@burdenoff/fe-libs 2026.1005.3 → 2026.1006.1

package/dist/shared/assistant/workflowApi.d.ts

@@ -0,0 +1,100 @@
+import { executeAssistantGraphQLOnce } from './gatewayClient';
+import { AssistantSandboxAuthContext } from './types';
+/** Product configuration selects a server-owned assistant, never a model or workflow override. */
+export type AssistantWorkflowTarget = {
+    kind: 'botmanor';
+    agentId: string;
+} | {
+    kind: 'buildmyiq-course';
+    courseId: string;
+};
+export interface WorkflowAssistantTurnInput {
+    clientTurnId: string;
+    clientConversationId: string;
+    message: string;
+}
+export interface WorkflowAssistantReceipt {
+    partialMessage?: string | null;
+    id: string;
+    clientTurnId: string;
+    courseId: string | null;
+    status: 'READY' | 'RUNNING' | 'GENERATED' | 'COMPLETED' | 'FAILED' | 'CANCELLED' | 'UNKNOWN';
+    historyDelivered: boolean;
+    usageDelivered: boolean;
+    result: {
+        message: string;
+        model: string;
+        tokensUsed: number;
+        sources: {
+            reference: number;
+            chunkId: string;
+            documentId: string;
+            knowledgeBaseId: string;
+        }[];
+    } | null;
+}
+export interface WorkflowAssistantConversationPage {
+    nodes: Array<{
+        clientConversationId: string;
+        createdAt: string;
+    }>;
+    nextCursor: string | null;
+}
+export interface WorkflowAssistantConversation {
+    clientConversationId: string;
+    turns: Array<{
+        message: string;
+        receipt: WorkflowAssistantReceipt;
+    }>;
+    pending: WorkflowAssistantTurnInput | null;
+}
+export interface WorkflowAssistantRequestContext {
+    workspaceId: string;
+    authContext?: AssistantSandboxAuthContext;
+    signal?: AbortSignal;
+}
+export interface WorkflowAssistantRunHandle {
+    runId: string;
+    status: string;
+    workflowId: string;
+    workflowKey: string;
+    version: string;
+    triggerNodeId: string;
+}
+export type WorkflowAssistantWaitOutcome = {
+    kind: 'completed';
+    receipt: WorkflowAssistantReceipt;
+} | {
+    kind: 'terminal';
+    receipt: WorkflowAssistantReceipt;
+} | {
+    kind: 'pending';
+    receipt: WorkflowAssistantReceipt | null;
+};
+/** Only an authoritative admission refusal can release a blocked composer. */
+export declare function isWorkflowAssistantAdmissionRefusal(error: unknown): boolean;
+/** Shared authenticated gateway implementation. There is no sandbox or vendor fallback. */
+export declare class AssistantWorkflowClient {
+    private readonly request;
+    constructor(request?: typeof executeAssistantGraphQLOnce);
+    /** Resolve an LMS route through its owner-filtered server endpoint. */
+    courseTargetForEnrollment(enrollmentId: string, context: WorkflowAssistantRequestContext): Promise<Extract<AssistantWorkflowTarget, {
+        kind: 'buildmyiq-course';
+    }>>;
+    start(target: AssistantWorkflowTarget, input: WorkflowAssistantTurnInput, context: WorkflowAssistantRequestContext): Promise<WorkflowAssistantRunHandle>;
+    read(target: AssistantWorkflowTarget, clientTurnId: string, context: WorkflowAssistantRequestContext, retryDelivery?: boolean): Promise<WorkflowAssistantReceipt | null>;
+    conversations(target: AssistantWorkflowTarget, context: WorkflowAssistantRequestContext, after?: string | null): Promise<WorkflowAssistantConversationPage>;
+    conversation(target: AssistantWorkflowTarget, context: WorkflowAssistantRequestContext, clientConversationId?: string | null): Promise<WorkflowAssistantConversation | null>;
+    messages(target: AssistantWorkflowTarget, context: WorkflowAssistantRequestContext, clientConversationId: string, before?: string | null): Promise<{
+        turns: WorkflowAssistantConversation['turns'];
+        nextCursor: string | null;
+    }>;
+    cancel(clientTurnId: string, context: WorkflowAssistantRequestContext): Promise<boolean>;
+    /** A client deadline leaves an admitted turn recoverable; it never regenerates it. */
+    wait(target: AssistantWorkflowTarget, clientTurnId: string, context: WorkflowAssistantRequestContext, options?: {
+        budgetMs?: number;
+        intervalMs?: number;
+        onProgress?: (receipt: WorkflowAssistantReceipt) => void;
+    }): Promise<WorkflowAssistantWaitOutcome>;
+}
+//# sourceMappingURL=workflowApi.d.ts.map

