@shipfox/client-auth 4.0.0 → 6.0.1

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 38 files with swc (507ms)
+Successfully compiled: 41 files with swc (135.57ms)

package/CHANGELOG.md

@@ -1,5 +1,61 @@
 # @shipfox/client-auth
 
+## 6.0.1
+
+### Patch Changes
+
+- 475ce59: Republishes all public packages after restoring release authorization.
+- 3f8f1cb: Enforces typed route-input and browser-storage boundaries across client features.
+- Updated dependencies [475ce59]
+- Updated dependencies [3f8f1cb]
+  - @shipfox/api-auth-dto@9.0.1
+  - @shipfox/api-workspaces-dto@9.0.1
+  - @shipfox/client-api@6.0.1
+  - @shipfox/client-invitations@6.0.1
+  - @shipfox/client-shell@6.0.1
+  - @shipfox/client-ui@6.0.1
+  - @shipfox/react-ui@0.3.6
+
+## 6.0.0
+
+### Minor Changes
+
+- cd90c19: Enforces package-owned query policies and explicit cache-operation ownership across client resources.
+
+### Patch Changes
+
+- d784a07: Enforces checked client API responses and removes stale transport compatibility helpers.
+- 891e469: Adds a sanitized logout redirect that clears local and server auth state before returning to a safe same-origin destination.
+- c56c124: Converges auth sessions and invitation responses on checked domain boundaries.
+- Updated dependencies [401b583]
+- Updated dependencies [82eda45]
+- Updated dependencies [9c9d266]
+- Updated dependencies [cd90c19]
+- Updated dependencies [24be269]
+- Updated dependencies [c56c124]
+- Updated dependencies [4a6d124]
+- Updated dependencies [c02ac42]
+  - @shipfox/client-shell@6.0.0
+  - @shipfox/api-workspaces-dto@9.0.0
+  - @shipfox/client-api@6.0.0
+  - @shipfox/client-invitations@6.0.0
+  - @shipfox/api-auth-dto@7.1.0
+  - @shipfox/client-ui@6.0.0
+  - @shipfox/react-ui@0.3.5
+
+## 5.0.0
+
+### Major Changes
+
+- ffd727b: Converges auth session and invitation state onto shared camelCase domain types validated at the API boundary, replacing the raw snake_case DTOs previously returned by login, signup, password reset, email verification, workspace creation, and invitation preview. `AuthState.user`, `useRefreshAuth()`, and `usePreviewInvitation()` now resolve to `UserIdentity`/`AuthenticatedSession`/`InvitationPreview` shapes (for example `accessToken` instead of `token`, `workspaceName` instead of `workspace_name`). Also moves the shared `AuthShell` component and session mapping helpers into `@shipfox/client-shell`, breaking the former `client-auth` ↔ `client-invitations` circular dependency.
+
+### Patch Changes
+
+- Updated dependencies [ffd727b]
+- Updated dependencies [79df9d1]
+  - @shipfox/client-shell@5.0.0
+  - @shipfox/client-invitations@5.0.0
+
 ## 4.0.0
 
 ### Minor Changes

package/dist/components/auth-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-guard.d.ts","sourceRoot":"","sources":["../../src/components/auth-guard.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAC,KAAK,iBAAiB,EAAY,MAAM,OAAO,CAAC;AAKxD,wBAAgB,SAAS,CAAC,EAAC,QAAQ,EAAC,EAAE,iBAAiB,+VAYtD;AAED,wBAAgB,UAAU,CAAC,EAAC,QAAQ,EAAC,EAAE,iBAAiB,+VA0BvD;AAED,wBAAgB,cAAc,CAAC,EAAC,QAAQ,EAAC,EAAE,iBAAiB,+VAQ3D"}
+{"version":3,"file":"auth-guard.d.ts","sourceRoot":"","sources":["../../src/components/auth-guard.tsx"],"names":[],"mappings":"AAGA,OAAO,EAAC,KAAK,iBAAiB,EAAY,MAAM,OAAO,CAAC;AAMxD,wBAAgB,SAAS,CAAC,EAAC,QAAQ,EAAC,EAAE,iBAAiB,+VAYtD;AAED,wBAAgB,UAAU,CAAC,EAAC,QAAQ,EAAC,EAAE,iBAAiB,+VA0BvD;AAED,wBAAgB,cAAc,CAAC,EAAC,QAAQ,EAAC,EAAE,iBAAiB,+VAQ3D"}

package/dist/components/auth-guard.js

@@ -1,9 +1,11 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+import { useRouteSearch } from '@shipfox/client-shell/runtime';
 import { FullPageLoader } from '@shipfox/react-ui/loader';
-import { Navigate, useRouter, useSearch } from '@tanstack/react-router';
+import { Navigate, useRouter } from '@tanstack/react-router';
 import { useEffect } from 'react';
 import { useAuthState } from '#hooks/use-auth-state.js';
 import { WorkspaceOnboardingPage } from '#pages/workspace-onboarding-page.js';
+import { validateRedirectSearch } from '../routes/inputs.js';
 import { sanitizeRedirectPath } from './redirect-target.js';
 export function AuthGuard({ children }) {
     const auth = useAuthState();
@@ -20,9 +22,7 @@ export function AuthGuard({ children }) {
 }
 export function GuestGuard({ children }) {
     const auth = useAuthState();
-    const search = useSearch({
-        strict: false
-    });
+    const search = useRouteSearch(validateRedirectSearch);
     const router = useRouter();
     const target = sanitizeRedirectPath(search.redirect);
     useEffect(()=>{

