,mCAAmC"}

package/dist/hooks/api/auth-mapper.d.ts

@@ -0,0 +1,21 @@
+import type { SignupResponseDto } from '@shipfox/api-auth-dto';
+import { toAuthenticatedSession, type UserIdentity } from '@shipfox/client-shell/runtime';
+export { toAuthenticatedSession };
+export interface SignupResult {
+    user: UserIdentity;
+    emailChallenge?: {
+        id: string;
+        nextResendAvailableAt: string;
+    };
+    membership?: {
+        id: string;
+        userId: string;
+        workspaceId: string;
+    };
+    acceptError?: {
+        code: string;
+        message: string;
+    };
+}
+export declare function toSignupResult(dto: SignupResponseDto): SignupResult;
+//# sourceMappingURL=auth-mapper.d.ts.map

package/dist/hooks/api/auth-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-mapper.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/auth-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,sBAAsB,EAEtB,KAAK,YAAY,EAClB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAC,sBAAsB,EAAC,CAAC;AAEhC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,cAAc,CAAC,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAA;KAAC,CAAC;IAC7D,UAAU,CAAC,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,CAAC;IAC/D,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,YAAY,CAsBnE"}

package/dist/hooks/api/auth-mapper.js

@@ -0,0 +1,25 @@
+import { toAuthenticatedSession, toUserIdentity } from '@shipfox/client-shell/runtime';
+export { toAuthenticatedSession };
+export function toSignupResult(dto) {
+    return {
+        user: toUserIdentity(dto.user),
+        ...dto.email_challenge ? {
+            emailChallenge: {
+                id: dto.email_challenge.id,
+                nextResendAvailableAt: dto.email_challenge.next_resend_available_at
+            }
+        } : {},
+        ...dto.membership ? {
+            membership: {
+                id: dto.membership.id,
+                userId: dto.membership.user_id,
+                workspaceId: dto.membership.workspace_id
+            }
+        } : {},
+        ...dto.accept_error ? {
+            acceptError: dto.accept_error
+        } : {}
+    };
+}
+
+//# sourceMappingURL=auth-mapper.js.map

package/dist/hooks/api/auth-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/hooks/api/auth-mapper.ts"],"sourcesContent":["import type {SignupResponseDto} from '@shipfox/api-auth-dto';\nimport {\n  toAuthenticatedSession,\n  toUserIdentity,\n  type UserIdentity,\n} from '@shipfox/client-shell/runtime';\n\nexport {toAuthenticatedSession};\n\nexport interface SignupResult {\n  user: UserIdentity;\n  emailChallenge?: {id: string; nextResendAvailableAt: string};\n  membership?: {id: string; userId: string; workspaceId: string};\n  acceptError?: {code: string; message: string};\n}\n\nexport function toSignupResult(dto: SignupResponseDto): SignupResult {\n  return {\n    user: toUserIdentity(dto.user),\n    ...(dto.email_challenge\n      ? {\n          emailChallenge: {\n            id: dto.email_challenge.id,\n            nextResendAvailableAt: dto.email_challenge.next_resend_available_at,\n          },\n        }\n      : {}),\n    ...(dto.membership\n      ? {\n          membership: {\n            id: dto.membership.id,\n            userId: dto.membership.user_id,\n            workspaceId: dto.membership.workspace_id,\n          },\n        }\n      : {}),\n    ...(dto.accept_error ? {acceptError: dto.accept_error} : {}),\n  };\n}\n"],"names":["toAuthenticatedSession","toUserIdentity","toSignupResult","dto","user","email_challenge","emailChallenge","id","nextResendAvailableAt","next_resend_available_at","membership","userId","user_id","workspaceId","workspace_id","accept_error","acceptError"],"mappings":"AACA,SACEA,sBAAsB,EACtBC,cAAc,QAET,gCAAgC;AAEvC,SAAQD,sBAAsB,GAAE;AAShC,OAAO,SAASE,eAAeC,GAAsB;IACnD,OAAO;QACLC,MAAMH,eAAeE,IAAIC,IAAI;QAC7B,GAAID,IAAIE,eAAe,GACnB;YACEC,gBAAgB;gBACdC,IAAIJ,IAAIE,eAAe,CAACE,EAAE;gBAC1BC,uBAAuBL,IAAIE,eAAe,CAACI,wBAAwB;YACrE;QACF,IACA,CAAC,CAAC;QACN,GAAIN,IAAIO,UAAU,GACd;YACEA,YAAY;gBACVH,IAAIJ,IAAIO,UAAU,CAACH,EAAE;gBACrBI,QAAQR,IAAIO,UAAU,CAACE,OAAO;gBAC9BC,aAAaV,IAAIO,UAAU,CAACI,YAAY;YAC1C;QACF,IACA,CAAC,CAAC;QACN,GAAIX,IAAIY,YAAY,GAAG;YAACC,aAAab,IAAIY,YAAY;QAAA,IAAI,CAAC,CAAC;IAC7D;AACF"}

