@simple-auth-kit/cli 1.0.0

package/registry/mobile-apps/expo/variants/workspaces/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "mobile-expo-workspaces",
+  "description": "Expo end-user mobile app consuming the workspaces simple-auth-kit backend variant (simple-auth-kit add <combo> --workspaces) via @simple-auth-kit/auth-client. A deliberate copy of apps/mobile-expo rather than a shared abstraction: a consumer installs one variant, not both.",
+  "private": true,
+  "version": "0.0.0",
+  "main": "index.ts",
+  "scripts": {
+    "start": "expo start",
+    "android": "expo start --android",
+    "ios": "expo start --ios",
+    "web": "expo start --web",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@simple-auth-kit/auth-client": "^1.0.0",
+    "@react-native-async-storage/async-storage": "2.2.0",
+    "@react-navigation/native": "^7.3.16",
+    "@react-navigation/native-stack": "^7.18.8",
+    "expo": "~57.0.11",
+    "expo-status-bar": "~57.0.1",
+    "nativewind": "5.0.0-preview.4",
+    "react": "19.2.3",
+    "react-native": "0.86.2",
+    "react-native-css": "^3.0.7",
+    "react-native-reanimated": "4.5.1",
+    "react-native-safe-area-context": "~5.7.0",
+    "react-native-screens": "~4.26.0",
+    "zustand": "^5.0.14"
+  },
+  "devDependencies": {
+    "@types/react": "~19.2.2",
+    "tailwindcss": "^4.3.3",
+    "typescript": "~6.0.3"
+  }
+}

package/registry/mobile-apps/expo/variants/workspaces/src/api/authClient.ts

@@ -0,0 +1,21 @@
+import { AuthClient } from "@simple-auth-kit/auth-client";
+import { asyncStorageTokenStorage } from "../storage/asyncStorageTokenStorage";
+import { activeWorkspaceIdResolver } from "../workspace/activeWorkspace";
+
+// Expo's public-env convention: inlined at build time, readable at runtime via
+// process.env. Falls back to localhost for local dev when unset. Note that on an
+// Android emulator "localhost" refers to the emulator itself, not the host
+// machine — use EXPO_PUBLIC_API_BASE_URL=http://10.0.2.2:3005 there, and the
+// host machine's LAN IP for a physical device.
+const API_BASE_URL = process.env.EXPO_PUBLIC_API_BASE_URL ?? "http://localhost:3005";
+
+// This app targets the workspaces backend variant (`simple-auth-kit add <combo> --workspaces`), so it
+// configures a workspace resolver. Which calls then carry `X-Workspace-Id` is not decided here
+// and not decided per call site: inside AuthClient only `scopedRequest()` can send it, so
+// `login`, `signup`, `sessions`, `logout*`, `POST /workspaces` and `GET /workspaces` structurally
+// cannot — you cannot already be in the workspace you are about to create or choose.
+export const authClient = new AuthClient({
+  baseUrl: API_BASE_URL,
+  storage: asyncStorageTokenStorage,
+  workspaceId: activeWorkspaceIdResolver,
+});

package/registry/mobile-apps/expo/variants/workspaces/src/navigation/RootNavigator.tsx