package/dist/components/auth-guard.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/auth-guard.tsx"],"sourcesContent":["import {FullPageLoader} from '@shipfox/react-ui/loader';\nimport {Navigate, useRouter, useSearch} from '@tanstack/react-router';\nimport {type PropsWithChildren, useEffect} from 'react';\nimport {useAuthState} from '#hooks/use-auth-state.js';\nimport {WorkspaceOnboardingPage} from '#pages/workspace-onboarding-page.js';\nimport {sanitizeRedirectPath} from './redirect-target.js';\n\nexport function AuthGuard({children}: PropsWithChildren) {\n  const auth = useAuthState();\n\n  if (auth.isLoading) {\n    return <FullPageLoader />;\n  }\n\n  if (!auth.isAuthenticated) {\n    return <Navigate to=\"/auth/login\" replace />;\n  }\n\n  return children;\n}\n\nexport function GuestGuard({children}: PropsWithChildren) {\n  const auth = useAuthState();\n  const search = useSearch({strict: false}) as {redirect?: unknown};\n  const router = useRouter();\n  const target = sanitizeRedirectPath(search.redirect);\n\n  useEffect(() => {\n    if (auth.isAuthenticated && target !== undefined) {\n      // Bypass the typed route matcher — `target` is an arbitrary same-origin\n      // path resolved at runtime, so we let the URL change drive route resolution.\n      router.history.replace(target);\n    }\n  }, [auth.isAuthenticated, target, router]);\n\n  if (auth.isLoading) {\n    return <FullPageLoader />;\n  }\n\n  if (auth.isAuthenticated) {\n    if (target !== undefined) {\n      return <FullPageLoader />;\n    }\n    return <Navigate to=\"/\" replace />;\n  }\n\n  return children;\n}\n\nexport function WorkspaceGuard({children}: PropsWithChildren) {\n  const auth = useAuthState();\n\n  if (auth.isAuthenticated && !auth.hasWorkspace) {\n    return <WorkspaceOnboardingPage />;\n  }\n\n  return children;\n}\n"],"names":["FullPageLoader","Navigate","useRouter","useSearch","useEffect","useAuthState","WorkspaceOnboardingPage","sanitizeRedirectPath","AuthGuard","children","auth","isLoading","isAuthenticated","to","replace","GuestGuard","search","strict","router","target","redirect","undefined","history","WorkspaceGuard","hasWorkspace"],"mappings":";AAAA,SAAQA,cAAc,QAAO,2BAA2B;AACxD,SAAQC,QAAQ,EAAEC,SAAS,EAAEC,SAAS,QAAO,yBAAyB;AACtE,SAAgCC,SAAS,QAAO,QAAQ;AACxD,SAAQC,YAAY,QAAO,2BAA2B;AACtD,SAAQC,uBAAuB,QAAO,sCAAsC;AAC5E,SAAQC,oBAAoB,QAAO,uBAAuB;AAE1D,OAAO,SAASC,UAAU,EAACC,QAAQ,EAAoB;IACrD,MAAMC,OAAOL;IAEb,IAAIK,KAAKC,SAAS,EAAE;QAClB,qBAAO,KAACX;IACV;IAEA,IAAI,CAACU,KAAKE,eAAe,EAAE;QACzB,qBAAO,KAACX;YAASY,IAAG;YAAcC,OAAO;;IAC3C;IAEA,OAAOL;AACT;AAEA,OAAO,SAASM,WAAW,EAACN,QAAQ,EAAoB;IACtD,MAAMC,OAAOL;IACb,MAAMW,SAASb,UAAU;QAACc,QAAQ;IAAK;IACvC,MAAMC,SAAShB;IACf,MAAMiB,SAASZ,qBAAqBS,OAAOI,QAAQ;IAEnDhB,UAAU;QACR,IAAIM,KAAKE,eAAe,IAAIO,WAAWE,WAAW;YAChD,wEAAwE;YACxE,6EAA6E;YAC7EH,OAAOI,OAAO,CAACR,OAAO,CAACK;QACzB;IACF,GAAG;QAACT,KAAKE,eAAe;QAAEO;QAAQD;KAAO;IAEzC,IAAIR,KAAKC,SAAS,EAAE;QAClB,qBAAO,KAACX;IACV;IAEA,IAAIU,KAAKE,eAAe,EAAE;QACxB,IAAIO,WAAWE,WAAW;YACxB,qBAAO,KAACrB;QACV;QACA,qBAAO,KAACC;YAASY,IAAG;YAAIC,OAAO;;IACjC;IAEA,OAAOL;AACT;AAEA,OAAO,SAASc,eAAe,EAACd,QAAQ,EAAoB;IAC1D,MAAMC,OAAOL;IAEb,IAAIK,KAAKE,eAAe,IAAI,CAACF,KAAKc,YAAY,EAAE;QAC9C,qBAAO,KAAClB;IACV;IAEA,OAAOG;AACT"}
+{"version":3,"sources":["../../src/components/auth-guard.tsx"],"sourcesContent":["import {useRouteSearch} from '@shipfox/client-shell/runtime';\nimport {FullPageLoader} from '@shipfox/react-ui/loader';\nimport {Navigate, useRouter} from '@tanstack/react-router';\nimport {type PropsWithChildren, useEffect} from 'react';\nimport {useAuthState} from '#hooks/use-auth-state.js';\nimport {WorkspaceOnboardingPage} from '#pages/workspace-onboarding-page.js';\nimport {validateRedirectSearch} from '../routes/inputs.js';\nimport {sanitizeRedirectPath} from './redirect-target.js';\n\nexport function AuthGuard({children}: PropsWithChildren) {\n  const auth = useAuthState();\n\n  if (auth.isLoading) {\n    return <FullPageLoader />;\n  }\n\n  if (!auth.isAuthenticated) {\n    return <Navigate to=\"/auth/login\" replace />;\n  }\n\n  return children;\n}\n\nexport function GuestGuard({children}: PropsWithChildren) {\n  const auth = useAuthState();\n  const search = useRouteSearch(validateRedirectSearch);\n  const router = useRouter();\n  const target = sanitizeRedirectPath(search.redirect);\n\n  useEffect(() => {\n    if (auth.isAuthenticated && target !== undefined) {\n      // Bypass the typed route matcher — `target` is an arbitrary same-origin\n      // path resolved at runtime, so we let the URL change drive route resolution.\n      router.history.replace(target);\n    }\n  }, [auth.isAuthenticated, target, router]);\n\n  if (auth.isLoading) {\n    return <FullPageLoader />;\n  }\n\n  if (auth.isAuthenticated) {\n    if (target !== undefined) {\n      return <FullPageLoader />;\n    }\n    return <Navigate to=\"/\" replace />;\n  }\n\n  return children;\n}\n\nexport function WorkspaceGuard({children}: PropsWithChildren) {\n  const auth = useAuthState();\n\n  if (auth.isAuthenticated && !auth.hasWorkspace) {\n    return <WorkspaceOnboardingPage />;\n  }\n\n  return children;\n}\n"],"names":["useRouteSearch","FullPageLoader","Navigate","useRouter","useEffect","useAuthState","WorkspaceOnboardingPage","validateRedirectSearch","sanitizeRedirectPath","AuthGuard","children","auth","isLoading","isAuthenticated","to","replace","GuestGuard","search","router","target","redirect","undefined","history","WorkspaceGuard","hasWorkspace"],"mappings":";AAAA,SAAQA,cAAc,QAAO,gCAAgC;AAC7D,SAAQC,cAAc,QAAO,2BAA2B;AACxD,SAAQC,QAAQ,EAAEC,SAAS,QAAO,yBAAyB;AAC3D,SAAgCC,SAAS,QAAO,QAAQ;AACxD,SAAQC,YAAY,QAAO,2BAA2B;AACtD,SAAQC,uBAAuB,QAAO,sCAAsC;AAC5E,SAAQC,sBAAsB,QAAO,sBAAsB;AAC3D,SAAQC,oBAAoB,QAAO,uBAAuB;AAE1D,OAAO,SAASC,UAAU,EAACC,QAAQ,EAAoB;IACrD,MAAMC,OAAON;IAEb,IAAIM,KAAKC,SAAS,EAAE;QAClB,qBAAO,KAACX;IACV;IAEA,IAAI,CAACU,KAAKE,eAAe,EAAE;QACzB,qBAAO,KAACX;YAASY,IAAG;YAAcC,OAAO;;IAC3C;IAEA,OAAOL;AACT;AAEA,OAAO,SAASM,WAAW,EAACN,QAAQ,EAAoB;IACtD,MAAMC,OAAON;IACb,MAAMY,SAASjB,eAAeO;IAC9B,MAAMW,SAASf;IACf,MAAMgB,SAASX,qBAAqBS,OAAOG,QAAQ;IAEnDhB,UAAU;QACR,IAAIO,KAAKE,eAAe,IAAIM,WAAWE,WAAW;YAChD,wEAAwE;YACxE,6EAA6E;YAC7EH,OAAOI,OAAO,CAACP,OAAO,CAACI;QACzB;IACF,GAAG;QAACR,KAAKE,eAAe;QAAEM;QAAQD;KAAO;IAEzC,IAAIP,KAAKC,SAAS,EAAE;QAClB,qBAAO,KAACX;IACV;IAEA,IAAIU,KAAKE,eAAe,EAAE;QACxB,IAAIM,WAAWE,WAAW;YACxB,qBAAO,KAACpB;QACV;QACA,qBAAO,KAACC;YAASY,IAAG;YAAIC,OAAO;;IACjC;IAEA,OAAOL;AACT;AAEA,OAAO,SAASa,eAAe,EAACb,QAAQ,EAAoB;IAC1D,MAAMC,OAAON;IAEb,IAAIM,KAAKE,eAAe,IAAI,CAACF,KAAKa,YAAY,EAAE;QAC9C,qBAAO,KAAClB;IACV;IAEA,OAAOI;AACT"}

package/dist/components/email-code-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-code-verification.d.ts","sourceRoot":"","sources":["../../src/components/email-code-verification.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAY,SAAS,EAAE,GAAG,EAAC,MAAM,OAAO,CAAC;AAMrD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,YAAY,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IAChE,UAAU,CAAC,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAQD,wBAAgB,qBAAqB,CAAC,EACpC,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,WAAmB,EACnB,WAAmB,EACnB,KAAK,EACL,KAA0B,EAC1B,WAA2E,EAC3E,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,iBAAiB,EACjB,QAAQ,GACT,EAAE,0BAA0B,+BAgI5B"}
+{"version":3,"file":"email-code-verification.d.ts","sourceRoot":"","sources":["../../src/components/email-code-verification.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAY,SAAS,EAAE,GAAG,EAAC,MAAM,OAAO,CAAC;AAKrD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,YAAY,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IAChE,UAAU,CAAC,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAQD,wBAAgB,qBAAqB,CAAC,EACpC,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,WAAmB,EACnB,WAAmB,EACnB,KAAK,EACL,KAA0B,EAC1B,WAA2E,EAC3E,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,iBAAiB,EACjB,QAAQ,GACT,EAAE,0BAA0B,+BAgI5B"}

package/dist/components/email-code-verification.js

@@ -1,9 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { AuthShell } from '@shipfox/client-shell/runtime';
 import { Button } from '@shipfox/react-ui/button';
 import { Callout } from '@shipfox/react-ui/callout';
 import { FormField, FormFieldInput } from '@shipfox/react-ui/form-field';
 import { useCallback, useEffect, useRef, useState } from 'react';
-import { AuthShell } from './auth-shell.js';
 const EIGHT_DIGIT_CODE_RE = /^\d{8}$/u;
 function timestamp(value) {
     if (!value) return undefined;

