@burdenoff/fe-libs 2026.1021.1 → 2026.1021.3

package/dist/shared/components/LandingOrDashboardRedirect.d.ts

@@ -0,0 +1,45 @@
+import { ReactNode } from 'react';
+/** What the `/` route renders. */
+export type LandingGateDecision = 'loading' | 'home' | 'native-welcome' | 'landing';
+export interface LandingGateInput {
+    /** The auth provider is still settling (bridge handshake, hydration). */
+    isLoading: boolean;
+    /** A usable session exists (in-memory or persisted for the active profile). */
+    hasSession: boolean;
+    /** The shell runs as an installed app (see `shouldShowNativeWelcome`). */
+    isInstalledApp: boolean;
+    /** Whether the shell supplied a native welcome page. */
+    hasNativeWelcome: boolean;
+}
+/**
+ * Pure decision for the `/` route. There is intentionally no "sso" outcome:
+ * the landing gate never relays an anonymous visitor to the auth bridge.
+ */
+export declare function resolveLandingGate(input: LandingGateInput): LandingGateDecision;
+/**
+ * Whether the active profile has an unexpired access token persisted in
+ * storage — the profile token slot first, then microfe-auth's per-profile
+ * persisted store. Covers the window right after sign-in, before the
+ * AuthProvider has picked the new tokens up. Never throws.
+ */
+export declare function hasStoredValidSession(now?: number): boolean;
+export interface LandingGateViewProps {
+    decision: LandingGateDecision;
+    /** Product home for signed-in visitors, e.g. `/dashboard` or `/vibecontrols`. */
+    homePath: string;
+    /** Public marketing landing for anonymous browser visitors. */
+    landing: ReactNode;
+    /** Installed-app welcome; when omitted installed apps get `landing`. */
+    nativeWelcome?: ReactNode;
+    /** Rendered while auth settles. Defaults to the branded splash. */
+    loadingFallback?: ReactNode;
+    /** Suspense message while a lazy landing / welcome page loads. */
+    loadingMessage?: string;
+}
+/** Renders a `LandingGateDecision`. Exported for shells and tests. */
+export declare function LandingGateView({ decision, homePath, landing, nativeWelcome, loadingFallback, loadingMessage, }: LandingGateViewProps): import('react/jsx-runtime').JSX.Element;
+export type LandingOrDashboardRedirectProps = Omit<LandingGateViewProps, 'decision'>;
+/**
+ * The `/` route element. Must render inside `AuthProvider` and a router.
+ */
+export declare function LandingOrDashboardRedirect(props: LandingOrDashboardRedirectProps): import('react/jsx-runtime').JSX.Element;

package/dist/shared/components/LandingOrDashboardRedirect.js

@@ -0,0 +1,63 @@
+import { getProfileTokens as e, resolveActiveProfileId as t } from "../providers/shell/ProfileStorageManager.js";
+import { BrandedSplash as n } from "../../ui/branded-splash.js";
+import { getJwtExpiry as r } from "../providers/shell/authProvider/jwt.js";
+import { useAuth as i } from "../providers/shell/AuthProvider.js";
+import { MicrofrontendErrorBoundary as a } from "./MicrofrontendErrorBoundary.js";
+import { shouldShowNativeWelcome as o } from "../native/entry.js";
+import { Fragment as s, jsx as c } from "react/jsx-runtime";
+import { Navigate as l } from "react-router";
+//#region src/shared/components/LandingOrDashboardRedirect.tsx
+function u(e) {
+	return e.isLoading ? "loading" : e.hasSession ? "home" : e.isInstalledApp && e.hasNativeWelcome ? "native-welcome" : "landing";
+}
+function d(e, t) {
+	if (!e) return !1;
+	let n = r(e);
+	return n !== null && n > t;
+}
+function f(e) {
+	let t = localStorage.getItem(e ? `bf-p-${e}-auth-storage` : "auth-storage");
+	if (!t) return null;
+	let n = JSON.parse(t)?.state?.accessToken;
+	return typeof n == "string" && n ? n : null;
+}
+function p(n = Date.now()) {
+	if (typeof window > "u") return !1;
+	try {
+		let r = t();
+		return d(r ? e(r)?.accessToken : null, n) ? !0 : d(f(r), n);
+	} catch {
+		return !1;
+	}
+}
+function m({ decision: e, homePath: t, landing: r, nativeWelcome: i, loadingFallback: o, loadingMessage: u }) {
+	switch (e) {
+		case "loading": return /* @__PURE__ */ c(s, { children: o ?? /* @__PURE__ */ c(n, {}) });
+		case "home": return /* @__PURE__ */ c(l, {
+			to: t,
+			replace: !0
+		});
+		case "native-welcome": return /* @__PURE__ */ c(a, {
+			loadingMessage: u,
+			children: i
+		});
+		case "landing": return /* @__PURE__ */ c(a, {
+			loadingMessage: u,
+			children: r
+		});
+	}
+}
+function h(e) {
+	let t = i();
+	return /* @__PURE__ */ c(m, {
+		decision: u({
+			isLoading: t.isLoading,
+			hasSession: !t.isLoading && (!!t.tokens?.accessToken || p()),
+			isInstalledApp: o(),
+			hasNativeWelcome: e.nativeWelcome !== void 0
+		}),
+		...e
+	});
+}
+//#endregion
+export { m as LandingGateView, h as LandingOrDashboardRedirect, p as hasStoredValidSession, u as resolveLandingGate };

