@woodsportal/hubspot-kit 1.0.42-dev.0 → 1.0.42-dev.2

package/dist/{exec-VY6BGWF3.js → exec-NS4GKXZS.js}

@@ -5,7 +5,7 @@ import {
   runNodeScript,
   runNodeScriptAsync,
   runNodeScriptLongRunning
-} from "./chunk-4GOJPOW3.js";
+} from "./chunk-GXYUGXF5.js";
 export {
   runCommand,
   runCommandAsync,
@@ -13,4 +13,4 @@ export {
   runNodeScriptAsync,
   runNodeScriptLongRunning
 };
-//# sourceMappingURL=exec-VY6BGWF3.js.map
+//# sourceMappingURL=exec-NS4GKXZS.js.map

package/dist/{scaffold-page-lifecycle-EHMPWPPE.js → scaffold-page-lifecycle-53AWWGFR.js}

@@ -8,11 +8,11 @@ import {
   resolveProjectNavConfig,
   slugToCamelCase,
   slugToPascalCase
-} from "./chunk-WHYTQEZX.js";
+} from "./chunk-4UFWXPQG.js";
 import {
   ExitCode,
   WpHsError
-} from "./chunk-4GOJPOW3.js";
+} from "./chunk-GXYUGXF5.js";
 
 // src/lib/scaffold-page-lifecycle.ts
 import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
@@ -191,4 +191,4 @@ export {
   listScaffoldedPages,
   removeScaffoldedPage
 };
-//# sourceMappingURL=scaffold-page-lifecycle-EHMPWPPE.js.map
+//# sourceMappingURL=scaffold-page-lifecycle-53AWWGFR.js.map

package/examples/greenfield/module-hybrid-cdn/README.md

@@ -5,7 +5,8 @@ This project was scaffolded with **WoodsCLI** (`@woodsportal/hubspot-kit`).
 ## Daily dev
 
 ```bash
-yarn install
+npm install
+wp setup
 wp doctor
 wp dev
 ```

package/examples/greenfield/module-hybrid-cdn-auth-full/README.md

@@ -5,7 +5,8 @@ This project was scaffolded with **WoodsCLI** (`@woodsportal/hubspot-kit`).
 ## Daily dev
 
 ```bash
-yarn install
+npm install
+wp setup
 wp doctor
 wp dev
 ```

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/components/starter-login.tsx

@@ -6,7 +6,7 @@ import { Form, FormField } from '@/components/ui/Form'
 import { Input } from '@/components/ui/Input'
 import { SsoLoginButton } from '@/components/ui/auth/SsoLoginButton'
 import { api } from '@/integrations/woodsportal-sdk'
-import { handleAuthLoginResponse, MFA_REQUIRED_SCAFFOLD_MESSAGE } from '@/features/auth/login-session-bridge'
+import { handleAuthLoginResponse } from '@/features/auth/login-session-bridge'
 import { resolveAuthLoginErrorMessage } from '@/features/auth/resolve-auth-login-error-message'
 import {
   getStoredLoginEmail,
@@ -28,11 +28,7 @@ export function StarterLogin() {
       const response = await login({ username: email.trim(), password })
       const result = await handleAuthLoginResponse(response, router)
       if (!result.success) {
-        if (result.reason === 'mfa_required') {
-          toast.error(MFA_REQUIRED_SCAFFOLD_MESSAGE)
-        } else {
-          toast.error('Login failed — no access token returned.')
-        }
+        toast.error('Login failed — no access token returned.')
         return
       }
       if (!result.mfaRequired) {

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/sso-callback.ts

@@ -1,6 +1,7 @@
 import { Routes } from '@/config/routes'
 import { readHashPathname } from '@/features/auth/auth-route-paths'
 import { normalizeRouterPath } from '@/utils/normalize-router-path'
+import { WP_STORAGE_KEYS } from 'woodsportal-client-sdk'
 
 export type SsoCallbackParams = {
   code: string
@@ -60,6 +61,11 @@ export function clearPreHashQueryParams(): void {
   window.history.replaceState(null, '', `${window.location.pathname}${window.location.hash}`)
 }
 
