@workos-inc/authkit-nextjs 2.4.5 → 2.5.0

package/dist/esm/auth.js

@@ -1,7 +1,7 @@
 'use server';
-import { revalidatePath, revalidateTag } from 'next/cache.js';
-import { cookies, headers } from 'next/headers.js';
-import { redirect } from 'next/navigation.js';
+import { revalidatePath, revalidateTag } from 'next/cache';
+import { cookies, headers } from 'next/headers';
+import { redirect } from 'next/navigation';
 import { WORKOS_COOKIE_NAME } from './env-variables.js';
 import { getCookieOptions } from './cookie.js';
 import { getAuthorizationUrl } from './get-authorization-url.js';

package/dist/esm/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,cAAc,EACd,SAAS,EACT,WAAW,MAC8D,EAAE;IAC3E,OAAO,mBAAmB,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,cAAc,EACd,SAAS,EACT,WAAW,MAC8D,EAAE;IAC3E,OAAO,mBAAmB,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAE,QAAQ,KAA4B,EAAE;IACpE,IAAI,SAA6B,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5C,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,kBAAkB,IAAI,aAAa,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;QAC9D,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzE,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,cAAsB,EACtB,UAAuC,EAAE;;IAEzC,MAAM,EAAE,QAAQ,EAAE,oBAAoB,GAAG,MAAM,EAAE,gBAAgB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,IAAI,MAAgB,CAAC;IACrB,uBAAuB;IACvB,MAAM,QAAQ,GAAG,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC;IACA,8DAA8D;IAC9D,KAAU,EACV,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACxB,0BAA0B;QAC1B,IAAI,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,0CAAE,oBAAoB,EAAE,CAAC;YACzC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,MAAK,cAAc,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,MAAK,gBAAgB,EAAE,CAAC;gBACzE,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,QAAQ,oBAAoB,EAAE,CAAC;QAC7B,KAAK,MAAM;YACT,cAAc,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM;QACR,KAAK,KAAK;YACR,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;gBACnC,aAAa,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YACD,MAAM;IACV,CAAC;IACD,IAAI,oBAAoB,KAAK,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,cAAc,EACd,SAAS,EACT,WAAW,MAC8D,EAAE;IAC3E,OAAO,mBAAmB,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,cAAc,EACd,SAAS,EACT,WAAW,MAC8D,EAAE;IAC3E,OAAO,mBAAmB,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAE,QAAQ,KAA4B,EAAE;IACpE,IAAI,SAA6B,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC5C,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,kBAAkB,IAAI,aAAa,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;QAC9D,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzE,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,cAAsB,EACtB,UAAuC,EAAE;;IAEzC,MAAM,EAAE,QAAQ,EAAE,oBAAoB,GAAG,MAAM,EAAE,gBAAgB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,IAAI,MAAgB,CAAC;IACrB,uBAAuB;IACvB,MAAM,QAAQ,GAAG,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC;IACA,8DAA8D;IAC9D,KAAU,EACV,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACxB,0BAA0B;QAC1B,IAAI,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,0CAAE,oBAAoB,EAAE,CAAC;YACzC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,MAAK,cAAc,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,MAAK,gBAAgB,EAAE,CAAC;gBACzE,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,QAAQ,oBAAoB,EAAE,CAAC;QAC7B,KAAK,MAAM;YACT,cAAc,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM;QACR,KAAK,KAAK;YACR,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;gBACnC,aAAa,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YACD,MAAM;IACV,CAAC;IACD,IAAI,oBAAoB,KAAK,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/esm/components/tokenStore.js