package/dist/components/email-code-verification.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/email-code-verification.tsx"],"sourcesContent":["import {Button} from '@shipfox/react-ui/button';\nimport {Callout} from '@shipfox/react-ui/callout';\nimport {FormField, FormFieldInput} from '@shipfox/react-ui/form-field';\nimport type {HeaderProps} from '@shipfox/react-ui/typography';\nimport type {FormEvent, ReactNode, Ref} from 'react';\nimport {useCallback, useEffect, useRef, useState} from 'react';\nimport {AuthShell} from './auth-shell.js';\n\nconst EIGHT_DIGIT_CODE_RE = /^\\d{8}$/u;\n\nexport interface EmailCodeVerificationProps {\n  destination: string;\n  expiresAt?: string | undefined;\n  nextResendAvailableAt?: string | undefined;\n  isResending?: boolean;\n  isVerifying?: boolean;\n  error?: string | undefined;\n  title?: string;\n  description?: string;\n  children?: ReactNode;\n  headingProps?: Omit<HeaderProps, 'children' | 'id'> | undefined;\n  headingRef?: Ref<HTMLHeadingElement> | undefined;\n  onResend: () => void | Promise<void>;\n  onUseAnotherEmail: () => void;\n  onVerify: (code: string) => void | Promise<void>;\n}\n\nfunction timestamp(value: string | undefined): number | undefined {\n  if (!value) return undefined;\n  const parsed = Date.parse(value);\n  return Number.isNaN(parsed) ? undefined : parsed;\n}\n\nexport function EmailCodeVerification({\n  destination,\n  expiresAt,\n  nextResendAvailableAt,\n  isResending = false,\n  isVerifying = false,\n  error,\n  title = 'Check your email',\n  description = `We sent an eight-digit verification code to ${destination}.`,\n  children,\n  headingProps,\n  headingRef,\n  onResend,\n  onUseAnotherEmail,\n  onVerify,\n}: EmailCodeVerificationProps) {\n  const [code, setCode] = useState('');\n  const [now, setNow] = useState(() => Date.now());\n  const [codeError, setCodeError] = useState<string>();\n  const localHeadingRef = useRef<HTMLHeadingElement>(null);\n  const resendAvailableAt = timestamp(nextResendAvailableAt);\n  const expiration = timestamp(expiresAt);\n  const resendRemainingSeconds = resendAvailableAt\n    ? Math.max(0, Math.ceil((resendAvailableAt - now) / 1_000))\n    : 0;\n  const isResendCoolingDown = resendRemainingSeconds > 0;\n  const isExpired = expiration !== undefined && expiration <= now;\n  const isPending = isResending || isVerifying;\n\n  useEffect(() => {\n    const isPending = (tickNow: number) =>\n      (resendAvailableAt !== undefined && resendAvailableAt > tickNow) ||\n      (expiration !== undefined && expiration > tickNow);\n\n    const tickNow = Date.now();\n    setNow(tickNow);\n    if (!isPending(tickNow)) return;\n\n    const interval = window.setInterval(() => {\n      const nextTick = Date.now();\n      setNow(nextTick);\n      if (!isPending(nextTick)) {\n        window.clearInterval(interval);\n      }\n    }, 1_000);\n    return () => window.clearInterval(interval);\n  }, [expiration, resendAvailableAt]);\n\n  useEffect(() => {\n    localHeadingRef.current?.focus();\n  }, []);\n\n  const setHeadingRef = useCallback(\n    (heading: HTMLHeadingElement | null) => {\n      localHeadingRef.current = heading;\n      if (typeof headingRef === 'function') {\n        headingRef(heading);\n      } else if (headingRef) {\n        headingRef.current = heading;\n      }\n    },\n    [headingRef],\n  );\n\n  function submit(event: FormEvent<HTMLFormElement>) {\n    event.preventDefault();\n    if (isExpired || isVerifying) return;\n    if (!validateCode()) return;\n    void onVerify(code);\n  }\n\n  function validateCode() {\n    const error = EIGHT_DIGIT_CODE_RE.test(code)\n      ? undefined\n      : 'Enter the eight-digit verification code.';\n    setCodeError(error);\n    return error === undefined;\n  }\n\n  return (\n    <AuthShell\n      title={title}\n      description={description}\n      headingProps={headingProps}\n      headingRef={setHeadingRef}\n    >\n      {error ? (\n        <Callout role=\"alert\" type=\"error\">\n          {error}\n        </Callout>\n      ) : null}\n      {isExpired ? (\n        <Callout role=\"alert\" type=\"error\">\n          This verification code has expired. Use another email to try again.\n        </Callout>\n      ) : null}\n      <form className=\"flex flex-col gap-8\" noValidate onSubmit={submit}>\n        <FormField label=\"Verification code\" id=\"verification-code\" error={codeError}>\n          <FormFieldInput\n            autoComplete=\"one-time-code\"\n            inputMode=\"numeric\"\n            maxLength={8}\n            pattern=\"[0-9]{8}\"\n            value={code}\n            onChange={(event) => {\n              setCode(event.target.value.replace(/\\D/gu, '').slice(0, 8));\n              setCodeError(undefined);\n            }}\n            onBlur={validateCode}\n          />\n        </FormField>\n        <Button className=\"w-full\" type=\"submit\" disabled={isExpired} isLoading={isVerifying}>\n          Verify email\n        </Button>\n        <Button\n          aria-disabled={isResendCoolingDown ? true : undefined}\n          className=\"w-full aria-disabled:cursor-not-allowed aria-disabled:opacity-70\"\n          variant=\"secondary\"\n          type=\"button\"\n          isLoading={isResending}\n          onClick={() => {\n            if (!isResendCoolingDown && !isResending) void onResend();\n          }}\n        >\n          {isResending\n            ? 'Sending email...'\n            : isResendCoolingDown\n              ? `Resend in ${resendRemainingSeconds}s`\n              : 'Resend verification email'}\n        </Button>\n      </form>\n      <Button\n        className=\"w-full\"\n        variant=\"transparent\"\n        type=\"button\"\n        disabled={isPending}\n        onClick={onUseAnotherEmail}\n      >\n        Use another email\n      </Button>\n      {children}\n    </AuthShell>\n  );\n}\n"],"names":["Button","Callout","FormField","FormFieldInput","useCallback","useEffect","useRef","useState","AuthShell","EIGHT_DIGIT_CODE_RE","timestamp","value","undefined","parsed","Date","parse","Number","isNaN","EmailCodeVerification","destination","expiresAt","nextResendAvailableAt","isResending","isVerifying","error","title","description","children","headingProps","headingRef","onResend","onUseAnotherEmail","onVerify","code","setCode","now","setNow","codeError","setCodeError","localHeadingRef","resendAvailableAt","expiration","resendRemainingSeconds","Math","max","ceil","isResendCoolingDown","isExpired","isPending","tickNow","interval","window","setInterval","nextTick","clearInterval","current","focus","setHeadingRef","heading","submit","event","preventDefault","validateCode","test","role","type","form","className","noValidate","onSubmit","label","id","autoComplete","inputMode","maxLength","pattern","onChange","target","replace","slice","onBlur","disabled","isLoading","aria-disabled","variant","onClick"],"mappings":";AAAA,SAAQA,MAAM,QAAO,2BAA2B;AAChD,SAAQC,OAAO,QAAO,4BAA4B;AAClD,SAAQC,SAAS,EAAEC,cAAc,QAAO,+BAA+B;AAGvE,SAAQC,WAAW,EAAEC,SAAS,EAAEC,MAAM,EAAEC,QAAQ,QAAO,QAAQ;AAC/D,SAAQC,SAAS,QAAO,kBAAkB;AAE1C,MAAMC,sBAAsB;AAmB5B,SAASC,UAAUC,KAAyB;IAC1C,IAAI,CAACA,OAAO,OAAOC;IACnB,MAAMC,SAASC,KAAKC,KAAK,CAACJ;IAC1B,OAAOK,OAAOC,KAAK,CAACJ,UAAUD,YAAYC;AAC5C;AAEA,OAAO,SAASK,sBAAsB,EACpCC,WAAW,EACXC,SAAS,EACTC,qBAAqB,EACrBC,cAAc,KAAK,EACnBC,cAAc,KAAK,EACnBC,KAAK,EACLC,QAAQ,kBAAkB,EAC1BC,cAAc,CAAC,4CAA4C,EAAEP,YAAY,CAAC,CAAC,EAC3EQ,QAAQ,EACRC,YAAY,EACZC,UAAU,EACVC,QAAQ,EACRC,iBAAiB,EACjBC,QAAQ,EACmB;IAC3B,MAAM,CAACC,MAAMC,QAAQ,GAAG3B,SAAS;IACjC,MAAM,CAAC4B,KAAKC,OAAO,GAAG7B,SAAS,IAAMO,KAAKqB,GAAG;IAC7C,MAAM,CAACE,WAAWC,aAAa,GAAG/B;IAClC,MAAMgC,kBAAkBjC,OAA2B;IACnD,MAAMkC,oBAAoB9B,UAAUW;IACpC,MAAMoB,aAAa/B,UAAUU;IAC7B,MAAMsB,yBAAyBF,oBAC3BG,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAAC,AAACL,CAAAA,oBAAoBL,GAAE,IAAK,UAClD;IACJ,MAAMW,sBAAsBJ,yBAAyB;IACrD,MAAMK,YAAYN,eAAe7B,aAAa6B,cAAcN;IAC5D,MAAMa,YAAY1B,eAAeC;IAEjClB,UAAU;QACR,MAAM2C,YAAY,CAACC,UACjB,AAACT,sBAAsB5B,aAAa4B,oBAAoBS,WACvDR,eAAe7B,aAAa6B,aAAaQ;QAE5C,MAAMA,UAAUnC,KAAKqB,GAAG;QACxBC,OAAOa;QACP,IAAI,CAACD,UAAUC,UAAU;QAEzB,MAAMC,WAAWC,OAAOC,WAAW,CAAC;YAClC,MAAMC,WAAWvC,KAAKqB,GAAG;YACzBC,OAAOiB;YACP,IAAI,CAACL,UAAUK,WAAW;gBACxBF,OAAOG,aAAa,CAACJ;YACvB;QACF,GAAG;QACH,OAAO,IAAMC,OAAOG,aAAa,CAACJ;IACpC,GAAG;QAACT;QAAYD;KAAkB;IAElCnC,UAAU;QACRkC,gBAAgBgB,OAAO,EAAEC;IAC3B,GAAG,EAAE;IAEL,MAAMC,gBAAgBrD,YACpB,CAACsD;QACCnB,gBAAgBgB,OAAO,GAAGG;QAC1B,IAAI,OAAO7B,eAAe,YAAY;YACpCA,WAAW6B;QACb,OAAO,IAAI7B,YAAY;YACrBA,WAAW0B,OAAO,GAAGG;QACvB;IACF,GACA;QAAC7B;KAAW;IAGd,SAAS8B,OAAOC,KAAiC;QAC/CA,MAAMC,cAAc;QACpB,IAAId,aAAaxB,aAAa;QAC9B,IAAI,CAACuC,gBAAgB;QACrB,KAAK9B,SAASC;IAChB;IAEA,SAAS6B;QACP,MAAMtC,QAAQf,oBAAoBsD,IAAI,CAAC9B,QACnCrB,YACA;QACJ0B,aAAad;QACb,OAAOA,UAAUZ;IACnB;IAEA,qBACE,MAACJ;QACCiB,OAAOA;QACPC,aAAaA;QACbE,cAAcA;QACdC,YAAY4B;;YAEXjC,sBACC,KAACvB;gBAAQ+D,MAAK;gBAAQC,MAAK;0BACxBzC;iBAED;YACHuB,0BACC,KAAC9C;gBAAQ+D,MAAK;gBAAQC,MAAK;0BAAQ;iBAGjC;0BACJ,MAACC;gBAAKC,WAAU;gBAAsBC,UAAU;gBAACC,UAAUV;;kCACzD,KAACzD;wBAAUoE,OAAM;wBAAoBC,IAAG;wBAAoB/C,OAAOa;kCACjE,cAAA,KAAClC;4BACCqE,cAAa;4BACbC,WAAU;4BACVC,WAAW;4BACXC,SAAQ;4BACRhE,OAAOsB;4BACP2C,UAAU,CAAChB;gCACT1B,QAAQ0B,MAAMiB,MAAM,CAAClE,KAAK,CAACmE,OAAO,CAAC,QAAQ,IAAIC,KAAK,CAAC,GAAG;gCACxDzC,aAAa1B;4BACf;4BACAoE,QAAQlB;;;kCAGZ,KAAC9D;wBAAOmE,WAAU;wBAASF,MAAK;wBAASgB,UAAUlC;wBAAWmC,WAAW3D;kCAAa;;kCAGtF,KAACvB;wBACCmF,iBAAerC,sBAAsB,OAAOlC;wBAC5CuD,WAAU;wBACViB,SAAQ;wBACRnB,MAAK;wBACLiB,WAAW5D;wBACX+D,SAAS;4BACP,IAAI,CAACvC,uBAAuB,CAACxB,aAAa,KAAKQ;wBACjD;kCAECR,cACG,qBACAwB,sBACE,CAAC,UAAU,EAAEJ,uBAAuB,CAAC,CAAC,GACtC;;;;0BAGV,KAAC1C;gBACCmE,WAAU;gBACViB,SAAQ;gBACRnB,MAAK;gBACLgB,UAAUjC;gBACVqC,SAAStD;0BACV;;YAGAJ;;;AAGP"}