+/** Legacy sessionStorage inflight — clear on boot so stale keys never block exchange. */
+export function clearLegacySsoCallbackInFlight(): void {
+  sessionStorage.removeItem(`${WP_STORAGE_KEYS.c.sso.cb}:inflight`)
+}
+
 export function isSsoCallbackAlreadyProcessed(key: string): boolean {
   return processedKeys.has(key)
 }

package/examples/greenfield/module-hybrid-cdn-auth-sso/README.md

@@ -5,7 +5,8 @@ This project was scaffolded with **WoodsCLI** (`@woodsportal/hubspot-kit`).
 ## Daily dev
 
 ```bash
-yarn install
+npm install
+wp setup
 wp doctor
 wp dev
 ```

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/sso-callback.ts

@@ -1,6 +1,7 @@
 import { Routes } from '@/config/routes'
 import { readHashPathname } from '@/features/auth/auth-route-paths'
 import { normalizeRouterPath } from '@/utils/normalize-router-path'
+import { WP_STORAGE_KEYS } from 'woodsportal-client-sdk'
 
 export type SsoCallbackParams = {
   code: string
@@ -60,6 +61,11 @@ export function clearPreHashQueryParams(): void {
   window.history.replaceState(null, '', `${window.location.pathname}${window.location.hash}`)
 }
 
+/** Legacy sessionStorage inflight — clear on boot so stale keys never block exchange. */
+export function clearLegacySsoCallbackInFlight(): void {
+  sessionStorage.removeItem(`${WP_STORAGE_KEYS.c.sso.cb}:inflight`)
+}
+
 export function isSsoCallbackAlreadyProcessed(key: string): boolean {
   return processedKeys.has(key)
 }

package/examples/greenfield/module-hybrid-cdn-auth-starter/README.md

@@ -5,7 +5,8 @@ This project was scaffolded with **WoodsCLI** (`@woodsportal/hubspot-kit`).
 ## Daily dev
 
 ```bash
-yarn install
+npm install
+wp setup
 wp doctor
 wp dev
 ```