package/dist/shared/components/SSORedirectGuard.d.ts

@@ -2,8 +2,12 @@
  * SSORedirectGuard — Checks for SSO cookie and redirects to login origin
  * for token relay if the current origin doesn't have local tokens.
  *
- * This component should be rendered in route guards (ProtectedRoute,
- * LandingOrDashboardRedirect) to enable cross-domain SSO.
+ * SSO discovery belongs ONLY where a session is genuinely required: a
+ * ProtectedRoute guard, and explicit "Sign in" CTAs. Never call it from the
+ * public landing gate (`/`): bouncing an anonymous visitor into the relay means
+ * nobody ever sees the landing page, and when no central session exists the
+ * bridge sends them back to `/?sso_failed=1` (BOFF-6457 / 6482 / 6494). Use
+ * `LandingOrDashboardRedirect` from this package for the `/` route instead.
  *
  * Works in all environments (local dev, alpha, production):
  * - Local dev: cookie on .local.burdenoff.com shared domain
@@ -19,8 +23,13 @@ export declare function markSSORedirectAttempt(relayOrigin: string, returnTo: st
  * Check if an SSO redirect should be initiated.
  * Returns the redirect URL if SSO should happen, null otherwise.
  *
- * Call this from ProtectedRoute or LandingOrDashboardRedirect
- * before showing login page.
+ * Call this from ProtectedRoute (before falling back to the login page) or
+ * from an explicit sign-in CTA — never from the public landing gate. Prefer
+ * `redirectToSSO()`, which also performs the allowlisted navigation.
+ *
+ * The returned URL always passes `isAllowedRedirectUrl`; a relay target that
+ * would not (a misconfigured bridge, say) yields `null` and leaves no relay
+ * attempt marker behind.
  *
  * Cross-eTLD+1 product shells always start at the central bridge
  * (alphaapp/app.burdenoff.com): product cookies are first-party only and must
@@ -31,6 +40,17 @@ export declare function markSSORedirectAttempt(relayOrigin: string, returnTo: st
  * `isAutoSSOSuppressed` keeps the user on the login screen.
  */
 export declare function getSSORedirectUrl(returnPath?: string): string | null;
+/**
+ * Start SSO discovery: resolve the relay URL with `getSSORedirectUrl()` and
+ * navigate to it through the cross-origin allowlist.
+ *
+ * Returns `true` when the navigation was started (render
+ * `<SSORedirectSpinner />` meanwhile) and `false` when there is nothing to
+ * relay to, so the caller can fall back to the in-app login route.
+ *
+ * For ProtectedRoute and sign-in CTAs only — never the public landing gate.
+ */
+export declare function redirectToSSO(returnPath?: string): boolean;
 /**
  * Check if Single Logout (SLO) has occurred on another shell.
  *
@@ -59,6 +79,6 @@ export declare function checkRemoteSLO(gatewayUrl: string, accessToken: string):
 export declare function clearLocalAuthState(): void;
 /**
  * React component that renders a spinner while redirecting.
- * Use this as the return value when getSSORedirectUrl() returns a URL.
+ * Use this as the return value when `redirectToSSO()` returns true.
  */
 export declare function SSORedirectSpinner(): import('react/jsx-runtime').JSX.Element;

package/dist/shared/components/SSORedirectGuard.js

@@ -3,14 +3,15 @@ import { clearActiveContextStorage as t } from "../providers/shell/ActiveContext
 import { clearShellSsoCookies as n, isLocalDevSsoHost as r, isSharedSsoCookieDomain as i, isTrustedSsoOrigin as a, readShellSsoCookie as o } from "../utils/authCookie.js";
 import { isRealNativeOrDesktopShell as s } from "../native/platform.js";
 import { BrandedSplash as c } from "../../ui/branded-splash.js";
-import { jsx as l } from "react/jsx-runtime";
+import { isAllowedRedirectUrl as l, replaceLocationWithAllowlist as u } from "../utils/redirectAllowlist.js";
+import { jsx as d } from "react/jsx-runtime";
 //#region src/shared/components/SSORedirectGuard.tsx
-var u = "bf-sso-relay-attempt", d = 120 * 1e3, f = [
+var f = "bf-sso-relay-attempt", p = 120 * 1e3, m = [
 	"sso_failed",
 	"sso-failed",
 	"sso-attempted"
 ];
-function p(e) {
+function h(e) {
 	if (typeof window > "u") return null;
 	try {
 		let t = `${window.location.pathname}${window.location.search}${window.location.hash}`, n = new URL(e ?? t, window.location.origin);
@@ -19,70 +20,74 @@ function p(e) {
 		return null;
 	}
 }
-function m(e) {
+function g(e) {
 	return e === "/auth" || e.startsWith("/auth/");
 }
-function h(e) {
-	return f.some((t) => e.searchParams.has(t));
+function _(e) {
+	return m.some((t) => e.searchParams.has(t));