package/dist/shared/assistant/workflowApi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflowApi.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/workflowApi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,kGAAkG;AAClG,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AACnD,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,wBAAwB;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;IAC7F,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE;YACP,SAAS,EAAE,MAAM,CAAC;YAClB,OAAO,EAAE,MAAM,CAAC;YAChB,UAAU,EAAE,MAAM,CAAC;YACnB,eAAe,EAAE,MAAM,CAAC;SACzB,EAAE,CAAC;KACL,GAAG,IAAI,CAAC;CACV;AACD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,KAAK,CAAC;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AACD,MAAM,WAAW,6BAA6B;IAC5C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,wBAAwB,CAAA;KAAE,CAAC,CAAC;IACrE,OAAO,EAAE,0BAA0B,GAAG,IAAI,CAAC;CAC5C;AACD,MAAM,WAAW,+BAA+B;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,2BAA2B,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AACD,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB;AACD,MAAM,MAAM,4BAA4B,GACpC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAA;CAAE,CAAC;AAoFlE,8EAA8E;AAC9E,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiB3E;AAED,2FAA2F;AAC3F,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,OAAO,2BAAyD;IAG5F,uEAAuE;IACjE,yBAAyB,CAC7B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAAC;IAoBpE,KAAK,CACT,MAAM,EAAE,uBAAuB,EAC/B,KAAK,EAAE,0BAA0B,EACjC,OAAO,EAAE,+BAA+B;IA2CpC,IAAI,CACR,MAAM,EAAE,uBAAuB,EAC/B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,+BAA+B,EACxC,aAAa,UAAQ,GACpB,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IA4BrC,aAAa,CACjB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,+BAA+B,EACxC,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,OAAO,CAAC,iCAAiC,CAAC;IA+BvC,YAAY,CAChB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,+BAA+B,EACxC,oBAAoB,GAAE,MAAM,GAAG,IAAW,GACzC,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IA6D1C,QAAQ,CACZ,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,+BAA+B,EACxC,oBAAoB,EAAE,MAAM,EAC5B,MAAM,GAAE,MAAM,GAAG,IAAW,GAC3B,OAAO,CAAC;QACT,KAAK,EAAE,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAC9C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;IA+DI,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,OAAO,CAAC;IAa9F,sFAAsF;IAChF,IAAI,CACR,MAAM,EAAE,uBAAuB,EAC/B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,+BAA+B,EACxC,OAAO,GAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;KACrD,GACL,OAAO,CAAC,4BAA4B,CAAC;CAmDzC"}