package/examples/greenfield/module-hybrid-cdn-auth-starter-sidebar/README.md

@@ -5,7 +5,8 @@ This project was scaffolded with **WoodsCLI** (`@woodsportal/hubspot-kit`).
 ## Daily dev
 
 ```bash
-yarn install
+npm install
+wp setup
 wp doctor
 wp dev
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@woodsportal/hubspot-kit",
-  "version": "1.0.42-dev.0",
+  "version": "1.0.42-dev.2",
   "description": "WoodsCLI — HubSpot CMS dev kit by WoodsPortal. wp CLI, Vite presets, module-config overlay, and theme/module build pipelines.",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,8 +53,9 @@
     "typecheck": "tsc --noEmit",
     "test": "node --import tsx --test 'src/lib/**/*.test.ts' 'src/cli/**/*.test.ts' 'src/schema/**/*.test.ts' 'src/vite/**/*.test.ts' 'scripts/portal-build-id.test.mjs' 'scripts/resolve-consumer-dep.test.mjs' 'scripts/wp-cli-smoke.test.mjs' 'scripts/vite/ensure-dev-kit-shims.test.mjs' 'scripts/vite/consumer-react-aliases.test.mjs' 'scripts/vite/resolve-from-project-root.test.mjs' && vitest run src/dev-module-config/__tests__/normalize-repeater-items.test.ts src/dev-module-config/__tests__/module-config-transform.test.ts src/dev-module-config/__tests__/flatten-visible-fields.test.ts",
     "test:examples": "node examples/smoke/run-matrix.mjs --tier static",
+    "test:dist-pack": "node --test scripts/dist-cli-pack-smoke.test.mjs",
     "lint": "eslint src",
-    "verify": "npm run typecheck && npm run test && npm run test:examples && npm run build",
+    "verify": "npm run typecheck && npm run test && npm run test:examples && npm run build && npm run test:dist-pack",
     "prepublishOnly": "npm run verify"
   },
   "engines": {

package/scripts/build-cdn.mjs

@@ -2,9 +2,9 @@
 /**
  * Build CDN vendor + app IIFE chunks into dist/cdn/
  */
-import { spawnSync } from 'node:child_process'
-import { resolve, dirname } from 'node:path'
+import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+
 import { findProjectRoot } from './project-root.mjs'
 
 import { envWithPortalBuildId } from './resolve-portal-build-id.mjs'
@@ -17,6 +17,7 @@ import {
   portalSubprocessStdio,
   portalViteLogArgs,
 } from './portal-subprocess-stdio.mjs'
+import { spawnViteSync } from './resolve-vite-spawn.mjs'
 
 const root = findProjectRoot()
 
@@ -31,9 +32,9 @@ const env = envForPortalBuild(mode, root, {
 })
 
 function runWithEnv(config, buildMode) {
-  const result = spawnSync(
-    'yarn',
-    ['vite', 'build', '--config', config, '--mode', buildMode, ...portalViteLogArgs()],
+  const result = spawnViteSync(
+    root,
+    ['build', '--config', config, '--mode', buildMode, ...portalViteLogArgs()],
     { cwd: root, stdio: portalSubprocessStdio(), env, encoding: 'utf8' },
   )
   exitOnSpawnFailure(result)

package/scripts/dist-cli-pack-smoke.test.mjs

@@ -0,0 +1,79 @@
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { test } from 'node:test'
+
+import { copyFixture, kitRoot } from './cli-smoke-helpers.mjs'
+
+const distCli = join(kitRoot, 'dist/cli.js')
+
+test('dist cli: doctor scaffolds .wphs without SyntaxError', () => {
+  if (!existsSync(distCli)) {
+    console.log('skip: dist/cli.js missing — run npm run build first')
+    return
+  }
+
+  const dir = mkdtempSync(join(tmpdir(), 'wphs-dist-pack-'))
+  try {
+    copyFixture('greenfield/module-hybrid-cdn', dir)
+    const result = spawnSync(
+      process.execPath,
+      [distCli, '--project', dir, '--ci', '-y', 'doctor'],
+      {
+        cwd: kitRoot,
+        encoding: 'utf8',
+        env: { ...process.env, NO_COLOR: '1', WP_SKIP_VERSION_CHECK: '1' },
+      },
+    )
+
+    const combined = `${result.stdout}\n${result.stderr}`
+    assert.doesNotMatch(combined, /Invalid or unexpected token/)
+    assert.ok(
+      result.status === 0 || result.status === 2,
+      `unexpected exit ${result.status}: ${combined}`,
+    )
+    assert.ok(existsSync(resolve(dir, '.wphs', 'config')), 'expected .wphs/config after doctor')
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('dist cli: init dry-run completes without SyntaxError', () => {
+  if (!existsSync(distCli)) {
+    console.log('skip: dist/cli.js missing — run npm run build first')
+    return
+  }
+
+  const targetDir = mkdtempSync(join(tmpdir(), 'wphs-dist-init-'))
+  try {
+    const result = spawnSync(
+      process.execPath,
+      [
+        distCli,
+        '--ci',
+        '-y',
+        '--dry-run',
