@burdenoff/fe-libs 2026.510.126

package/dist/shared/components/PermissionGate.d.ts

@@ -0,0 +1,202 @@
+import { ReactNode, ReactElement } from 'react';
+export interface PermissionGateProps {
+    /** Content to render when permission check passes */
+    children: ReactNode;
+    /**
+     * Required permission(s).
+     * Supports wildcard patterns like "project:*"
+     */
+    permission?: string;
+    /**
+     * Multiple permissions to check.
+     * By default uses OR logic (any permission grants access).
+     * Set requireAll=true for AND logic.
+     */
+    permissions?: string[];
+    /**
+     * Require all permissions (AND logic) instead of any (OR logic).
+     * @default false
+     */
+    requireAll?: boolean;
+    /**
+     * Required role(s). Checked in addition to permissions.
+     */
+    role?: string;
+    /**
+     * Multiple roles to check.
+     * By default uses OR logic (any role grants access).
+     * Set requireAllRoles=true for AND logic.
+     */
+    roles?: string[];
+    /**
+     * Require all roles (AND logic) instead of any (OR logic).
+     * @default false
+     */
+    requireAllRoles?: boolean;
+    /**
+     * Content to render when permission check fails.
+     * If not provided, nothing is rendered.
+     */
+    fallback?: ReactNode;
+    /**
+     * Content to render while permissions are loading.
+     * If not provided, nothing is rendered during loading.
+     */
+    loading?: ReactNode;
+    /**
+     * Invert the permission check (render children when permission is DENIED).
+     * Useful for showing "request access" buttons.
+     * @default false
+     */
+    invert?: boolean;
+}
+/**
+ * PermissionGate - Conditionally render content based on permissions
+ *
+ * Features:
+ * - Single or multiple permission checks
+ * - AND/OR logic for multiple permissions
+ * - Role-based checks
+ * - Wildcard permission support (e.g., "project:*")
+ * - Loading and fallback states
+ * - Invert mode for showing "access denied" content
+ *
+ * @example Basic permission check
+ * ```tsx
+ * <PermissionGate permission="project:write">
+ *   <EditButton />
+ * </PermissionGate>
+ * ```
+ *
+ * @example Multiple permissions (OR logic - default)
+ * ```tsx
+ * <PermissionGate permissions={["project:write", "project:admin"]}>
+ *   <EditButton />
+ * </PermissionGate>
+ * ```
+ *
+ * @example Multiple permissions (AND logic)
+ * ```tsx
+ * <PermissionGate permissions={["project:read", "files:read"]} requireAll>
+ *   <ProjectFilesViewer />
+ * </PermissionGate>
+ * ```
+ *
+ * @example With fallback
+ * ```tsx
+ * <PermissionGate
+ *   permission="billing:manage"
+ *   fallback={<UpgradePrompt />}
+ * >
+ *   <BillingDashboard />
+ * </PermissionGate>
+ * ```
+ *
+ * @example Role check
+ * ```tsx
+ * <PermissionGate role="Admin">
+ *   <AdminPanel />
+ * </PermissionGate>
+ * ```
+ *
+ * @example Inverted (show when permission is denied)
+ * ```tsx
+ * <PermissionGate permission="project:write" invert>
+ *   <RequestAccessButton />
+ * </PermissionGate>
+ * ```
+ */
+export declare function PermissionGate({ children, permission, permissions, requireAll, role, roles, requireAllRoles, fallback, loading, invert, }: PermissionGateProps): ReactElement | null;
+export interface PermissionButtonProps {
+    /** The button element to wrap */
+    children: ReactElement;
+    /**
+     * Required permission(s).
+     * Supports wildcard patterns like "project:*"
+     */
+    permission?: string;
+    /**
+     * Multiple permissions to check.
+     */
+    permissions?: string[];
+    /**
+     * Require all permissions (AND logic).
+     * @default false
+     */
+    requireAll?: boolean;
+    /**
+     * Behavior when permission is denied.
+     * - 'disable': Disable the button (default)
+     * - 'hide': Hide the button completely
+     * - 'tooltip': Show tooltip explaining why button is disabled
+     * @default 'disable'
+     */
+    deniedBehavior?: "disable" | "hide" | "tooltip";
+    /**
+     * Tooltip text when permission is denied.
+     * Only used when deniedBehavior='tooltip'
+     */
+    deniedTooltip?: string;
+    /**
+     * Additional className for the wrapper when using tooltip
+     */
+    className?: string;
+}
+/**
+ * PermissionButton - Wrap a button to disable/hide based on permissions
+ *
+ * @example Disable button when no permission
+ * ```tsx
+ * <PermissionButton permission="project:delete">
+ *   <Button onClick={handleDelete}>Delete</Button>
+ * </PermissionButton>
+ * ```
+ *
+ * @example Hide button when no permission
+ * ```tsx
+ * <PermissionButton permission="project:delete" deniedBehavior="hide">
+ *   <Button onClick={handleDelete}>Delete</Button>
+ * </PermissionButton>
+ * ```
+ */
+export declare function PermissionButton({ children, permission, permissions, requireAll, deniedBehavior, deniedTooltip, className, }: PermissionButtonProps): ReactElement | null;
+export interface PermissionLinkProps {
+    /** The link element to wrap */
+    children: ReactElement;
+    /**
+     * Required permission(s).
+     */
+    permission?: string;
+    /**
+     * Multiple permissions to check.
+     */
+    permissions?: string[];
+    /**
+     * Require all permissions (AND logic).
+     * @default false
+     */
+    requireAll?: boolean;
+    /**
+     * Behavior when permission is denied.
+     * - 'disable': Make link non-clickable (default)
+     * - 'hide': Hide the link completely
+     * @default 'disable'
+     */
+    deniedBehavior?: "disable" | "hide";
+    /**
+     * Custom styles for disabled state
+     */
+    disabledClassName?: string;
+}
+/**
+ * PermissionLink - Wrap a link to disable/hide based on permissions
+ *
+ * @example
+ * ```tsx
+ * <PermissionLink permission="settings:read">
+ *   <Link to="/settings">Settings</Link>
+ * </PermissionLink>
+ * ```
+ */
+export declare function PermissionLink({ children, permission, permissions, requireAll, deniedBehavior, disabledClassName, }: PermissionLinkProps): ReactElement | null;
+//# sourceMappingURL=PermissionGate.d.ts.map