@@ -0,0 +1,220 @@
+import { getAccessTokenAction, refreshAccessTokenAction } from '../actions.js';
+import { decodeJwt } from '../jwt.js';
+const TOKEN_EXPIRY_BUFFER_SECONDS = 60;
+const MIN_REFRESH_DELAY_SECONDS = 15;
+const MAX_REFRESH_DELAY_SECONDS = 24 * 60 * 60;
+const RETRY_DELAY_SECONDS = 300; // 5 minutes for retry on error
+class TokenStore {
+    constructor() {
+        this.state = {
+            token: undefined,
+            loading: false,
+            error: null,
+        };
+        this.listeners = new Set();
+        this.refreshPromise = null;
+        this.subscribe = (listener) => {
+            this.listeners.add(listener);
+            return () => {
+                this.listeners.delete(listener);
+                if (this.listeners.size === 0 && this.refreshTimeout) {
+                    clearTimeout(this.refreshTimeout);
+                    this.refreshTimeout = undefined;
+                }
+            };
+        };
+        this.getSnapshot = () => this.state;
+        this.getServerSnapshot = () => TokenStore.SERVER_SNAPSHOT;
+    }
+    notify() {
+        this.listeners.forEach((listener) => listener());
+    }
+    setState(updates) {
+        this.state = { ...this.state, ...updates };
+        this.notify();
+    }
+    scheduleRefresh(timeUntilExpiry) {
+        if (this.refreshTimeout) {
+            clearTimeout(this.refreshTimeout);
+            this.refreshTimeout = undefined;
+        }
+        const delay = typeof timeUntilExpiry === 'undefined' ? RETRY_DELAY_SECONDS * 1000 : this.getRefreshDelay(timeUntilExpiry);
+        this.refreshTimeout = setTimeout(() => {
+            /* istanbul ignore next */
+            void this.getAccessTokenSilently().catch(() => { });
+        }, delay);
+    }
+    getRefreshDelay(timeUntilExpiry) {
+        if (timeUntilExpiry <= TOKEN_EXPIRY_BUFFER_SECONDS) {
+            return 0; // Immediate refresh
+        }
+        const idealDelay = (timeUntilExpiry - TOKEN_EXPIRY_BUFFER_SECONDS) * 1000;
+        return Math.min(Math.max(idealDelay, MIN_REFRESH_DELAY_SECONDS * 1000), MAX_REFRESH_DELAY_SECONDS * 1000);
+    }
+    parseToken(token) {
+        if (!token)
+            return null;
+        try {
+            const { payload } = decodeJwt(token);
+            const now = Math.floor(Date.now() / 1000);
+            if (typeof payload.exp !== 'number') {
+                return null;
+            }
+            const timeUntilExpiry = payload.exp - now;
+            // For short-lived tokens (< 5 minutes), use a 30-second buffer
+            // This prevents constant refreshing when tokens only last 60 seconds
+            let bufferSeconds = TOKEN_EXPIRY_BUFFER_SECONDS;
+            const totalTokenLifetime = payload.exp - (payload.iat || now);
+            if (totalTokenLifetime <= 300) {
+                // Token lifetime is 5 minutes or less - use 30 second buffer
+                bufferSeconds = 30;
+            }
+            const isExpiring = payload.exp < now + bufferSeconds;
+            return {
+                payload,
+                expiresAt: payload.exp,
+                isExpiring,
+                timeUntilExpiry,
+            };
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    isRefreshing() {
+        return this.refreshPromise !== null;
+    }
+    clearToken() {
+        this.setState({ token: undefined, error: null, loading: false });
+        if (this.refreshTimeout) {
+            clearTimeout(this.refreshTimeout);
+            this.refreshTimeout = undefined;
+        }
+    }
+    async getAccessToken() {
+        const tokenData = this.parseToken(this.state.token);
+        // If we have a valid JWT that's not expiring, return it
+        if (tokenData && !tokenData.isExpiring) {
+            return this.state.token;
+        }
+        // If we have an opaque token (can't parse as JWT), return it as-is
+        if (this.state.token && !tokenData) {
+            return this.state.token;
+        }
+        // Otherwise refresh (no token or expiring JWT)
+        return this.refreshTokenSilently();
+    }
+    async getAccessTokenSilently() {
+        const tokenData = this.parseToken(this.state.token);
+        // If we have a valid JWT that's not expiring, return it
+        if (tokenData && !tokenData.isExpiring) {
+            // Valid non-expiring JWT - return cached token without server call
+            return this.state.token;
+        }
+        // If we have an opaque token (can't parse as JWT), return it as-is
+        if (this.state.token && !tokenData) {
+            // Opaque token - return cached token without server call
+            return this.state.token;
+        }
+        // Otherwise refresh (no token or expiring JWT)
+        return this.refreshTokenSilently();
+    }
+    async refreshToken() {
+        return this._refreshToken(false);
+    }
+    async refreshTokenSilently() {
+        return this._refreshToken(true);
+    }
+    async _refreshToken(silent) {
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        const previousToken = this.state.token;
+        // Only set loading for user-initiated refreshes, not background refreshes
+        if (!silent) {
+            this.setState({ loading: true, error: null });
+        }
+        else {
+            // Clear error for silent refreshes but don't set loading
+            this.setState({ error: null });
+        }
+        this.refreshPromise = (async () => {
+            try {
+                // For manual refresh, always call refreshAccessTokenAction
+                // For silent refresh, try to get existing first, then refresh if needed
+                let token;
+                if (!silent) {
+                    // Manual refresh - always force refresh
+                    token = await refreshAccessTokenAction();
+                }
+                else {
+                    // Silent refresh - only fetch from server if we don't have a local token
+                    if (!previousToken) {
+                        // No local token, need to check server
+                        token = await getAccessTokenAction();
+                        const tokenData = this.parseToken(token);
+                        // Set the token even if it's expiring, to preserve it in case refresh fails
+                        if (token && token !== previousToken) {
+                            this.setState({
+                                token,
+                                loading: false,
+                                error: null,
+                            });
+                        }
+                        // If the token from server is expiring, refresh it
+                        if (!token || (tokenData && tokenData.isExpiring)) {
+                            const refreshedToken = await refreshAccessTokenAction();
+                            if (refreshedToken) {
+                                token = refreshedToken;
+                            }
+                        }
+                    }
+                    else {
+                        // We have a local token that needs refreshing (already checked by getAccessTokenSilently)
+                        token = await refreshAccessTokenAction();
+                    }
+                }
+                // Only update state if token actually changed or if loading was true
+                if (token !== previousToken || !silent) {
+                    this.setState({
+                        token,
+                        loading: false,
+                        error: null,
+                    });
+                }
+                const tokenData = this.parseToken(token);
+                if (tokenData) {
+                    this.scheduleRefresh(tokenData.timeUntilExpiry);
+                }
+                // If token is opaque (not a JWT), we don't schedule automatic refreshes
+                return token;
+            }
+            catch (error) {
+                // Don't clear the token immediately - keep the stale one while retrying
+                this.setState({
+                    loading: false,
+                    error: error instanceof Error ? error : new Error(String(error)),
+                });
+                // Schedule a retry after delay
+                this.scheduleRefresh();
+                throw error;
+            }
+            finally {
+                this.refreshPromise = null;
+            }
+        })();
+        return this.refreshPromise;
+    }
+    reset() {
+        this.state = { token: undefined, loading: false, error: null };
+        this.refreshPromise = null;
+        if (this.refreshTimeout) {
+            clearTimeout(this.refreshTimeout);
+            this.refreshTimeout = undefined;
+        }
+        this.listeners.clear();
+    }
+}
+TokenStore.SERVER_SNAPSHOT = { token: undefined, loading: false, error: null };
+export const tokenStore = new TokenStore();
+//# sourceMappingURL=tokenStore.js.map