+        'init',
+        '-t',
+        'module-hybrid-cdn',
+        '-n',
+        'dist-init-smoke',
+        '--directory',
+        targetDir,
+      ],
+      {
+        cwd: kitRoot,
+        encoding: 'utf8',
+        env: { ...process.env, NO_COLOR: '1', WP_SKIP_VERSION_CHECK: '1' },
+      },
+    )
+
+    const combined = `${result.stdout}\n${result.stderr}`
+    assert.doesNotMatch(combined, /Invalid or unexpected token/)
+    assert.equal(result.status, 0, combined)
+  } finally {
+    rmSync(targetDir, { recursive: true, force: true })
+  }
+})

package/scripts/ensure-wphs-workspace.mjs

@@ -1,8 +1,9 @@
-#!/usr/bin/env node
 /**
  * Scaffold WoodsCLI `.wphs/` workspace + kit symlinks.
  */
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 import { findProjectRoot, getKitRoot } from './project-root.mjs'
 import { wphsPaths, wphsWorkspaceSubdirs } from './wphs-paths.mjs'
@@ -48,7 +49,11 @@ export function ensureWphsWorkspace(projectRoot, kitRoot) {
   return paths
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+const invokedDirectly =
+  process.argv[1] &&
+  resolve(fileURLToPath(import.meta.url)) === resolve(process.argv[1])
+
+if (invokedDirectly) {
   const paths = ensureWphsWorkspace()
   console.log(`[wphs] workspace ready at ${paths.workspaceRoot}`)
 }

package/scripts/resolve-hubspot-cli.mjs

@@ -0,0 +1,51 @@
+import { existsSync } from 'node:fs'
+import { platform } from 'node:os'
+import { resolve } from 'node:path'
+
+/**
+ * @param {string} [projectRoot]
+ * @returns {{ command: string, prefixArgs: string[], shell?: boolean }}
+ */
+export function resolveHubSpotCliSpawn(projectRoot) {
+  const roots = []
+  if (projectRoot) roots.push(projectRoot)
+  if (!roots.includes(process.cwd())) roots.push(process.cwd())
+
+  for (const root of roots) {
+    const binDir = resolve(root, 'node_modules', '.bin')
+    if (platform() === 'win32') {
+      const cmd = resolve(binDir, 'hs.cmd')
+      if (existsSync(cmd)) return { command: cmd, prefixArgs: [], shell: false }
+    }
+    const shim = resolve(binDir, 'hs')
+    if (existsSync(shim)) return { command: shim, prefixArgs: [], shell: false }
+  }
+
+  if (platform() === 'win32') {
+    return { command: 'hs', prefixArgs: [], shell: true }
+  }
+  return { command: 'hs', prefixArgs: [], shell: false }
+}
+
+/**
+ * @param {string} projectRoot
+ * @param {string | undefined} kitCliPath
+ */
+export function resolveWpBinSpawn(projectRoot, kitCliPath) {
+  if (kitCliPath && existsSync(kitCliPath)) {
+    return { command: process.execPath, prefixArgs: [kitCliPath], shell: false }
+  }
+
+  const binDir = resolve(projectRoot, 'node_modules', '.bin')
+  if (platform() === 'win32') {
+    const cmd = resolve(binDir, 'wp.cmd')
+    if (existsSync(cmd)) return { command: cmd, prefixArgs: [], shell: false }
+  }
+  const shim = resolve(binDir, 'wp')
+  if (existsSync(shim)) return { command: shim, prefixArgs: [], shell: false }
+
+  if (platform() === 'win32') {
+    return { command: 'wp', prefixArgs: [], shell: true }
+  }
+  return { command: 'wp', prefixArgs: [], shell: false }
+}

package/scripts/resolve-vite-config.mjs

@@ -2,7 +2,7 @@
  * Resolve a Vite config path: prefer project root, fall back to kit vite presets.
  */
 import { existsSync } from 'node:fs'
-import { basename, resolve } from 'node:path'
+import { basename, resolve, isAbsolute } from 'node:path'
 
 import { findProjectRoot, getKitRoot } from './project-root.mjs'
 
@@ -11,8 +11,7 @@ import { findProjectRoot, getKitRoot } from './project-root.mjs'
  * @param {string} [projectRoot]
  */
 export function resolveViteConfig(configArg, projectRoot = findProjectRoot()) {
-  const isAbsolute = configArg.startsWith('/')
-  const localPath = isAbsolute ? configArg : resolve(projectRoot, configArg)
+  const localPath = isAbsolute(configArg) ? configArg : resolve(projectRoot, configArg)
   if (existsSync(localPath)) {
     return localPath
   }

package/scripts/resolve-vite-spawn.mjs

@@ -0,0 +1,48 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { platform } from 'node:os'
+import { resolve } from 'node:path'
+
+const VITE_JS_SEGMENTS = ['node_modules', 'vite', 'bin', 'vite.js']
+
+/**
+ * @param {string} projectRoot
+ * @returns {{ command: string, prefixArgs: string[], shell?: boolean } | null}
+ */
+export function resolveViteSpawn(projectRoot) {
+  const viteJs = resolve(projectRoot, ...VITE_JS_SEGMENTS)