package/dist/hooks/api/login-auth.d.ts

@@ -1,28 +1,6 @@
-import type { LoginBodyDto } from '@shipfox/api-auth-dto';
-export declare function loginAuth(body: LoginBodyDto): Promise<{
-    token: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-        email_verified_at: string | null;
-        status: "active" | "suspended" | "deleted";
-        created_at: string;
-        updated_at: string;
-    };
-}>;
-export declare function useLoginAuth(): import("@tanstack/react-query").UseMutationResult<{
-    token: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-        email_verified_at: string | null;
-        status: "active" | "suspended" | "deleted";
-        created_at: string;
-        updated_at: string;
-    };
-}, Error, {
+import { type LoginBodyDto } from '@shipfox/api-auth-dto';
+export declare function loginAuth(body: LoginBodyDto): Promise<import("@shipfox/client-shell/runtime").AuthenticatedSession>;
+export declare function useLoginAuth(): import("@tanstack/react-query").UseMutationResult<import("@shipfox/client-shell/runtime").AuthenticatedSession, Error, {
     email: string;
     password: string;
 }, unknown>;

package/dist/hooks/api/login-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/login-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,YAAY,EAAmB,MAAM,uBAAuB,CAAC;AAQ1E,wBAAsB,SAAS,CAAC,IAAI,EAAE,YAAY;;;;;;;;;;;GAEjD;AAED,wBAAgB,YAAY;;;;;;;;;;;;;;YA4B3B"}
+{"version":3,"file":"login-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/login-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,YAAY,EAAsB,MAAM,uBAAuB,CAAC;AAM7E,wBAAsB,SAAS,CAAC,IAAI,EAAE,YAAY,yEAMjD;AAED,wBAAgB,YAAY;;;YAO3B"}

package/dist/hooks/api/login-auth.js

@@ -1,41 +1,20 @@
-import { apiRequest } from '@shipfox/client-api';
-import { useMutation, useQueryClient } from '@tanstack/react-query';
-import { useSetAtom } from 'jotai';
-import { authStateAtom, toAuthenticatedState } from '#state/auth.js';
-import { authRefreshQueryKey } from './refresh-auth.js';
-import { listUserWorkspaces, userWorkspacesQueryKey } from './workspace-auth.js';
+import { loginResponseSchema } from '@shipfox/api-auth-dto';
+import { checkedApiRequest } from '@shipfox/client-api';
+import { useMutation } from '@tanstack/react-query';
+import { useAuthTransition } from '#state/auth.js';
+import { toAuthenticatedSession } from './auth-mapper.js';
 export async function loginAuth(body) {
-    return await apiRequest('/auth/login', {
+    const response = await checkedApiRequest(loginResponseSchema, '/auth/login', {
         method: 'POST',
         body
     });
+    return toAuthenticatedSession(response);
 }
 export function useLoginAuth() {
-    const queryClient = useQueryClient();
-    const setState = useSetAtom(authStateAtom);
+    const { enterAuthenticated } = useAuthTransition();
     return useMutation({
         mutationFn: loginAuth,
-        onSuccess: async (result)=>{
-            queryClient.setQueryData(authRefreshQueryKey, result);
-            // Resolve workspaces before flipping auth state to authenticated. A
-            // single atomic setState avoids the intermediate window where the user
-            // appears authenticated with zero workspaces, which sent users with
-            // workspaces straight to `/setup/workspaces/new` after form login.
-            let memberships = [];
-            try {
-                const workspaces = await queryClient.fetchQuery({
-                    queryKey: userWorkspacesQueryKey,
-                    queryFn: ()=>listUserWorkspaces(result.token),
-                    retry: false,
-                    staleTime: 0
-                });
-                memberships = workspaces.memberships;
-                queryClient.setQueryData(userWorkspacesQueryKey, workspaces);
-            } catch  {
-            // The user is authenticated even if workspace hydration fails.
-            }
-            setState(toAuthenticatedState(result, memberships));
-        }
+        onSuccess: enterAuthenticated
     });
 }
 