package/dist/esm/components/tokenStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenStore.js","sourceRoot":"","sources":["../../../src/components/tokenStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAQtC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC/C,MAAM,mBAAmB,GAAG,GAAG,CAAC,CAAC,+BAA+B;AAEhE,MAAM,UAAU;IAAhB;QAGU,UAAK,GAAe;YAC1B,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,IAAI;SACZ,CAAC;QAEM,cAAS,GAAG,IAAI,GAAG,EAAc,CAAC;QAClC,mBAAc,GAAuC,IAAI,CAAC;QAGlE,cAAS,GAAG,CAAC,QAAoB,EAAE,EAAE;YACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,GAAG,EAAE;gBACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAChC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACrD,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAClC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC;QACJ,CAAC,CAAC;QAEF,gBAAW,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QAE/B,sBAAiB,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;IAiOvD,CAAC;IA/NS,MAAM;QACZ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IAEO,QAAQ,CAAC,OAA4B;QAC3C,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAEO,eAAe,CAAC,eAAwB;QAC9C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;QAED,MAAM,KAAK,GACT,OAAO,eAAe,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAE9G,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,0BAA0B;YAC1B,KAAK,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrD,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAEO,eAAe,CAAC,eAAuB;QAC7C,IAAI,eAAe,IAAI,2BAA2B,EAAE,CAAC;YACnD,OAAO,CAAC,CAAC,CAAC,oBAAoB;QAChC,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,eAAe,GAAG,2BAA2B,CAAC,GAAG,IAAI,CAAC;QAE1E,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAC5G,CAAC;IAED,UAAU,CAAC,KAAyB;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAE1C,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;YAE1C,+DAA+D;YAC/D,qEAAqE;YACrE,IAAI,aAAa,GAAG,2BAA2B,CAAC;YAChD,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YAE9D,IAAI,kBAAkB,IAAI,GAAG,EAAE,CAAC;gBAC9B,6DAA6D;gBAC7D,aAAa,GAAG,EAAE,CAAC;YACrB,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC;YAErD,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,OAAO,CAAC,GAAG;gBACtB,UAAU;gBACV,eAAe;aAChB,CAAC;QACJ,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,UAAU;QACR,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEpD,wDAAwD;QACxD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1B,CAAC;QAED,mEAAmE;QACnE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1B,CAAC;QAED,+CAA+C;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEpD,wDAAwD;QACxD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YACvC,mEAAmE;YACnE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1B,CAAC;QAED,mEAAmE;QACnE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,yDAAyD;YACzD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1B,CAAC;QAED,+CAA+C;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAe;QACzC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAEvC,0EAA0E;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,yDAAyD;YACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;YAChC,IAAI,CAAC;gBACH,2DAA2D;gBAC3D,wEAAwE;gBACxE,IAAI,KAAyB,CAAC;gBAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,wCAAwC;oBACxC,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,yEAAyE;oBACzE,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,uCAAuC;wBACvC,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAC;wBACrC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;wBAEzC,4EAA4E;wBAC5E,IAAI,KAAK,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;4BACrC,IAAI,CAAC,QAAQ,CAAC;gCACZ,KAAK;gCACL,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE,IAAI;6BACZ,CAAC,CAAC;wBACL,CAAC;wBAED,mDAAmD;wBACnD,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;4BAClD,MAAM,cAAc,GAAG,MAAM,wBAAwB,EAAE,CAAC;4BACxD,IAAI,cAAc,EAAE,CAAC;gCACnB,KAAK,GAAG,cAAc,CAAC;4BACzB,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,0FAA0F;wBAC1F,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;oBAC3C,CAAC;gBACH,CAAC;gBAED,qEAAqE;gBACrE,IAAI,KAAK,KAAK,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvC,IAAI,CAAC,QAAQ,CAAC;wBACZ,KAAK;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,IAAI;qBACZ,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,SAAS,EAAE,CAAC;oBACd,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;gBAClD,CAAC;gBACD,wEAAwE;gBAExE,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wEAAwE;gBACxE,IAAI,CAAC,QAAQ,CAAC;oBACZ,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC,CAAC;gBAEH,+BAA+B;gBAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;gBAEvB,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;;AAzPuB,0BAAe,GAAe,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,AAAhE,CAAiE;AA4P1G,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC"}