+  if (existsSync(viteJs)) {
+    return { command: process.execPath, prefixArgs: [viteJs], shell: false }
+  }
+
+  const binDir = resolve(projectRoot, 'node_modules', '.bin')
+  if (platform() === 'win32') {
+    const winCmd = resolve(binDir, 'vite.cmd')
+    if (existsSync(winCmd)) {
+      return { command: winCmd, prefixArgs: [], shell: false }
+    }
+  }
+
+  const posixShim = resolve(binDir, 'vite')
+  if (existsSync(posixShim)) {
+    return { command: posixShim, prefixArgs: [], shell: false }
+  }
+
+  return null
+}
+
+/**
+ * @param {string} projectRoot
+ * @param {string[]} viteArgs
+ * @param {import('node:child_process').SpawnSyncOptions} options
+ */
+export function spawnViteSync(projectRoot, viteArgs, options) {
+  const spawn = resolveViteSpawn(projectRoot)
+  if (!spawn) {
+    throw new Error('vite not installed — run npm install or yarn install in the project root')
+  }
+  return spawnSync(spawn.command, [...spawn.prefixArgs, ...viteArgs], {
+    ...options,
+    shell: spawn.shell ?? false,
+  })
+}

package/scripts/run-vite-build.mjs

@@ -4,8 +4,6 @@
  *
  * Usage: node scripts/run-vite-build.mjs <vite-config.mjs> [--local | --dev | --stg | --prod]
  */
-import { spawnSync } from 'node:child_process'
-
 import { defaultDatadogFlag, envForPortalBuild } from './portal-vite-env.mjs'
 import { resolvePortalViteMode } from './portal-env-mode.mjs'
 import { findProjectRoot } from './project-root.mjs'
@@ -15,6 +13,7 @@ import {
   portalSubprocessStdio,
   portalViteLogArgs,
 } from './portal-subprocess-stdio.mjs'
+import { spawnViteSync } from './resolve-vite-spawn.mjs'
 
 const root = findProjectRoot()
 const configArg = process.argv[2]
@@ -32,10 +31,10 @@ const env = envForPortalBuild(mode, root, {
   WP_HS_PROJECT_ROOT: root,
 })
 
-const result = spawnSync(
-  'npx',
-  ['vite', 'build', '--config', config, '--mode', mode, ...portalViteLogArgs()],
-  { cwd: root, stdio: portalSubprocessStdio(), env, shell: true, encoding: 'utf8' },
+const result = spawnViteSync(
+  root,
+  ['build', '--config', config, '--mode', mode, ...portalViteLogArgs()],
+  { cwd: root, stdio: portalSubprocessStdio(), env, encoding: 'utf8' },
 )
 
 exitOnSpawnFailure(result)

package/scripts/watch-hubspot.mjs

@@ -8,6 +8,7 @@ import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { moduleOutDir, moduleUploadPath, readWoodsportalConfig, themeUploadPath } from './read-woodsportal-config.mjs'
+import { resolveHubSpotCliSpawn, resolveWpBinSpawn } from './resolve-hubspot-cli.mjs'
 
 const kitScriptsDir = dirname(fileURLToPath(import.meta.url))
 const kitRoot = resolve(kitScriptsDir, '..')
@@ -87,23 +88,15 @@ process.on('SIGTERM', () => shutdown('SIGTERM'))
 function runWpBuild() {
   const env = { ...process.env, WP_HS_PROJECT_ROOT: root }
 
-  let command = process.execPath
-  let args = []
-
-  if (existsSync(kitCli)) {
-    args = [kitCli, 'build', '--tier', tier, '--quiet']
-  } else {
-    const localWp = resolve(root, 'node_modules', '.bin', 'wp')
-    command = existsSync(localWp) ? localWp : 'wp'
-    args = ['build', '--tier', tier, '--quiet']
-  }
+  const wpSpawn = resolveWpBinSpawn(root, existsSync(kitCli) ? kitCli : undefined)
+  const args = [...wpSpawn.prefixArgs, 'build', '--tier', tier, '--quiet']
 
   log(`Running wp build --tier ${tier} …`)
-  const result = spawnSync(command, args, {
+  const result = spawnSync(wpSpawn.command, args, {
     cwd: root,
     stdio: 'inherit',
     env,
-    shell: command === 'wp',
+    shell: wpSpawn.shell ?? false,
   })
   if (result.status !== 0) {
     process.exit(result.status ?? 1)
@@ -122,7 +115,12 @@ function startCmsWatch() {
   const src = isTheme ? theme.srcDir : hubspotModulePath
   const target = isTheme ? theme.uploadPath : hubspotUploadTarget
   log(`Starting hs cms watch ${src} → ${target}`)
-  cmsChild = spawn('hs', ['cms', 'watch', src, target], { cwd: root, stdio: 'inherit' })
+  const hsSpawn = resolveHubSpotCliSpawn(root)
+  cmsChild = spawn(hsSpawn.command, [...hsSpawn.prefixArgs, 'cms', 'watch', src, target], {
+    cwd: root,
+    stdio: 'inherit',
+    shell: hsSpawn.shell ?? false,
+  })
   cmsChild.on('exit', (code) => {
     if (shuttingDown) return
     process.exit(code ?? 0)

package/templates/module-hybrid-cdn/README.md

@@ -5,7 +5,8 @@ This project was scaffolded with **WoodsCLI** (`@woodsportal/hubspot-kit`).
 ## Daily dev
 