package/dist/hooks/api/login-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/api/login-auth.ts"],"sourcesContent":["import type {LoginBodyDto, LoginResponseDto} from '@shipfox/api-auth-dto';\nimport {apiRequest} from '@shipfox/client-api';\nimport {useMutation, useQueryClient} from '@tanstack/react-query';\nimport {useSetAtom} from 'jotai';\nimport {authStateAtom, toAuthenticatedState} from '#state/auth.js';\nimport {authRefreshQueryKey} from './refresh-auth.js';\nimport {listUserWorkspaces, userWorkspacesQueryKey} from './workspace-auth.js';\n\nexport async function loginAuth(body: LoginBodyDto) {\n  return await apiRequest<LoginResponseDto>('/auth/login', {method: 'POST', body});\n}\n\nexport function useLoginAuth() {\n  const queryClient = useQueryClient();\n  const setState = useSetAtom(authStateAtom);\n\n  return useMutation({\n    mutationFn: loginAuth,\n    onSuccess: async (result) => {\n      queryClient.setQueryData(authRefreshQueryKey, result);\n      // Resolve workspaces before flipping auth state to authenticated. A\n      // single atomic setState avoids the intermediate window where the user\n      // appears authenticated with zero workspaces, which sent users with\n      // workspaces straight to `/setup/workspaces/new` after form login.\n      let memberships: Awaited<ReturnType<typeof listUserWorkspaces>>['memberships'] = [];\n      try {\n        const workspaces = await queryClient.fetchQuery({\n          queryKey: userWorkspacesQueryKey,\n          queryFn: () => listUserWorkspaces(result.token),\n          retry: false,\n          staleTime: 0,\n        });\n        memberships = workspaces.memberships;\n        queryClient.setQueryData(userWorkspacesQueryKey, workspaces);\n      } catch {\n        // The user is authenticated even if workspace hydration fails.\n      }\n      setState(toAuthenticatedState(result, memberships));\n    },\n  });\n}\n"],"names":["apiRequest","useMutation","useQueryClient","useSetAtom","authStateAtom","toAuthenticatedState","authRefreshQueryKey","listUserWorkspaces","userWorkspacesQueryKey","loginAuth","body","method","useLoginAuth","queryClient","setState","mutationFn","onSuccess","result","setQueryData","memberships","workspaces","fetchQuery","queryKey","queryFn","token","retry","staleTime"],"mappings":"AACA,SAAQA,UAAU,QAAO,sBAAsB;AAC/C,SAAQC,WAAW,EAAEC,cAAc,QAAO,wBAAwB;AAClE,SAAQC,UAAU,QAAO,QAAQ;AACjC,SAAQC,aAAa,EAAEC,oBAAoB,QAAO,iBAAiB;AACnE,SAAQC,mBAAmB,QAAO,oBAAoB;AACtD,SAAQC,kBAAkB,EAAEC,sBAAsB,QAAO,sBAAsB;AAE/E,OAAO,eAAeC,UAAUC,IAAkB;IAChD,OAAO,MAAMV,WAA6B,eAAe;QAACW,QAAQ;QAAQD;IAAI;AAChF;AAEA,OAAO,SAASE;IACd,MAAMC,cAAcX;IACpB,MAAMY,WAAWX,WAAWC;IAE5B,OAAOH,YAAY;QACjBc,YAAYN;QACZO,WAAW,OAAOC;YAChBJ,YAAYK,YAAY,CAACZ,qBAAqBW;YAC9C,oEAAoE;YACpE,uEAAuE;YACvE,oEAAoE;YACpE,mEAAmE;YACnE,IAAIE,cAA6E,EAAE;YACnF,IAAI;gBACF,MAAMC,aAAa,MAAMP,YAAYQ,UAAU,CAAC;oBAC9CC,UAAUd;oBACVe,SAAS,IAAMhB,mBAAmBU,OAAOO,KAAK;oBAC9CC,OAAO;oBACPC,WAAW;gBACb;gBACAP,cAAcC,WAAWD,WAAW;gBACpCN,YAAYK,YAAY,CAACV,wBAAwBY;YACnD,EAAE,OAAM;YACN,+DAA+D;YACjE;YACAN,SAAST,qBAAqBY,QAAQE;QACxC;IACF;AACF"}
+{"version":3,"sources":["../../../src/hooks/api/login-auth.ts"],"sourcesContent":["import {type LoginBodyDto, loginResponseSchema} from '@shipfox/api-auth-dto';\nimport {checkedApiRequest} from '@shipfox/client-api';\nimport {useMutation} from '@tanstack/react-query';\nimport {useAuthTransition} from '#state/auth.js';\nimport {toAuthenticatedSession} from './auth-mapper.js';\n\nexport async function loginAuth(body: LoginBodyDto) {\n  const response = await checkedApiRequest(loginResponseSchema, '/auth/login', {\n    method: 'POST',\n    body,\n  });\n  return toAuthenticatedSession(response);\n}\n\nexport function useLoginAuth() {\n  const {enterAuthenticated} = useAuthTransition();\n\n  return useMutation({\n    mutationFn: loginAuth,\n    onSuccess: enterAuthenticated,\n  });\n}\n"],"names":["loginResponseSchema","checkedApiRequest","useMutation","useAuthTransition","toAuthenticatedSession","loginAuth","body","response","method","useLoginAuth","enterAuthenticated","mutationFn","onSuccess"],"mappings":"AAAA,SAA2BA,mBAAmB,QAAO,wBAAwB;AAC7E,SAAQC,iBAAiB,QAAO,sBAAsB;AACtD,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,iBAAiB,QAAO,iBAAiB;AACjD,SAAQC,sBAAsB,QAAO,mBAAmB;AAExD,OAAO,eAAeC,UAAUC,IAAkB;IAChD,MAAMC,WAAW,MAAMN,kBAAkBD,qBAAqB,eAAe;QAC3EQ,QAAQ;QACRF;IACF;IACA,OAAOF,uBAAuBG;AAChC;AAEA,OAAO,SAASE;IACd,MAAM,EAACC,kBAAkB,EAAC,GAAGP;IAE7B,OAAOD,YAAY;QACjBS,YAAYN;QACZO,WAAWF;IACb;AACF"}