package/dist/esm/components/useAccessToken.js

@@ -1,166 +1,81 @@
-import { useCallback, useEffect, useReducer, useRef } from 'react';
-import { getAccessTokenAction, refreshAccessTokenAction } from '../actions.js';
+import { useCallback, useEffect, useRef, useSyncExternalStore } from 'react';
 import { useAuth } from './authkit-provider.js';
-import { decodeJwt } from '../jwt.js';
-const TOKEN_EXPIRY_BUFFER_SECONDS = 60;
-const MIN_REFRESH_DELAY_SECONDS = 15; // minimum delay before refreshing token
-const MAX_REFRESH_DELAY_SECONDS = 24 * 60 * 60; // 24 hours
-const RETRY_DELAY_SECONDS = 300; // 5 minutes
-function tokenReducer(state, action) {
-    switch (action.type) {
-        case 'FETCH_START':
-            return { ...state, loading: true, error: null };
-        case 'FETCH_SUCCESS':
-            return { ...state, loading: false, token: action.token, error: null };
-        case 'FETCH_ERROR':
-            return { ...state, loading: false, error: action.error };
-        case 'RESET':
-            return { ...state, token: undefined, loading: false, error: null };
-        // istanbul ignore next
-        default:
-            return state;
-    }
-}
-function getRefreshDelay(timeUntilExpiry) {
-    const idealDelay = (timeUntilExpiry - TOKEN_EXPIRY_BUFFER_SECONDS) * 1000;
-    return Math.min(Math.max(idealDelay, MIN_REFRESH_DELAY_SECONDS * 1000), MAX_REFRESH_DELAY_SECONDS * 1000);
-}
-function parseTokenPayload(token) {
-    // istanbul ignore next
-    if (!token) {
-        return null;
-    }
-    try {
-        const { payload } = decodeJwt(token);
-        const now = Math.floor(Date.now() / 1000);
-        // istanbul ignore next - if the token does not have an exp claim, we cannot determine expiry
-        if (typeof payload.exp !== 'number') {
-            return null;
-        }
-        return {
-            payload,
-            expiresAt: payload.exp,
-            isExpiring: payload.exp < now + TOKEN_EXPIRY_BUFFER_SECONDS,
-            timeUntilExpiry: payload.exp - now,
-        };
-    }
-    catch (_a) {
-        // istanbul ignore next
-        return null;
-    }
-}
+import { tokenStore } from './tokenStore.js';
 /**
  * A hook that manages access tokens with automatic refresh.
  */
 export function useAccessToken() {
-    const { user, sessionId, refreshAuth } = useAuth();
+    const { user, sessionId } = useAuth();
     const userId = user === null || user === void 0 ? void 0 : user.id;
-    const [state, dispatch] = useReducer(tokenReducer, {
-        token: undefined,
-        loading: false,
-        error: null,
-    });
-    const refreshTimeoutRef = useRef();
-    const fetchingRef = useRef(false);
-    const clearRefreshTimeout = useCallback(() => {
-        if (refreshTimeoutRef.current) {
-            clearTimeout(refreshTimeoutRef.current);
-            refreshTimeoutRef.current = undefined;
-        }
-    }, []);
-    // Store the current token in a ref to avoid stale closures
-    const currentTokenRef = useRef(state.token);
-    currentTokenRef.current = state.token;
-    // Store updateToken in a ref to break circular dependency
-    const updateTokenRef = useRef();
-    // Centralized timer scheduling function
-    const scheduleNextRefresh = useCallback((delay) => {
-        clearRefreshTimeout();
-        refreshTimeoutRef.current = setTimeout(() => {
-            if (updateTokenRef.current) {
-                updateTokenRef.current();
-            }
-        }, delay);
-    }, [clearRefreshTimeout]);
-    const updateToken = useCallback(async () => {
-        // istanbul ignore next - safety guard against concurrent fetches
-        if (fetchingRef.current) {
+    const userRef = useRef(user);
+    userRef.current = user;
+    const prevSessionRef = useRef(sessionId);
+    const prevUserIdRef = useRef(userId);
+    const tokenState = useSyncExternalStore(tokenStore.subscribe, tokenStore.getSnapshot, tokenStore.getServerSnapshot);
+    useEffect(() => {
+        if (!user) {
+            tokenStore.clearToken();
             return;
         }
-        fetchingRef.current = true;
-        try {
-            let token = await getAccessTokenAction();
-            if (token) {
-                const tokenData = parseTokenPayload(token);
-                if (!tokenData || tokenData.isExpiring) {
-                    token = await refreshAccessTokenAction();
-                }
-            }
-            // Only update state if token has changed
-            if (token !== currentTokenRef.current) {
-                dispatch({ type: 'FETCH_SUCCESS', token });
-            }
-            if (token) {
-                const tokenData = parseTokenPayload(token);
-                if (tokenData) {
-                    const delay = getRefreshDelay(tokenData.timeUntilExpiry);
-                    scheduleNextRefresh(delay);
-                }
-            }
-            return token;
-        }
-        catch (error) {
-            dispatch({ type: 'FETCH_ERROR', error: error instanceof Error ? error : new Error(String(error)) });
-            scheduleNextRefresh(RETRY_DELAY_SECONDS * 1000);
+        // Only clear token if user or session actually changed (not on initial mount)
+        const sessionChanged = prevSessionRef.current !== undefined && prevSessionRef.current !== sessionId;
+        const userChanged = prevUserIdRef.current !== undefined && prevUserIdRef.current !== userId;
+        if (sessionChanged || userChanged) {
+            tokenStore.clearToken();
         }
-        finally {
-            fetchingRef.current = false;
-        }
-    }, [scheduleNextRefresh]);
-    // Assign updateToken to ref for use in scheduleNextRefresh
-    updateTokenRef.current = updateToken;
-    const refresh = useCallback(async () => {
-        if (fetchingRef.current) {
+        prevSessionRef.current = sessionId;
+        prevUserIdRef.current = userId;
+        /* istanbul ignore next */
+        tokenStore.getAccessTokenSilently().catch(() => {
+            // Error is handled in the store
+        });
+    }, [userId, sessionId]);
+    useEffect(() => {
+        if (!user || typeof document === 'undefined') {
             return;
         }
-        fetchingRef.current = true;
-        dispatch({ type: 'FETCH_START' });
-        try {
-            await refreshAuth();
-            const token = await getAccessTokenAction();
-            dispatch({ type: 'FETCH_SUCCESS', token });
-            if (token) {
-                const tokenData = parseTokenPayload(token);
-                if (tokenData) {
-                    const delay = getRefreshDelay(tokenData.timeUntilExpiry);
-                    scheduleNextRefresh(delay);
-                }
+        /* istanbul ignore next */
+        const refreshIfNeeded = () => {
+            tokenStore.getAccessTokenSilently().catch(() => {
+                // Error is handled in the store
+            });
+        };
+        /* istanbul ignore next */
+        const handleWake = (event) => {
+            if (event.type !== 'visibilitychange' || document.visibilityState === 'visible') {
+                refreshIfNeeded();
             }
-            return token;
-        }
-        catch (error) {
-            const typedError = error instanceof Error ? error : new Error(String(error));
-            dispatch({ type: 'FETCH_ERROR', error: typedError });
-            scheduleNextRefresh(RETRY_DELAY_SECONDS * 1000);
-        }
-        finally {
-            fetchingRef.current = false;
+        };
+        document.addEventListener('visibilitychange', handleWake);
+        window.addEventListener('focus', handleWake);
+        window.addEventListener('online', handleWake);
+        window.addEventListener('pageshow', handleWake);
+        return () => {
+            document.removeEventListener('visibilitychange', handleWake);
+            window.removeEventListener('focus', handleWake);
+            window.removeEventListener('online', handleWake);
+            window.removeEventListener('pageshow', handleWake);
+        };
+    }, [userId, sessionId]);
+    const getAccessToken = useCallback(async () => {
+        if (!userRef.current) {
+            return undefined;
         }
-    }, [refreshAuth, scheduleNextRefresh, updateToken]);
-    useEffect(() => {
-        if (!user) {
-            dispatch({ type: 'RESET' });
-            clearRefreshTimeout();
-            return;
+        return tokenStore.getAccessToken();
+    }, []);
+    // Stable refresh function
+    const refresh = useCallback(async () => {
+        if (!userRef.current) {
+            return undefined;
         }
-        updateToken();
-        return clearRefreshTimeout;
-    }, [userId, sessionId, clearRefreshTimeout]);
+        return tokenStore.refreshToken();
+    }, []);
     return {
-        accessToken: state.token,
-        loading: state.loading,
-        error: state.error,
+        accessToken: tokenState.token,
+        loading: tokenState.loading,
+        error: tokenState.error,
         refresh,
+        getAccessToken,
     };
 }
 //# sourceMappingURL=useAccessToken.js.map