@@ -0,0 +1,82 @@
+import React, { useEffect } from "react";
+import { ActivityIndicator, View } from "react-native";
+import { NavigationContainer } from "@react-navigation/native";
+import { createNativeStackNavigator } from "@react-navigation/native-stack";
+import type { AppStackParamList, AuthStackParamList, WorkspaceGateStackParamList } from "./types";
+import { useAuthStore, useIsAuthenticated } from "../store/authStore";
+import { useActiveWorkspaceId } from "../workspace/activeWorkspace";
+import { LoginScreen } from "../screens/LoginScreen";
+import { SignupScreen } from "../screens/SignupScreen";
+import { TwoFactorScreen } from "../screens/TwoFactorScreen";
+import { HomeScreen } from "../screens/HomeScreen";
+import { SessionsScreen } from "../screens/SessionsScreen";
+import { WorkspaceSelectScreen } from "../screens/WorkspaceSelectScreen";
+
+const AuthStack = createNativeStackNavigator<AuthStackParamList>();
+const WorkspaceGateStack = createNativeStackNavigator<WorkspaceGateStackParamList>();
+const AppStack = createNativeStackNavigator<AppStackParamList>();
+
+// Module-scope wrappers rather than inline arrows so the screen component identity is stable
+// across renders and React Navigation doesn't remount the screen on every parent render.
+const ChooseWorkspace = () => <WorkspaceSelectScreen mode="gate" />;
+const SwitchWorkspace = () => <WorkspaceSelectScreen mode="switch" />;
+
+function AuthNavigator() {
+  return (
+    <AuthStack.Navigator screenOptions={{ headerShown: false }}>
+      <AuthStack.Screen name="Login" component={LoginScreen} />
+      <AuthStack.Screen name="Signup" component={SignupScreen} />
+      <AuthStack.Screen name="TwoFactor" component={TwoFactorScreen} options={{ headerShown: true, title: "Verify" }} />
+    </AuthStack.Navigator>
+  );
+}
+
+function WorkspaceGateNavigator() {
+  return (
+    <WorkspaceGateStack.Navigator screenOptions={{ headerShown: false }}>
+      <WorkspaceGateStack.Screen name="ChooseWorkspace" component={ChooseWorkspace} />
+    </WorkspaceGateStack.Navigator>
+  );
+}
+
+function AppNavigator() {
+  return (
+    <AppStack.Navigator>
+      <AppStack.Screen name="Home" component={HomeScreen} options={{ title: "Profile" }} />
+      <AppStack.Screen name="Sessions" component={SessionsScreen} options={{ title: "Sessions" }} />
+      <AppStack.Screen name="SwitchWorkspace" component={SwitchWorkspace} options={{ title: "Workspaces" }} />
+    </AppStack.Navigator>
+  );
+}
+
+/**
+ * Standard React Navigation "auth flow" pattern, with one extra gate: the whole navigator is
+ * swapped based on state rather than navigated between, so there's no way to back-swipe from
+ * Home into the auth screens (or vice versa), and no way to reach the app while no workspace is
+ * active. That last one matters — every workspace-scoped call would otherwise go out with no
+ * `X-Workspace-Id` and be refused.
+ */
+export function RootNavigator() {
+  const bootstrap = useAuthStore((state) => state.bootstrap);
+  const isBootstrapping = useAuthStore((state) => state.isBootstrapping);
+  const isAuthenticated = useIsAuthenticated();
+  const activeWorkspaceId = useActiveWorkspaceId();
+
+  useEffect(() => {
+    bootstrap();
+  }, [bootstrap]);
+
+  if (isBootstrapping) {
+    return (
+      <View className="flex-1 items-center justify-center">
+        <ActivityIndicator size="large" />
+      </View>
+    );
+  }
+
+  return (
+    <NavigationContainer>
+      {!isAuthenticated ? <AuthNavigator /> : activeWorkspaceId ? <AppNavigator /> : <WorkspaceGateNavigator />}
+    </NavigationContainer>
+  );
+}

package/registry/mobile-apps/expo/variants/workspaces/src/navigation/types.ts

@@ -0,0 +1,20 @@
+export type AuthStackParamList = {
+  Login: undefined;
+  Signup: undefined;
+  TwoFactor: undefined;
+};
+
+/**
+ * Shown when the user is authenticated but no workspace is active — either they have none yet,
+ * or the persisted one is no longer theirs. Its own stack rather than a screen in the app stack
+ * so there is nothing behind it to back out into.
+ */
+export type WorkspaceGateStackParamList = {
+  ChooseWorkspace: undefined;
+};
+
+export type AppStackParamList = {
+  Home: undefined;
+  Sessions: undefined;
+  SwitchWorkspace: undefined;
+};