package/dist/hooks/api/logout-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/logout-auth.ts"],"names":[],"mappings":"AAcA,wBAAgB,aAAa,kFAW5B"}
+{"version":3,"file":"logout-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/logout-auth.ts"],"names":[],"mappings":"AAYA,wBAAgB,aAAa,kFAO5B"}

package/dist/hooks/api/logout-auth.js

@@ -1,8 +1,6 @@
 import { apiRequest } from '@shipfox/client-api';
-import { useMutation, useQueryClient } from '@tanstack/react-query';
-import { useSetAtom } from 'jotai';
-import { authStateAtom } from '#state/auth.js';
-import { authRefreshQueryKey } from './refresh-auth.js';
+import { useMutation } from '@tanstack/react-query';
+import { useAuthTransition } from '#state/auth.js';
 async function logoutAuth() {
     try {
         await apiRequest('/auth/logout', {
@@ -14,18 +12,10 @@ async function logoutAuth() {
     }
 }
 export function useLogoutAuth() {
-    const queryClient = useQueryClient();
-    const setState = useSetAtom(authStateAtom);
+    const { enterGuest } = useAuthTransition();
     return useMutation({
         mutationFn: logoutAuth,
-        onSettled: ()=>{
-            setState({
-                status: 'guest'
-            });
-            queryClient.removeQueries({
-                queryKey: authRefreshQueryKey
-            });
-        }
+        onSettled: enterGuest
     });
 }
 