package/dist/esm/components/useAccessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAccessToken.js","sourceRoot":"","sources":["../../../src/components/useAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,yBAAyB,GAAG,EAAE,CAAC,CAAC,wCAAwC;AAC9E,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW;AAC3D,MAAM,mBAAmB,GAAG,GAAG,CAAC,CAAC,YAAY;AAc7C,SAAS,YAAY,CAAC,KAAiB,EAAE,MAAmB;IAC1D,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,eAAe;YAClB,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACxE,KAAK,aAAa;YAChB,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3D,KAAK,OAAO;YACV,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACrE,uBAAuB;QACvB;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,eAAuB;IAC9C,MAAM,UAAU,GAAG,CAAC,eAAe,GAAG,2BAA2B,CAAC,GAAG,IAAI,CAAC;IAC1E,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,uBAAuB;IACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,6FAA6F;QAC7F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,OAAO;YACP,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,UAAU,EAAE,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,2BAA2B;YAC3D,eAAe,EAAE,OAAO,CAAC,GAAG,GAAG,GAAG;SACnC,CAAC;IACJ,CAAC;IAAC,WAAM,CAAC;QACP,uBAAuB;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAC;IACxB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,YAAY,EAAE;QACjD,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,MAAM,EAAiC,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,MAAM,mBAAmB,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3C,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxC,iBAAiB,CAAC,OAAO,GAAG,SAAS,CAAC;QACxC,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,2DAA2D;IAC3D,MAAM,eAAe,GAAG,MAAM,CAAqB,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;IAEtC,0DAA0D;IAC1D,MAAM,cAAc,GAAG,MAAM,EAAqC,CAAC;IAEnE,wCAAwC;IACxC,MAAM,mBAAmB,GAAG,WAAW,CACrC,CAAC,KAAa,EAAE,EAAE;QAChB,mBAAmB,EAAE,CAAC;QACtB,iBAAiB,CAAC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1C,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC3B,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC,EACD,CAAC,mBAAmB,CAAC,CACtB,CAAC;IAEF,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACzC,iEAAiE;QACjE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;QAE3B,IAAI,CAAC;YACH,IAAI,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC3C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;oBACvC,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;gBAC3C,CAAC;YACH,CAAC;YAED,yCAAyC;YACzC,IAAI,KAAK,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC;gBACtC,QAAQ,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC3C,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;oBACzD,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACpG,mBAAmB,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;QAClD,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,OAAO,GAAG,KAAK,CAAC;QAC9B,CAAC;IACH,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAE1B,2DAA2D;IAC3D,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;IAErC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,WAAW,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAC;YAE3C,QAAQ,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAE3C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC3C,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;oBACzD,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YACrD,mBAAmB,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;QAClD,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,OAAO,GAAG,KAAK,CAAC;QAC9B,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC,CAAC;IAEpD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5B,mBAAmB,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,WAAW,EAAE,CAAC;QAEd,OAAO,mBAAmB,CAAC;IAC7B,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAE7C,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;KACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"useAccessToken.js","sourceRoot":"","sources":["../../../src/components/useAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA6B7C;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IACvB,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAErC,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAEpH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,UAAU,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,KAAK,SAAS,IAAI,cAAc,CAAC,OAAO,KAAK,SAAS,CAAC;QACpG,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,KAAK,SAAS,IAAI,aAAa,CAAC,OAAO,KAAK,MAAM,CAAC;QAE5F,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;YAClC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,cAAc,CAAC,OAAO,GAAG,SAAS,CAAC;QACnC,aAAa,CAAC,OAAO,GAAG,MAAM,CAAC;QAE/B,0BAA0B;QAC1B,UAAU,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7C,gCAAgC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAExB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,MAAM,eAAe,GAAG,GAAG,EAAE;YAC3B,UAAU,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7C,gCAAgC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,0BAA0B;QAC1B,MAAM,UAAU,GAAG,CAAC,KAAY,EAAE,EAAE;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBAChF,eAAe,EAAE,CAAC;YACpB,CAAC;QACH,CAAC,CAAC;QAEF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAEhD,OAAO,GAAG,EAAE;YACV,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;YAC7D,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAChD,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAExB,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,IAAiC,EAAE;QACzE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,UAAU,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,0BAA0B;IAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAiC,EAAE;QAClE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO;QACL,WAAW,EAAE,UAAU,CAAC,KAAK;QAC7B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,OAAO;QACP,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/esm/types/components/tokenStore.d.ts

@@ -0,0 +1,35 @@
+interface TokenState {
+    token: string | undefined;
+    loading: boolean;
+    error: Error | null;
+}
+declare class TokenStore {
+    private static readonly SERVER_SNAPSHOT;
+    private state;
+    private listeners;
+    private refreshPromise;
+    private refreshTimeout;
+    subscribe: (listener: () => void) => () => void;
+    getSnapshot: () => TokenState;
+    getServerSnapshot: () => TokenState;
+    private notify;
+    private setState;
+    private scheduleRefresh;
+    private getRefreshDelay;
+    parseToken(token: string | undefined): {
+        payload: Partial<import("../jwt.js").JWTPayload & Record<string, unknown>>;
+        expiresAt: number;
+        isExpiring: boolean;
+        timeUntilExpiry: number;
+    } | null;
+    isRefreshing(): boolean;
+    clearToken(): void;
+    getAccessToken(): Promise<string | undefined>;
+    getAccessTokenSilently(): Promise<string | undefined>;
+    refreshToken(): Promise<string | undefined>;
+    private refreshTokenSilently;
+    private _refreshToken;
+    reset(): void;
+}
+export declare const tokenStore: TokenStore;
+export {};

package/dist/esm/types/components/useAccessToken.d.ts

@@ -1,9 +1,30 @@
-/**
- * A hook that manages access tokens with automatic refresh.
- */
-export declare function useAccessToken(): {
+export interface UseAccessTokenReturn {
+    /**
+     * Current access token. May be stale when tab is inactive.
+     * Use this for display purposes or where eventual consistency is acceptable.
+     */
     accessToken: string | undefined;
+    /**
+     * Loading state for initial token fetch
+     */
     loading: boolean;
+    /**
+     * Error from the last token operation
+     */
     error: Error | null;
+    /**
+     * Manually trigger a token refresh
+     */
     refresh: () => Promise<string | undefined>;
-};
+    /**
+     * Get a guaranteed fresh access token. Automatically refreshes if needed.
+     * Use this for API calls where token freshness is critical.
+     * @returns Promise resolving to fresh token or undefined if not authenticated
+     * @throws Error if refresh fails
+     */
+    getAccessToken: () => Promise<string | undefined>;
+}
+/**
+ * A hook that manages access tokens with automatic refresh.
+ */
+export declare function useAccessToken(): UseAccessTokenReturn;

package/dist/esm/types/workos.d.ts

@@ -1,5 +1,5 @@
 import { WorkOS } from '@workos-inc/node';
-export declare const VERSION = "2.4.5";
+export declare const VERSION = "2.5.0";
 /**
  * Create a WorkOS instance with the provided API key and options.
  * If an instance already exists, it returns the existing instance.

package/dist/esm/workos.js

@@ -1,7 +1,7 @@
 import { WorkOS } from '@workos-inc/node';
 import { WORKOS_API_HOSTNAME, WORKOS_API_KEY, WORKOS_API_HTTPS, WORKOS_API_PORT } from './env-variables.js';
 import { lazy } from './utils.js';
-export const VERSION = '2.4.5';
+export const VERSION = '2.5.0';
 const options = {
     apiHostname: WORKOS_API_HOSTNAME,
     https: WORKOS_API_HTTPS ? WORKOS_API_HTTPS === 'true' : true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos-inc/authkit-nextjs",
-  "version": "2.4.5",
+  "version": "2.5.0",
   "description": "Authentication and session helpers for using WorkOS & AuthKit with Next.js",
   "sideEffects": false,
   "type": "module",

package/src/auth.ts

@@ -1,8 +1,8 @@
 'use server';
 