package/dist/shared/components/PermissionGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionGate.d.ts","sourceRoot":"","sources":["../../../src/shared/components/PermissionGate.tsx"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,SAAS,EACd,KAAK,YAAY,EAGlB,MAAM,OAAO,CAAC;AAOf,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,QAAQ,EAAE,SAAS,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,UAAU,EACV,WAAW,EACX,UAAkB,EAClB,IAAI,EACJ,KAAK,EACL,eAAuB,EACvB,QAAe,EACf,OAAc,EACd,MAAc,GACf,EAAE,mBAAmB,GAAG,YAAY,GAAG,IAAI,CA4C3C;AAMD,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,QAAQ,EAAE,YAAY,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,UAAU,EACV,WAAW,EACX,UAAkB,EAClB,cAA0B,EAC1B,aAAmE,EACnE,SAAS,GACV,EAAE,qBAAqB,GAAG,YAAY,GAAG,IAAI,CAkD7C;AAMD,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,UAAU,EACV,WAAW,EACX,UAAkB,EAClB,cAA0B,EAC1B,iBAAuE,GACxE,EAAE,mBAAmB,GAAG,YAAY,GAAG,IAAI,CA0C3C"}

package/dist/shared/components/PermissionGate.js

@@ -0,0 +1,41 @@
+import { usePermissions as e } from "../providers/shell/PermissionProvider.js";
+import { cloneElement as t, isValidElement as n } from "react";
+import { Fragment as r, jsx as i } from "react/jsx-runtime";
+//#region src/shared/components/PermissionGate.tsx
+function a({ children: t, permission: n, permissions: a, requireAll: o = !1, role: s, roles: c, requireAllRoles: l = !1, fallback: u = null, loading: d = null, invert: f = !1 }) {
+	let { hasPermission: p, hasPermissions: m, hasRole: h, hasAnyRole: g, hasAllRoles: _, isLoading: v } = e();
+	if (v) return d;
+	let y = !0;
+	n ? y = p(n) : a && a.length > 0 && (y = m(a, { requireAll: o }));
+	let b = !0;
+	s ? b = h(s) : c && c.length > 0 && (b = l ? _(c) : g(c));
+	let x = y && b;
+	return (f ? !x : x) ? /* @__PURE__ */ i(r, { children: t }) : u;
+}
+function o({ children: r, permission: a, permissions: o, requireAll: s = !1, deniedBehavior: c = "disable", deniedTooltip: l = "You do not have permission to perform this action", className: u }) {
+	let { hasPermission: d, hasPermissions: f, isLoading: p } = e(), m = !0;
+	if (a ? m = d(a) : o && o.length > 0 && (m = f(o, { requireAll: s })), p) return n(r) ? t(r, { disabled: !0 }) : null;
+	if (m) return r;
+	switch (c) {
+		case "hide": return null;
+		case "tooltip": return n(r) ? /* @__PURE__ */ i("span", {
+			className: u,
+			title: l,
+			children: t(r, { disabled: !0 })
+		}) : null;
+		default: return n(r) ? t(r, { disabled: !0 }) : null;
+	}
+}
+function s({ children: r, permission: i, permissions: a, requireAll: o = !1, deniedBehavior: s = "disable", disabledClassName: c = "pointer-events-none opacity-50 cursor-not-allowed" }) {
+	let { hasPermission: l, hasPermissions: u, isLoading: d } = e(), f = !0;
+	return i ? f = l(i) : a && a.length > 0 && (f = u(a, { requireAll: o })), d ? n(r) ? t(r, {
+		className: `${r.props.className ?? ""} ${c}`.trim(),
+		onClick: (e) => e.preventDefault()
