@burdenoff/fe-libs 2026.510.126

package/dist/shared/graphql/fetch.js

@@ -0,0 +1,323 @@
+import { createBrowserTraceContext as e } from "../events/metadata.js";
+import { GATEWAYS as t } from "../../shared-config.js";
+import { getActiveWorkspaceToken as n, resolveActiveProfileId as r, setProfileWorkspaceToken as i } from "../providers/shell/ProfileStorageManager.js";
+import { readActiveContextValueWithUrlPrecedence as a } from "../providers/shell/ActiveContextStorage.js";
+import { getValidAccessTokenFromStorage as o, sanitizeExtraHeaders as s, sanitizeGeography as c, validateGatewayBaseUrl as l } from "./security.js";
+import { isWorkspaceTokenValidForContext as u } from "./workspaceToken.js";
+//#region src/shared/graphql/fetch.ts
+var d = "\n  mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n    issueWorkspaceToken(input: $input) {\n      success\n      token\n      workspaceId\n      error {\n        message\n      }\n    }\n  }\n", f = /* @__PURE__ */ new Map();
+function p() {
+	try {
+		let e = sessionStorage.getItem("bf-active-profile");
+		return e ? o(localStorage.getItem(`bf-p-${e}-tokens`)) : null;
+	} catch {
+		return null;
+	}
+}
+function m() {
+	try {
+		return n();
+	} catch {
+		return null;
+	}
+}
+function h() {
+	try {
+		return sessionStorage.getItem("bf-active-profile");
+	} catch {
+		return null;
+	}
+}
+function g(e) {
+	try {
+		let [, t] = e.split(".");
+		if (!t || typeof globalThis.atob != "function") return null;
+		let n = t.replace(/-/g, "+").replace(/_/g, "/");
+		return JSON.parse(globalThis.atob(n));
+	} catch {
+		return null;
+	}
+}
+function _(e) {
+	let t = g(e)?.exp;
+	return typeof t == "number" ? t * 1e3 <= Date.now() + 3e4 : !1;
+}
+function v() {
+	try {
+		let e = sessionStorage.getItem("bf-active-profile");
+		if (e) {
+			let t = localStorage.getItem(`bf-p-${e}-geography`);
+			if (t) return c(JSON.parse(t));
+		}
+		let t = localStorage.getItem("burdenoff-geography");
+		return t ? c(JSON.parse(t)) : null;
+	} catch {
+		return null;
+	}
+}
+function y() {
+	try {
+		let e = sessionStorage.getItem("bf-active-profile");
+		if (e) {
+			let t = localStorage.getItem(`bf-p-${e}-locale`);
+			if (t) return t;
+		}
+		return localStorage.getItem("burdenoff-locale") || "en";
+	} catch {
+		return "en";
+	}
+}
+function b() {
+	return a("workspace");
+}
+function x() {
+	return a("organization");
+}
+function S() {
+	return a("tenant");
+}
+function C() {
+	try {
+		return typeof window > "u" ? null : new URLSearchParams(window.location.search).get("org");
+	} catch {
+		return null;
+	}
+}
+function w(e) {
+	return {
+		workspaceId: typeof e.workspaceId == "string" ? e.workspaceId : b() || void 0,
+		organizationId: typeof e.organizationId == "string" ? e.organizationId : x() || C() || void 0,
+		tenantId: typeof e.tenantId == "string" ? e.tenantId : S() || void 0
+	};
+}
+function T(e, t, n) {
+	try {
+		let a = r() ?? h();
+		if (!a) return;
+		i(a, t), sessionStorage.setItem("burdenoff-active-context-workspace", e), n && sessionStorage.setItem("burdenoff-active-context-organization", n);
+	} catch {}
+}
+async function E(e) {
+	let { url: t, authToken: n, workspaceId: r, organizationId: i, locale: a, signal: o, currentQuery: s } = e;
+	if (!n || s.includes("issueWorkspaceToken")) return null;