-import { revalidatePath, revalidateTag } from 'next/cache.js';
-import { cookies, headers } from 'next/headers.js';
-import { redirect } from 'next/navigation.js';
+import { revalidatePath, revalidateTag } from 'next/cache';
+import { cookies, headers } from 'next/headers';
+import { redirect } from 'next/navigation';
 import { WORKOS_COOKIE_NAME } from './env-variables.js';
 import { getCookieOptions } from './cookie.js';
 import { getAuthorizationUrl } from './get-authorization-url.js';

package/src/components/tokenStore.ts

@@ -0,0 +1,268 @@
+import { getAccessTokenAction, refreshAccessTokenAction } from '../actions.js';
+import { decodeJwt } from '../jwt.js';
+
+interface TokenState {
+  token: string | undefined;
+  loading: boolean;
+  error: Error | null;
+}
+
+const TOKEN_EXPIRY_BUFFER_SECONDS = 60;
+const MIN_REFRESH_DELAY_SECONDS = 15;
+const MAX_REFRESH_DELAY_SECONDS = 24 * 60 * 60;
+const RETRY_DELAY_SECONDS = 300; // 5 minutes for retry on error
+
+class TokenStore {
+  private static readonly SERVER_SNAPSHOT: TokenState = { token: undefined, loading: false, error: null };
+
+  private state: TokenState = {
+    token: undefined,
+    loading: false,
+    error: null,
+  };
+
+  private listeners = new Set<() => void>();
+  private refreshPromise: Promise<string | undefined> | null = null;
+  private refreshTimeout: ReturnType<typeof setTimeout> | undefined;
+
+  subscribe = (listener: () => void) => {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+      if (this.listeners.size === 0 && this.refreshTimeout) {
+        clearTimeout(this.refreshTimeout);
+        this.refreshTimeout = undefined;
+      }
+    };
+  };
+
+  getSnapshot = () => this.state;
+
+  getServerSnapshot = () => TokenStore.SERVER_SNAPSHOT;
+
+  private notify() {
+    this.listeners.forEach((listener) => listener());
+  }
+
+  private setState(updates: Partial<TokenState>) {
+    this.state = { ...this.state, ...updates };
+    this.notify();
+  }
+
+  private scheduleRefresh(timeUntilExpiry?: number) {
+    if (this.refreshTimeout) {
+      clearTimeout(this.refreshTimeout);
+      this.refreshTimeout = undefined;
+    }
+
+    const delay =
+      typeof timeUntilExpiry === 'undefined' ? RETRY_DELAY_SECONDS * 1000 : this.getRefreshDelay(timeUntilExpiry);
+
+    this.refreshTimeout = setTimeout(() => {
+      /* istanbul ignore next */
+      void this.getAccessTokenSilently().catch(() => {});
+    }, delay);
+  }
+
+  private getRefreshDelay(timeUntilExpiry: number) {
+    if (timeUntilExpiry <= TOKEN_EXPIRY_BUFFER_SECONDS) {
+      return 0; // Immediate refresh
+    }
+
+    const idealDelay = (timeUntilExpiry - TOKEN_EXPIRY_BUFFER_SECONDS) * 1000;
+
+    return Math.min(Math.max(idealDelay, MIN_REFRESH_DELAY_SECONDS * 1000), MAX_REFRESH_DELAY_SECONDS * 1000);
+  }
+
+  parseToken(token: string | undefined) {
+    if (!token) return null;
+
+    try {
+      const { payload } = decodeJwt(token);
+      const now = Math.floor(Date.now() / 1000);
+
+      if (typeof payload.exp !== 'number') {
+        return null;
+      }
+
+      const timeUntilExpiry = payload.exp - now;
+
+      // For short-lived tokens (< 5 minutes), use a 30-second buffer
+      // This prevents constant refreshing when tokens only last 60 seconds
+      let bufferSeconds = TOKEN_EXPIRY_BUFFER_SECONDS;
+      const totalTokenLifetime = payload.exp - (payload.iat || now);
+
+      if (totalTokenLifetime <= 300) {
+        // Token lifetime is 5 minutes or less - use 30 second buffer
+        bufferSeconds = 30;
+      }
+
+      const isExpiring = payload.exp < now + bufferSeconds;
+
+      return {
+        payload,
+        expiresAt: payload.exp,
+        isExpiring,
+        timeUntilExpiry,
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  isRefreshing(): boolean {
+    return this.refreshPromise !== null;
+  }
+
+  clearToken() {
+    this.setState({ token: undefined, error: null, loading: false });
+    if (this.refreshTimeout) {
+      clearTimeout(this.refreshTimeout);
+      this.refreshTimeout = undefined;
+    }
+  }
+
+  async getAccessToken(): Promise<string | undefined> {
+    const tokenData = this.parseToken(this.state.token);
+
+    // If we have a valid JWT that's not expiring, return it
+    if (tokenData && !tokenData.isExpiring) {
+      return this.state.token;
+    }
+
+    // If we have an opaque token (can't parse as JWT), return it as-is
+    if (this.state.token && !tokenData) {
+      return this.state.token;
+    }
+
+    // Otherwise refresh (no token or expiring JWT)
+    return this.refreshTokenSilently();
+  }
+
+  async getAccessTokenSilently(): Promise<string | undefined> {
+    const tokenData = this.parseToken(this.state.token);
+
+    // If we have a valid JWT that's not expiring, return it
+    if (tokenData && !tokenData.isExpiring) {
+      // Valid non-expiring JWT - return cached token without server call
+      return this.state.token;
+    }
+
+    // If we have an opaque token (can't parse as JWT), return it as-is
+    if (this.state.token && !tokenData) {
+      // Opaque token - return cached token without server call
+      return this.state.token;
+    }
+
+    // Otherwise refresh (no token or expiring JWT)
+    return this.refreshTokenSilently();
+  }
+
+  async refreshToken(): Promise<string | undefined> {
+    return this._refreshToken(false);
+  }
+
+  private async refreshTokenSilently(): Promise<string | undefined> {
+    return this._refreshToken(true);
+  }
+
+  private async _refreshToken(silent: boolean): Promise<string | undefined> {
+    if (this.refreshPromise) {
+      return this.refreshPromise;
+    }
+
+    const previousToken = this.state.token;
+
+    // Only set loading for user-initiated refreshes, not background refreshes
+    if (!silent) {
+      this.setState({ loading: true, error: null });
+    } else {
+      // Clear error for silent refreshes but don't set loading
+      this.setState({ error: null });
+    }
+
+    this.refreshPromise = (async () => {
+      try {
+        // For manual refresh, always call refreshAccessTokenAction
+        // For silent refresh, try to get existing first, then refresh if needed
+        let token: string | undefined;
+
+        if (!silent) {
+          // Manual refresh - always force refresh
+          token = await refreshAccessTokenAction();
+        } else {
+          // Silent refresh - only fetch from server if we don't have a local token
+          if (!previousToken) {
+            // No local token, need to check server
+            token = await getAccessTokenAction();
+            const tokenData = this.parseToken(token);
+
+            // Set the token even if it's expiring, to preserve it in case refresh fails
+            if (token && token !== previousToken) {
+              this.setState({
+                token,
+                loading: false,
+                error: null,
+              });
+            }
+
+            // If the token from server is expiring, refresh it
+            if (!token || (tokenData && tokenData.isExpiring)) {
+              const refreshedToken = await refreshAccessTokenAction();
+              if (refreshedToken) {
+                token = refreshedToken;
+              }
+            }
+          } else {
+            // We have a local token that needs refreshing (already checked by getAccessTokenSilently)
+            token = await refreshAccessTokenAction();
+          }
+        }
+
+        // Only update state if token actually changed or if loading was true
+        if (token !== previousToken || !silent) {
+          this.setState({
+            token,
+            loading: false,
+            error: null,
+          });
+        }
+
+        const tokenData = this.parseToken(token);
+        if (tokenData) {
+          this.scheduleRefresh(tokenData.timeUntilExpiry);
+        }
+        // If token is opaque (not a JWT), we don't schedule automatic refreshes
+
+        return token;
+      } catch (error) {
+        // Don't clear the token immediately - keep the stale one while retrying
+        this.setState({
+          loading: false,
+          error: error instanceof Error ? error : new Error(String(error)),
+        });
+
+        // Schedule a retry after delay
+        this.scheduleRefresh();
+
+        throw error;
+      } finally {
+        this.refreshPromise = null;
+      }
+    })();
+
+    return this.refreshPromise;
+  }
+
+  reset() {
+    this.state = { token: undefined, loading: false, error: null };
+    this.refreshPromise = null;
+    if (this.refreshTimeout) {
+      clearTimeout(this.refreshTimeout);
+      this.refreshTimeout = undefined;
+    }
+    this.listeners.clear();
+  }
+}
+
+export const tokenStore = new TokenStore();

