@burdenoff/fe-libs 2026.1023.7 → 2026.1023.8

package/dist/shared/providers/shell/authProvider/identityChange.d.ts

@@ -0,0 +1,26 @@
+/**
+ * BOFF-9384: the signed-in account, and the announcement every path that
+ * changes it makes first (see `AuthProviderProps.onBeforeIdentityChange`).
+ */
+/** Which path is about to change the signed-in account. */
+export type IdentityChangeReason = 'login' | 'logout' | 'switch-account' | 'logout-all' | 'remote-slo' | 'bridge-sync' | 'storage-sync';
+/** The account a path is about to make active: profile and user (null = signed out). */
+export interface IdentitySnapshot {
+    profileId: string | null;
+    userId: string | null;
+}
+export declare const SIGNED_OUT: IdentitySnapshot;
+/**
+ * Called BEFORE a path changes React state. The paths AuthProvider drives
+ * itself (sign-in, sign-out, account switch, sign-out of every account) call it
+ * before they write storage too; the background paths call it once storage
+ * already names the next account (remote single-logout after checkSLO cleared
+ * it, auth-bridge sync after it wrote the bridge's state, storage sync because
+ * a storage change is what woke it). It reaches `onBeforeIdentityChange` only
+ * when `next` differs from the account the shell has committed, so a token
+ * refresh or a repeated sync never announces.
+ */
+export type AnnounceIdentityChange = (reason: IdentityChangeReason, next: IdentitySnapshot) => void;
+export declare function identityKeyOf(profileId: string | null | undefined, userId: string | null | undefined): string;
+/** The identity key of the signed-out state (no profile, no user). */
+export declare const SIGNED_OUT_IDENTITY_KEY: string;

package/dist/shared/providers/shell/authProvider/identityChange.js

@@ -0,0 +1,11 @@
+//#region src/shared/providers/shell/authProvider/identityChange.ts
+var e = {
+	profileId: null,
+	userId: null
+};
+function t(e, t) {
+	return `${e ?? ""}:${t ?? ""}`;
+}
+var n = t(null, null);
+//#endregion
+export { e as SIGNED_OUT, n as SIGNED_OUT_IDENTITY_KEY, t as identityKeyOf };

package/dist/shared/providers/shell/authProvider/useAuthActions.d.ts

@@ -1,5 +1,6 @@
 import { MutableRefObject } from 'react';
 import { ProfileUser, AuthTokens } from '../ProfileStorageManager';
+import { AnnounceIdentityChange } from './identityChange';
 /**
  * BOFF-9411: the token for the authoritative SignOut request. The caller's
  * token comes first, then this hook's state, then storage for the active
@@ -31,6 +32,8 @@ export interface AuthActionsDeps {
     setIsLoading: (loading: boolean) => void;
     clearAccounts: () => void;
     refreshAccounts: () => void;
+    /** BOFF-9384: called before any storage or state change that switches the account. */
+    announceIdentityChange: AnnounceIdentityChange;
 }
 export interface LogoutOptions {
     /**
@@ -68,4 +71,4 @@ export interface AuthActions {
     addAccount: (user: ProfileUser, accessToken: string, refreshToken?: string) => void;
     removeAccount: (accountId: string) => void;
 }
-export declare function useAuthActions({ user, tokens, activeId, bridgeSyncInProgress, onRefreshToken, onTokenExpired, setActiveId, setUser, setTokens, setWorkspaceTokenLocal, setMfaRequiredState, setMfaChallengeIdState, setIsLoading, clearAccounts, refreshAccounts, }: AuthActionsDeps): AuthActions;
+export declare function useAuthActions({ user, tokens, activeId, bridgeSyncInProgress, onRefreshToken, onTokenExpired, setActiveId, setUser, setTokens, setWorkspaceTokenLocal, setMfaRequiredState, setMfaChallengeIdState, setIsLoading, clearAccounts, refreshAccounts, announceIdentityChange, }: AuthActionsDeps): AuthActions;