 }
-function g(e) {
-	if (h(e)) return n(), !0;
-	if (m(e.pathname)) return !0;
+function v(e) {
+	if (_(e)) return n(), !0;
+	if (g(e.pathname)) return !0;
 	let t = e.searchParams.get("reason");
 	return t === "session-expired" || t === "logout";
 }
-function _() {
+function y() {
 	try {
-		sessionStorage.removeItem(u);
+		sessionStorage.removeItem(f);
 	} catch {}
 }
-function v() {
+function b() {
 	if (typeof window > "u") return null;
 	try {
-		let e = sessionStorage.getItem(u);
+		let e = sessionStorage.getItem(f);
 		if (!e) return null;
 		let t = JSON.parse(e);
-		return typeof t.relayOrigin != "string" || typeof t.returnTo != "string" || typeof t.startedAt != "number" || Date.now() - t.startedAt > d ? (_(), null) : {
+		return typeof t.relayOrigin != "string" || typeof t.returnTo != "string" || typeof t.startedAt != "number" || Date.now() - t.startedAt > p ? (y(), null) : {
 			relayOrigin: t.relayOrigin,
 			returnTo: t.returnTo,
 			startedAt: t.startedAt
 		};
 	} catch {
-		return _(), null;
+		return y(), null;
 	}
 }
-function y(e) {
+function x(e) {
 	try {
 		return new URL(e).origin;
 	} catch {
 		return null;
 	}
 }
-function b(e) {
-	let t = p(e);
-	return !t || g(t);
+function S(e) {
+	let t = h(e);
+	return !t || v(t);
 }
-function x(e, t) {
-	let n = y(e), r = p(t), i = v();
+function C(e, t) {
+	let n = x(e), r = h(t), i = b();
 	return !!(n && r && i?.returnTo === r.href);
 }
-function S(e, t) {
+function w(e, t) {
 	if (typeof window > "u") return;
-	let n = y(e), r = p(t);
+	let n = x(e), r = h(t);
 	if (!(!n || !r)) try {
 		let e = {
 			relayOrigin: n,
 			returnTo: r.href,
 			startedAt: Date.now()
 		};
-		sessionStorage.setItem(u, JSON.stringify(e));
+		sessionStorage.setItem(f, JSON.stringify(e));
 	} catch {}
 }
-function C(t) {
+function T(e, t) {
+	let n = `${e}/auth/sso-relay?returnTo=${encodeURIComponent(t.href)}`;
+	return l(n) ? n : null;
+}
+function E(t) {
 	if (s()) return null;
 	try {
-		let n = p(t);
-		if (!n || g(n) || r()) return null;
+		let n = h(t);
+		if (!n || v(n) || r()) return null;
 		let i = window.location.origin, s = null;
 		try {
 			s = new URL(e().url).origin;
@@ -90,23 +95,34 @@ function C(t) {
 		let c = o();
 		if (s === i && c?.origin && a(c.origin)) {
 			let e = new URL(c.origin).origin;
-			if (e && e !== i && !x(e, n.href)) return S(e, n.href), `${e}/auth/sso-relay?returnTo=${encodeURIComponent(n.href)}`;
+			if (e && e !== i) {
+				let t = T(e, n);
+				if (t && !C(e, n.href)) return w(e, n.href), t;
+			}
+		}
+		if (s && s !== i) {
+			let e = T(s, n);
+			if (e && !C(s, n.href)) return w(s, n.href), e;
 		}
-		return s && s !== i && !x(s, n.href) ? (S(s, n.href), `${s}/auth/sso-relay?returnTo=${encodeURIComponent(n.href)}`) : null;
+		return null;
 	} catch {
 		return null;
 	}
 }
-function w() {
+function D(e) {
+	let t = E(e);
+	return t ? u(t) : !1;
+}
+function O() {
 	try {
 		if (o()) return !1;
 		let e = sessionStorage.getItem("bf-active-profile");
-		return !e || !localStorage.getItem(`bf-p-${e}-tokens`) || !i() ? !1 : (E(), !0);
+		return !e || !localStorage.getItem(`bf-p-${e}-tokens`) || !i() ? !1 : (A(), !0);
 	} catch {
 		return !1;
 	}
 }
-async function T(e, t) {
+async function k(e, t) {
 	try {
 		let n = await fetch(e, {
 			method: "POST",
@@ -123,7 +139,7 @@ async function T(e, t) {
 		return !1;
 	}
 }
-function E() {
+function A() {
 	try {
 		let e = localStorage.getItem("bf-profiles");
 		if (e) {
@@ -134,8 +150,8 @@ function E() {
 		localStorage.removeItem("bf-profiles"), localStorage.removeItem("auth-storage"), sessionStorage.removeItem("bf-active-profile"), t(), n(), window.dispatchEvent(new Event("bf-auth-state-cleared")), window.dispatchEvent(new Event("bf-profile-storage-change"));
 	} catch {}
 }
-function D() {
-	return /* @__PURE__ */ l(c, { label: "Signing you in…" });
+function j() {
+	return /* @__PURE__ */ d(c, { label: "Signing you in…" });
 }
 //#endregion
-export { D as SSORedirectSpinner, T as checkRemoteSLO, w as checkSLO, E as clearLocalAuthState, _ as clearSSORelayAttempt, C as getSSORedirectUrl, x as hasRecentSSORedirectAttempt, S as markSSORedirectAttempt, b as shouldSkipSSORedirect };
+export { j as SSORedirectSpinner, k as checkRemoteSLO, O as checkSLO, A as clearLocalAuthState, y as clearSSORelayAttempt, E as getSSORedirectUrl, C as hasRecentSSORedirectAttempt, w as markSSORedirectAttempt, D as redirectToSSO, S as shouldSkipSSORedirect };