+	}) : null : f ? r : s === "hide" || !n(r) ? null : t(r, {
+		className: `${r.props.className ?? ""} ${c}`.trim(),
+		onClick: (e) => e.preventDefault(),
+		"aria-disabled": !0
+	});
+}
+//#endregion
+export { o as PermissionButton, a as PermissionGate, s as PermissionLink };

package/dist/shared/components/ProductAccessGuard.d.ts

@@ -0,0 +1,8 @@
+import { ReactNode } from 'react';
+export interface ProductAccessGuardProps {
+    productId: string;
+    children: ReactNode;
+    waitlistUrl?: string;
+}
+export declare function ProductAccessGuard({ productId, children, waitlistUrl, }: ProductAccessGuardProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=ProductAccessGuard.d.ts.map

package/dist/shared/components/ProductAccessGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProductAccessGuard.d.ts","sourceRoot":"","sources":["../../../src/shared/components/ProductAccessGuard.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAQvC,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAmCD,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,QAAQ,EACR,WAAW,GACZ,EAAE,uBAAuB,2CAgCzB"}

package/dist/shared/components/QuotaMeter.d.ts

@@ -0,0 +1,30 @@
+export interface QuotaMeterProps {
+    /** Quota label, e.g. "Tags created" or "Agents". */
+    label: string;
+    /** Current consumption. */
+    used: number;
+    /** Plan limit. Use `null`/`undefined` for unlimited (renders "Unlimited"). */
+    limit?: number | null;
+    /** Optional unit suffix, e.g. "tags", "MB". */
+    unit?: string;
+    /** Threshold (0-100) above which the meter shows the "warning" state. */
+    warningPercent?: number;
+    /** Additional className applied to the root. */
+    className?: string;
+    /** Hide the textual usage line above the bar. */
+    hideHeader?: boolean;
+    /** Optional helper text rendered when the quota is exhausted. */
+    exhaustedHint?: string;
+}
+/**
+ * `QuotaMeter` — semantic-token quota progress meter. Renders a label,
+ * `used / limit` summary, a progress bar, and an inline state hint
+ * ("Approaching limit" / "Quota exhausted"). Designed for billing and
+ * settings pages where quota usage is surfaced inline.
+ *
+ * All colours are sourced from the design token system (status-warning-*,
+ * status-error-*, action-primary-*, bg-sunken, text-secondary) so the
+ * component theme-shifts automatically.
+ */
+export declare function QuotaMeter({ label, used, limit, unit, warningPercent, className, hideHeader, exhaustedHint, }: QuotaMeterProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=QuotaMeter.d.ts.map

package/dist/shared/components/QuotaMeter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuotaMeter.d.ts","sourceRoot":"","sources":["../../../src/shared/components/QuotaMeter.tsx"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,EACzB,KAAK,EACL,IAAI,EACJ,KAAK,EACL,IAAS,EACT,cAAmB,EACnB,SAAS,EACT,UAAkB,EAClB,aAAiE,GAClE,EAAE,eAAe,2CAoEjB"}