package/dist/shared/providers/shell/authProvider/useAuthActions.js

@@ -1,12 +1,13 @@
 import { resolveGatewayUrls as e } from "../../../config/gatewayUrls.js";
-import { addProfile as t, getActiveProfileId as n, getProfileTokens as r, getProfileUser as i, getProfileWorkspaceToken as a, getProfiles as o, loginProfile as s, logoutAllProfiles as c, removeProfile as l, resolveActiveProfileId as u, setProfileTokens as d, setProfileUser as f, setProfileWorkspaceToken as p, switchProfile as m } from "../ProfileStorageManager.js";
-import { clearShellSsoCookies as h, setShellSsoCookies as g } from "../../../utils/authCookie.js";
-import { getAuthBridge as _ } from "../AuthBridgeClient.js";
-import { getCrossOriginLogoutUrl as v } from "./ssoRelay.js";
-import { getJwtExpiry as y } from "./jwt.js";
-import { useCallback as b } from "react";
+import { addProfile as t, getActiveProfileId as n, getProfileTokens as r, getProfileUser as i, getProfileWorkspaceToken as a, getProfiles as o, getSelectableProfiles as s, loginProfile as c, logoutAllProfiles as l, removeProfile as u, resolveActiveProfileId as d, setProfileTokens as f, setProfileUser as p, setProfileWorkspaceToken as m, switchProfile as h } from "../ProfileStorageManager.js";
+import { clearShellSsoCookies as g, setShellSsoCookies as _ } from "../../../utils/authCookie.js";
+import { getAuthBridge as v } from "../AuthBridgeClient.js";
+import { getCrossOriginLogoutUrl as y } from "./ssoRelay.js";
+import { SIGNED_OUT as b } from "./identityChange.js";
+import { getJwtExpiry as x } from "./jwt.js";
+import { useCallback as S } from "react";
 //#region src/shared/providers/shell/authProvider/useAuthActions.ts
-function x(t) {
+function C(t) {
 	if (t) try {
 		let { globalBaseUrl: n } = e();
 		if (!n) return;
@@ -21,24 +22,29 @@ function x(t) {
 		}).catch(() => {});
 	} catch {}
 }
-function S(e, t, i) {
+function w(e, t, i) {
 	if (e) return e;
 	if (t?.accessToken) return t.accessToken;
 	let a = i ?? n();
 	return (a ? r(a)?.accessToken : void 0) || void 0;
 }
-function C({ user: e, tokens: n, activeId: C, bridgeSyncInProgress: w, onRefreshToken: T, onTokenExpired: E, setActiveId: D, setUser: O, setTokens: k, setWorkspaceTokenLocal: A, setMfaRequiredState: j, setMfaChallengeIdState: M, setIsLoading: N, clearAccounts: P, refreshAccounts: F }) {
-	let I = b((e, t, n) => {
-		let r = y(t) ?? Date.now() + 3600 * 1e3, i = {
+function T({ user: e, tokens: n, activeId: T, bridgeSyncInProgress: E, onRefreshToken: D, onTokenExpired: O, setActiveId: k, setUser: A, setTokens: j, setWorkspaceTokenLocal: M, setMfaRequiredState: N, setMfaChallengeIdState: P, setIsLoading: F, clearAccounts: I, refreshAccounts: L, announceIdentityChange: R }) {