package/dist/shared/components/index.d.ts

@@ -25,7 +25,9 @@ export { UpgradePromptModal, dispatchUpgradePrompt, UPGRADE_PROMPT_EVENT, } from
 export type { UpgradePromptModalProps, UpgradePromptDetail } from './UpgradePromptModal';
 export { UpgradeInlineBanner } from './UpgradeInlineBanner';
 export type { UpgradeInlineBannerProps } from './UpgradeInlineBanner';
-export { getSSORedirectUrl, SSORedirectSpinner, checkSLO, checkRemoteSLO, clearLocalAuthState, } from './SSORedirectGuard';
+export { getSSORedirectUrl, redirectToSSO, SSORedirectSpinner, checkSLO, checkRemoteSLO, clearLocalAuthState, } from './SSORedirectGuard';
+export { LandingOrDashboardRedirect, LandingGateView, resolveLandingGate, hasStoredValidSession, } from './LandingOrDashboardRedirect';
+export type { LandingOrDashboardRedirectProps, LandingGateViewProps, LandingGateDecision, LandingGateInput, } from './LandingOrDashboardRedirect';
 export { AssistantWidget, ASSISTANT_WIDGET_TOGGLE_EVENT } from './assistantWidget/AssistantWidget';
 export type { AssistantWidgetProps, AssistantModeOption } from './assistantWidget/AssistantWidget';
 export { useVoiceInput } from './assistantWidget/useVoiceInput';

package/dist/shared/utils/index.d.ts

@@ -22,6 +22,8 @@ export { initializeLogger, setUserContext, clearUserContext, } from './loggerIni
 export type { InitLoggerOptions } from './loggerInit';
 export { setSSoCookie, getSSoCookie, clearSSoCookie, setShellSsoCookies, readShellSsoCookie, clearShellSsoCookies, isSharedSsoCookieDomain, isTrustedSsoOrigin, } from './authCookie';
 export type { ShellSsoCookieData } from './authCookie';
+export { isAllowedRedirectUrl, replaceLocationWithAllowlist, assignLocationWithAllowlist, openUrlInNewTabWithAllowlist, } from './redirectAllowlist';
+export type { RedirectAllowlistOptions } from './redirectAllowlist';
 export { SSO_DEPOSITED_PARAM, beginSsoNavigation, isSsoNavigationPending, clearSsoNavigation, readSsoDepositState, markSsoDepositPending, markSsoDepositDone, clearSsoDepositState, shouldAttemptSsoDeposit, mintSsoSessionTokens, buildSsoDepositUrl, consumeSsoDepositMarker, } from './ssoDeposit';
 export type { MintedSsoTokens, MintSsoSessionResult, SsoDepositPayload, SsoDepositState, } from './ssoDeposit';
 export { createProfileScopedStorage, getProfileScopedKey, } from './profileScopedStorage';