package/dist/shared/components/QuotaMeter.js

@@ -0,0 +1,47 @@
+import { cn as e } from "../../shared-utils.js";
+import { jsx as t, jsxs as n } from "react/jsx-runtime";
+//#region src/shared/components/QuotaMeter.tsx
+function r({ label: r, used: i, limit: a, unit: o = "", warningPercent: s = 80, className: c, hideHeader: l = !1, exhaustedHint: u = "Quota exhausted — upgrade your plan to continue" }) {
+	let d = a == null || a <= 0, f = d ? 0 : Math.min(Math.max(i / a * 100, 0), 100), p = !d && f >= s && f < 100, m = !d && f >= 100, h = m ? "text-status-error-text" : p ? "text-status-warning-text" : "text-text-secondary", g = m ? "bg-status-error-bg" : p ? "bg-status-warning-bg" : "bg-action-primary-bg", _ = d ? `${i.toLocaleString()} ${o}`.trim() + " · Unlimited" : `${i.toLocaleString()} / ${a.toLocaleString()} ${o}`.trim();
+	return /* @__PURE__ */ n("div", {
+		className: e("space-y-1.5", c),
+		role: "meter",
+		"aria-label": r,
+		"aria-valuenow": i,
+		"aria-valuemin": 0,
+		"aria-valuemax": d ? void 0 : a,
+		children: [
+			!l && /* @__PURE__ */ n("div", {
+				className: "flex items-center justify-between text-sm",
+				children: [/* @__PURE__ */ t("span", {
+					className: "text-text-secondary",
+					children: r
+				}), /* @__PURE__ */ t("span", {
+					className: e(h, (p || m) && "font-medium"),
+					children: _
+				})]
+			}),
+			/* @__PURE__ */ t("div", {
+				className: "h-2 bg-bg-sunken rounded-full overflow-hidden",
+				children: /* @__PURE__ */ t("div", {
+					className: e("h-full rounded-full transition-all duration-500", g),
+					style: { width: d ? "100%" : `${f}%` }
+				})
+			}),
+			p && /* @__PURE__ */ n("p", {
+				className: "text-xs text-status-warning-text",
+				children: [
+					"Approaching limit — ",
+					Math.max(0, Math.round(100 - f)),
+					"% remaining"
+				]
+			}),
+			m && /* @__PURE__ */ t("p", {
+				className: "text-xs text-status-error-text",
+				children: u
+			})
+		]
+	});
+}
+//#endregion
+export { r as QuotaMeter };

package/dist/shared/components/RequireAuth.d.ts

@@ -0,0 +1,76 @@
+import { ReactNode } from 'react';
+export interface RequireAuthProps {
+    /** Content to render when authenticated */
+    children: ReactNode;
+    /** Path to redirect to when not authenticated (default: /auth/login) */
+    loginPath?: string;
+    /** Custom loading component */
+    loadingComponent?: ReactNode;
+    /** Custom unauthorized component (shown when lacking permissions) */
+    unauthorizedComponent?: ReactNode;
+    /** Required permission(s) to access this route */
+    permissions?: string | string[];
+    /** Whether all permissions are required (true) or just one (false) */
+    requireAllPermissions?: boolean;
+    /** Callback when authentication check fails */
+    onAuthFail?: () => void;
+    /** Custom redirect function (for React Router integration) */
+    redirect?: (path: string) => ReactNode;
+}
+/**
+ * RequireAuth Component
+ *
+ * Route guard component that protects routes from unauthenticated access.
+ * Supports permission-based access control and customizable fallback UI.
+ *
+ * Features:
+ * - Authentication check
+ * - Permission-based authorization
+ * - Loading state handling
+ * - Customizable redirect
+ * - Flexible fallback components
+ *
+ * @example Basic usage (with Navigate from react-router-dom)
+ * ```tsx
+ * import { Navigate } from 'react-router-dom';
+ *
+ * <RequireAuth redirect={(path) => <Navigate to={path} replace />}>
+ *   <ProtectedPage />
+ * </RequireAuth>
+ * ```
+ *
+ * @example With permissions
+ * ```tsx
+ * <RequireAuth
+ *   permissions={['admin', 'editor']}
+ *   requireAllPermissions={false}
+ *   redirect={(path) => <Navigate to={path} replace />}
+ *   unauthorizedComponent={<UnauthorizedPage />}
+ * >
+ *   <AdminDashboard />
+ * </RequireAuth>
+ * ```
+ */
+export declare function RequireAuth({ children, loginPath, loadingComponent, unauthorizedComponent, permissions, requireAllPermissions, onAuthFail, redirect, }: RequireAuthProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * RequireGuest Component
+ *
+ * Opposite of RequireAuth - only allows unauthenticated users.
+ * Useful for login/register pages that should redirect authenticated users away.
+ *
+ * @example
+ * ```tsx
+ * <RequireGuest redirect={(path) => <Navigate to={path} replace />}>
+ *   <LoginPage />
+ * </RequireGuest>
+ * ```
+ */
+export interface RequireGuestProps {
+    children: ReactNode;
+    /** Path to redirect authenticated users to */
+    redirectTo?: string;
+    /** Custom redirect function */
+    redirect?: (path: string) => ReactNode;
+}
+export declare function RequireGuest({ children, redirectTo, redirect, }: RequireGuestProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=RequireAuth.d.ts.map