package/dist/shared/assistant/workflowApi.js

@@ -0,0 +1,206 @@
+import { executeAssistantGraphQLOnce as e } from "./gatewayClient.js";
+//#region src/shared/assistant/workflowApi.ts
+var t = "id clientTurnId courseId status partialMessage historyDelivered usageDelivered\n  result { message model tokensUsed sources { reference chunkId documentId knowledgeBaseId } }", n = "runId status workflowId workflowKey version triggerNodeId";
+function r(e) {
+	return typeof e == "string" && e.length > 0 && e.length <= 255;
+}
+function i(e, t, n) {
+	if (!r(n.workspaceId) || !/^[a-zA-Z0-9_.:-]{1,128}$/.test(t) || !r(e.kind === "botmanor" ? e.agentId : e.courseId)) throw Error("Invalid assistant turn scope");
+}
+function a(e) {
+	return !e || typeof e.message != "string" || !e.message.trim() || new TextEncoder().encode(e.message).length > 131072 || typeof e.model != "string" || !e.model || new TextEncoder().encode(e.model).length > 1024 || !Number.isInteger(e.tokensUsed) || e.tokensUsed < 0 || e.tokensUsed > 2147483647 || !Array.isArray(e.sources) || e.sources.length > 100 ? !1 : e.sources.every((e) => e && Number.isInteger(e.reference) && e.reference >= 1 && r(e.chunkId) && r(e.documentId) && r(e.knowledgeBaseId));
+}
+function o(e, t, n) {
+	if (n === null) return null;
+	if (!n) throw Error("Missing assistant turn receipt");
+	if (!r(n.id) || typeof n.historyDelivered != "boolean" || typeof n.usageDelivered != "boolean" || n.clientTurnId !== t || (e.kind === "buildmyiq-course" ? n.courseId !== e.courseId : n.courseId !== null) || ![
+		"READY",
+		"RUNNING",
+		"GENERATED",
+		"COMPLETED",
+		"FAILED",
+		"CANCELLED",
+		"UNKNOWN"
+	].includes(n.status)) throw Error("Invalid assistant turn receipt");
+	if (n.partialMessage != null && (n.status !== "RUNNING" || typeof n.partialMessage != "string" || new TextEncoder().encode(n.partialMessage).length > 131072)) throw Error("Invalid provisional assistant answer");
+	if (n.result !== null && !a(n.result)) throw Error("Invalid assistant answer receipt");
+	if (n.status === "COMPLETED" && (!n.result || !n.historyDelivered || !n.usageDelivered)) throw Error("Assistant answer delivery is incomplete");
+	return n;
+}
+function s(e) {
+	if (!e || typeof e != "object" || !("extensions" in e)) return !1;
+	let t = e.extensions;
+	return !!t && typeof t == "object" && "code" in t && typeof t.code == "string" && [
+		"BAD_USER_INPUT",
+		"FAILED_PRECONDITION",
+		"FORBIDDEN",
+		"NOT_FOUND",
+		"QUOTA_EXHAUSTED",
+		"QUOTA_NOT_PROVISIONED"
+	].includes(t.code);
+}
+var c = class {
+	request;
+	constructor(t = e) {
+		this.request = t;
+	}
+	async courseTargetForEnrollment(e, t) {
+		if (!r(e) || !r(t.workspaceId)) throw Error("Invalid assistant enrollment scope");
+		let n = await this.request({
+			...t,
+			operationName: "ReadCourseAssistantTarget",
+			query: "query ReadCourseAssistantTarget($enrollmentId: ID!) { buiMyCourseAssistantTarget(enrollmentId: $enrollmentId) { courseId } }",
+			variables: { enrollmentId: e }
+		});
+		if (!r(n.buiMyCourseAssistantTarget?.courseId)) throw Error("Invalid assistant course target");
+		return {
+			kind: "buildmyiq-course",
+			courseId: n.buiMyCourseAssistantTarget.courseId
+		};
+	}
+	async start(e, t, a) {
+		if (i(e, t.clientTurnId, a), !a.workspaceId || !/^[a-zA-Z0-9_.:-]{1,128}$/.test(t.clientTurnId) || !/^[a-zA-Z0-9][a-zA-Z0-9_.:-]{7,127}$/.test(t.clientConversationId) || !t.message.trim() || t.message.length > 8192) throw Error("Invalid assistant turn");
+		let o = e.kind === "buildmyiq-course", s = o ? "buiStartCourseAssistantTurn" : "startAssistantTurn", c = o ? "BuiCourseAssistantTurnInput" : "StartAssistantTurnInput", l = (await this.request({
+			...a,
+			operationName: "StartWorkflowAssistantTurn",