package/dist/shared/utils/redirectAllowlist.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Hostname allowlist for full-page navigations that may leave the current
+ * origin: the cross-eTLD+1 SSO relay, product-switcher hops between product
+ * shells, and similar first-party links.
+ *
+ * `isSafeRedirectTarget` / `redirectToSafeLocation` in `../graphql/security`
+ * are deliberately same-origin only, so they cannot carry a visitor to the
+ * central auth bridge (app.burdenoff.com) from a product shell. This module is
+ * the cross-origin counterpart: a target is allowed when it stays on the
+ * current hostname, or when its hostname is (a subdomain of) one of the
+ * Burdenoff product domains in `ALL_PRODUCT_DOMAINS` — the same single list
+ * that already drives the bridge host resolution and `isTrustedSsoOrigin`, so
+ * a new product never needs another hardcoded copy here.
+ *
+ * Ported from fluidgrids-app `src/utils/security.ts` (`isAllowedRedirectUrl`
+ * and friends), which shipped this check first.
+ *
+ * @module @burdenoff/fe-libs/shared/utils/redirectAllowlist
+ */
+export interface RedirectAllowlistOptions {
+    /**
+     * Origin the target is resolved against and compared with. Defaults to
+     * `window.location.origin`.
+     */
+    baseOrigin?: string;
+    /**
+     * Additional host suffixes to trust on top of the Burdenoff product
+     * domains (for example a shell's `VITE_ALLOWED_REDIRECT_HOSTS`, split on
+     * commas). Each entry matches the host itself and any subdomain of it.
+     */
+    extraHostSuffixes?: readonly string[];
+}
+/**
+ * Whether `target` may be navigated to from `baseOrigin`.
+ *
+ * Allowed:
+ * - relative paths and absolute URLs on the current hostname;
+ * - `https:` URLs whose hostname is a Burdenoff product domain or one of its
+ *   subdomains (`app.`, `alphaapp.`, `www.`, `docs.` …), or an
+ *   `extraHostSuffixes` entry;
+ * - local development hosts (`localhost`, `127.0.0.1` …, over `http:` or
+ *   `https:`) only when the current origin is itself local development.
+ *
+ * Everything else — other schemes (`javascript:`, `data:` …), unparsable
+ * input, protocol-relative or absolute URLs to any other host — is refused.
+ */
+export declare function isAllowedRedirectUrl(target: string, options?: RedirectAllowlistOptions): boolean;
+/**
+ * `window.location.replace(target)` when the target passes the allowlist.
+ * Returns whether the navigation was started, so callers can fall back
+ * (e.g. to the in-app login route) when it was refused.
+ */
+export declare function replaceLocationWithAllowlist(target: string, options?: RedirectAllowlistOptions): boolean;
+/** `window.location.assign(target)` when the target passes the allowlist. */
+export declare function assignLocationWithAllowlist(target: string, options?: RedirectAllowlistOptions): boolean;
+/**
+ * Open the target in a new tab (`noopener,noreferrer`) when it passes the
+ * allowlist.
+ */
+export declare function openUrlInNewTabWithAllowlist(target: string, options?: RedirectAllowlistOptions): boolean;

package/dist/shared/utils/redirectAllowlist.js

@@ -0,0 +1,47 @@
+import { ALL_PRODUCT_DOMAINS as e } from "../config/gatewayUrls.js";
+//#region src/shared/utils/redirectAllowlist.ts
+var t = new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"[::1]",
+	"host.docker.internal"
+]);
+function n(e) {
+	return e.trim().toLowerCase();
+}
+function r(e, t) {
+	let r = n(t);
+	return r ? e === r || e.endsWith(`.${r}`) : !1;
+}
+function i(e) {
+	return t.has(e) || r(e, "local.burdenoff.com");
+}
+function a(e) {
+	return e || (typeof window > "u" ? null : window.location.origin);
+}
+function o(o, s = {}) {
+	if (!o.trim()) return !1;
+	let c = a(s.baseOrigin);
+	if (!c) return !1;
+	let l, u;
+	try {
+		u = new URL(c), l = new URL(o, c);
+	} catch {
+		return !1;
+	}
+	if (l.protocol !== "https:" && l.protocol !== "http:") return !1;
+	let d = n(l.hostname), f = n(u.hostname);
+	return d === f ? !0 : t.has(d) ? i(f) : l.protocol === "http:" ? !1 : [...e, ...s.extraHostSuffixes ?? []].some((e) => r(d, e));
+}
+function s(e, t) {
+	return typeof window > "u" || !o(e, t) ? !1 : (window.location.replace(e), !0);
+}
+function c(e, t) {
+	return typeof window > "u" || !o(e, t) ? !1 : (window.location.assign(e), !0);
+}
+function l(e, t) {
+	return typeof window > "u" || !o(e, t) ? !1 : (window.open(e, "_blank", "noopener,noreferrer"), !0);
+}
+//#endregion
+export { c as assignLocationWithAllowlist, o as isAllowedRedirectUrl, l as openUrlInNewTabWithAllowlist, s as replaceLocationWithAllowlist };