+	let z = S((e, t, n) => {
+		let r = x(t) ?? Date.now() + 3600 * 1e3, i = {
 			accessToken: t,
 			refreshToken: n,
 			expiresAt: r
-		}, a = s(e, i);
-		D(a), O(e), k(i), A(null), j(!1), M(null), F();
+		};
+		R("login", {
+			profileId: e.id,
+			userId: e.id
+		});
+		let a = c(e, i);
+		k(a), A(e), j(i), M(null), N(!1), P(null), L();
 		try {
-			g(a, window.location.origin);
+			_(a, window.location.origin);
 		} catch {}
-		w.current || _()?.notifyLogin({
+		E.current || v()?.notifyLogin({
 			user: e,
 			tokens: {
 				accessToken: t,
@@ -50,141 +56,148 @@ function C({ user: e, tokens: n, activeId: C, bridgeSyncInProgress: w, onRefresh
 			profiles: o()
 		});
 	}, [
-		F,
-		w,
-		D,
-		O,
+		L,
+		E,
 		k,
 		A,
 		j,
-		M
-	]), L = b((e) => {
+		M,
+		N,
+		P,
+		R
+	]), B = S((e) => {
 		let t = e?.authoritative !== !1;
-		t && !w.current && x(S(e?.accessToken, n, C)), C && l(C);
-		let o = u();
-		o ? (D(o), O(i(o)), k(r(o)), A(a(o))) : (D(null), O(null), k(null), A(null)), j(!1), M(null), F();
+		t && !E.current && C(w(e?.accessToken, n, T)), R("logout", b), T && u(T);
+		let o = d();
+		o ? (k(o), A(i(o)), j(r(o)), M(a(o))) : (k(null), A(null), j(null), M(null)), N(!1), P(null), L();
 		try {
-			h();
+			g();
 		} catch {}
-		w.current || _()?.notifyLogout();
-		let s = t ? v() : null;
-		s && !w.current && window.location.replace(s);
+		E.current || v()?.notifyLogout();
+		let s = t ? y() : null;
+		s && !E.current && window.location.replace(s);
 	}, [
-		C,
+		T,
 		n,
-		F,
-		w,
-		D,
-		O,
+		L,
+		E,
 		k,
 		A,
 		j,
-		M
-	]), R = b((n) => {
-		if (!e || !C) return;
+		M,
+		N,
+		P,
+		R
+	]), V = S((n) => {
+		if (!e || !T) return;
 		let r = {
 			...e,
 			...n
 		};
-		O(r), f(C, r), t({
-			id: C,
+		A(r), p(T, r), t({
+			id: T,
 			email: r.email,
 			name: r.name ?? `${r.firstName ?? ""} ${r.lastName ?? ""}`.trim(),
 			avatar: r.avatar,
 			lastLogin: (/* @__PURE__ */ new Date()).toISOString()
-		}), F();
+		}), L();
 	}, [
 		e,
-		C,
-		F,
-		O
-	]), z = b(async () => {
-		if (!T || !C) return;
-		let e = n?.refreshToken ?? r(C)?.refreshToken ?? void 0;
+		T,
+		L,
+		A
+	]), H = S(async () => {
+		if (!D || !T) return;
+		let e = n?.refreshToken ?? r(T)?.refreshToken ?? void 0;
 		if (e) {
-			N(!0);
+			F(!0);
 			try {
-				let t = await T(e), n = y(t.accessToken), r = t.expiresAt ?? n ?? Date.now() + 1440 * 60 * 1e3, i = {
+				let t = await D(e), n = x(t.accessToken), r = t.expiresAt ?? n ?? Date.now() + 1440 * 60 * 1e3, i = {
 					accessToken: t.accessToken,
 					refreshToken: t.refreshToken ?? e,
 					expiresAt: r
 				};
-				k(i), d(C, i), w.current || _()?.notifyTokenRefresh({
+				j(i), f(T, i), E.current || v()?.notifyTokenRefresh({
 					accessToken: i.accessToken,