package/registry/mobile-apps/expo/variants/workspaces/src/screens/HomeScreen.tsx

@@ -0,0 +1,94 @@
+import React, { useCallback, useState } from "react";
+import { ActivityIndicator, Pressable, RefreshControl, ScrollView, Text, View } from "react-native";
+import type { NativeStackScreenProps } from "@react-navigation/native-stack";
+import type { AppStackParamList } from "../navigation/types";
+import { useAuthStore } from "../store/authStore";
+import { useActiveWorkspace } from "../store/workspaceStore";
+
+type Props = NativeStackScreenProps<AppStackParamList, "Home">;
+
+export function HomeScreen({ navigation }: Props) {
+  const currentUser = useAuthStore((state) => state.currentUser);
+  const activeWorkspace = useActiveWorkspace();
+  const refreshCurrentUser = useAuthStore((state) => state.refreshCurrentUser);
+  const logout = useAuthStore((state) => state.logout);
+  const isSubmitting = useAuthStore((state) => state.isSubmitting);
+  const [refreshing, setRefreshing] = useState(false);
+
+  const onRefresh = useCallback(async () => {
+    setRefreshing(true);
+    try {
+      await refreshCurrentUser();
+    } catch {
+      // Swallow — the store already recorded the error; this is a background refresh.
+    } finally {
+      setRefreshing(false);
+    }
+  }, [refreshCurrentUser]);
+
+  return (
+    <ScrollView
+      contentContainerClassName="grow p-6 bg-white"
+      refreshControl={<RefreshControl refreshing={refreshing} onRefresh={onRefresh} />}
+    >
+      <Text className="text-[28px] font-bold mb-4">Profile</Text>
+
+      <View className="border border-blue-600 bg-blue-50 rounded-xl p-4 mb-6">
+        <Text className="text-xs font-semibold text-blue-600 uppercase mb-0.5">Active workspace</Text>
+        <Text className="text-[17px] font-semibold text-[#111]">{activeWorkspace?.name ?? "—"}</Text>
+        <Text className="text-xs text-[#666] mt-1">{activeWorkspace?.id ?? ""}</Text>
+        <Pressable className="mt-3" onPress={() => navigation.navigate("SwitchWorkspace")}>
+          <Text className="text-blue-600 text-sm font-semibold">Switch workspace</Text>
+        </Pressable>
+      </View>
+
+      {currentUser ? (
+        <View className="border border-[#eee] rounded-xl p-4 mb-6 gap-3">
+          <Field label="User ID" value={currentUser.sub} />
+          <Field label="Session ID" value={currentUser.sessionId} />
+          {/*
+            `me()` carries the active workspace, so these two are the caller's roles and
+            permissions *inside it* — not deployment-wide. Being admin here says nothing about
+            any other workspace, which is the property the backend enforces.
+          */}
+          <Field
+            label={`Roles in ${activeWorkspace?.name ?? "this workspace"}`}
+            value={currentUser.roles.length ? currentUser.roles.join(", ") : "—"}
+          />
+          <Field
+            label="Permissions here"
+            value={currentUser.permissions.length ? currentUser.permissions.join(", ") : "—"}
+          />
+          <Field label="Two-factor" value={currentUser.twoFactorEnabled ? "Enabled" : "Disabled"} />
+        </View>
+      ) : (
+        <Text className="text-sm text-[#666]">No profile data.</Text>
+      )}
+
+      <Pressable className="border border-blue-600 rounded-lg py-3.5 items-center mb-3" onPress={() => navigation.navigate("Sessions")}>
+        <Text className="text-blue-600 text-base font-semibold">View sessions</Text>
+      </Pressable>
+
+      <Pressable
+        className={`bg-red-600 rounded-lg py-3.5 items-center mt-auto ${isSubmitting ? "opacity-50" : ""}`}
+        onPress={() => logout()}
+        disabled={isSubmitting}
+      >
+        {isSubmitting ? (
+          <ActivityIndicator className="text-white" />
+        ) : (
+          <Text className="text-white text-base font-semibold">Log out</Text>
+        )}
+      </Pressable>
+    </ScrollView>
+  );
+}
+
+function Field({ label, value }: { label: string; value: string }) {
+  return (
+    <View className="mb-3">
+      <Text className="text-xs font-semibold text-[#888] uppercase mb-0.5">{label}</Text>
+      <Text className="text-[15px] text-[#111]">{value}</Text>
+    </View>
+  );
+}

package/registry/mobile-apps/expo/variants/workspaces/src/screens/WorkspaceSelectScreen.tsx