package/dist/shared-components.js

@@ -1,21 +1,22 @@
-import { SSORedirectSpinner as e, checkRemoteSLO as t, checkSLO as n, clearLocalAuthState as r, getSSORedirectUrl as i } from "./shared/components/SSORedirectGuard.js";
-import { ErrorBoundary as a } from "./shared/components/ErrorBoundary.js";
-import { RequireAuth as o, RequireGuest as s } from "./shared/components/RequireAuth.js";
-import { PermissionButton as c, PermissionGate as l, PermissionLink as u } from "./shared/components/PermissionGate.js";
-import { AccessDenied as d, PermissionDenied as f } from "./shared/components/AccessDenied.js";
-import { ErrorFallback as p } from "./shared/components/ErrorFallback.js";
-import { LoadingFallback as m, PageLoadingFallback as h, SectionLoadingFallback as g } from "./shared/components/LoadingFallback.js";
-import { MicrofrontendErrorBoundary as _ } from "./shared/components/MicrofrontendErrorBoundary.js";
-import { ConditionalShell as v } from "./shared/components/ConditionalShell.js";
-import { PWAInstallBanner as y } from "./shared/components/PWAInstallBanner.js";
-import { ErrorBoundary as b } from "./shared/components/AppErrorBoundary.js";
-import { ContextConversationWidget as x } from "./shared/components/ContextConversationWidget.js";
-import { KeyboardHelpDialogWrapper as S } from "./shared/components/KeyboardHelpDialogWrapper.js";
-import { QuotaMeter as C } from "./shared/components/QuotaMeter.js";
-import { UPGRADE_PROMPT_EVENT as w, UpgradePromptModal as T, dispatchUpgradePrompt as E } from "./shared/components/UpgradePromptModal.js";
-import { UpgradeInlineBanner as D } from "./shared/components/UpgradeInlineBanner.js";
-import { useVoiceInput as O } from "./shared/components/assistantWidget/useVoiceInput.js";
-import { ASSISTANT_WIDGET_TOGGLE_EVENT as k, AssistantWidget as A } from "./shared/components/assistantWidget/AssistantWidget.js";
-import { Markdown as j } from "./shared/components/Markdown.js";
-import { DesktopUpdateToast as M } from "./shared/components/DesktopUpdateToast.js";
-export { k as ASSISTANT_WIDGET_TOGGLE_EVENT, d as AccessDenied, b as AppErrorBoundary, A as AssistantWidget, v as ConditionalShell, x as ContextConversationWidget, M as DesktopUpdateToast, a as ErrorBoundary, p as ErrorFallback, S as KeyboardHelpDialogWrapper, m as LoadingFallback, j as Markdown, _ as MicrofrontendErrorBoundary, y as PWAInstallBanner, h as PageLoadingFallback, c as PermissionButton, f as PermissionDenied, l as PermissionGate, u as PermissionLink, C as QuotaMeter, o as RequireAuth, s as RequireGuest, e as SSORedirectSpinner, g as SectionLoadingFallback, w as UPGRADE_PROMPT_EVENT, D as UpgradeInlineBanner, T as UpgradePromptModal, t as checkRemoteSLO, n as checkSLO, r as clearLocalAuthState, E as dispatchUpgradePrompt, i as getSSORedirectUrl, O as useVoiceInput };
+import { SSORedirectSpinner as e, checkRemoteSLO as t, checkSLO as n, clearLocalAuthState as r, getSSORedirectUrl as i, redirectToSSO as a } from "./shared/components/SSORedirectGuard.js";
+import { ErrorBoundary as o } from "./shared/components/ErrorBoundary.js";
+import { RequireAuth as s, RequireGuest as c } from "./shared/components/RequireAuth.js";
+import { PermissionButton as l, PermissionGate as u, PermissionLink as d } from "./shared/components/PermissionGate.js";
+import { AccessDenied as f, PermissionDenied as p } from "./shared/components/AccessDenied.js";
+import { ErrorFallback as m } from "./shared/components/ErrorFallback.js";
+import { LoadingFallback as h, PageLoadingFallback as g, SectionLoadingFallback as _ } from "./shared/components/LoadingFallback.js";
+import { MicrofrontendErrorBoundary as v } from "./shared/components/MicrofrontendErrorBoundary.js";
+import { ConditionalShell as y } from "./shared/components/ConditionalShell.js";
+import { PWAInstallBanner as b } from "./shared/components/PWAInstallBanner.js";
+import { ErrorBoundary as x } from "./shared/components/AppErrorBoundary.js";
+import { ContextConversationWidget as S } from "./shared/components/ContextConversationWidget.js";
+import { KeyboardHelpDialogWrapper as C } from "./shared/components/KeyboardHelpDialogWrapper.js";
+import { QuotaMeter as w } from "./shared/components/QuotaMeter.js";
+import { UPGRADE_PROMPT_EVENT as T, UpgradePromptModal as E, dispatchUpgradePrompt as D } from "./shared/components/UpgradePromptModal.js";
+import { UpgradeInlineBanner as O } from "./shared/components/UpgradeInlineBanner.js";
+import { LandingGateView as k, LandingOrDashboardRedirect as A, hasStoredValidSession as j, resolveLandingGate as M } from "./shared/components/LandingOrDashboardRedirect.js";
+import { useVoiceInput as N } from "./shared/components/assistantWidget/useVoiceInput.js";
+import { ASSISTANT_WIDGET_TOGGLE_EVENT as P, AssistantWidget as F } from "./shared/components/assistantWidget/AssistantWidget.js";
+import { Markdown as I } from "./shared/components/Markdown.js";
+import { DesktopUpdateToast as L } from "./shared/components/DesktopUpdateToast.js";
+export { P as ASSISTANT_WIDGET_TOGGLE_EVENT, f as AccessDenied, x as AppErrorBoundary, F as AssistantWidget, y as ConditionalShell, S as ContextConversationWidget, L as DesktopUpdateToast, o as ErrorBoundary, m as ErrorFallback, C as KeyboardHelpDialogWrapper, k as LandingGateView, A as LandingOrDashboardRedirect, h as LoadingFallback, I as Markdown, v as MicrofrontendErrorBoundary, b as PWAInstallBanner, g as PageLoadingFallback, l as PermissionButton, p as PermissionDenied, u as PermissionGate, d as PermissionLink, w as QuotaMeter, s as RequireAuth, c as RequireGuest, e as SSORedirectSpinner, _ as SectionLoadingFallback, T as UPGRADE_PROMPT_EVENT, O as UpgradeInlineBanner, E as UpgradePromptModal, t as checkRemoteSLO, n as checkSLO, r as clearLocalAuthState, D as dispatchUpgradePrompt, i as getSSORedirectUrl, j as hasStoredValidSession, a as redirectToSSO, M as resolveLandingGate, N as useVoiceInput };