+			query: `mutation StartWorkflowAssistantTurn($input: ${c}!) { ${s}(input: $input) { ${n} } }`,
+			variables: { input: {
+				...t,
+				...o ? { courseId: e.courseId } : {
+					agentId: e.agentId,
+					expectedCourseId: null
+				}
+			} }
+		}))[s];
+		if (!l || ![
+			l.runId,
+			l.status,
+			l.workflowId,
+			l.workflowKey,
+			l.version,
+			l.triggerNodeId
+		].every(r)) throw Error("Assistant admission could not be confirmed; recover with the same turn ID");
+		return l;
+	}
+	async read(e, n, r, a = !1) {
+		i(e, n, r);
+		let s = e.kind === "buildmyiq-course", c = s ? a ? "buiRetryCourseAssistantDelivery" : "buiMyCourseAssistantTurn" : a ? "retryMyAssistantTurnDelivery" : "myAssistantTurn", l = a ? "RetryWorkflowAssistantDelivery" : "ReadWorkflowAssistantTurn", u = (await this.request({
+			...r,
+			operationName: l,
+			query: `${a ? "mutation" : "query"} ${l}($clientTurnId: ID!${s ? ", $courseId: ID!" : ""}) {
+        ${c}(clientTurnId: $clientTurnId${s ? ", courseId: $courseId" : ""}) { ${t} }
+      }`,
+			variables: {
+				clientTurnId: n,
+				...s ? { courseId: e.courseId } : {}
+			}
+		}))[c];
+		return o(e, n, u);
+	}
+	async conversations(e, t, n = null) {
+		i(e, "history-list", t);
+		let r = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+		if (n !== null && !r.test(n)) throw Error("Invalid assistant conversation cursor");
+		let a = e.kind === "buildmyiq-course", o = a ? "buiMyCourseAssistantConversations" : "myAssistantWorkflowConversations", s = (await this.request({
+			...t,
+			operationName: "ListWorkflowAssistantConversations",
+			query: `query ListWorkflowAssistantConversations($targetId: ID!, $after: ID) { ${o}(${a ? "courseId" : "agentId"}: $targetId, after: $after) { nodes { clientConversationId createdAt } nextCursor } }`,
+			variables: {
+				targetId: a ? e.courseId : e.agentId,
+				after: n
+			}
+		}))[o];
+		if (!s || !Array.isArray(s.nodes) || s.nodes.length > 20 || s.nodes.some((e) => !e || !/^[a-zA-Z0-9][a-zA-Z0-9_.:-]{7,127}$/.test(e.clientConversationId) || typeof e.createdAt != "string" || !Number.isFinite(Date.parse(e.createdAt))) || s.nextCursor !== null && (!r.test(s.nextCursor) || s.nextCursor === n)) throw Error("Invalid assistant conversation page");
+		return s;
+	}
+	async conversation(e, n, r = null) {
+		if (i(e, "history-read", n), r !== null && !/^[a-zA-Z0-9][a-zA-Z0-9_.:-]{7,127}$/.test(r)) throw Error("Invalid assistant conversation");
+		let a = e.kind === "buildmyiq-course", s = a ? "buiMyCourseAssistantConversation" : "myAssistantWorkflowConversation", c = a ? "courseId" : "agentId", l = (await this.request({
+			...n,
+			operationName: "ReadWorkflowAssistantConversation",
+			query: `query ReadWorkflowAssistantConversation($targetId: ID!, $clientConversationId: ID) { ${s}(${c}: $targetId, clientConversationId: $clientConversationId) {
+        clientConversationId turns { message receipt { ${t} } } pending { clientTurnId clientConversationId message }
+      } }`,
+			variables: {
+				targetId: a ? e.courseId : e.agentId,
+				clientConversationId: r
+			}
+		}))[s];
+		if (l === null) return null;
+		if (!l || r !== null && l.clientConversationId !== r || !/^[a-zA-Z0-9][a-zA-Z0-9_.:-]{7,127}$/.test(l.clientConversationId) || !Array.isArray(l.turns) || l.turns.length > 6) throw Error("Invalid assistant conversation receipt");
+		let u = /* @__PURE__ */ new Set();
+		for (let t of l.turns) {
+			if (!t || typeof t.message != "string" || t.message.length > 8192 || !t.receipt || t.receipt.status !== "COMPLETED" || !/^[a-zA-Z0-9_.:-]{1,128}$/.test(t.receipt.clientTurnId) || u.has(t.receipt.clientTurnId)) throw Error("Invalid assistant history turn");
+			o(e, t.receipt.clientTurnId, t.receipt), u.add(t.receipt.clientTurnId);