 					refreshToken: i.refreshToken,
 					expiresAt: i.expiresAt
 				});
 			} catch (e) {
-				console.error("Failed to refresh token:", e), n?.expiresAt && n.expiresAt - Date.now() > 0 || (L({ authoritative: !1 }), E?.());
+				console.error("Failed to refresh token:", e), n?.expiresAt && n.expiresAt - Date.now() > 0 || (B({ authoritative: !1 }), O?.());
 			} finally {
-				N(!1);
+				F(!1);
 			}
 		}
 	}, [
 		n,
+		D,
 		T,
-		C,
-		L,
+		B,
+		O,
 		E,
-		w,
-		k,
-		N
-	]), B = b((t) => e?.permissions ? e.permissions.includes(t) || e.permissions.includes("*") : !1, [e]), V = b((e) => {
-		A(e), C && p(C, e);
-	}, [C, A]), H = b((e, t) => {
-		j(e), M(t ?? null);
-	}, [j, M]), U = b((e) => {
-		if (!m(e)) {
+		j,
+		F
+	]), U = S((t) => e?.permissions ? e.permissions.includes(t) || e.permissions.includes("*") : !1, [e]), W = S((e) => {
+		M(e), T && m(T, e);
+	}, [T, M]), G = S((e, t) => {
+		N(e), P(t ?? null);
+	}, [N, P]), K = S((e) => {
+		if (s().some((t) => t.id === e) && R("switch-account", {
+			profileId: e,
+			userId: i(e)?.id ?? null
+		}), !h(e)) {
 			console.error(`Profile ${e} not found`);
 			return;
 		}
-		D(e), O(i(e)), k(r(e)), A(a(e)), j(!1), M(null), F(), w.current || _()?.notifyAccountSwitch(e);
+		k(e), A(i(e)), j(r(e)), M(a(e)), N(!1), P(null), L(), E.current || v()?.notifyAccountSwitch(e);
 	}, [
-		F,
-		w,
-		D,
-		O,
+		L,
+		E,
 		k,
 		A,
 		j,
-		M
-	]), W = I, G = b((e) => {
-		if (e === C) {
+		M,
+		N,
+		P,
+		R
+	]), q = z, J = S((e) => {
+		if (e === T) {
 			console.error("Cannot remove active account — logout first");
 			return;
 		}
-		l(e), F();
-	}, [C, F]);
+		u(e), L();
+	}, [T, L]);
 	return {
-		login: I,
-		logout: L,
-		logoutAll: b(() => {
-			c(), D(null), O(null), k(null), A(null), j(!1), M(null), P();
+		login: z,
+		logout: B,
+		logoutAll: S(() => {
+			R("logout-all", b), l(), k(null), A(null), j(null), M(null), N(!1), P(null), I();
 			try {
-				h();
+				g();
 			} catch {}
-			w.current || _()?.notifyLogoutAll();
-			let e = v();
-			e && !w.current && window.location.replace(e);
+			E.current || v()?.notifyLogoutAll();
+			let e = y();
+			e && !E.current && window.location.replace(e);
 		}, [
-			w,
-			D,
-			O,
+			E,
 			k,
 			A,
 			j,
 			M,
-			P
+			N,
+			P,
+			I,
+			R
 		]),
-		updateUser: R,
-		refreshAccessToken: z,
-		hasPermission: B,
-		setWorkspaceToken: V,
-		setMfaState: H,
-		switchAccount: U,
-		addAccount: W,
-		removeAccount: G
+		updateUser: V,
+		refreshAccessToken: H,
+		hasPermission: U,
+		setWorkspaceToken: W,
+		setMfaState: G,
+		switchAccount: K,
+		addAccount: q,
+		removeAccount: J
 	};
 }
 //#endregion
-export { C as useAuthActions };
+export { T as useAuthActions };