@@ -0,0 +1,175 @@
+import React, { useCallback, useEffect, useState } from "react";
+import { ActivityIndicator, FlatList, Pressable, RefreshControl, Text, TextInput, View } from "react-native";
+import { useNavigation } from "@react-navigation/native";
+import type { WorkspaceSummary } from "@simple-auth-kit/auth-client";
+import { useActiveWorkspaceId } from "../workspace/activeWorkspace";
+import { useAuthStore } from "../store/authStore";
+import { useWorkspaceStore } from "../store/workspaceStore";
+
+/**
+ * `"gate"` is the post-login stop when no workspace is active — it cannot be dismissed, and
+ * offers logging out as the only way past without choosing. `"switch"` is the same screen
+ * pushed from Home to change workspaces, and pops back once one is chosen.
+ */
+export type WorkspaceSelectMode = "gate" | "switch";
+
+export function WorkspaceSelectScreen({ mode }: { mode: WorkspaceSelectMode }) {
+  const navigation = useNavigation();
+  const workspaces = useWorkspaceStore((state) => state.workspaces);
+  const isLoading = useWorkspaceStore((state) => state.isLoading);
+  const isSubmitting = useWorkspaceStore((state) => state.isSubmitting);
+  const error = useWorkspaceStore((state) => state.error);
+  const clearError = useWorkspaceStore((state) => state.clearError);
+  const load = useWorkspaceStore((state) => state.load);
+  const select = useWorkspaceStore((state) => state.select);
+  const create = useWorkspaceStore((state) => state.create);
+  const activeWorkspaceId = useActiveWorkspaceId();
+  const refreshCurrentUser = useAuthStore((state) => state.refreshCurrentUser);
+  const logout = useAuthStore((state) => state.logout);
+
+  const [name, setName] = useState("");
+  const [refreshing, setRefreshing] = useState(false);
+  const [isActivating, setIsActivating] = useState(false);
+
+  useEffect(() => {
+    // The list is normally already loaded by the auth flow; refresh it anyway so a workspace
+    // added on another device shows up without a relaunch.
+    load().catch(() => {
+      // Surfaced through the store's `error`, rendered below.
+    });
+  }, [load]);
+
+  const onRefresh = useCallback(async () => {
+    setRefreshing(true);
+    try {
+      await load();
+    } catch {
+      // Same as above.
+    } finally {
+      setRefreshing(false);
+    }
+  }, [load]);
+
+  /**
+   * The workspace switch and the identity refresh are one user-visible step: `me()` answers
+   * with the roles and permissions of *the workspace named on the request*, so re-fetching it
+   * is what makes the app's idea of "what I may do here" match the server's.
+   */
+  const activate = useCallback(
+    async (activation: () => Promise<unknown>) => {
+      setIsActivating(true);
+      try {
+        await activation();
+        await refreshCurrentUser();
+        if (mode === "switch") navigation.goBack();
+      } catch {
+        // Store-level error already recorded and rendered.
+      } finally {
+        setIsActivating(false);
+      }
+    },
+    [mode, navigation, refreshCurrentUser],
+  );
+
+  const trimmedName = name.trim();
+  const canCreate = trimmedName.length > 0 && !isSubmitting && !isActivating;
+  const busy = isSubmitting || isActivating;
+
+  if (isLoading && workspaces.length === 0) {
+    return (
+      <View className="flex-1 items-center justify-center bg-white">
+        <ActivityIndicator />
+      </View>
+    );
+  }
+
+  return (
+    <View className="flex-1 p-6 bg-white">
+      <Text className="text-[28px] font-bold mb-2">{mode === "gate" ? "Choose a workspace" : "Switch workspace"}</Text>
+      <Text className="text-[13px] text-[#666] mb-4">
+        Your roles are per workspace — a request acts in exactly one, named by the{" "}
+        <Text className="font-semibold">X-Workspace-Id</Text> header.
+      </Text>
+
+      {error ? <Text className="text-[#c0392b] mb-3">{error}</Text> : null}
+
+      <FlatList
+        data={workspaces}
+        keyExtractor={(item) => item.id}
+        refreshControl={<RefreshControl refreshing={refreshing} onRefresh={onRefresh} />}
+        ListEmptyComponent={
+          <Text className="text-sm text-[#666] mb-2">
+            You're not a member of any workspace yet. Create the first one below — you'll be its admin.
+          </Text>
+        }
+        renderItem={({ item }) => (
+          <WorkspaceRow
+            workspace={item}
+            isActive={item.id === activeWorkspaceId}
+            disabled={busy}
+            onPress={() => activate(() => select(item.id))}
+          />
+        )}
+      />
+
+      <View className="border-t border-[#eee] pt-4 mt-4">
+        <Text className="text-[13px] font-semibold text-[#444] mb-1.5">New workspace</Text>
+        <TextInput
+          className="border border-[#ccc] rounded-lg px-3 py-2.5 text-base"
+          value={name}
+          onChangeText={(text) => {
+            clearError();
+            setName(text);
+          }}
+          autoCapitalize="words"
+          autoCorrect={false}
+          placeholder="Acme"
+        />
+        <Pressable
+          className={`bg-blue-600 rounded-lg py-3.5 items-center mt-3 ${!canCreate ? "opacity-50" : ""}`}
+          onPress={() => {
+            const created = trimmedName;
+            setName("");
+            return activate(() => create(created));
+          }}
+          disabled={!canCreate}
+        >
+          {busy ? <ActivityIndicator className="text-white" /> : <Text className="text-white text-base font-semibold">Create workspace</Text>}
+        </Pressable>
+      </View>
+
+      {mode === "gate" ? (
+        <Pressable className="mt-4 items-center" onPress={() => logout()} disabled={busy}>
+          <Text className="text-[#c0392b] text-sm">Log out</Text>
+        </Pressable>
+      ) : null}
+    </View>
+  );
+}
+
+function WorkspaceRow({
+  workspace,
+  isActive,
+  disabled,
+  onPress,
+}: {
+  workspace: WorkspaceSummary;
+  isActive: boolean;
+  disabled: boolean;
+  onPress: () => void;
+}) {
+  return (
+    <Pressable
+      className={`border rounded-[10px] p-3 mb-2.5 ${isActive ? "border-blue-600 bg-blue-50" : "border-[#eee]"} ${disabled ? "opacity-50" : ""}`}
+      onPress={onPress}
+      disabled={disabled}
+    >
+      <View className="flex-row items-center justify-between">
+        <Text className="text-base font-semibold">{workspace.name}</Text>
+        {isActive ? <Text className="text-xs font-semibold text-blue-600">ACTIVE</Text> : null}
+      </View>
+      <Text className="text-xs text-[#666] mt-1">Your roles: {workspace.roles.length ? workspace.roles.join(", ") : "—"}</Text>
+      <Text className="text-xs text-[#888] mt-0.5">{workspace.id}</Text>
+    </Pressable>
+  );
+}