+{"version":3,"sources":["../../src/components/email-code-verification.tsx"],"sourcesContent":["import {AuthShell} from '@shipfox/client-shell/runtime';\nimport {Button} from '@shipfox/react-ui/button';\nimport {Callout} from '@shipfox/react-ui/callout';\nimport {FormField, FormFieldInput} from '@shipfox/react-ui/form-field';\nimport type {HeaderProps} from '@shipfox/react-ui/typography';\nimport type {FormEvent, ReactNode, Ref} from 'react';\nimport {useCallback, useEffect, useRef, useState} from 'react';\n\nconst EIGHT_DIGIT_CODE_RE = /^\\d{8}$/u;\n\nexport interface EmailCodeVerificationProps {\n  destination: string;\n  expiresAt?: string | undefined;\n  nextResendAvailableAt?: string | undefined;\n  isResending?: boolean;\n  isVerifying?: boolean;\n  error?: string | undefined;\n  title?: string;\n  description?: string;\n  children?: ReactNode;\n  headingProps?: Omit<HeaderProps, 'children' | 'id'> | undefined;\n  headingRef?: Ref<HTMLHeadingElement> | undefined;\n  onResend: () => void | Promise<void>;\n  onUseAnotherEmail: () => void;\n  onVerify: (code: string) => void | Promise<void>;\n}\n\nfunction timestamp(value: string | undefined): number | undefined {\n  if (!value) return undefined;\n  const parsed = Date.parse(value);\n  return Number.isNaN(parsed) ? undefined : parsed;\n}\n\nexport function EmailCodeVerification({\n  destination,\n  expiresAt,\n  nextResendAvailableAt,\n  isResending = false,\n  isVerifying = false,\n  error,\n  title = 'Check your email',\n  description = `We sent an eight-digit verification code to ${destination}.`,\n  children,\n  headingProps,\n  headingRef,\n  onResend,\n  onUseAnotherEmail,\n  onVerify,\n}: EmailCodeVerificationProps) {\n  const [code, setCode] = useState('');\n  const [now, setNow] = useState(() => Date.now());\n  const [codeError, setCodeError] = useState<string>();\n  const localHeadingRef = useRef<HTMLHeadingElement>(null);\n  const resendAvailableAt = timestamp(nextResendAvailableAt);\n  const expiration = timestamp(expiresAt);\n  const resendRemainingSeconds = resendAvailableAt\n    ? Math.max(0, Math.ceil((resendAvailableAt - now) / 1_000))\n    : 0;\n  const isResendCoolingDown = resendRemainingSeconds > 0;\n  const isExpired = expiration !== undefined && expiration <= now;\n  const isPending = isResending || isVerifying;\n\n  useEffect(() => {\n    const isPending = (tickNow: number) =>\n      (resendAvailableAt !== undefined && resendAvailableAt > tickNow) ||\n      (expiration !== undefined && expiration > tickNow);\n\n    const tickNow = Date.now();\n    setNow(tickNow);\n    if (!isPending(tickNow)) return;\n\n    const interval = window.setInterval(() => {\n      const nextTick = Date.now();\n      setNow(nextTick);\n      if (!isPending(nextTick)) {\n        window.clearInterval(interval);\n      }\n    }, 1_000);\n    return () => window.clearInterval(interval);\n  }, [expiration, resendAvailableAt]);\n\n  useEffect(() => {\n    localHeadingRef.current?.focus();\n  }, []);\n\n  const setHeadingRef = useCallback(\n    (heading: HTMLHeadingElement | null) => {\n      localHeadingRef.current = heading;\n      if (typeof headingRef === 'function') {\n        headingRef(heading);\n      } else if (headingRef) {\n        headingRef.current = heading;\n      }\n    },\n    [headingRef],\n  );\n\n  function submit(event: FormEvent<HTMLFormElement>) {\n    event.preventDefault();\n    if (isExpired || isVerifying) return;\n    if (!validateCode()) return;\n    void onVerify(code);\n  }\n\n  function validateCode() {\n    const error = EIGHT_DIGIT_CODE_RE.test(code)\n      ? undefined\n      : 'Enter the eight-digit verification code.';\n    setCodeError(error);\n    return error === undefined;\n  }\n\n  return (\n    <AuthShell\n      title={title}\n      description={description}\n      headingProps={headingProps}\n      headingRef={setHeadingRef}\n    >\n      {error ? (\n        <Callout role=\"alert\" type=\"error\">\n          {error}\n        </Callout>\n      ) : null}\n      {isExpired ? (\n        <Callout role=\"alert\" type=\"error\">\n          This verification code has expired. Use another email to try again.\n        </Callout>\n      ) : null}\n      <form className=\"flex flex-col gap-8\" noValidate onSubmit={submit}>\n        <FormField label=\"Verification code\" id=\"verification-code\" error={codeError}>\n          <FormFieldInput\n            autoComplete=\"one-time-code\"\n            inputMode=\"numeric\"\n            maxLength={8}\n            pattern=\"[0-9]{8}\"\n            value={code}\n            onChange={(event) => {\n              setCode(event.target.value.replace(/\\D/gu, '').slice(0, 8));\n              setCodeError(undefined);\n            }}\n            onBlur={validateCode}\n          />\n        </FormField>\n        <Button className=\"w-full\" type=\"submit\" disabled={isExpired} isLoading={isVerifying}>\n          Verify email\n        </Button>\n        <Button\n          aria-disabled={isResendCoolingDown ? true : undefined}\n          className=\"w-full aria-disabled:cursor-not-allowed aria-disabled:opacity-70\"\n          variant=\"secondary\"\n          type=\"button\"\n          isLoading={isResending}\n          onClick={() => {\n            if (!isResendCoolingDown && !isResending) void onResend();\n          }}\n        >\n          {isResending\n            ? 'Sending email...'\n            : isResendCoolingDown\n              ? `Resend in ${resendRemainingSeconds}s`\n              : 'Resend verification email'}\n        </Button>\n      </form>\n      <Button\n        className=\"w-full\"\n        variant=\"transparent\"\n        type=\"button\"\n        disabled={isPending}\n        onClick={onUseAnotherEmail}\n      >\n        Use another email\n      </Button>\n      {children}\n    </AuthShell>\n  );\n}\n"],"names":["AuthShell","Button","Callout","FormField","FormFieldInput","useCallback","useEffect","useRef","useState","EIGHT_DIGIT_CODE_RE","timestamp","value","undefined","parsed","Date","parse","Number","isNaN","EmailCodeVerification","destination","expiresAt","nextResendAvailableAt","isResending","isVerifying","error","title","description","children","headingProps","headingRef","onResend","onUseAnotherEmail","onVerify","code","setCode","now","setNow","codeError","setCodeError","localHeadingRef","resendAvailableAt","expiration","resendRemainingSeconds","Math","max","ceil","isResendCoolingDown","isExpired","isPending","tickNow","interval","window","setInterval","nextTick","clearInterval","current","focus","setHeadingRef","heading","submit","event","preventDefault","validateCode","test","role","type","form","className","noValidate","onSubmit","label","id","autoComplete","inputMode","maxLength","pattern","onChange","target","replace","slice","onBlur","disabled","isLoading","aria-disabled","variant","onClick"],"mappings":";AAAA,SAAQA,SAAS,QAAO,gCAAgC;AACxD,SAAQC,MAAM,QAAO,2BAA2B;AAChD,SAAQC,OAAO,QAAO,4BAA4B;AAClD,SAAQC,SAAS,EAAEC,cAAc,QAAO,+BAA+B;AAGvE,SAAQC,WAAW,EAAEC,SAAS,EAAEC,MAAM,EAAEC,QAAQ,QAAO,QAAQ;AAE/D,MAAMC,sBAAsB;AAmB5B,SAASC,UAAUC,KAAyB;IAC1C,IAAI,CAACA,OAAO,OAAOC;IACnB,MAAMC,SAASC,KAAKC,KAAK,CAACJ;IAC1B,OAAOK,OAAOC,KAAK,CAACJ,UAAUD,YAAYC;AAC5C;AAEA,OAAO,SAASK,sBAAsB,EACpCC,WAAW,EACXC,SAAS,EACTC,qBAAqB,EACrBC,cAAc,KAAK,EACnBC,cAAc,KAAK,EACnBC,KAAK,EACLC,QAAQ,kBAAkB,EAC1BC,cAAc,CAAC,4CAA4C,EAAEP,YAAY,CAAC,CAAC,EAC3EQ,QAAQ,EACRC,YAAY,EACZC,UAAU,EACVC,QAAQ,EACRC,iBAAiB,EACjBC,QAAQ,EACmB;IAC3B,MAAM,CAACC,MAAMC,QAAQ,GAAG1B,SAAS;IACjC,MAAM,CAAC2B,KAAKC,OAAO,GAAG5B,SAAS,IAAMM,KAAKqB,GAAG;IAC7C,MAAM,CAACE,WAAWC,aAAa,GAAG9B;IAClC,MAAM+B,kBAAkBhC,OAA2B;IACnD,MAAMiC,oBAAoB9B,UAAUW;IACpC,MAAMoB,aAAa/B,UAAUU;IAC7B,MAAMsB,yBAAyBF,oBAC3BG,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAAC,AAACL,CAAAA,oBAAoBL,GAAE,IAAK,UAClD;IACJ,MAAMW,sBAAsBJ,yBAAyB;IACrD,MAAMK,YAAYN,eAAe7B,aAAa6B,cAAcN;IAC5D,MAAMa,YAAY1B,eAAeC;IAEjCjB,UAAU;QACR,MAAM0C,YAAY,CAACC,UACjB,AAACT,sBAAsB5B,aAAa4B,oBAAoBS,WACvDR,eAAe7B,aAAa6B,aAAaQ;QAE5C,MAAMA,UAAUnC,KAAKqB,GAAG;QACxBC,OAAOa;QACP,IAAI,CAACD,UAAUC,UAAU;QAEzB,MAAMC,WAAWC,OAAOC,WAAW,CAAC;YAClC,MAAMC,WAAWvC,KAAKqB,GAAG;YACzBC,OAAOiB;YACP,IAAI,CAACL,UAAUK,WAAW;gBACxBF,OAAOG,aAAa,CAACJ;YACvB;QACF,GAAG;QACH,OAAO,IAAMC,OAAOG,aAAa,CAACJ;IACpC,GAAG;QAACT;QAAYD;KAAkB;IAElClC,UAAU;QACRiC,gBAAgBgB,OAAO,EAAEC;IAC3B,GAAG,EAAE;IAEL,MAAMC,gBAAgBpD,YACpB,CAACqD;QACCnB,gBAAgBgB,OAAO,GAAGG;QAC1B,IAAI,OAAO7B,eAAe,YAAY;YACpCA,WAAW6B;QACb,OAAO,IAAI7B,YAAY;YACrBA,WAAW0B,OAAO,GAAGG;QACvB;IACF,GACA;QAAC7B;KAAW;IAGd,SAAS8B,OAAOC,KAAiC;QAC/CA,MAAMC,cAAc;QACpB,IAAId,aAAaxB,aAAa;QAC9B,IAAI,CAACuC,gBAAgB;QACrB,KAAK9B,SAASC;IAChB;IAEA,SAAS6B;QACP,MAAMtC,QAAQf,oBAAoBsD,IAAI,CAAC9B,QACnCrB,YACA;QACJ0B,aAAad;QACb,OAAOA,UAAUZ;IACnB;IAEA,qBACE,MAACZ;QACCyB,OAAOA;QACPC,aAAaA;QACbE,cAAcA;QACdC,YAAY4B;;YAEXjC,sBACC,KAACtB;gBAAQ8D,MAAK;gBAAQC,MAAK;0BACxBzC;iBAED;YACHuB,0BACC,KAAC7C;gBAAQ8D,MAAK;gBAAQC,MAAK;0BAAQ;iBAGjC;0BACJ,MAACC;gBAAKC,WAAU;gBAAsBC,UAAU;gBAACC,UAAUV;;kCACzD,KAACxD;wBAAUmE,OAAM;wBAAoBC,IAAG;wBAAoB/C,OAAOa;kCACjE,cAAA,KAACjC;4BACCoE,cAAa;4BACbC,WAAU;4BACVC,WAAW;4BACXC,SAAQ;4BACRhE,OAAOsB;4BACP2C,UAAU,CAAChB;gCACT1B,QAAQ0B,MAAMiB,MAAM,CAAClE,KAAK,CAACmE,OAAO,CAAC,QAAQ,IAAIC,KAAK,CAAC,GAAG;gCACxDzC,aAAa1B;4BACf;4BACAoE,QAAQlB;;;kCAGZ,KAAC7D;wBAAOkE,WAAU;wBAASF,MAAK;wBAASgB,UAAUlC;wBAAWmC,WAAW3D;kCAAa;;kCAGtF,KAACtB;wBACCkF,iBAAerC,sBAAsB,OAAOlC;wBAC5CuD,WAAU;wBACViB,SAAQ;wBACRnB,MAAK;wBACLiB,WAAW5D;wBACX+D,SAAS;4BACP,IAAI,CAACvC,uBAAuB,CAACxB,aAAa,KAAKQ;wBACjD;kCAECR,cACG,qBACAwB,sBACE,CAAC,UAAU,EAAEJ,uBAAuB,CAAC,CAAC,GACtC;;;;0BAGV,KAACzC;gBACCkE,WAAU;gBACViB,SAAQ;gBACRnB,MAAK;gBACLgB,UAAUjC;gBACVqC,SAAStD;0BACV;;YAGAJ;;;AAGP"}

