@the-portland-company/shell 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.8.0 — 2026-07-02
+
+### Added (backward-compatible)
+
+- **Host-driven auth for non-Supabase apps**: `ShellProviderProps.supabaseClient` is now optional, and a new optional `auth: ShellInjectedAuth` prop (`{ status, user, signOut }`, exported type) takes precedence over Supabase session tracking. This lets OIDC apps (e.g. the standalone Contacts app) mount the full Chakra chrome — `ShellProvider` → `ShellChrome` → `AppLayout` — with their own identity feeding `useShellAuth`/`UserMenu`. The host builds a Supabase-shaped `user.raw` (`id`/`email`/`user_metadata.full_name`) so chrome components render identically. With neither prop, auth resolves to `unauthenticated`. Existing `supabaseClient` consumers are unaffected.
+
+### Tests
+
+- Injected auth: precedence over Supabase (no `getSession`/`onAuthStateChange`/`auth.signOut` calls), client-less mounting, neither-prop fallback (3 tests).
+
 ## 0.7.0 — 2026-07-01
 
 ### Added (native chrome — all backward-compatible)

package/dist/index.cjs

@@ -1126,6 +1126,7 @@ function toShellUser(session) {
 function ShellProvider({
   children,
   supabaseClient,
+  auth,
   currentApp,
   appRegistry,
   basename,
@@ -1139,6 +1140,11 @@ function ShellProvider({
   const [status, setStatus] = react$1.useState("loading");
   const [session, setSession] = react$1.useState(null);
   react$1.useEffect(() => {
+    if (auth || !supabaseClient) {
+      setSession(null);
+      if (!auth) setStatus("unauthenticated");
+      return;
+    }
     let cancelled = false;
     supabaseClient.auth.getSession().then(({ data }) => {
       if (cancelled) return;
@@ -1153,18 +1159,27 @@ function ShellProvider({
       cancelled = true;
       sub.data.subscription.unsubscribe();
     };
-  }, [supabaseClient]);
-  const value = react$1.useMemo(
-    () => ({
+  }, [supabaseClient, auth]);
+  const value = react$1.useMemo(() => {
+    if (auth) {
+      return {
+        status: auth.status,
+        session: null,
+        user: auth.user,
+        signOut: async () => {
+          await auth.signOut();
+        }
+      };
+    }
+    return {
       status,
       session,
       user: toShellUser(session),
       signOut: async () => {
-        await supabaseClient.auth.signOut();
+        await supabaseClient?.auth.signOut();
       }
-    }),
-    [status, session, supabaseClient]
-  );
+    };
+  }, [auth, status, session, supabaseClient]);
   const meta = react$1.useMemo(
     () => ({
       currentApp,