+		}
+		let d = l.pending;
+		if (d !== null && (!d || !/^[a-zA-Z0-9_.:-]{1,128}$/.test(d.clientTurnId) || d.clientConversationId !== l.clientConversationId || typeof d.message != "string" || !d.message.trim() || d.message.length > 8192 || u.has(d.clientTurnId))) throw Error("Invalid assistant recovery handle");
+		return l;
+	}
+	async messages(e, n, r, a = null) {
+		if (i(e, "history-page", n), !/^[a-zA-Z0-9][a-zA-Z0-9_.:-]{7,127}$/.test(r) || a !== null && (a.length > 4096 || !/^[A-Za-z0-9_-]+$/.test(a))) throw Error("Invalid assistant transcript cursor");
+		let s = e.kind === "buildmyiq-course", c = s ? "buiMyCourseAssistantMessages" : "myAssistantWorkflowConversationMessages", l = (await this.request({
+			...n,
+			operationName: "ReadWorkflowAssistantMessages",
+			query: `query ReadWorkflowAssistantMessages($targetId:ID!,$clientConversationId:ID!,$before:String) { ${c}(${s ? "courseId" : "agentId"}:$targetId,clientConversationId:$clientConversationId,before:$before) { turns { message receipt { ${t} } } nextCursor } }`,
+			variables: {
+				targetId: s ? e.courseId : e.agentId,
+				clientConversationId: r,
+				before: a
+			}
+		}))[c];
+		if (!l || !Array.isArray(l.turns) || l.turns.length > 25 || l.nextCursor !== null && (typeof l.nextCursor != "string" || l.nextCursor.length > 4096 || !/^[A-Za-z0-9_-]+$/.test(l.nextCursor) || l.nextCursor === a)) throw Error("Invalid assistant transcript page");
+		let u = /* @__PURE__ */ new Set(), d = 0;
+		for (let t of l.turns) {
+			if (!t || typeof t.message != "string" || !t.receipt || t.receipt.status !== "COMPLETED" || !t.receipt.result || u.has(t.receipt.clientTurnId)) throw Error("Invalid assistant transcript turn");
+			o(e, t.receipt.clientTurnId, t.receipt), u.add(t.receipt.clientTurnId), d += new TextEncoder().encode(t.message).length + new TextEncoder().encode(t.receipt.result.message).length;
+		}
+		if (d > 262144) throw Error("Invalid assistant transcript size");
+		return l;
+	}
+	async cancel(e, t) {
+		if (!r(t.workspaceId) || !/^[a-zA-Z0-9_.:-]{1,128}$/.test(e)) throw Error("Invalid assistant turn scope");
+		return (await this.request({
+			...t,
+			operationName: "CancelWorkflowAssistantTurn",
+			query: "mutation CancelWorkflowAssistantTurn($clientTurnId: ID!) { cancelMyAssistantTurn(clientTurnId: $clientTurnId) }",
+			variables: { clientTurnId: e }
+		})).cancelMyAssistantTurn === !0;
+	}
+	async wait(e, t, n, r = {}) {
+		let i = r.budgetMs ?? 18e4, a = r.intervalMs ?? 1e3;
+		if (!Number.isInteger(i) || i < 100 || i > 6e5 || !Number.isInteger(a) || a < 10 || a > 5e3) throw Error("Invalid assistant polling budget");
+		let o = Date.now() + i, s = null, c = 0;
+		for (; Date.now() < o;) {
+			if (n.signal?.throwIfAborted(), s = await this.read(e, t, n), s?.status === "GENERATED" && Date.now() >= c && (c = Date.now() + 5e3, s = await this.read(e, t, n, !0)), s) {
+				if (r.onProgress?.(s), s.status === "COMPLETED") return {
+					kind: "completed",
+					receipt: s
+				};
+				if ([
+					"FAILED",
+					"UNKNOWN",
+					"CANCELLED"
+				].includes(s.status)) return {
+					kind: "terminal",
+					receipt: s
+				};
+			}
+			if (n.signal?.throwIfAborted(), Date.now() >= o) break;
+			await new Promise((e, t) => {
+				let r = () => n.signal?.removeEventListener("abort", s), i = setTimeout(() => {
+					r(), e();
+				}, Math.min(a, o - Date.now())), s = () => {
+					clearTimeout(i), r(), t(n.signal?.reason ?? new DOMException("Aborted", "AbortError"));
+				};
+				n.signal?.addEventListener("abort", s, { once: !0 }), n.signal?.aborted && s();
+			});
+		}
+		return {
+			kind: "pending",
+			receipt: s
+		};
+	}
+};
+//#endregion
+export { c as AssistantWorkflowClient, s as isWorkflowAssistantAdmissionRefusal };