package/src/components/useAccessToken.ts

@@ -1,204 +1,122 @@
-import { useCallback, useEffect, useReducer, useRef } from 'react';
-import { getAccessTokenAction, refreshAccessTokenAction } from '../actions.js';
+import { useCallback, useEffect, useRef, useSyncExternalStore } from 'react';
 import { useAuth } from './authkit-provider.js';
-import { decodeJwt } from '../jwt.js';
-
-const TOKEN_EXPIRY_BUFFER_SECONDS = 60;
-const MIN_REFRESH_DELAY_SECONDS = 15; // minimum delay before refreshing token
-const MAX_REFRESH_DELAY_SECONDS = 24 * 60 * 60; // 24 hours
-const RETRY_DELAY_SECONDS = 300; // 5 minutes
-
-interface TokenState {
-  token: string | undefined;
+import { tokenStore } from './tokenStore.js';
+
+export interface UseAccessTokenReturn {
+  /**
+   * Current access token. May be stale when tab is inactive.
+   * Use this for display purposes or where eventual consistency is acceptable.
+   */
+  accessToken: string | undefined;
+  /**
+   * Loading state for initial token fetch
+   */
   loading: boolean;
+  /**
+   * Error from the last token operation
+   */
   error: Error | null;
-}
-
-type TokenAction =
-  | { type: 'FETCH_START' }
-  | { type: 'FETCH_SUCCESS'; token: string | undefined }
-  | { type: 'FETCH_ERROR'; error: Error }
-  | { type: 'RESET' };
-
-function tokenReducer(state: TokenState, action: TokenAction): TokenState {
-  switch (action.type) {
-    case 'FETCH_START':
-      return { ...state, loading: true, error: null };
-    case 'FETCH_SUCCESS':
-      return { ...state, loading: false, token: action.token, error: null };
-    case 'FETCH_ERROR':
-      return { ...state, loading: false, error: action.error };
-    case 'RESET':
-      return { ...state, token: undefined, loading: false, error: null };
-    // istanbul ignore next
-    default:
-      return state;
-  }
-}
-
-function getRefreshDelay(timeUntilExpiry: number) {
-  const idealDelay = (timeUntilExpiry - TOKEN_EXPIRY_BUFFER_SECONDS) * 1000;
-  return Math.min(Math.max(idealDelay, MIN_REFRESH_DELAY_SECONDS * 1000), MAX_REFRESH_DELAY_SECONDS * 1000);
-}
-
-function parseTokenPayload(token: string | undefined) {
-  // istanbul ignore next
-  if (!token) {
-    return null;
-  }
-
-  try {
-    const { payload } = decodeJwt(token);
-    const now = Math.floor(Date.now() / 1000);
-
-    // istanbul ignore next - if the token does not have an exp claim, we cannot determine expiry
-    if (typeof payload.exp !== 'number') {
-      return null;
-    }
-
-    return {
-      payload,
-      expiresAt: payload.exp,
-      isExpiring: payload.exp < now + TOKEN_EXPIRY_BUFFER_SECONDS,
-      timeUntilExpiry: payload.exp - now,
-    };
-  } catch {
-    // istanbul ignore next
-    return null;
-  }
+  /**
+   * Manually trigger a token refresh
+   */
+  refresh: () => Promise<string | undefined>;
+  /**
+   * Get a guaranteed fresh access token. Automatically refreshes if needed.
+   * Use this for API calls where token freshness is critical.
+   * @returns Promise resolving to fresh token or undefined if not authenticated
+   * @throws Error if refresh fails
+   */
+  getAccessToken: () => Promise<string | undefined>;
 }
 
 /**
  * A hook that manages access tokens with automatic refresh.
  */
-export function useAccessToken() {
-  const { user, sessionId, refreshAuth } = useAuth();
+export function useAccessToken(): UseAccessTokenReturn {
+  const { user, sessionId } = useAuth();
   const userId = user?.id;
-  const [state, dispatch] = useReducer(tokenReducer, {
-    token: undefined,
-    loading: false,
-    error: null,
-  });
-
-  const refreshTimeoutRef = useRef<ReturnType<typeof setTimeout>>();
-  const fetchingRef = useRef(false);
-
-  const clearRefreshTimeout = useCallback(() => {
-    if (refreshTimeoutRef.current) {
-      clearTimeout(refreshTimeoutRef.current);
-      refreshTimeoutRef.current = undefined;
-    }
-  }, []);
+  const userRef = useRef(user);
+  userRef.current = user;
+  const prevSessionRef = useRef(sessionId);
+  const prevUserIdRef = useRef(userId);
 