package/dist/components/redirect-target.d.ts

@@ -1,2 +1,9 @@
 export declare function sanitizeRedirectPath(value: unknown): string | undefined;
+/**
+ * Returns the destination used by the shared logout route.
+ *
+ * Login is the only auth destination allowed, and invitation tokens never
+ * survive this boundary. Invalid values fail closed to login.
+ */
+export declare function sanitizeLogoutRedirectPath(value: unknown): string;
 //# sourceMappingURL=redirect-target.d.ts.map

package/dist/components/redirect-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-target.d.ts","sourceRoot":"","sources":["../../src/components/redirect-target.ts"],"names":[],"mappings":"AAIA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAiBvE"}
+{"version":3,"file":"redirect-target.d.ts","sourceRoot":"","sources":["../../src/components/redirect-target.ts"],"names":[],"mappings":"AAkCA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIvE;AAOD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOjE"}

package/dist/components/redirect-target.js

@@ -1,7 +1,9 @@
 const REDIRECT_ORIGIN = 'https://shipfox-redirect.invalid';
-// Resolves and canonicalizes an internal path before returning it, so browser URL
-// parsing cannot turn a seemingly safe path into an external or auth route.
-export function sanitizeRedirectPath(value) {
+const LOGIN_PATH = '/auth/login';
+const INVITATION_ACCEPT_PATH = '/invitations/accept';
+const DEFAULT_LOGOUT_REDIRECT = LOGIN_PATH;
+const TRAILING_SLASHES = /\/+$/;
+function resolveRedirectPath(value) {
     if (typeof value !== 'string' || !value.startsWith('/')) return undefined;
     let decoded;
     try {
@@ -16,8 +18,37 @@ export function sanitizeRedirectPath(value) {
         return undefined;
     }
     if (target.origin !== REDIRECT_ORIGIN) return undefined;
-    if (target.pathname === '/auth' || target.pathname.startsWith('/auth/')) return undefined;
+    return target;
+}
+function formatRedirectPath(target) {
     return `${target.pathname}${target.search}${target.hash}`;
 }
+function isAuthPath(pathname) {
+    return pathname === '/auth' || pathname.startsWith('/auth/');
+}
+// Resolves and canonicalizes an internal path before returning it, so browser URL
+// parsing cannot turn a seemingly safe path into an external or auth route.
+export function sanitizeRedirectPath(value) {
+    const target = resolveRedirectPath(value);
+    if (!target || isAuthPath(target.pathname)) return undefined;
+    return formatRedirectPath(target);
+}
+function containsInvitationToken(target) {
+    const normalizedPathname = target.pathname.replace(TRAILING_SLASHES, '') || '/';
+    return normalizedPathname === INVITATION_ACCEPT_PATH && target.searchParams.has('token');
+}
+/**
+ * Returns the destination used by the shared logout route.
+ *
+ * Login is the only auth destination allowed, and invitation tokens never
+ * survive this boundary. Invalid values fail closed to login.
+ */ export function sanitizeLogoutRedirectPath(value) {
+    const target = resolveRedirectPath(value);
+    if (!target) return DEFAULT_LOGOUT_REDIRECT;
+    if (isAuthPath(target.pathname) || containsInvitationToken(target)) {
+        return DEFAULT_LOGOUT_REDIRECT;
+    }
+    return formatRedirectPath(target);
+}
 