package/dist/shared/providers/shell/authProvider/useBridgeInitialization.d.ts

@@ -1,5 +1,7 @@
 import { MutableRefObject } from 'react';
 import { ProfileUser, AuthTokens } from '../ProfileStorageManager';
+import { BridgeAuthState } from '../AuthBridgeClient';
+import { AnnounceIdentityChange } from './identityChange';
 export interface BridgeInitializationDeps {
     bridgeUrl: string | undefined;
     bridgeAllowedOrigins: string | undefined;
@@ -13,5 +15,29 @@ export interface BridgeInitializationDeps {
     setWorkspaceTokenLocal: (token: string | null) => void;
     clearAccounts: () => void;
     refreshAccounts: () => void;
+    /** BOFF-9384: called before React state moves to another account. */
+    announceIdentityChange: AnnounceIdentityChange;
 }
-export declare function useBridgeInitialization({ bridgeUrl, bridgeAllowedOrigins, bridgeDebug, onBridgeReady, bridgeSyncInProgress, setIsLoading, setActiveId, setUser, setTokens, setWorkspaceTokenLocal, clearAccounts, refreshAccounts, }: BridgeInitializationDeps): void;
+/** What `applyBridgeAuthState` writes to: AuthProvider's state setters and callbacks. */
+export interface BridgeAuthStateTarget {
+    bridgeUrl: string;
+    bridgeSyncInProgress: MutableRefObject<boolean>;
+    setActiveId: (id: string | null) => void;
+    setUser: (user: ProfileUser | null) => void;
+    setTokens: (tokens: AuthTokens | null) => void;
+    setWorkspaceTokenLocal: (token: string | null) => void;
+    clearAccounts: () => void;
+    refreshAccounts: () => void;
+    announceIdentityChange: AnnounceIdentityChange;
+    markBridgeReady: () => void;
+}
+/**
+ * Apply an auth state the bridge delivered (initial state, or a change made in
+ * another app shell): sync it into profile storage, then into React state.
+ * BOFF-9384: an account change is announced after the profile storage write
+ * and before any React state change (like remote single-logout); the write
+ * and the announcement run in the same synchronous call, so nothing can read
+ * the cache in between.
+ */
+export declare function applyBridgeAuthState(state: BridgeAuthState, target: BridgeAuthStateTarget): void;
+export declare function useBridgeInitialization({ bridgeUrl, bridgeAllowedOrigins, bridgeDebug, onBridgeReady, bridgeSyncInProgress, setIsLoading, setActiveId, setUser, setTokens, setWorkspaceTokenLocal, clearAccounts, refreshAccounts, announceIdentityChange, }: BridgeInitializationDeps): void;