package/dist/shared/components/RequireAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequireAuth.d.ts","sourceRoot":"","sources":["../../../src/shared/components/RequireAuth.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAIvC,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,QAAQ,EAAE,SAAS,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC7B,qEAAqE;IACrE,qBAAqB,CAAC,EAAE,SAAS,CAAC;IAClC,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,SAAyB,EACzB,gBAAgB,EAChB,qBAAqB,EACrB,WAAW,EACX,qBAA6B,EAC7B,UAAU,EACV,QAAQ,GACT,EAAE,gBAAgB,2CAsGlB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC;CACxC;AAED,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,UAAgB,EAChB,QAAQ,GACT,EAAE,iBAAiB,kDAwBnB"}

package/dist/shared/components/RequireAuth.js

@@ -0,0 +1,90 @@
+import { redirectToSafeLocation as e } from "../graphql/security.js";
+import { useAuth as t } from "../providers/shell/AuthProvider.js";
+import { Fragment as n, jsx as r, jsxs as i } from "react/jsx-runtime";
+//#region src/shared/components/RequireAuth.tsx
+function a({ children: e, loginPath: a = "/auth/login", loadingComponent: o, unauthorizedComponent: s, permissions: c, requireAllPermissions: l = !1, onAuthFail: u, redirect: d }) {
+	let { isAuthenticated: f, isLoading: p, hasPermission: m } = t();
+	if (p) return /* @__PURE__ */ r(n, { children: o ?? /* @__PURE__ */ r("div", {
+		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
+		children: /* @__PURE__ */ i("div", {
+			className: "flex flex-col items-center gap-4",
+			children: [/* @__PURE__ */ r("div", { className: "w-8 h-8 border-2 border-brand-primary border-t-transparent rounded-full animate-spin" }), /* @__PURE__ */ r("span", {
+				className: "text-text-secondary text-sm",
+				children: "Loading..."
+			})]
+		})
+	}) });
+	if (!f) return u?.(), d ? /* @__PURE__ */ r(n, { children: d(a) }) : /* @__PURE__ */ r("div", {
+		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
+		children: /* @__PURE__ */ i("div", {
+			className: "bg-bg-surface border border-border-default rounded-lg p-8 max-w-md w-full text-center",
+			children: [
+				/* @__PURE__ */ r("h2", {
+					className: "text-heading-h3 text-text-primary mb-4",
+					children: "Authentication Required"
+				}),
+				/* @__PURE__ */ r("p", {
+					className: "text-text-secondary mb-6",
+					children: "Please log in to access this page."
+				}),
+				/* @__PURE__ */ r("a", {
+					href: a,
+					className: "inline-flex items-center justify-center px-4 py-2 bg-action-primary-bg text-action-primary-text rounded-md hover:bg-action-primary-bg-hover transition-colors",
+					children: "Go to Login"
+				})
+			]
+		})
+	});
+	if (c) {
+		let e = Array.isArray(c) ? c : [c], t;
+		if (t = l ? e.every(m) : e.some(m), !t) return s ? /* @__PURE__ */ r(n, { children: s }) : /* @__PURE__ */ r("div", {
+			className: "flex items-center justify-center min-h-screen bg-bg-canvas",
+			children: /* @__PURE__ */ i("div", {
+				className: "bg-bg-surface border border-border-default rounded-lg p-8 max-w-md w-full text-center",
+				children: [
+					/* @__PURE__ */ r("div", {
+						className: "w-12 h-12 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center",
+						children: /* @__PURE__ */ r("svg", {
+							className: "w-6 h-6 text-status-error-text",
+							fill: "none",
+							viewBox: "0 0 24 24",
+							stroke: "currentColor",
+							children: /* @__PURE__ */ r("path", {
+								strokeLinecap: "round",
+								strokeLinejoin: "round",
+								strokeWidth: 2,
+								d: "M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+							})
+						})
+					}),
+					/* @__PURE__ */ r("h2", {
+						className: "text-heading-h3 text-text-primary mb-4",
+						children: "Access Denied"
+					}),
+					/* @__PURE__ */ r("p", {
+						className: "text-text-secondary mb-6",
+						children: "You don't have permission to access this page."
+					}),
+					/* @__PURE__ */ i("p", {
+						className: "text-text-muted text-sm",
+						children: [
+							"Required permissions:",
+							" ",
+							e.join(l ? " AND " : " OR ")
+						]
+					})
+				]
+			})
+		});
+	}
+	return /* @__PURE__ */ r(n, { children: e });
+}
+function o({ children: i, redirectTo: a = "/", redirect: o }) {
+	let { isAuthenticated: s, isLoading: c } = t();
+	return c ? /* @__PURE__ */ r("div", {
+		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
+		children: /* @__PURE__ */ r("div", { className: "w-8 h-8 border-2 border-brand-primary border-t-transparent rounded-full animate-spin" })
+	}) : s ? o ? /* @__PURE__ */ r(n, { children: o(a) }) : (typeof window < "u" && e(a), null) : /* @__PURE__ */ r(n, { children: i });
+}
+//#endregion
+export { a as RequireAuth, o as RequireGuest };