package/dist/shared-native.js

@@ -6,19 +6,19 @@ import { nativeActionSheet as R, nativeConfirm as z, nativeCopyText as B, native
 import { SafeAreaView as q } from "./shared/native/SafeAreaView.js";
 import { readInitialNetworkStatus as J, reduceNetworkStatus as Y, useNetworkStatus as X } from "./shared/native/hooks/useNetworkStatus.js";
 import { PULL_TO_REFRESH_THRESHOLD as Z, computePullOffset as Q, computePullProgress as $, usePullToRefresh as ee } from "./shared/native/hooks/usePullToRefresh.js";
-import { useNativePlatform as te } from "./shared/native/hooks/useNativePlatform.js";
-import { useSafeArea as ne } from "./shared/native/hooks/useSafeArea.js";
-import { useNativeKeyboard as re } from "./shared/native/hooks/useNativeKeyboard.js";
-import { useAppState as ie } from "./shared/native/hooks/useAppState.js";
-import { useDeviceInfo as ae } from "./shared/native/hooks/useDeviceInfo.js";
-import { useHaptics as oe } from "./shared/native/hooks/useHaptics.js";
-import { useStatusBar as se } from "./shared/native/hooks/useStatusBar.js";
-import { resolveActionSheetOutcome as ce, useActionSheet as le } from "./shared/native/hooks/useActionSheet.js";
-import { useDesktop as ue } from "./shared/native/hooks/useDesktop.js";
-import { useDesktopUpdateState as de } from "./shared/native/hooks/useDesktopUpdateState.js";
-import { useDesktopWindowState as fe } from "./shared/native/hooks/useDesktopWindowState.js";
+import { getNativeEntryRoutes as te, shouldShowNativeWelcome as ne } from "./shared/native/entry.js";
+import { useNativePlatform as re } from "./shared/native/hooks/useNativePlatform.js";
+import { useSafeArea as ie } from "./shared/native/hooks/useSafeArea.js";
+import { useNativeKeyboard as ae } from "./shared/native/hooks/useNativeKeyboard.js";
+import { useAppState as oe } from "./shared/native/hooks/useAppState.js";
+import { useDeviceInfo as se } from "./shared/native/hooks/useDeviceInfo.js";
+import { useHaptics as ce } from "./shared/native/hooks/useHaptics.js";
+import { useStatusBar as le } from "./shared/native/hooks/useStatusBar.js";
+import { resolveActionSheetOutcome as ue, useActionSheet as de } from "./shared/native/hooks/useActionSheet.js";
+import { useDesktop as fe } from "./shared/native/hooks/useDesktop.js";
+import { useDesktopUpdateState as pe } from "./shared/native/hooks/useDesktopUpdateState.js";
+import { useDesktopWindowState as me } from "./shared/native/hooks/useDesktopWindowState.js";
 import "./shared/native/hooks/index.js";
-import { acknowledgeNativePurchase as pe, getNativeProducts as me, getNativePurchases as he, installNativeIAP as ge, isNativeIAPAvailable as _e, purchaseNativeProduct as ve, restoreNativePurchases as ye } from "./shared/native/purchases.js";
-import { getNativeEntryRoutes as be, shouldShowNativeWelcome as xe } from "./shared/native/entry.js";
+import { acknowledgeNativePurchase as he, getNativeProducts as ge, getNativePurchases as _e, installNativeIAP as ve, isNativeIAPAvailable as ye, purchaseNativeProduct as be, restoreNativePurchases as xe } from "./shared/native/purchases.js";
 import { getPushOptInController as Se, recordPushPermissionPromptDismissed as Ce, registerPushOptInController as we, shouldPromptForPushPermission as Te } from "./shared/native/push-optin.js";
-export { n as DESKTOP_UPDATE_UNSUPPORTED, r as DESKTOP_WINDOW_STATE_DEFAULT, Z as PULL_TO_REFRESH_THRESHOLD, q as SafeAreaView, pe as acknowledgeNativePurchase, i as bootDesktopShell, Q as computePullOffset, $ as computePullProgress, a as desktopCheckForUpdates, o as desktopDeepLinkToPath, s as desktopInstallUpdate, c as desktopNotify, l as desktopOpenExternal, u as desktopSetBadgeCount, d as desktopSetLocale, f as desktopSetTheme, p as desktopSetTrayQuickActions, e as getCapacitorPlatform, m as getDesktopAuthBridgeConfig, h as getDesktopBridge, g as getDesktopGatewayBases, _ as getDesktopGatewayUrls, v as getDesktopRuntimeConfig, y as getDesktopUpdateState, b as getDesktopWindowState, x as getLegacyDesktopRuntime, O as getNativeBridge, be as getNativeEntryRoutes, me as getNativeProducts, he as getNativePurchases, k as getPlatform, Se as getPushOptInController, S as installDesktopDeepLinkHandler, C as installDesktopNavigateHandler, ge as installNativeIAP, A as isAndroid, t as isCapacitorNative, w as isDesktop, j as isElectron, M as isIOS, N as isInstalledApp, P as isNative, _e as isNativeIAPAvailable, F as isStandalonePWA, I as isWeb, L as isWebBrowser, R as nativeActionSheet, z as nativeConfirm, B as nativeCopyText, V as nativeImpact, H as nativeNotify, U as nativeOpenUrl, W as nativeSelection, G as nativeShare, K as nativeToast, T as onDesktopUpdateState, E as onDesktopWindowState, ve as purchaseNativeProduct, J as readInitialNetworkStatus, Ce as recordPushPermissionPromptDismissed, Y as reduceNetworkStatus, D as registerDesktopNavigator, we as registerPushOptInController, ce as resolveActionSheetOutcome, ye as restoreNativePurchases, Te as shouldPromptForPushPermission, xe as shouldShowNativeWelcome, le as useActionSheet, ie as useAppState, ue as useDesktop, de as useDesktopUpdateState, fe as useDesktopWindowState, ae as useDeviceInfo, oe as useHaptics, re as useNativeKeyboard, te as useNativePlatform, X as useNetworkStatus, ee as usePullToRefresh, ne as useSafeArea, se as useStatusBar };
+export { n as DESKTOP_UPDATE_UNSUPPORTED, r as DESKTOP_WINDOW_STATE_DEFAULT, Z as PULL_TO_REFRESH_THRESHOLD, q as SafeAreaView, he as acknowledgeNativePurchase, i as bootDesktopShell, Q as computePullOffset, $ as computePullProgress, a as desktopCheckForUpdates, o as desktopDeepLinkToPath, s as desktopInstallUpdate, c as desktopNotify, l as desktopOpenExternal, u as desktopSetBadgeCount, d as desktopSetLocale, f as desktopSetTheme, p as desktopSetTrayQuickActions, e as getCapacitorPlatform, m as getDesktopAuthBridgeConfig, h as getDesktopBridge, g as getDesktopGatewayBases, _ as getDesktopGatewayUrls, v as getDesktopRuntimeConfig, y as getDesktopUpdateState, b as getDesktopWindowState, x as getLegacyDesktopRuntime, O as getNativeBridge, te as getNativeEntryRoutes, ge as getNativeProducts, _e as getNativePurchases, k as getPlatform, Se as getPushOptInController, S as installDesktopDeepLinkHandler, C as installDesktopNavigateHandler, ve as installNativeIAP, A as isAndroid, t as isCapacitorNative, w as isDesktop, j as isElectron, M as isIOS, N as isInstalledApp, P as isNative, ye as isNativeIAPAvailable, F as isStandalonePWA, I as isWeb, L as isWebBrowser, R as nativeActionSheet, z as nativeConfirm, B as nativeCopyText, V as nativeImpact, H as nativeNotify, U as nativeOpenUrl, W as nativeSelection, G as nativeShare, K as nativeToast, T as onDesktopUpdateState, E as onDesktopWindowState, be as purchaseNativeProduct, J as readInitialNetworkStatus, Ce as recordPushPermissionPromptDismissed, Y as reduceNetworkStatus, D as registerDesktopNavigator, we as registerPushOptInController, ue as resolveActionSheetOutcome, xe as restoreNativePurchases, Te as shouldPromptForPushPermission, ne as shouldShowNativeWelcome, de as useActionSheet, oe as useAppState, fe as useDesktop, pe as useDesktopUpdateState, me as useDesktopWindowState, se as useDeviceInfo, ce as useHaptics, ae as useNativeKeyboard, re as useNativePlatform, X as useNetworkStatus, ee as usePullToRefresh, ie as useSafeArea, le as useStatusBar };