package/dist/shared/components/SSORedirectGuard.d.ts

@@ -15,6 +15,21 @@ export declare function clearSSORelayAttempt(): void;
 export declare function shouldSkipSSORedirect(returnPath?: string): boolean;
 export declare function hasRecentSSORedirectAttempt(relayOrigin: string, returnTo: string): boolean;
 export declare function markSSORedirectAttempt(relayOrigin: string, returnTo: string): void;
+/**
+ * Check if an SSO redirect should be initiated.
+ * Returns the redirect URL if SSO should happen, null otherwise.
+ *
+ * Call this from ProtectedRoute or LandingOrDashboardRedirect
+ * before showing login page.
+ *
+ * Cross-eTLD+1 product shells always start at the central bridge
+ * (alphaapp/app.burdenoff.com): product cookies are first-party only and must
+ * not route a visitor through a different product origin. The bridge reads its
+ * own first-party session state — including its profile-origin hint — then
+ * returns to the original product origin through `/auth/sso-callback#sso=...`.
+ * On no central session the bridge bounces back with `?sso_failed=1` and
+ * `isAutoSSOSuppressed` keeps the user on the login screen.
+ */
 export declare function getSSORedirectUrl(returnPath?: string): string | null;
 /**
  * Check if Single Logout (SLO) has occurred on another shell.