package/dist/shared/components/SSORedirectGuard.d.ts

@@ -0,0 +1,56 @@
+/**
+ * SSORedirectGuard — Checks for SSO cookie and redirects to login origin
+ * for token relay if the current origin doesn't have local tokens.
+ *
+ * This component should be rendered in route guards (ProtectedRoute,
+ * LandingOrDashboardRedirect) to enable cross-domain SSO.
+ *
+ * Works in all environments (local dev, alpha, production):
+ * - Local dev: cookie on .local.burdenoff.com shared domain
+ * - Production: cookie on current domain (redirect-based relay)
+ *
+ * @module @burdenoff/fe-libs/shared/components/SSORedirectGuard
+ */
+export declare function shouldSkipSSORedirect(returnPath?: string): boolean;
+export declare function hasRecentSSORedirectAttempt(relayOrigin: string, returnTo: string): boolean;
+export declare function markSSORedirectAttempt(relayOrigin: string, returnTo: string): void;
+/**
+ * Check if an SSO redirect should be initiated.
+ * Returns the redirect URL if SSO should happen, null otherwise.
+ *
+ * Call this from ProtectedRoute or LandingOrDashboardRedirect
+ * before showing login page.
+ */
+export declare function getSSORedirectUrl(returnPath?: string): string | null;
+/**
+ * Check if Single Logout (SLO) has occurred on another shell.
+ *
+ * If the bf-sso cookie is ABSENT but localStorage has auth tokens,
+ * it means another shell cleared the shared cookie (logged out).
+ * This function clears local tokens and returns true so the caller
+ * can redirect to the login page.
+ *
+ * Call this in ProtectedRoute BEFORE checking local tokens.
+ */
+export declare function checkSLO(): boolean;
+/**
+ * Check if the current access token is still valid by making a lightweight
+ * GraphQL query. If the server rejects it (401/UNAUTHENTICATED), the session
+ * was invalidated (SLO from another domain) → clear local state.
+ *
+ * This enables SLO across different eTLD+1 domains (production).
+ * Called once on page load from ProtectedRoute.
+ *
+ * Returns a Promise that resolves to true if session is invalid (SLO occurred).
+ */
+export declare function checkRemoteSLO(gatewayUrl: string, accessToken: string): Promise<boolean>;
+/**
+ * Clear all local auth state (used by both checkSLO and checkRemoteSLO).
+ */
+export declare function clearLocalAuthState(): void;
+/**
+ * React component that renders a spinner while redirecting.
+ * Use this as the return value when getSSORedirectUrl() returns a URL.
+ */
+export declare function SSORedirectSpinner(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SSORedirectGuard.d.ts.map

package/dist/shared/components/SSORedirectGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SSORedirectGuard.d.ts","sourceRoot":"","sources":["../../../src/shared/components/SSORedirectGuard.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAyGH,wBAAgB,qBAAqB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAQT;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,IAAI,CAiBN;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,IAAI,OAAO,CA6BlC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAyClB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CA6B1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,4CAMjC"}