 //# sourceMappingURL=redirect-target.js.map

package/dist/components/redirect-target.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/redirect-target.ts"],"sourcesContent":["const REDIRECT_ORIGIN = 'https://shipfox-redirect.invalid';\n\n// Resolves and canonicalizes an internal path before returning it, so browser URL\n// parsing cannot turn a seemingly safe path into an external or auth route.\nexport function sanitizeRedirectPath(value: unknown): string | undefined {\n  if (typeof value !== 'string' || !value.startsWith('/')) return undefined;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(value);\n  } catch {\n    return undefined;\n  }\n  let target: URL;\n  try {\n    target = new URL(decoded, REDIRECT_ORIGIN);\n  } catch {\n    return undefined;\n  }\n  if (target.origin !== REDIRECT_ORIGIN) return undefined;\n  if (target.pathname === '/auth' || target.pathname.startsWith('/auth/')) return undefined;\n  return `${target.pathname}${target.search}${target.hash}`;\n}\n"],"names":["REDIRECT_ORIGIN","sanitizeRedirectPath","value","startsWith","undefined","decoded","decodeURIComponent","target","URL","origin","pathname","search","hash"],"mappings":"AAAA,MAAMA,kBAAkB;AAExB,kFAAkF;AAClF,4EAA4E;AAC5E,OAAO,SAASC,qBAAqBC,KAAc;IACjD,IAAI,OAAOA,UAAU,YAAY,CAACA,MAAMC,UAAU,CAAC,MAAM,OAAOC;IAChE,IAAIC;IACJ,IAAI;QACFA,UAAUC,mBAAmBJ;IAC/B,EAAE,OAAM;QACN,OAAOE;IACT;IACA,IAAIG;IACJ,IAAI;QACFA,SAAS,IAAIC,IAAIH,SAASL;IAC5B,EAAE,OAAM;QACN,OAAOI;IACT;IACA,IAAIG,OAAOE,MAAM,KAAKT,iBAAiB,OAAOI;IAC9C,IAAIG,OAAOG,QAAQ,KAAK,WAAWH,OAAOG,QAAQ,CAACP,UAAU,CAAC,WAAW,OAAOC;IAChF,OAAO,GAAGG,OAAOG,QAAQ,GAAGH,OAAOI,MAAM,GAAGJ,OAAOK,IAAI,EAAE;AAC3D"}
+{"version":3,"sources":["../../src/components/redirect-target.ts"],"sourcesContent":["const REDIRECT_ORIGIN = 'https://shipfox-redirect.invalid';\nconst LOGIN_PATH = '/auth/login';\nconst INVITATION_ACCEPT_PATH = '/invitations/accept';\nconst DEFAULT_LOGOUT_REDIRECT = LOGIN_PATH;\nconst TRAILING_SLASHES = /\\/+$/;\n\nfunction resolveRedirectPath(value: unknown): URL | undefined {\n  if (typeof value !== 'string' || !value.startsWith('/')) return undefined;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(value);\n  } catch {\n    return undefined;\n  }\n  let target: URL;\n  try {\n    target = new URL(decoded, REDIRECT_ORIGIN);\n  } catch {\n    return undefined;\n  }\n  if (target.origin !== REDIRECT_ORIGIN) return undefined;\n  return target;\n}\n\nfunction formatRedirectPath(target: URL): string {\n  return `${target.pathname}${target.search}${target.hash}`;\n}\n\nfunction isAuthPath(pathname: string): boolean {\n  return pathname === '/auth' || pathname.startsWith('/auth/');\n}\n\n// Resolves and canonicalizes an internal path before returning it, so browser URL\n// parsing cannot turn a seemingly safe path into an external or auth route.\nexport function sanitizeRedirectPath(value: unknown): string | undefined {\n  const target = resolveRedirectPath(value);\n  if (!target || isAuthPath(target.pathname)) return undefined;\n  return formatRedirectPath(target);\n}\n\nfunction containsInvitationToken(target: URL): boolean {\n  const normalizedPathname = target.pathname.replace(TRAILING_SLASHES, '') || '/';\n  return normalizedPathname === INVITATION_ACCEPT_PATH && target.searchParams.has('token');\n}\n\n/**\n * Returns the destination used by the shared logout route.\n *\n * Login is the only auth destination allowed, and invitation tokens never\n * survive this boundary. Invalid values fail closed to login.\n */\nexport function sanitizeLogoutRedirectPath(value: unknown): string {\n  const target = resolveRedirectPath(value);\n  if (!target) return DEFAULT_LOGOUT_REDIRECT;\n  if (isAuthPath(target.pathname) || containsInvitationToken(target)) {\n    return DEFAULT_LOGOUT_REDIRECT;\n  }\n  return formatRedirectPath(target);\n}\n"],"names":["REDIRECT_ORIGIN","LOGIN_PATH","INVITATION_ACCEPT_PATH","DEFAULT_LOGOUT_REDIRECT","TRAILING_SLASHES","resolveRedirectPath","value","startsWith","undefined","decoded","decodeURIComponent","target","URL","origin","formatRedirectPath","pathname","search","hash","isAuthPath","sanitizeRedirectPath","containsInvitationToken","normalizedPathname","replace","searchParams","has","sanitizeLogoutRedirectPath"],"mappings":"AAAA,MAAMA,kBAAkB;AACxB,MAAMC,aAAa;AACnB,MAAMC,yBAAyB;AAC/B,MAAMC,0BAA0BF;AAChC,MAAMG,mBAAmB;AAEzB,SAASC,oBAAoBC,KAAc;IACzC,IAAI,OAAOA,UAAU,YAAY,CAACA,MAAMC,UAAU,CAAC,MAAM,OAAOC;IAChE,IAAIC;IACJ,IAAI;QACFA,UAAUC,mBAAmBJ;IAC/B,EAAE,OAAM;QACN,OAAOE;IACT;IACA,IAAIG;IACJ,IAAI;QACFA,SAAS,IAAIC,IAAIH,SAAST;IAC5B,EAAE,OAAM;QACN,OAAOQ;IACT;IACA,IAAIG,OAAOE,MAAM,KAAKb,iBAAiB,OAAOQ;IAC9C,OAAOG;AACT;AAEA,SAASG,mBAAmBH,MAAW;IACrC,OAAO,GAAGA,OAAOI,QAAQ,GAAGJ,OAAOK,MAAM,GAAGL,OAAOM,IAAI,EAAE;AAC3D;AAEA,SAASC,WAAWH,QAAgB;IAClC,OAAOA,aAAa,WAAWA,SAASR,UAAU,CAAC;AACrD;AAEA,kFAAkF;AAClF,4EAA4E;AAC5E,OAAO,SAASY,qBAAqBb,KAAc;IACjD,MAAMK,SAASN,oBAAoBC;IACnC,IAAI,CAACK,UAAUO,WAAWP,OAAOI,QAAQ,GAAG,OAAOP;IACnD,OAAOM,mBAAmBH;AAC5B;AAEA,SAASS,wBAAwBT,MAAW;IAC1C,MAAMU,qBAAqBV,OAAOI,QAAQ,CAACO,OAAO,CAAClB,kBAAkB,OAAO;IAC5E,OAAOiB,uBAAuBnB,0BAA0BS,OAAOY,YAAY,CAACC,GAAG,CAAC;AAClF;AAEA;;;;;CAKC,GACD,OAAO,SAASC,2BAA2BnB,KAAc;IACvD,MAAMK,SAASN,oBAAoBC;IACnC,IAAI,CAACK,QAAQ,OAAOR;IACpB,IAAIe,WAAWP,OAAOI,QAAQ,KAAKK,wBAAwBT,SAAS;QAClE,OAAOR;IACT;IACA,OAAOW,mBAAmBH;AAC5B"}

package/dist/components/workspace-switcher.stories.d.ts

@@ -13,7 +13,7 @@ declare const meta: {
     };
     args: {
         activeWorkspaceId: string;
-        workspaces: Workspace[];
+        workspaces: import("@shipfox/client-shell/runtime").WorkspaceSummary[];
     };
 };
 export default meta;

package/dist/continuation.d.ts

@@ -1,4 +1,4 @@
-export { AuthActions, AuthShell, type AuthShellProps } from './components/auth-shell.js';
+export { AuthActions, AuthShell, type AuthShellProps } from '@shipfox/client-shell/runtime';
 export { EmailCodeVerification, type EmailCodeVerificationProps, } from './components/email-code-verification.js';
 export { parseRedirectContext, type RedirectContext } from './components/redirect-context.js';
 //# sourceMappingURL=continuation.d.ts.map

package/dist/continuation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"continuation.d.ts","sourceRoot":"","sources":["../src/continuation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAE,SAAS,EAAE,KAAK,cAAc,EAAC,MAAM,4BAA4B,CAAC;AACvF,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAC,oBAAoB,EAAE,KAAK,eAAe,EAAC,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"continuation.d.ts","sourceRoot":"","sources":["../src/continuation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAE,SAAS,EAAE,KAAK,cAAc,EAAC,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAC,oBAAoB,EAAE,KAAK,eAAe,EAAC,MAAM,kCAAkC,CAAC"}

package/dist/continuation.js

@@ -1,4 +1,4 @@
-export { AuthActions, AuthShell } from './components/auth-shell.js';
+export { AuthActions, AuthShell } from '@shipfox/client-shell/runtime';
 export { EmailCodeVerification } from './components/email-code-verification.js';
 export { parseRedirectContext } from './components/redirect-context.js';
 

package/dist/continuation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/continuation.ts"],"sourcesContent":["export {AuthActions, AuthShell, type AuthShellProps} from './components/auth-shell.js';\nexport {\n  EmailCodeVerification,\n  type EmailCodeVerificationProps,\n} from './components/email-code-verification.js';\nexport {parseRedirectContext, type RedirectContext} from './components/redirect-context.js';\n"],"names":["AuthActions","AuthShell","EmailCodeVerification","parseRedirectContext"],"mappings":"AAAA,SAAQA,WAAW,EAAEC,SAAS,QAA4B,6BAA6B;AACvF,SACEC,qBAAqB,QAEhB,0CAA0C;AACjD,SAAQC,oBAAoB,QAA6B,mCAAmC"}
+{"version":3,"sources":["../src/continuation.ts"],"sourcesContent":["export {AuthActions, AuthShell, type AuthShellProps} from '@shipfox/client-shell/runtime';\nexport {\n  EmailCodeVerification,\n  type EmailCodeVerificationProps,\n} from './components/email-code-verification.js';\nexport {parseRedirectContext, type RedirectContext} from './components/redirect-context.js';\n"],"names":["AuthActions","AuthShell","EmailCodeVerification","parseRedirectContext"],"mappings":"AAAA,SAAQA,WAAW,EAAEC,SAAS,QAA4B,gCAAgC;AAC1F,SACEC,qBAAqB,QAEhB,0CAA0C;AACjD,SAAQC,oBAAoB,QAA6B,mCAAmC"}

package/dist/core/auth.d.ts

@@ -0,0 +1,57 @@
+export interface LoginCommand {
+    email: string;
+    password: string;
+}
+export interface SignupCommand extends LoginCommand {
+    name: string;
+    invitationToken?: string;
+}
+export interface PasswordResetRequestCommand {
+    email: string;
+}
+export interface PasswordResetConfirmCommand {
+    token: string;
+    newPassword: string;
+}
+export interface VerifyEmailCommand {
+    email: string;
+    challengeId: string;
+    code: string;
+}
+export interface ResendEmailVerificationCommand {
+    email: string;
+    challengeId: string;
+}
+export interface WorkspaceCreateCommand {
+    name: string;
+}
+export interface Workspace {
+    id: string;
+    name: string;
+    status: 'active' | 'suspended' | 'deleted';
+}
+export interface SignupResult {
+    user: {
+        id: string;
+        email: string;
+        name?: string;
+        emailVerifiedAt?: string;
+    };
+    emailChallenge?: {
+        id: string;
+        nextResendAvailableAt: string;
+    };
+    membership?: {
+        id: string;
+        userId: string;
+        workspaceId: string;
+    };
+    acceptError?: {
+        code: string;
+        message: string;
+    };
+}
+export interface EmailVerificationResendResult {
+    nextResendAvailableAt: string;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/core/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,cAAc,CAAC,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAA;KAAC,CAAC;IAC7D,UAAU,CAAC,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,CAAC;IAC/D,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,MAAM,CAAC;CAC/B"}