 ```bash
-yarn install
+npm install
+wp setup
 wp doctor
 wp dev
 ```

package/templates/module-monolith/README.md

@@ -5,7 +5,8 @@ This project was scaffolded with **WoodsCLI** (`@woodsportal/hubspot-kit`).
 ## Daily dev
 
 ```bash
-yarn install
+npm install
+wp setup
 wp doctor
 wp dev
 ```

package/templates/scaffold/auth/_full/src/features/auth/components/starter-login.tsx

@@ -0,0 +1,79 @@
+import { useState } from 'react'
+import { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/Button'
+import { Form, FormField } from '@/components/ui/Form'
+import { Input } from '@/components/ui/Input'
+import { SsoLoginButton } from '@/components/ui/auth/SsoLoginButton'
+import { api } from '@/integrations/woodsportal-sdk'
+import { handleAuthLoginResponse } from '@/features/auth/login-session-bridge'
+import { resolveAuthLoginErrorMessage } from '@/features/auth/resolve-auth-login-error-message'
+import {
+  getStoredLoginEmail,
+  setStoredLoginEmail,
+} from '@/features/auth/login-email-storage'
+
+export function StarterLogin() {
+  const router = useRouter()
+  const [email, setEmail] = useState(getStoredLoginEmail() ?? '')
+  const [password, setPassword] = useState('')
+  const [isSubmitting, setIsSubmitting] = useState(false)
+
+  const onSubmit = async (event: React.FormEvent) => {
+    event.preventDefault()
+    setIsSubmitting(true)
+    try {
+      setStoredLoginEmail(email)
+      const { login } = api.auth.login({})
+      const response = await login({ username: email.trim(), password })
+      const result = await handleAuthLoginResponse(response, router)
+      if (!result.success) {
+        toast.error('Login failed — no access token returned.')
+        return
+      }
+      if (!result.mfaRequired) {
+        toast.success('Signed in')
+      }
+    } catch (error) {
+      toast.error(resolveAuthLoginErrorMessage(error))
+    } finally {
+      setIsSubmitting(false)
+    }
+  }
+
+  return (
+    <div className="w-full max-w-md rounded-lg border border-gray-200 bg-white p-6 shadow-sm">
+      <h1 className="mb-2 text-xl font-semibold text-gray-900">Sign in</h1>
+      <p className="mb-6 text-sm text-gray-600">Use your portal email and password or SSO.</p>
+      <Form onSubmit={onSubmit}>
+        <FormField label="Email">
+          <Input
+            type="email"
+            autoComplete="email"
+            required
+            value={email}
+            onChange={(e) => setEmail(e.target.value)}
+          />
+        </FormField>
+        <FormField label="Password">
+          <Input
+            type="password"
+            autoComplete="current-password"
+            required
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+          />
+        </FormField>
+        <Button type="submit" className="w-full" disabled={isSubmitting}>
+          {isSubmitting ? 'Signing in…' : 'Sign in'}
+        </Button>
+      </Form>
+      <div className="my-4 flex items-center gap-3 text-xs text-gray-500">
+        <span className="h-px flex-1 bg-gray-200" />
+        or
+        <span className="h-px flex-1 bg-gray-200" />
+      </div>
+      <SsoLoginButton />
+    </div>
+  )
+}

package/templates/scaffold/auth/_shared/src/app.tsx

@@ -2,7 +2,7 @@ import { useEffect, useRef, useState } from 'react'
 import { RouterProvider } from '@tanstack/react-router'
 import { installCrossTabSessionListener } from 'woodsportal-client-sdk'
 
-import { api } from '@/integrations/woodsportal-sdk'
+import { api, isSessionRefreshDeferredError } from '@/integrations/woodsportal-sdk'
 import * as TanStackQueryProvider from '@/integrations/tanstack-query/root-provider'
 import { env } from '@/env'
 import Loader from '@/components/ui/loader/loader'
@@ -123,7 +123,10 @@ export function App({ router }: AppProps) {
 
       try {
         await session.refreshSession({ force: true })
-      } catch {
+      } catch (error) {
+        if (isSessionRefreshDeferredError(error)) {
+          return
+        }
         if (!inCmsEditor) {
           await teardownAndRedirectToLogin()
         }
@@ -147,7 +150,9 @@ export function App({ router }: AppProps) {
           }),
         ])
       } catch (error) {
-        if (!inCmsEditor && skipCurrentPublicPath()) {
+        if (isSessionRefreshDeferredError(error)) {
+          // API temporarily unavailable — keep session cookies intact.
+        } else if (!inCmsEditor && skipCurrentPublicPath()) {
           await teardownAndRedirectToLogin()
         } else if (error instanceof Error && error.message !== 'bootstrap_timeout') {
           throw error