package/dist/hooks/api/logout-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/api/logout-auth.ts"],"sourcesContent":["import {apiRequest} from '@shipfox/client-api';\nimport {useMutation, useQueryClient} from '@tanstack/react-query';\nimport {useSetAtom} from 'jotai';\nimport {authStateAtom} from '#state/auth.js';\nimport {authRefreshQueryKey} from './refresh-auth.js';\n\nasync function logoutAuth() {\n  try {\n    await apiRequest<void>('/auth/logout', {method: 'POST', body: {}});\n  } catch {\n    // Logout is best-effort: local session state must clear even if the API is offline.\n  }\n}\n\nexport function useLogoutAuth() {\n  const queryClient = useQueryClient();\n  const setState = useSetAtom(authStateAtom);\n\n  return useMutation({\n    mutationFn: logoutAuth,\n    onSettled: () => {\n      setState({status: 'guest'});\n      queryClient.removeQueries({queryKey: authRefreshQueryKey});\n    },\n  });\n}\n"],"names":["apiRequest","useMutation","useQueryClient","useSetAtom","authStateAtom","authRefreshQueryKey","logoutAuth","method","body","useLogoutAuth","queryClient","setState","mutationFn","onSettled","status","removeQueries","queryKey"],"mappings":"AAAA,SAAQA,UAAU,QAAO,sBAAsB;AAC/C,SAAQC,WAAW,EAAEC,cAAc,QAAO,wBAAwB;AAClE,SAAQC,UAAU,QAAO,QAAQ;AACjC,SAAQC,aAAa,QAAO,iBAAiB;AAC7C,SAAQC,mBAAmB,QAAO,oBAAoB;AAEtD,eAAeC;IACb,IAAI;QACF,MAAMN,WAAiB,gBAAgB;YAACO,QAAQ;YAAQC,MAAM,CAAC;QAAC;IAClE,EAAE,OAAM;IACN,oFAAoF;IACtF;AACF;AAEA,OAAO,SAASC;IACd,MAAMC,cAAcR;IACpB,MAAMS,WAAWR,WAAWC;IAE5B,OAAOH,YAAY;QACjBW,YAAYN;QACZO,WAAW;YACTF,SAAS;gBAACG,QAAQ;YAAO;YACzBJ,YAAYK,aAAa,CAAC;gBAACC,UAAUX;YAAmB;QAC1D;IACF;AACF"}
+{"version":3,"sources":["../../../src/hooks/api/logout-auth.ts"],"sourcesContent":["import {apiRequest} from '@shipfox/client-api';\nimport {useMutation} from '@tanstack/react-query';\nimport {useAuthTransition} from '#state/auth.js';\n\nasync function logoutAuth() {\n  try {\n    await apiRequest<void>('/auth/logout', {method: 'POST', body: {}});\n  } catch {\n    // Logout is best-effort: local session state must clear even if the API is offline.\n  }\n}\n\nexport function useLogoutAuth() {\n  const {enterGuest} = useAuthTransition();\n\n  return useMutation({\n    mutationFn: logoutAuth,\n    onSettled: enterGuest,\n  });\n}\n"],"names":["apiRequest","useMutation","useAuthTransition","logoutAuth","method","body","useLogoutAuth","enterGuest","mutationFn","onSettled"],"mappings":"AAAA,SAAQA,UAAU,QAAO,sBAAsB;AAC/C,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,iBAAiB,QAAO,iBAAiB;AAEjD,eAAeC;IACb,IAAI;QACF,MAAMH,WAAiB,gBAAgB;YAACI,QAAQ;YAAQC,MAAM,CAAC;QAAC;IAClE,EAAE,OAAM;IACN,oFAAoF;IACtF;AACF;AAEA,OAAO,SAASC;IACd,MAAM,EAACC,UAAU,EAAC,GAAGL;IAErB,OAAOD,YAAY;QACjBO,YAAYL;QACZM,WAAWF;IACb;AACF"}

package/dist/hooks/api/password-reset-auth.d.ts

@@ -1,32 +1,10 @@
-import type { PasswordResetConfirmBodyDto, PasswordResetRequestBodyDto } from '@shipfox/api-auth-dto';
+import { type PasswordResetConfirmBodyDto, type PasswordResetRequestBodyDto } from '@shipfox/api-auth-dto';
 export declare function requestPasswordReset(body: PasswordResetRequestBodyDto): Promise<void>;
-export declare function confirmPasswordReset(body: PasswordResetConfirmBodyDto): Promise<{
-    token: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-        email_verified_at: string | null;
-        status: "active" | "suspended" | "deleted";
-        created_at: string;
-        updated_at: string;
-    };
-}>;
+export declare function confirmPasswordReset(body: PasswordResetConfirmBodyDto): Promise<import("@shipfox/client-shell/runtime").AuthenticatedSession>;
 export declare function useRequestPasswordResetAuth(): import("@tanstack/react-query").UseMutationResult<void, Error, {
     email: string;
 }, unknown>;
-export declare function useConfirmPasswordResetAuth(): import("@tanstack/react-query").UseMutationResult<{
-    token: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-        email_verified_at: string | null;
-        status: "active" | "suspended" | "deleted";
-        created_at: string;
-        updated_at: string;
-    };
-}, Error, {
+export declare function useConfirmPasswordResetAuth(): import("@tanstack/react-query").UseMutationResult<import("@shipfox/client-shell/runtime").AuthenticatedSession, Error, {
     token: string;
     new_password: string;
 }, unknown>;