package/dist/core/auth.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=auth.js.map

package/dist/core/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/auth.ts"],"sourcesContent":["export interface LoginCommand {\n  email: string;\n  password: string;\n}\n\nexport interface SignupCommand extends LoginCommand {\n  name: string;\n  invitationToken?: string;\n}\n\nexport interface PasswordResetRequestCommand {\n  email: string;\n}\n\nexport interface PasswordResetConfirmCommand {\n  token: string;\n  newPassword: string;\n}\n\nexport interface VerifyEmailCommand {\n  email: string;\n  challengeId: string;\n  code: string;\n}\n\nexport interface ResendEmailVerificationCommand {\n  email: string;\n  challengeId: string;\n}\n\nexport interface WorkspaceCreateCommand {\n  name: string;\n}\n\nexport interface Workspace {\n  id: string;\n  name: string;\n  status: 'active' | 'suspended' | 'deleted';\n}\n\nexport interface SignupResult {\n  user: {\n    id: string;\n    email: string;\n    name?: string;\n    emailVerifiedAt?: string;\n  };\n  emailChallenge?: {id: string; nextResendAvailableAt: string};\n  membership?: {id: string; userId: string; workspaceId: string};\n  acceptError?: {code: string; message: string};\n}\n\nexport interface EmailVerificationResendResult {\n  nextResendAvailableAt: string;\n}\n"],"names":[],"mappings":"AAoDA,WAEC"}

package/dist/hooks/api/auth-mapper.d.ts

@@ -0,0 +1,6 @@
+import type { SignupResponseDto } from '@shipfox/api-auth-dto';
+import { toAuthenticatedSession } from '@shipfox/client-shell/runtime';
+import type { SignupResult } from '#core/auth.js';
+export { toAuthenticatedSession };
+export declare function toSignupResult(dto: SignupResponseDto): SignupResult;
+//# sourceMappingURL=auth-mapper.d.ts.map

package/dist/hooks/api/auth-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-mapper.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/auth-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAC,sBAAsB,EAAiB,MAAM,+BAA+B,CAAC;AACrF,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAC,sBAAsB,EAAC,CAAC;AAEhC,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,YAAY,CAsBnE"}

package/dist/hooks/api/auth-mapper.js

@@ -0,0 +1,25 @@
+import { toAuthenticatedSession, toUserIdentity } from '@shipfox/client-shell/runtime';
+export { toAuthenticatedSession };
+export function toSignupResult(dto) {
+    return {
+        user: toUserIdentity(dto.user),
+        ...dto.email_challenge ? {
+            emailChallenge: {
+                id: dto.email_challenge.id,
+                nextResendAvailableAt: dto.email_challenge.next_resend_available_at
+            }
+        } : {},
+        ...dto.membership ? {
+            membership: {
+                id: dto.membership.id,
+                userId: dto.membership.user_id,
+                workspaceId: dto.membership.workspace_id
+            }
+        } : {},
+        ...dto.accept_error ? {
+            acceptError: dto.accept_error
+        } : {}
+    };
+}
+
+//# sourceMappingURL=auth-mapper.js.map

package/dist/hooks/api/auth-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/hooks/api/auth-mapper.ts"],"sourcesContent":["import type {SignupResponseDto} from '@shipfox/api-auth-dto';\nimport {toAuthenticatedSession, toUserIdentity} from '@shipfox/client-shell/runtime';\nimport type {SignupResult} from '#core/auth.js';\n\nexport {toAuthenticatedSession};\n\nexport function toSignupResult(dto: SignupResponseDto): SignupResult {\n  return {\n    user: toUserIdentity(dto.user),\n    ...(dto.email_challenge\n      ? {\n          emailChallenge: {\n            id: dto.email_challenge.id,\n            nextResendAvailableAt: dto.email_challenge.next_resend_available_at,\n          },\n        }\n      : {}),\n    ...(dto.membership\n      ? {\n          membership: {\n            id: dto.membership.id,\n            userId: dto.membership.user_id,\n            workspaceId: dto.membership.workspace_id,\n          },\n        }\n      : {}),\n    ...(dto.accept_error ? {acceptError: dto.accept_error} : {}),\n  };\n}\n"],"names":["toAuthenticatedSession","toUserIdentity","toSignupResult","dto","user","email_challenge","emailChallenge","id","nextResendAvailableAt","next_resend_available_at","membership","userId","user_id","workspaceId","workspace_id","accept_error","acceptError"],"mappings":"AACA,SAAQA,sBAAsB,EAAEC,cAAc,QAAO,gCAAgC;AAGrF,SAAQD,sBAAsB,GAAE;AAEhC,OAAO,SAASE,eAAeC,GAAsB;IACnD,OAAO;QACLC,MAAMH,eAAeE,IAAIC,IAAI;QAC7B,GAAID,IAAIE,eAAe,GACnB;YACEC,gBAAgB;gBACdC,IAAIJ,IAAIE,eAAe,CAACE,EAAE;gBAC1BC,uBAAuBL,IAAIE,eAAe,CAACI,wBAAwB;YACrE;QACF,IACA,CAAC,CAAC;QACN,GAAIN,IAAIO,UAAU,GACd;YACEA,YAAY;gBACVH,IAAIJ,IAAIO,UAAU,CAACH,EAAE;gBACrBI,QAAQR,IAAIO,UAAU,CAACE,OAAO;gBAC9BC,aAAaV,IAAIO,UAAU,CAACI,YAAY;YAC1C;QACF,IACA,CAAC,CAAC;QACN,GAAIX,IAAIY,YAAY,GAAG;YAACC,aAAab,IAAIY,YAAY;QAAA,IAAI,CAAC,CAAC;IAC7D;AACF"}

package/dist/hooks/api/login-auth.d.ts

@@ -1,29 +1,4 @@
-import type { LoginBodyDto } from '@shipfox/api-auth-dto';
-export declare function loginAuth(body: LoginBodyDto): Promise<{
-    token: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-        email_verified_at: string | null;
-        status: "active" | "suspended" | "deleted";
-        created_at: string;
-        updated_at: string;
-    };
-}>;
-export declare function useLoginAuth(): import("@tanstack/react-query").UseMutationResult<{
-    token: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-        email_verified_at: string | null;
-        status: "active" | "suspended" | "deleted";
-        created_at: string;
-        updated_at: string;
-    };
-}, Error, {
-    email: string;
-    password: string;
-}, unknown>;
+import type { LoginCommand } from '#core/auth.js';
+export declare function loginAuth(command: LoginCommand): Promise<import("@shipfox/client-shell/runtime").AuthenticatedSession>;
+export declare function useLoginAuth(): import("@tanstack/react-query").UseMutationResult<import("@shipfox/client-shell/runtime").AuthenticatedSession, Error, LoginCommand, unknown>;
 //# sourceMappingURL=login-auth.d.ts.map

package/dist/hooks/api/login-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/login-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,YAAY,EAAmB,MAAM,uBAAuB,CAAC;AAK1E,wBAAsB,SAAS,CAAC,IAAI,EAAE,YAAY;;;;;;;;;;;GAEjD;AAED,wBAAgB,YAAY;;;;;;;;;;;;;;YAO3B"}
+{"version":3,"file":"login-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/login-auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,eAAe,CAAC;AAIhD,wBAAsB,SAAS,CAAC,OAAO,EAAE,YAAY,yEAMpD;AAED,wBAAgB,YAAY,kJAO3B"}

package/dist/hooks/api/login-auth.js

@@ -1,11 +1,14 @@
-import { apiRequest } from '@shipfox/client-api';
+import { loginResponseSchema } from '@shipfox/api-auth-dto';
+import { checkedApiRequest } from '@shipfox/client-api';
 import { useMutation } from '@tanstack/react-query';
 import { useAuthTransition } from '#state/auth.js';
-export async function loginAuth(body) {
-    return await apiRequest('/auth/login', {
+import { toAuthenticatedSession } from './auth-mapper.js';
+export async function loginAuth(command) {
+    const response = await checkedApiRequest(loginResponseSchema, '/auth/login', {
         method: 'POST',
-        body
+        body: command
     });
+    return toAuthenticatedSession(response);
 }
 export function useLoginAuth() {
     const { enterAuthenticated } = useAuthTransition();