package/dist/shared/components/SSORedirectGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SSORedirectGuard.d.ts","sourceRoot":"","sources":["../../../src/shared/components/SSORedirectGuard.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAuDH,wBAAgB,oBAAoB,IAAI,IAAI,CAM3C;AA2CD,wBAAgB,qBAAqB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM1F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBlF;AA+BD,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqDpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,IAAI,OAAO,CA6BlC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyC9F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CA6B1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,4CAEjC"}
+{"version":3,"file":"SSORedirectGuard.d.ts","sourceRoot":"","sources":["../../../src/shared/components/SSORedirectGuard.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAuDH,wBAAgB,oBAAoB,IAAI,IAAI,CAM3C;AA2CD,wBAAgB,qBAAqB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM1F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBlF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqDpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,IAAI,OAAO,CA6BlC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyC9F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CA6B1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,4CAEjC"}

package/dist/shared/components/SSORedirectGuard.js

@@ -1,16 +1,16 @@
 import { resolveAuthBridgeConfig as e } from "../config/authBridgeUrls.js";
 import { clearActiveContextStorage as t } from "../providers/shell/ActiveContextStorage.js";
 import { clearShellSsoCookies as n, isLocalDevSsoHost as r, isSharedSsoCookieDomain as i, isTrustedSsoOrigin as a, readShellSsoCookie as o } from "../utils/authCookie.js";
-import { isElectron as s, isNative as c } from "../native/platform.js";
-import { BrandedSplash as l } from "../../ui/branded-splash.js";
-import { jsx as u } from "react/jsx-runtime";
+import { isRealNativeOrDesktopShell as s } from "../native/platform.js";
+import { BrandedSplash as c } from "../../ui/branded-splash.js";
+import { jsx as l } from "react/jsx-runtime";
 //#region src/shared/components/SSORedirectGuard.tsx
-var d = "bf-sso-relay-attempt", f = 120 * 1e3, p = [
+var u = "bf-sso-relay-attempt", d = 120 * 1e3, f = [
 	"sso_failed",
 	"sso-failed",
 	"sso-attempted"
 ];
-function m(e) {
+function p(e) {
 	if (typeof window > "u") return null;
 	try {
 		let t = `${window.location.pathname}${window.location.search}${window.location.hash}`, n = new URL(e ?? t, window.location.origin);
@@ -19,73 +19,70 @@ function m(e) {
 		return null;
 	}
 }
-function h(e) {
+function m(e) {
 	return e === "/auth" || e.startsWith("/auth/");
 }
-function g(e) {
-	return p.some((t) => e.searchParams.has(t));
+function h(e) {
+	return f.some((t) => e.searchParams.has(t));
 }
-function _(e) {
-	if (g(e)) return n(), !0;
-	if (h(e.pathname)) return !0;
+function g(e) {
+	if (h(e)) return n(), !0;
+	if (m(e.pathname)) return !0;
 	let t = e.searchParams.get("reason");
 	return t === "session-expired" || t === "logout";
 }
-function v() {
+function _() {
 	try {
-		sessionStorage.removeItem(d);
+		sessionStorage.removeItem(u);
 	} catch {}
 }
-function y() {
+function v() {
 	if (typeof window > "u") return null;
 	try {
-		let e = sessionStorage.getItem(d);
+		let e = sessionStorage.getItem(u);
 		if (!e) return null;
 		let t = JSON.parse(e);
-		return typeof t.relayOrigin != "string" || typeof t.returnTo != "string" || typeof t.startedAt != "number" || Date.now() - t.startedAt > f ? (v(), null) : {
+		return typeof t.relayOrigin != "string" || typeof t.returnTo != "string" || typeof t.startedAt != "number" || Date.now() - t.startedAt > d ? (_(), null) : {
 			relayOrigin: t.relayOrigin,
 			returnTo: t.returnTo,
 			startedAt: t.startedAt
 		};
 	} catch {
-		return v(), null;
+		return _(), null;
 	}
 }
-function b(e) {
+function y(e) {
 	try {
 		return new URL(e).origin;
 	} catch {
 		return null;
 	}
 }
-function x(e) {
-	let t = m(e);
-	return !t || _(t);
+function b(e) {
+	let t = p(e);
+	return !t || g(t);
 }
-function S(e, t) {
-	let n = b(e), r = m(t), i = y();
+function x(e, t) {
+	let n = y(e), r = p(t), i = v();
 	return !!(n && r && i?.returnTo === r.href);
 }
-function C(e, t) {
+function S(e, t) {
 	if (typeof window > "u") return;
-	let n = b(e), r = m(t);
+	let n = y(e), r = p(t);
 	if (!(!n || !r)) try {
 		let e = {
 			relayOrigin: n,
 			returnTo: r.href,
 			startedAt: Date.now()
 		};
-		sessionStorage.setItem(d, JSON.stringify(e));
+		sessionStorage.setItem(u, JSON.stringify(e));
 	} catch {}
 }
-function w() {
-	return c() || s();
-}
-function T(t) {
-	if (w()) return null;
+function C(t) {
+	if (s()) return null;
 	try {
-		let n = m(t);
-		if (!n || _(n) || r()) return null;
+		let n = p(t);
+		if (!n || g(n) || r()) return null;
 		let i = window.location.origin, s = null;
 		try {
 			s = new URL(e().url).origin;
@@ -93,23 +90,23 @@ function T(t) {
 		let c = o();
 		if (s === i && c?.origin && a(c.origin)) {
 			let e = new URL(c.origin).origin;
-			if (e && e !== i && !S(e, n.href)) return C(e, n.href), `${e}/auth/sso-relay?returnTo=${encodeURIComponent(n.href)}`;
+			if (e && e !== i && !x(e, n.href)) return S(e, n.href), `${e}/auth/sso-relay?returnTo=${encodeURIComponent(n.href)}`;
 		}
-		return s && s !== i && !S(s, n.href) ? (C(s, n.href), `${s}/auth/sso-relay?returnTo=${encodeURIComponent(n.href)}`) : null;
+		return s && s !== i && !x(s, n.href) ? (S(s, n.href), `${s}/auth/sso-relay?returnTo=${encodeURIComponent(n.href)}`) : null;
 	} catch {
 		return null;
 	}
 }
-function E() {
+function w() {
 	try {
 		if (o()) return !1;
 		let e = sessionStorage.getItem("bf-active-profile");
-		return !e || !localStorage.getItem(`bf-p-${e}-tokens`) || !i() ? !1 : (O(), !0);
+		return !e || !localStorage.getItem(`bf-p-${e}-tokens`) || !i() ? !1 : (E(), !0);
 	} catch {
 		return !1;
 	}
 }
-async function D(e, t) {
+async function T(e, t) {
 	try {
 		let n = await fetch(e, {
 			method: "POST",
@@ -126,7 +123,7 @@ async function D(e, t) {
 		return !1;
 	}
 }
-function O() {
+function E() {
 	try {
 		let e = localStorage.getItem("bf-profiles");
 		if (e) {
@@ -137,8 +134,8 @@ function O() {
 		localStorage.removeItem("bf-profiles"), localStorage.removeItem("auth-storage"), sessionStorage.removeItem("bf-active-profile"), t(), n(), window.dispatchEvent(new Event("bf-auth-state-cleared")), window.dispatchEvent(new Event("bf-profile-storage-change"));
 	} catch {}
 }
-function k() {
-	return /* @__PURE__ */ u(l, { label: "Signing you in…" });
+function D() {
+	return /* @__PURE__ */ l(c, { label: "Signing you in…" });
 }
 //#endregion
-export { k as SSORedirectSpinner, D as checkRemoteSLO, E as checkSLO, O as clearLocalAuthState, v as clearSSORelayAttempt, T as getSSORedirectUrl, S as hasRecentSSORedirectAttempt, C as markSSORedirectAttempt, x as shouldSkipSSORedirect };
+export { D as SSORedirectSpinner, T as checkRemoteSLO, w as checkSLO, E as clearLocalAuthState, _ as clearSSORelayAttempt, C as getSSORedirectUrl, x as hasRecentSSORedirectAttempt, S as markSSORedirectAttempt, b as shouldSkipSSORedirect };

package/dist/shared/native/platform.d.ts

@@ -6,6 +6,12 @@ export declare function isAndroid(): boolean;
 export declare function isWeb(): boolean;
 /** Running inside an Electron desktop shell. */
 export declare function isElectron(): boolean;
+/**
+ * Whether cross-origin session hops should stay inside the current product origin.
+ * Capacitor is detected independently of boot order; presentation previews remain
+ * ordinary browser tabs so their bridge-host session maintenance still runs.
+ */
+export declare function isRealNativeOrDesktopShell(): boolean;
 /** Running as an installed / standalone PWA (added to home screen / installed). */
 export declare function isStandalonePWA(): boolean;
 /**