package/registry/mobile-apps/expo/variants/workspaces/src/store/authStore.ts

@@ -0,0 +1,179 @@
+import { create } from "zustand";
+import { AuthApiError, type CurrentUser } from "@simple-auth-kit/auth-client";
+import { authClient } from "../api/authClient";
+import { useWorkspaceStore } from "./workspaceStore";
+import { getActiveWorkspaceId, hydrateActiveWorkspace, setActiveWorkspaceId } from "../workspace/activeWorkspace";
+
+/**
+ * Everything that follows a successful authentication, in the order the workspaces variant
+ * requires it:
+ *
+ *  1. list the workspaces this user belongs to — `GET /workspaces` is not workspace-scoped, so
+ *     it is the one call that works before any workspace is chosen;
+ *  2. drop a persisted active workspace the user is no longer a member of. Without this,
+ *     `GET /auth/me` would carry a stale `X-Workspace-Id` and the backend would answer 403
+ *     (deliberately indistinguishable from "no such workspace"), which bootstrap would read as
+ *     a dead session and sign a perfectly good user out;
+ *  3. only then ask who we are — `me()` carries the active workspace, so its `roles` and
+ *     `permissions` are the ones that apply *inside* it.
+ *
+ * No workspace is auto-selected when several are available: choosing is the user's, and
+ * `RootNavigator` routes to the picker while none is active.
+ */
+async function loadIdentityForActiveWorkspace(): Promise<CurrentUser> {
+  const workspaces = await useWorkspaceStore.getState().load();
+  const activeWorkspaceId = getActiveWorkspaceId();
+  if (activeWorkspaceId && !workspaces.some((workspace) => workspace.id === activeWorkspaceId)) {
+    await setActiveWorkspaceId(null);
+  }
+  return authClient.me();
+}
+
+export interface LoginResult {
+  twoFactorRequired: boolean;
+}
+
+interface AuthState {
+  /** Populated from `me()` after any successful auth flow completes. */
+  currentUser: CurrentUser | null;
+  /** True while `bootstrap()` is checking for an already-stored session on app start. */
+  isBootstrapping: boolean;
+  /** True while a login/signup/2fa/logout request is in flight. */
+  isSubmitting: boolean;
+  /** Last error message from an auth action, if any — screens can render/clear this. */
+  error: string | null;
+  /** Set when `login()` returns a 2FA challenge instead of tokens. */
+  pendingChallengeToken: string | null;
+
+  /** Call once on app start: hydrate the persisted active workspace, then `currentUser` from `me()` if tokens are stored. */
+  bootstrap: () => Promise<void>;
+  /** Re-fetch `me()` for an already-authenticated user (e.g. pull-to-refresh on Home). */
+  refreshCurrentUser: () => Promise<void>;
+  signup: (input: { email: string; password: string }) => Promise<void>;
+  login: (input: { identifier: string; password: string }) => Promise<LoginResult>;
+  loginTwoFactor: (code: string) => Promise<void>;
+  logout: () => Promise<void>;
+  logoutAll: () => Promise<void>;
+  clearError: () => void;
+}
+
+function messageFor(err: unknown): string {
+  if (err instanceof AuthApiError) return err.message;
+  if (err instanceof Error) return err.message;
+  return "Something went wrong. Please try again.";
+}
+
+export const useAuthStore = create<AuthState>((set, get) => ({
+  currentUser: null,
+  isBootstrapping: true,
+  isSubmitting: false,
+  error: null,
+  pendingChallengeToken: null,
+
+  bootstrap: async () => {
+    set({ isBootstrapping: true });
+    try {
+      // Before any scoped request, so the first `me()` already names the right workspace.
+      await hydrateActiveWorkspace();