package/dist/shared/providers/shell/authProvider/useBridgeInitialization.js

@@ -4,84 +4,104 @@ import { isRealNativeOrDesktopShell as o } from "../../../native/platform.js";
 import { hasRecentSSORedirectAttempt as s, markSSORedirectAttempt as c, shouldSkipSSORedirect as l } from "../../../components/SSORedirectGuard.js";
 import { getCookieSsoRelayUrl as u } from "./ssoRelay.js";
 import { syncBridgeStateToProfileStorage as d } from "./bridgeStateSync.js";
-import { useEffect as f } from "react";
+import { SIGNED_OUT as f } from "./identityChange.js";
+import { useEffect as p } from "react";
 //#region src/shared/providers/shell/authProvider/useBridgeInitialization.ts
-function p({ bridgeUrl: p, bridgeAllowedOrigins: m, bridgeDebug: h, onBridgeReady: g, bridgeSyncInProgress: _, setIsLoading: v, setActiveId: y, setUser: b, setTokens: x, setWorkspaceTokenLocal: S, clearAccounts: C, refreshAccounts: w }) {
-	f(() => {
-		if (!p) return;
+function m(i, a) {
+	let { bridgeUrl: p, bridgeSyncInProgress: m, setActiveId: h, setUser: g, setTokens: _, setWorkspaceTokenLocal: v, clearAccounts: y, refreshAccounts: b, announceIdentityChange: x, markBridgeReady: S } = a;
+	m.current = !0;
+	try {
+		if (p) {
+			let e = u(p);
+			if (e) {
+				window.location.replace(e);
+				return;
+			}
+		}
+		d(i);
+		let a = r();
+		if (a) x("bridge-sync", {
+			profileId: a,
+			userId: t(a)?.id ?? null
+		}), h(a), g(t(a)), _(e(a)), v(n(a)), b();
+		else {
+			if (p && !i.user && !i.tokens) try {
+				let e = new URL(p).origin, t = window.location.origin, n = u(p);
+				if (n) {
+					window.location.replace(n);
+					return;
+				}
+				if (e !== t && !l() && !o()) {
+					let t = window.location.href;
+					if (s(e, t)) return;
+					c(e, t), window.location.replace(`${e}/auth/sso-relay?returnTo=${encodeURIComponent(t)}`);
+					return;
+				}
+			} catch {}
+			x("bridge-sync", f), h(null), g(null), _(null), v(null), y();
+		}
+	} finally {
+		m.current = !1, S();
+	}
+}
+function h({ bridgeUrl: e, bridgeAllowedOrigins: t, bridgeDebug: n, onBridgeReady: r, bridgeSyncInProgress: o, setIsLoading: s, setActiveId: c, setUser: l, setTokens: u, setWorkspaceTokenLocal: d, clearAccounts: f, refreshAccounts: h, announceIdentityChange: g }) {
+	p(() => {
+		if (!e) return;
 		try {
-			let e = new URL(p).pathname;
-			if (window.location.pathname === e) {
-				v(!1), g?.();
+			let t = new URL(e).pathname;
+			if (window.location.pathname === t) {
+				s(!1), r?.();
 				return;
 			}
 		} catch {
-			v(!1), g?.();
+			s(!1), r?.();
 			return;
 		}
 		if (a()) {
-			v(!1), g?.();
+			s(!1), r?.();
 			return;
 		}
-		let f = () => {
-			v(!1), g?.();
-		}, T = (i) => {
-			_.current = !0;
-			try {
-				if (p) {
-					let e = u(p);
-					if (e) {
-						window.location.replace(e);
-						return;
-					}
-				}
-				d(i);
-				let a = r();
-				if (a) y(a), b(t(a)), x(e(a)), S(n(a)), w();
-				else {
-					if (p && !i.user && !i.tokens) try {
-						let e = new URL(p).origin, t = window.location.origin, n = u(p);
-						if (n) {
-							window.location.replace(n);
-							return;
-						}
-						if (e !== t && !l() && !o()) {
-							let t = window.location.href;
-							if (s(e, t)) return;
-							c(e, t), window.location.replace(`${e}/auth/sso-relay?returnTo=${encodeURIComponent(t)}`);
-							return;
-						}
-					} catch {}
-					y(null), b(null), x(null), S(null), C();
-				}
-			} finally {
-				_.current = !1, f();
-			}
-		}, E = setTimeout(() => {
-			f();
+		let p = () => {
+			s(!1), r?.();
+		}, _ = (t) => {
+			m(t, {
+				bridgeUrl: e,
+				bridgeSyncInProgress: o,
+				setActiveId: c,
+				setUser: l,
+				setTokens: u,
+				setWorkspaceTokenLocal: d,
+				clearAccounts: f,
+				refreshAccounts: h,
+				announceIdentityChange: g,
+				markBridgeReady: p
+			});
+		}, v = setTimeout(() => {
+			p();
 		}, 5e3);
 		return i({
-			bridgeUrl: p,
-			allowedOrigins: m,
-			onStateChanged: T,
-			debug: h ?? !1
+			bridgeUrl: e,
+			allowedOrigins: t,
+			onStateChanged: _,
+			debug: n ?? !1
 		}), () => {
-			clearTimeout(E);
+			clearTimeout(v);
 		};
 	}, [
-		p,
-		m,
+		e,
+		t,
+		n,
+		r,
 		h,
-		g,
-		w,
-		_,
-		v,
-		y,
-		b,
-		x,
-		S,
-		C
+		o,
+		s,
+		c,
+		l,
+		u,
+		d,
+		f,
+		g
 	]);
 }
 //#endregion
-export { p as useBridgeInitialization };
+export { h as useBridgeInitialization };

package/dist/shared/providers/shell/authProvider/useRemoteSLO.d.ts

@@ -1,4 +1,5 @@
 import { ProfileUser, AuthTokens } from '../ProfileStorageManager';
+import { AnnounceIdentityChange } from './identityChange';
 export interface RemoteSLODeps {
     tokens: AuthTokens | null;
     bridgeUrl: string | undefined;
@@ -10,5 +11,7 @@ export interface RemoteSLODeps {
     setTokens: (tokens: AuthTokens | null) => void;
     setWorkspaceTokenLocal: (token: string | null) => void;
     clearAccounts: () => void;
+    /** BOFF-9384: called before React state moves to the signed-out account. */
+    announceIdentityChange: AnnounceIdentityChange;
 }
-export declare function useRemoteSLO({ tokens, bridgeUrl, logout, setActiveId, setUser, setTokens, setWorkspaceTokenLocal, clearAccounts, }: RemoteSLODeps): void;
+export declare function useRemoteSLO({ tokens, bridgeUrl, logout, setActiveId, setUser, setTokens, setWorkspaceTokenLocal, clearAccounts, announceIdentityChange, }: RemoteSLODeps): void;