package/dist/shared/native/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../../src/shared/native/platform.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAEvD,wBAAgB,WAAW,IAAI,uBAAuB,CAIrD;AAED,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAED,wBAAgB,KAAK,IAAI,OAAO,CAE/B;AAED,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED,wBAAgB,KAAK,IAAI,OAAO,CAE/B;AAED,gDAAgD;AAChD,wBAAgB,UAAU,IAAI,OAAO,CAapC;AAED,mFAAmF;AACnF,wBAAgB,eAAe,IAAI,OAAO,CAQzC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../../src/shared/native/platform.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAEvD,wBAAgB,WAAW,IAAI,uBAAuB,CAIrD;AAED,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAED,wBAAgB,KAAK,IAAI,OAAO,CAE/B;AAED,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED,wBAAgB,KAAK,IAAI,OAAO,CAE/B;AAED,gDAAgD;AAChD,wBAAgB,UAAU,IAAI,OAAO,CAapC;AAYD;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAIpD;AAED,mFAAmF;AACnF,wBAAgB,eAAe,IAAI,OAAO,CAQzC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}

package/dist/shared/native/platform.js

@@ -1,35 +1,42 @@
-import { getNativeBridge as e } from "./bridge.js";
+import { isCapacitorNative as e } from "./capacitor.js";
+import { getNativeBridge as t } from "./bridge.js";
 //#region src/shared/native/platform.ts
-function t() {
-	let t = e();
-	return t ? t.getPlatform() : "web";
-}
 function n() {
-	return e()?.isNativePlatform() ?? !1;
+	let e = t();
+	return e ? e.getPlatform() : "web";
 }
 function r() {
-	return t() === "ios";
+	return t()?.isNativePlatform() ?? !1;
 }
 function i() {
-	return t() === "android";
+	return n() === "ios";
 }
 function a() {
-	return t() === "web";
+	return n() === "android";
 }
 function o() {
-	return typeof window > "u" ? !1 : !!(window.__burdenoffDesktop?.isElectron || typeof navigator < "u" && /electron/i.test(navigator.userAgent) || typeof window < "u" && window.process?.type === "renderer");
+	return n() === "web";
 }
 function s() {
+	return typeof window > "u" ? !1 : !!(window.__burdenoffDesktop?.isElectron || typeof navigator < "u" && /electron/i.test(navigator.userAgent) || typeof window < "u" && window.process?.type === "renderer");
+}
+function c() {
+	return typeof document < "u" && !!document.documentElement?.dataset?.nativePreview;
+}
+function l() {
+	return e() ? !0 : c() ? !1 : r() || s();
+}
+function u() {
 	if (typeof window > "u") return !1;
 	if (document?.documentElement?.dataset?.nativePreview === "pwa") return !0;
 	let e = window.matchMedia?.("(display-mode: standalone)")?.matches ?? !1, t = window.navigator.standalone === !0;
 	return e || t;
 }
-function c() {
-	return n() || o() || s();
+function d() {
+	return r() || s() || u();
 }
-function l() {
-	return !c();
+function f() {
+	return !d();
 }
 //#endregion
-export { t as getPlatform, i as isAndroid, o as isElectron, r as isIOS, c as isInstalledApp, n as isNative, s as isStandalonePWA, a as isWeb, l as isWebBrowser };
+export { n as getPlatform, a as isAndroid, s as isElectron, i as isIOS, d as isInstalledApp, r as isNative, l as isRealNativeOrDesktopShell, u as isStandalonePWA, o as isWeb, f as isWebBrowser };

package/dist/shared/providers/shell/authProvider/ssoRelay.d.ts

@@ -7,9 +7,9 @@
  * getSSORedirectUrl would relay the stale session back on the next visit
  * and the user would silently stay logged in.
  *
- * Returns null when no detour is needed (already on the bridge host, or
- * unable to resolve a bridge URL — caller should just stay/navigate on its
- * own origin).
+ * Returns null when no detour is needed (already on the bridge host, inside a
+ * native or desktop shell, or unable to resolve a bridge URL — caller should
+ * just stay/navigate on its own origin).
  */
 export declare function getCrossOriginLogoutUrl(): string | null;
 export declare function hasLocalProfileSession(profileId: string | null): boolean;

package/dist/shared/providers/shell/authProvider/ssoRelay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssoRelay.d.ts","sourceRoot":"","sources":["../../../../../src/shared/providers/shell/authProvider/ssoRelay.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAWvD;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAWxE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BrE"}
+{"version":3,"file":"ssoRelay.d.ts","sourceRoot":"","sources":["../../../../../src/shared/providers/shell/authProvider/ssoRelay.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAYvD;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAWxE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2BrE"}