package/dist/hooks/api/login-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/api/login-auth.ts"],"sourcesContent":["import type {LoginBodyDto, LoginResponseDto} from '@shipfox/api-auth-dto';\nimport {apiRequest} from '@shipfox/client-api';\nimport {useMutation} from '@tanstack/react-query';\nimport {useAuthTransition} from '#state/auth.js';\n\nexport async function loginAuth(body: LoginBodyDto) {\n  return await apiRequest<LoginResponseDto>('/auth/login', {method: 'POST', body});\n}\n\nexport function useLoginAuth() {\n  const {enterAuthenticated} = useAuthTransition();\n\n  return useMutation({\n    mutationFn: loginAuth,\n    onSuccess: enterAuthenticated,\n  });\n}\n"],"names":["apiRequest","useMutation","useAuthTransition","loginAuth","body","method","useLoginAuth","enterAuthenticated","mutationFn","onSuccess"],"mappings":"AACA,SAAQA,UAAU,QAAO,sBAAsB;AAC/C,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,iBAAiB,QAAO,iBAAiB;AAEjD,OAAO,eAAeC,UAAUC,IAAkB;IAChD,OAAO,MAAMJ,WAA6B,eAAe;QAACK,QAAQ;QAAQD;IAAI;AAChF;AAEA,OAAO,SAASE;IACd,MAAM,EAACC,kBAAkB,EAAC,GAAGL;IAE7B,OAAOD,YAAY;QACjBO,YAAYL;QACZM,WAAWF;IACb;AACF"}
+{"version":3,"sources":["../../../src/hooks/api/login-auth.ts"],"sourcesContent":["import {loginResponseSchema} from '@shipfox/api-auth-dto';\nimport {checkedApiRequest} from '@shipfox/client-api';\nimport {useMutation} from '@tanstack/react-query';\nimport type {LoginCommand} from '#core/auth.js';\nimport {useAuthTransition} from '#state/auth.js';\nimport {toAuthenticatedSession} from './auth-mapper.js';\n\nexport async function loginAuth(command: LoginCommand) {\n  const response = await checkedApiRequest(loginResponseSchema, '/auth/login', {\n    method: 'POST',\n    body: command,\n  });\n  return toAuthenticatedSession(response);\n}\n\nexport function useLoginAuth() {\n  const {enterAuthenticated} = useAuthTransition();\n\n  return useMutation({\n    mutationFn: loginAuth,\n    onSuccess: enterAuthenticated,\n  });\n}\n"],"names":["loginResponseSchema","checkedApiRequest","useMutation","useAuthTransition","toAuthenticatedSession","loginAuth","command","response","method","body","useLoginAuth","enterAuthenticated","mutationFn","onSuccess"],"mappings":"AAAA,SAAQA,mBAAmB,QAAO,wBAAwB;AAC1D,SAAQC,iBAAiB,QAAO,sBAAsB;AACtD,SAAQC,WAAW,QAAO,wBAAwB;AAElD,SAAQC,iBAAiB,QAAO,iBAAiB;AACjD,SAAQC,sBAAsB,QAAO,mBAAmB;AAExD,OAAO,eAAeC,UAAUC,OAAqB;IACnD,MAAMC,WAAW,MAAMN,kBAAkBD,qBAAqB,eAAe;QAC3EQ,QAAQ;QACRC,MAAMH;IACR;IACA,OAAOF,uBAAuBG;AAChC;AAEA,OAAO,SAASG;IACd,MAAM,EAACC,kBAAkB,EAAC,GAAGR;IAE7B,OAAOD,YAAY;QACjBU,YAAYP;QACZQ,WAAWF;IACb;AACF"}

package/dist/hooks/api/logout-auth.js

@@ -1,9 +1,9 @@
-import { apiRequest } from '@shipfox/client-api';
+import { checkedApiRequest, emptyResponseSchema } from '@shipfox/client-api';
 import { useMutation } from '@tanstack/react-query';
 import { useAuthTransition } from '#state/auth.js';
 async function logoutAuth() {
     try {
-        await apiRequest('/auth/logout', {
+        await checkedApiRequest(emptyResponseSchema, '/auth/logout', {
             method: 'POST',
             body: {}
         });

package/dist/hooks/api/logout-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hooks/api/logout-auth.ts"],"sourcesContent":["import {apiRequest} from '@shipfox/client-api';\nimport {useMutation} from '@tanstack/react-query';\nimport {useAuthTransition} from '#state/auth.js';\n\nasync function logoutAuth() {\n  try {\n    await apiRequest<void>('/auth/logout', {method: 'POST', body: {}});\n  } catch {\n    // Logout is best-effort: local session state must clear even if the API is offline.\n  }\n}\n\nexport function useLogoutAuth() {\n  const {enterGuest} = useAuthTransition();\n\n  return useMutation({\n    mutationFn: logoutAuth,\n    onSettled: enterGuest,\n  });\n}\n"],"names":["apiRequest","useMutation","useAuthTransition","logoutAuth","method","body","useLogoutAuth","enterGuest","mutationFn","onSettled"],"mappings":"AAAA,SAAQA,UAAU,QAAO,sBAAsB;AAC/C,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,iBAAiB,QAAO,iBAAiB;AAEjD,eAAeC;IACb,IAAI;QACF,MAAMH,WAAiB,gBAAgB;YAACI,QAAQ;YAAQC,MAAM,CAAC;QAAC;IAClE,EAAE,OAAM;IACN,oFAAoF;IACtF;AACF;AAEA,OAAO,SAASC;IACd,MAAM,EAACC,UAAU,EAAC,GAAGL;IAErB,OAAOD,YAAY;QACjBO,YAAYL;QACZM,WAAWF;IACb;AACF"}
+{"version":3,"sources":["../../../src/hooks/api/logout-auth.ts"],"sourcesContent":["import {checkedApiRequest, emptyResponseSchema} from '@shipfox/client-api';\nimport {useMutation} from '@tanstack/react-query';\nimport {useAuthTransition} from '#state/auth.js';\n\nasync function logoutAuth() {\n  try {\n    await checkedApiRequest(emptyResponseSchema, '/auth/logout', {method: 'POST', body: {}});\n  } catch {\n    // Logout is best-effort: local session state must clear even if the API is offline.\n  }\n}\n\nexport function useLogoutAuth() {\n  const {enterGuest} = useAuthTransition();\n\n  return useMutation({\n    mutationFn: logoutAuth,\n    onSettled: enterGuest,\n  });\n}\n"],"names":["checkedApiRequest","emptyResponseSchema","useMutation","useAuthTransition","logoutAuth","method","body","useLogoutAuth","enterGuest","mutationFn","onSettled"],"mappings":"AAAA,SAAQA,iBAAiB,EAAEC,mBAAmB,QAAO,sBAAsB;AAC3E,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,iBAAiB,QAAO,iBAAiB;AAEjD,eAAeC;IACb,IAAI;QACF,MAAMJ,kBAAkBC,qBAAqB,gBAAgB;YAACI,QAAQ;YAAQC,MAAM,CAAC;QAAC;IACxF,EAAE,OAAM;IACN,oFAAoF;IACtF;AACF;AAEA,OAAO,SAASC;IACd,MAAM,EAACC,UAAU,EAAC,GAAGL;IAErB,OAAOD,YAAY;QACjBO,YAAYL;QACZM,WAAWF;IACb;AACF"}

package/dist/hooks/api/password-reset-auth.d.ts

@@ -1,33 +1,6 @@
-import type { PasswordResetConfirmBodyDto, PasswordResetRequestBodyDto } from '@shipfox/api-auth-dto';
-export declare function requestPasswordReset(body: PasswordResetRequestBodyDto): Promise<void>;
-export declare function confirmPasswordReset(body: PasswordResetConfirmBodyDto): Promise<{
-    token: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-        email_verified_at: string | null;
-        status: "active" | "suspended" | "deleted";
-        created_at: string;
-        updated_at: string;
-    };
-}>;
-export declare function useRequestPasswordResetAuth(): import("@tanstack/react-query").UseMutationResult<void, Error, {
-    email: string;
-}, unknown>;
-export declare function useConfirmPasswordResetAuth(): import("@tanstack/react-query").UseMutationResult<{
-    token: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-        email_verified_at: string | null;
-        status: "active" | "suspended" | "deleted";
-        created_at: string;
-        updated_at: string;
-    };
-}, Error, {
-    token: string;
-    new_password: string;
-}, unknown>;
+import type { PasswordResetConfirmCommand, PasswordResetRequestCommand } from '#core/auth.js';
+export declare function requestPasswordReset(command: PasswordResetRequestCommand): Promise<void>;
+export declare function confirmPasswordReset(command: PasswordResetConfirmCommand): Promise<import("@shipfox/client-shell/runtime").AuthenticatedSession>;
+export declare function useRequestPasswordResetAuth(): import("@tanstack/react-query").UseMutationResult<void, Error, PasswordResetRequestCommand, unknown>;
+export declare function useConfirmPasswordResetAuth(): import("@tanstack/react-query").UseMutationResult<import("@shipfox/client-shell/runtime").AuthenticatedSession, Error, PasswordResetConfirmCommand, unknown>;
 //# sourceMappingURL=password-reset-auth.d.ts.map

package/dist/hooks/api/password-reset-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/password-reset-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAE3B,2BAA2B,EAC5B,MAAM,uBAAuB,CAAC;AAK/B,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,iBAE3E;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,2BAA2B;;;;;;;;;;;GAK3E;AAED,wBAAgB,2BAA2B;;YAE1C;AAED,wBAAgB,2BAA2B;;;;;;;;;;;;;;YAO1C"}
+{"version":3,"file":"password-reset-auth.d.ts","sourceRoot":"","sources":["../../../src/hooks/api/password-reset-auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,2BAA2B,EAAE,2BAA2B,EAAC,MAAM,eAAe,CAAC;AAI5F,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,iBAK9E;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,yEAU9E;AAED,wBAAgB,2BAA2B,yGAE1C;AAED,wBAAgB,2BAA2B,iKAO1C"}

package/dist/hooks/api/password-reset-auth.js

@@ -1,17 +1,23 @@
-import { apiRequest } from '@shipfox/client-api';
+import { passwordResetConfirmResponseSchema } from '@shipfox/api-auth-dto';
+import { checkedApiRequest, emptyResponseSchema } from '@shipfox/client-api';
 import { useMutation } from '@tanstack/react-query';
 import { useAuthTransition } from '#state/auth.js';
-export async function requestPasswordReset(body) {
-    await apiRequest('/auth/password-reset', {
+import { toAuthenticatedSession } from './auth-mapper.js';
+export async function requestPasswordReset(command) {
+    await checkedApiRequest(emptyResponseSchema, '/auth/password-reset', {
         method: 'POST',
-        body
+        body: command
     });
 }
-export async function confirmPasswordReset(body) {
-    return await apiRequest('/auth/password-reset/confirm', {
+export async function confirmPasswordReset(command) {
+    const response = await checkedApiRequest(passwordResetConfirmResponseSchema, '/auth/password-reset/confirm', {
         method: 'POST',
-        body
+        body: {
+            token: command.token,
+            new_password: command.newPassword
+        }
     });
+    return toAuthenticatedSession(response);
 }
 export function useRequestPasswordResetAuth() {
     return useMutation({