-  // Store the current token in a ref to avoid stale closures
-  const currentTokenRef = useRef<string | undefined>(state.token);
-  currentTokenRef.current = state.token;
-
-  // Store updateToken in a ref to break circular dependency
-  const updateTokenRef = useRef<() => Promise<string | undefined>>();
-
-  // Centralized timer scheduling function
-  const scheduleNextRefresh = useCallback(
-    (delay: number) => {
-      clearRefreshTimeout();
-      refreshTimeoutRef.current = setTimeout(() => {
-        if (updateTokenRef.current) {
-          updateTokenRef.current();
-        }
-      }, delay);
-    },
-    [clearRefreshTimeout],
-  );
-
-  const updateToken = useCallback(async () => {
-    // istanbul ignore next - safety guard against concurrent fetches
-    if (fetchingRef.current) {
+  const tokenState = useSyncExternalStore(tokenStore.subscribe, tokenStore.getSnapshot, tokenStore.getServerSnapshot);
+
+  useEffect(() => {
+    if (!user) {
+      tokenStore.clearToken();
       return;
     }
 
-    fetchingRef.current = true;
+    // Only clear token if user or session actually changed (not on initial mount)
+    const sessionChanged = prevSessionRef.current !== undefined && prevSessionRef.current !== sessionId;
+    const userChanged = prevUserIdRef.current !== undefined && prevUserIdRef.current !== userId;
 
-    try {
-      let token = await getAccessTokenAction();
-      if (token) {
-        const tokenData = parseTokenPayload(token);
-        if (!tokenData || tokenData.isExpiring) {
-          token = await refreshAccessTokenAction();
-        }
-      }
-
-      // Only update state if token has changed
-      if (token !== currentTokenRef.current) {
-        dispatch({ type: 'FETCH_SUCCESS', token });
-      }
-
-      if (token) {
-        const tokenData = parseTokenPayload(token);
-        if (tokenData) {
-          const delay = getRefreshDelay(tokenData.timeUntilExpiry);
-          scheduleNextRefresh(delay);
-        }
-      }
-
-      return token;
-    } catch (error) {
-      dispatch({ type: 'FETCH_ERROR', error: error instanceof Error ? error : new Error(String(error)) });
-      scheduleNextRefresh(RETRY_DELAY_SECONDS * 1000);
-    } finally {
-      fetchingRef.current = false;
+    if (sessionChanged || userChanged) {
+      tokenStore.clearToken();
     }
-  }, [scheduleNextRefresh]);
 
-  // Assign updateToken to ref for use in scheduleNextRefresh
-  updateTokenRef.current = updateToken;
+    prevSessionRef.current = sessionId;
+    prevUserIdRef.current = userId;
 
-  const refresh = useCallback(async () => {
-    if (fetchingRef.current) {
+    /* istanbul ignore next */
+    tokenStore.getAccessTokenSilently().catch(() => {
+      // Error is handled in the store
+    });
+  }, [userId, sessionId]);
+
+  useEffect(() => {
+    if (!user || typeof document === 'undefined') {
       return;
     }
 
-    fetchingRef.current = true;
-    dispatch({ type: 'FETCH_START' });
+    /* istanbul ignore next */
+    const refreshIfNeeded = () => {
+      tokenStore.getAccessTokenSilently().catch(() => {
+        // Error is handled in the store
+      });
+    };
 
-    try {
-      await refreshAuth();
-      const token = await getAccessTokenAction();
+    /* istanbul ignore next */
+    const handleWake = (event: Event) => {
+      if (event.type !== 'visibilitychange' || document.visibilityState === 'visible') {
+        refreshIfNeeded();
+      }
+    };
 
-      dispatch({ type: 'FETCH_SUCCESS', token });
+    document.addEventListener('visibilitychange', handleWake);
+    window.addEventListener('focus', handleWake);
+    window.addEventListener('online', handleWake);
+    window.addEventListener('pageshow', handleWake);
 
-      if (token) {
-        const tokenData = parseTokenPayload(token);
-        if (tokenData) {
-          const delay = getRefreshDelay(tokenData.timeUntilExpiry);
-          scheduleNextRefresh(delay);
-        }
-      }
+    return () => {
+      document.removeEventListener('visibilitychange', handleWake);
+      window.removeEventListener('focus', handleWake);
+      window.removeEventListener('online', handleWake);
+      window.removeEventListener('pageshow', handleWake);
+    };
+  }, [userId, sessionId]);
 
-      return token;
-    } catch (error) {
-      const typedError = error instanceof Error ? error : new Error(String(error));
-      dispatch({ type: 'FETCH_ERROR', error: typedError });
-      scheduleNextRefresh(RETRY_DELAY_SECONDS * 1000);
-    } finally {
-      fetchingRef.current = false;
+  const getAccessToken = useCallback(async (): Promise<string | undefined> => {
+    if (!userRef.current) {
+      return undefined;
     }
-  }, [refreshAuth, scheduleNextRefresh, updateToken]);
+    return tokenStore.getAccessToken();
+  }, []);
 
-  useEffect(() => {
-    if (!user) {
-      dispatch({ type: 'RESET' });
-      clearRefreshTimeout();
-      return;
+  // Stable refresh function
+  const refresh = useCallback(async (): Promise<string | undefined> => {
+    if (!userRef.current) {
+      return undefined;
     }
-    updateToken();
-
-    return clearRefreshTimeout;
-  }, [userId, sessionId, clearRefreshTimeout]);
+    return tokenStore.refreshToken();
+  }, []);
 
   return {
-    accessToken: state.token,
-    loading: state.loading,
-    error: state.error,
+    accessToken: tokenState.token,
+    loading: tokenState.loading,
+    error: tokenState.error,
     refresh,
+    getAccessToken,
   };
 }

package/src/workos.ts

@@ -2,7 +2,7 @@ import { WorkOS } from '@workos-inc/node';
 import { WORKOS_API_HOSTNAME, WORKOS_API_KEY, WORKOS_API_HTTPS, WORKOS_API_PORT } from './env-variables.js';
 import { lazy } from './utils.js';
 
-export const VERSION = '2.4.5';
+export const VERSION = '2.5.0';
 
 const options = {
   apiHostname: WORKOS_API_HOSTNAME,