+	let c = r || b();
+	if (!c) return null;
+	let l = m(), p = b(), h = i || x() || C();
+	if (l && p === c && u(l, {
+		workspaceId: c,
+		organizationId: h
+	})) return l;
+	if (!h) return null;
+	let g = `${h}:${c}`, _ = f.get(g);
+	if (_) return _;
+	let v = fetch(t, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${n}`,
+			...a ? { "Accept-Language": a } : {}
+		},
+		body: JSON.stringify({
+			query: d,
+			variables: { input: {
+				organizationId: h,
+				workspaceId: c
+			} }
+		}),
+		signal: o
+	}).then(async (e) => {
+		let t = (await e.json()).data?.issueWorkspaceToken;
+		return t?.success && t.token ? (T(t.workspaceId || c, t.token, h), t.token) : null;
+	}).catch(() => null).finally(() => {
+		f.delete(g);
+	});
+	return f.set(g, v), v;
+}
+function D(e, n) {
+	let r = t[e], i = n || r.defaultBaseUrl;
+	return `${i.endsWith("/") ? i.slice(0, -1) : i}${r.graphql}`;
+}
+function O() {
+	return globalThis;
+}
+function k() {
+	let e = O();
+	return e.__graphqlFetchQueues ||= /* @__PURE__ */ new Map(), e.__graphqlFetchQueues;
+}
+function A() {
+	let e = O();
+	return e.__graphqlFetchResponseCache ||= /* @__PURE__ */ new Map(), e.__graphqlFetchResponseCache;
+}
+function j() {
+	let e = O();
+	return e.__graphqlFetchPendingResponses ||= /* @__PURE__ */ new Map(), e.__graphqlFetchPendingResponses;
+}
+var M = 50, N = 2500, P = 100, F = 1e4, I = 15e3, L = new Set([
+	"traceparent",
+	"tracestate",
+	"baggage"
+]);
+function R() {
+	if (typeof performance > "u") return P;
+	let e = O();
+	return e.__graphqlFetchBurstStartedAt ??= performance.now(), performance.now() - e.__graphqlFetchBurstStartedAt < F ? N : P;
+}
+function z(e) {
+	return typeof e.query == "string" ? /^\s*query\b/.test(e.query) : !1;
+}
+function B(e) {
+	return typeof e.operationName == "string" && e.operationName.length > 0 ? {
+		operationName: e.operationName,
+		variables: e.variables ?? null
+	} : e;
+}
+function V(e) {
+	let t = /* @__PURE__ */ new Map();
+	for (let [n, r] of Object.entries(e)) {
+		let e = n.toLowerCase();
+		L.has(e) || t.set(e, r);
+	}
+	return Object.fromEntries(Array.from(t.entries()).sort(([e], [t]) => e.localeCompare(t)));
+}
+function H(t) {
+	let n = e();
+	return {
+		...t,
+		traceparent: n.traceparent
+	};
+}
+async function U(e, t, n) {
+	if (n.length === 1) {
+		let r = n[0];
+		try {
+			let n = await fetch(e, {
+				method: "POST",
+				headers: H(t),
+				credentials: "include",
+				body: JSON.stringify(r.body),
+				signal: r.signal
+			});
+			if (!n.ok) throw Error(`GraphQL fetch failed: ${n.status} ${n.statusText}`);
+			let i = await n.json();
+			r.cacheKey && A().set(r.cacheKey, {
+				value: i,
+				expiresAt: Date.now() + I
+			}), r.resolve(i);
+		} catch (e) {
+			r.reject(e);
+		}
+		return;
+	}
+	let r = n.map((e) => e.body);
+	try {
+		let i = await fetch(e, {
+			method: "POST",
+			headers: H(t),
+			credentials: "include",
+			body: JSON.stringify(r)
+		});
+		if (!i.ok) throw Error(`GraphQL fetch failed: ${i.status} ${i.statusText}`);
+		let a = await i.json();
+		Array.isArray(a) ? a.forEach((e, t) => {
+			let r = n[t];
+			r && (r.cacheKey && A().set(r.cacheKey, {
+				value: e,
+				expiresAt: Date.now() + I
+			}), r.resolve(e));
+		}) : n.forEach((e) => {