package/dist/shared-utils.js

@@ -6,17 +6,18 @@ import { installGatewayFetchRewrite as P, resolveGatewayBases as F, suppressCons
 import { BACKEND_ERROR_EVENT as L, CONNECTION_STATUS_EVENT as R, dispatchBackendErrorEvent as z, extractBackendError as B, isAbortError as V, isBackendErrorDisplay as H, isTransportError as U, markConnectionHealthy as W, shouldToastBackendError as G } from "./shared/utils/backendErrors.js";
 import { attemptTokenRefresh as K, clearAuthSessionStorage as q, hasAuthGraphQLErrors as J, isAuthGraphQLError as Y, isAuthNetworkError as X, redirectToLogin as Z } from "./shared/utils/authErrorHandling.js";
 import { clearSSoCookie as Q, clearShellSsoCookies as $, getSSoCookie as ee, isSharedSsoCookieDomain as te, isTrustedSsoOrigin as ne, readShellSsoCookie as re, setSSoCookie as ie, setShellSsoCookies as ae } from "./shared/utils/authCookie.js";
-import { SSO_DEPOSITED_PARAM as oe, beginSsoNavigation as se, buildSsoDepositUrl as ce, clearSsoDepositState as le, clearSsoNavigation as ue, consumeSsoDepositMarker as de, isSsoNavigationPending as fe, markSsoDepositDone as pe, markSsoDepositPending as me, mintSsoSessionTokens as he, readSsoDepositState as ge, shouldAttemptSsoDeposit as _e } from "./shared/utils/ssoDeposit.js";
-import { AppInitializer as ve, useRegistryHelpers as ye, useShellNavigate as be } from "./shared/utils/appHelpers.js";
-import { clearUserContext as xe, initializeLogger as Se, setUserContext as Ce } from "./shared/utils/loggerInit.js";
-import { createProfileScopedStorage as we, getProfileScopedKey as Te } from "./shared/utils/profileScopedStorage.js";
-import { QUOTA_EXHAUSTED_CODE as Ee, RESOURCE_CAP_EXCEEDED_CODE as De, STORAGE_QUOTA_EXCEEDED_CODE as Oe, UPGRADE_ERROR_CODES as ke, buildQuotaExhaustedMessage as Ae, extractQuotaExhaustedExtensions as je, extractUpgradeErrorExtensions as Me, isQuotaExhaustedError as Ne, isUpgradeError as Pe } from "./shared/utils/quotaErrors.js";
-import { INLINE_ENCODE as Fe, downscaleImage as Ie, selectInlineBase64 as Le } from "./shared/utils/imageDownscale.js";
-import { clsx as Re } from "clsx";
-import { twMerge as ze } from "tailwind-merge";
+import { assignLocationWithAllowlist as oe, isAllowedRedirectUrl as se, openUrlInNewTabWithAllowlist as ce, replaceLocationWithAllowlist as le } from "./shared/utils/redirectAllowlist.js";
+import { SSO_DEPOSITED_PARAM as ue, beginSsoNavigation as de, buildSsoDepositUrl as fe, clearSsoDepositState as pe, clearSsoNavigation as me, consumeSsoDepositMarker as he, isSsoNavigationPending as ge, markSsoDepositDone as _e, markSsoDepositPending as ve, mintSsoSessionTokens as ye, readSsoDepositState as be, shouldAttemptSsoDeposit as xe } from "./shared/utils/ssoDeposit.js";
+import { AppInitializer as Se, useRegistryHelpers as Ce, useShellNavigate as we } from "./shared/utils/appHelpers.js";
+import { clearUserContext as Te, initializeLogger as Ee, setUserContext as De } from "./shared/utils/loggerInit.js";
+import { createProfileScopedStorage as Oe, getProfileScopedKey as ke } from "./shared/utils/profileScopedStorage.js";
+import { QUOTA_EXHAUSTED_CODE as Ae, RESOURCE_CAP_EXCEEDED_CODE as je, STORAGE_QUOTA_EXCEEDED_CODE as Me, UPGRADE_ERROR_CODES as Ne, buildQuotaExhaustedMessage as Pe, extractQuotaExhaustedExtensions as Fe, extractUpgradeErrorExtensions as Ie, isQuotaExhaustedError as Le, isUpgradeError as Re } from "./shared/utils/quotaErrors.js";
+import { INLINE_ENCODE as ze, downscaleImage as Be, selectInlineBase64 as Ve } from "./shared/utils/imageDownscale.js";
+import { clsx as He } from "clsx";
+import { twMerge as Ue } from "tailwind-merge";
 //#region src/shared/utils/index.ts
-function Be(...e) {
-	return ze(Re(e));
+function We(...e) {
+	return Ue(He(e));
 }
 //#endregion
-export { ve as AppInitializer, L as BACKEND_ERROR_EVENT, R as CONNECTION_STATUS_EVENT, Fe as INLINE_ENCODE, Ee as QUOTA_EXHAUSTED_CODE, De as RESOURCE_CAP_EXCEEDED_CODE, oe as SSO_DEPOSITED_PARAM, Oe as STORAGE_QUOTA_EXCEEDED_CODE, ke as UPGRADE_ERROR_CODES, t as alertTokens, K as attemptTokenRefresh, se as beginSsoNavigation, Ae as buildQuotaExhaustedMessage, ce as buildSsoDepositUrl, f as capitalizeFirst, p as capitalizeWords, n as categoryTokens, q as clearAuthSessionStorage, Q as clearSSoCookie, $ as clearShellSsoCookies, le as clearSsoDepositState, ue as clearSsoNavigation, xe as clearUserContext, Be as cn, de as consumeSsoDepositMarker, e as createApolloClient, we as createProfileScopedStorage, z as dispatchBackendErrorEvent, Ie as downscaleImage, B as extractBackendError, je as extractQuotaExhaustedExtensions, Me as extractUpgradeErrorExtensions, m as formatBytes, h as formatCompactNumber, g as formatCurrency, _ as formatCurrencyCompact, v as formatDate, y as formatDateTime, b as formatDuration, x as formatList, S as formatNumber, C as formatOrdinal, w as formatPercentage, T as formatRelativeTime, E as formatTime, r as getAlertTokens, i as getCategoryTokens, Te as getProfileScopedKey, a as getProgressTokens, ee as getSSoCookie, o as getStatusBadgeTokens, s as getStatusTokens, c as getTrendTokens, J as hasAuthGraphQLErrors, Se as initializeLogger, P as installGatewayFetchRewrite, V as isAbortError, Y as isAuthGraphQLError, X as isAuthNetworkError, H as isBackendErrorDisplay, M as isChunkLoadError, Ne as isQuotaExhaustedError, te as isSharedSsoCookieDomain, fe as isSsoNavigationPending, U as isTransportError, ne as isTrustedSsoOrigin, Pe as isUpgradeError, N as lazyWithRetry, W as markConnectionHealthy, pe as markSsoDepositDone, me as markSsoDepositPending, he as mintSsoSessionTokens, D as pluralize, l as progressTokens, re as readShellSsoCookie, ge as readSsoDepositState, Z as redirectToLogin, F as resolveGatewayBases, Le as selectInlineBase64, ie as setSSoCookie, ae as setShellSsoCookies, Ce as setUserContext, _e as shouldAttemptSsoDeposit, G as shouldToastBackendError, O as slugify, u as statusTokens, I as suppressConsole, k as toCamelCase, A as toPascalCase, d as trendTokens, j as truncateText, ye as useRegistryHelpers, be as useShellNavigate };
+export { Se as AppInitializer, L as BACKEND_ERROR_EVENT, R as CONNECTION_STATUS_EVENT, ze as INLINE_ENCODE, Ae as QUOTA_EXHAUSTED_CODE, je as RESOURCE_CAP_EXCEEDED_CODE, ue as SSO_DEPOSITED_PARAM, Me as STORAGE_QUOTA_EXCEEDED_CODE, Ne as UPGRADE_ERROR_CODES, t as alertTokens, oe as assignLocationWithAllowlist, K as attemptTokenRefresh, de as beginSsoNavigation, Pe as buildQuotaExhaustedMessage, fe as buildSsoDepositUrl, f as capitalizeFirst, p as capitalizeWords, n as categoryTokens, q as clearAuthSessionStorage, Q as clearSSoCookie, $ as clearShellSsoCookies, pe as clearSsoDepositState, me as clearSsoNavigation, Te as clearUserContext, We as cn, he as consumeSsoDepositMarker, e as createApolloClient, Oe as createProfileScopedStorage, z as dispatchBackendErrorEvent, Be as downscaleImage, B as extractBackendError, Fe as extractQuotaExhaustedExtensions, Ie as extractUpgradeErrorExtensions, m as formatBytes, h as formatCompactNumber, g as formatCurrency, _ as formatCurrencyCompact, v as formatDate, y as formatDateTime, b as formatDuration, x as formatList, S as formatNumber, C as formatOrdinal, w as formatPercentage, T as formatRelativeTime, E as formatTime, r as getAlertTokens, i as getCategoryTokens, ke as getProfileScopedKey, a as getProgressTokens, ee as getSSoCookie, o as getStatusBadgeTokens, s as getStatusTokens, c as getTrendTokens, J as hasAuthGraphQLErrors, Ee as initializeLogger, P as installGatewayFetchRewrite, V as isAbortError, se as isAllowedRedirectUrl, Y as isAuthGraphQLError, X as isAuthNetworkError, H as isBackendErrorDisplay, M as isChunkLoadError, Le as isQuotaExhaustedError, te as isSharedSsoCookieDomain, ge as isSsoNavigationPending, U as isTransportError, ne as isTrustedSsoOrigin, Re as isUpgradeError, N as lazyWithRetry, W as markConnectionHealthy, _e as markSsoDepositDone, ve as markSsoDepositPending, ye as mintSsoSessionTokens, ce as openUrlInNewTabWithAllowlist, D as pluralize, l as progressTokens, re as readShellSsoCookie, be as readSsoDepositState, Z as redirectToLogin, le as replaceLocationWithAllowlist, F as resolveGatewayBases, Ve as selectInlineBase64, ie as setSSoCookie, ae as setShellSsoCookies, De as setUserContext, xe as shouldAttemptSsoDeposit, G as shouldToastBackendError, O as slugify, u as statusTokens, I as suppressConsole, k as toCamelCase, A as toPascalCase, d as trendTokens, j as truncateText, Ce as useRegistryHelpers, we as useShellNavigate };