+      const hasTokens = await authClient.isAuthenticated();
+      if (!hasTokens) {
+        await useWorkspaceStore.getState().reset();
+        set({ currentUser: null, isBootstrapping: false });
+        return;
+      }
+      const currentUser = await loadIdentityForActiveWorkspace();
+      set({ currentUser, isBootstrapping: false });
+    } catch {
+      // Stored tokens were invalid/expired and unrefreshable — fall back to logged-out.
+      set({ currentUser: null, isBootstrapping: false });
+    }
+  },
+
+  refreshCurrentUser: async () => {
+    try {
+      const currentUser = await authClient.me();
+      set({ currentUser });
+    } catch (err) {
+      set({ error: messageFor(err) });
+      throw err;
+    }
+  },
+
+  signup: async (input) => {
+    set({ isSubmitting: true, error: null });
+    try {
+      await authClient.signup(input);
+      // A brand-new user belongs to no workspace yet — the picker offers creating the first one.
+      const currentUser = await loadIdentityForActiveWorkspace();
+      set({ currentUser, isSubmitting: false });
+    } catch (err) {
+      set({ isSubmitting: false, error: messageFor(err) });
+      throw err;
+    }
+  },
+
+  login: async (input) => {
+    set({ isSubmitting: true, error: null });
+    try {
+      const result = await authClient.login(input);
+      if ("twoFactorRequired" in result && result.twoFactorRequired) {
+        set({ isSubmitting: false, pendingChallengeToken: result.challengeToken });
+        return { twoFactorRequired: true };
+      }
+      const currentUser = await loadIdentityForActiveWorkspace();
+      set({ currentUser, isSubmitting: false, pendingChallengeToken: null });
+      return { twoFactorRequired: false };
+    } catch (err) {
+      set({ isSubmitting: false, error: messageFor(err) });
+      throw err;
+    }
+  },
+
+  loginTwoFactor: async (code) => {
+    const challengeToken = get().pendingChallengeToken;
+    if (!challengeToken) {
+      const err = new Error("No pending 2FA challenge — start over from login.");
+      set({ error: err.message });
+      throw err;
+    }
+    set({ isSubmitting: true, error: null });
+    try {
+      await authClient.loginTwoFactor({ challengeToken, code });
+      const currentUser = await loadIdentityForActiveWorkspace();
+      set({ currentUser, isSubmitting: false, pendingChallengeToken: null });
+    } catch (err) {
+      set({ isSubmitting: false, error: messageFor(err) });
+      throw err;
+    }
+  },
+
+  logout: async () => {
+    set({ isSubmitting: true, error: null });
+    try {
+      await authClient.logout();
+    } catch {
+      // Even if the network call fails, storage is cleared by the client — proceed
+      // to a logged-out UI state rather than trapping the user.
+    } finally {
+      await useWorkspaceStore.getState().reset();
+      set({ currentUser: null, isSubmitting: false, pendingChallengeToken: null });
+    }
+  },
+
+  logoutAll: async () => {
+    set({ isSubmitting: true, error: null });
+    try {
+      await authClient.logoutAll();
+    } catch {
+      // Same rationale as logout() above.
+    } finally {
+      await useWorkspaceStore.getState().reset();
+      set({ currentUser: null, isSubmitting: false, pendingChallengeToken: null });
+    }
+  },
+
+  clearError: () => set({ error: null }),
+}));
+
+/** Derived selector — prefer this over reading `currentUser` directly for gating navigation. */
+export const useIsAuthenticated = (): boolean => useAuthStore((state) => state.currentUser !== null);