package/dist/shared/providers/shell/authProvider/useRemoteSLO.js

@@ -1,36 +1,38 @@
 import { resolveGatewayUrls as e } from "../../../config/gatewayUrls.js";
 import { isSharedSsoCookieDomain as t } from "../../../utils/authCookie.js";
 import { checkRemoteSLO as n, checkSLO as r } from "../../../components/SSORedirectGuard.js";
-import { useEffect as i } from "react";
+import { SIGNED_OUT as i } from "./identityChange.js";
+import { useEffect as a } from "react";
 //#region src/shared/providers/shell/authProvider/useRemoteSLO.ts
-function a({ tokens: a, bridgeUrl: o, logout: s, setActiveId: c, setUser: l, setTokens: u, setWorkspaceTokenLocal: d, clearAccounts: f }) {
-	i(() => {
-		if (!a?.accessToken || !o) return;
-		let i = async () => {
+function o({ tokens: o, bridgeUrl: s, logout: c, setActiveId: l, setUser: u, setTokens: d, setWorkspaceTokenLocal: f, clearAccounts: p, announceIdentityChange: m }) {
+	a(() => {
+		if (!o?.accessToken || !s) return;
+		let a = async () => {
 			if (document.visibilityState === "visible") try {
 				if (r()) {
-					c(null), l(null), u(null), d(null), f();
+					m("remote-slo", i), l(null), u(null), d(null), f(null), p();
 					return;
 				}
 				if (t()) return;
-				await n(`${e().globalBaseUrl}/global/graphql`, a.accessToken) && s({ authoritative: !1 });
+				await n(`${e().globalBaseUrl}/global/graphql`, o.accessToken) && c({ authoritative: !1 });
 			} catch {}
 		};
-		document.addEventListener("visibilitychange", i);
-		let p = setInterval(i, 9e4);
+		document.addEventListener("visibilitychange", a);
+		let h = setInterval(a, 9e4);
 		return () => {
-			document.removeEventListener("visibilitychange", i), clearInterval(p);
+			document.removeEventListener("visibilitychange", a), clearInterval(h);
 		};
 	}, [
-		a?.accessToken,
-		o,
+		o?.accessToken,
 		s,
 		c,
 		l,
 		u,
 		d,
-		f
+		f,
+		p,
+		m
 	]);
 }
 //#endregion
-export { a as useRemoteSLO };
+export { o as useRemoteSLO };

package/dist/shared/providers/shell/authProvider/useStorageSync.d.ts

@@ -1,4 +1,5 @@
 import { ProfileUser, AuthTokens } from '../ProfileStorageManager';
+import { AnnounceIdentityChange } from './identityChange';
 export interface StorageSyncDeps {
     user: ProfileUser | null;
     tokens: AuthTokens | null;
@@ -10,5 +11,7 @@ export interface StorageSyncDeps {
     setActiveId: (id: string | null) => void;
     clearAccounts: () => void;
     refreshAccounts: () => void;
+    /** BOFF-9384: called before React state moves to another account. */
+    announceIdentityChange: AnnounceIdentityChange;
 }
-export declare function useStorageSync({ user, tokens, workspaceToken, activeId, setUser, setTokens, setWorkspaceTokenLocal, setActiveId, clearAccounts, refreshAccounts, }: StorageSyncDeps): void;
+export declare function useStorageSync({ user, tokens, workspaceToken, activeId, setUser, setTokens, setWorkspaceTokenLocal, setActiveId, clearAccounts, refreshAccounts, announceIdentityChange, }: StorageSyncDeps): void;