+			e.cacheKey && A().set(e.cacheKey, {
+				value: a,
+				expiresAt: Date.now() + I
+			}), e.resolve(a);
+		});
+	} catch (e) {
+		n.forEach((t) => t.reject(e));
+	}
+}
+function W(e, t, n, r, i) {
+	let a = V(t), o = Math.max(1, i?.batchMax ?? M), s = Math.max(0, i?.batchInterval ?? R()), c = `${e}|${JSON.stringify(a)}`, l = z(n) ? `${c}|${JSON.stringify(B(n))}` : void 0;
+	if (l) {
+		let e = A(), t = e.get(l);
+		if (t) {
+			if (t.expiresAt > Date.now()) return Promise.resolve(t.value);
+			e.delete(l);
+		}
+		let n = j().get(l);
+		if (n) return n;
+	}
+	let u = new Promise((t, i) => {
+		if (o <= 1) {
+			U(e, a, [{
+				body: n,
+				resolve: t,
+				reject: i,
+				signal: r,
+				cacheKey: l
+			}]);
+			return;
+		}
+		let u = k(), d = u.get(c);
+		if (d || (d = {
+			requests: [],
+			timer: null,
+			batchMax: o,
+			batchInterval: s
+		}, u.set(c, d)), d.requests.push({
+			body: n,
+			resolve: t,
+			reject: i,
+			signal: r,
+			cacheKey: l
+		}), d.requests.length >= d.batchMax) {
+			G(e, a, c);
+			return;
+		}
+		d.timer ||= setTimeout(() => G(e, a, c), d.batchInterval);
+	});
+	return l && (j().set(l, u), u.finally(() => {
+		j().delete(l);
+	}).catch(() => {})), u;
+}
+function G(e, t, n) {
+	let r = k(), i = r.get(n);
+	i && (r.delete(n), i.timer &&= (clearTimeout(i.timer), null), U(e, t, i.requests));
+}
+async function K(e) {
+	let { gateway: t, query: n, variables: r, operationName: i, authToken: a, workspaceToken: o, workspaceId: c, organizationId: d, tenantId: f, locale: h, baseUrl: g, extraHeaders: b, signal: x } = e, C = l(D(t, g)), T = a && !_(a) ? a : p(), O = h ?? y(), k = w({
+		workspaceId: c,
+		organizationId: d,
+		tenantId: f
+	}), A = { "Content-Type": "application/json" };
+	T && (A.Authorization = `Bearer ${T}`), O && (A["Accept-Language"] = O);
+	let j = v();
+	if (j?.country && (A["X-Geo-Country"] = j.country), j?.currency && (A["X-Geo-Currency"] = j.currency), j?.timezone && (A["X-Geo-Timezone"] = j.timezone), t === "workspace" ? o !== !1 : o) {
+		let e = typeof o == "string" ? o : m();
+		e && !u(e, k) && (e = null), !e && o === !0 && /^\s*mutation\b/.test(n) && (e = await E({
+			url: C,
+			authToken: T,
+			workspaceId: k.workspaceId,
+			organizationId: k.organizationId,
+			locale: O,
+			signal: x,
+			currentQuery: n
+		})), e && (A["X-Workspace-Authorization"] = `Bearer ${e}`);
+	}
+	if (t === "workspace" || c) {
+		let e = k.workspaceId;
+		e && (A["x-workspace-id"] = e);
+	}
+	if (t === "global" || d) {
+		let e = k.organizationId;
+		e && (A["x-org-id"] = e);
+	}
+	if (f) {
+		let e = typeof f == "string" ? f : S();
+		e && (A["x-tenant-id"] = e);
+	}
+	let M = s(b);
+	M && Object.assign(A, M);
+	let N = { query: n };
+	return r && (N.variables = r), i && (N.operationName = i), W(C, A, N, x);
+}
+//#endregion
+export { W as enqueueGraphQLFetch, p as getStoredAuthToken, y as getStoredLocale, x as getStoredOrganizationId, b as getStoredWorkspaceId, m as getStoredWorkspaceToken, K as graphqlFetch, D as resolveGatewayUrl };

package/dist/shared/graphql/index.d.ts

@@ -0,0 +1,9 @@
+export { createGraphQLClient, initializeAppClients, getWorkspaceClient, getGlobalClient, resetAppClients, type CreateClientOptions, type AppClientConfig, type Gateway, } from './client';
+export { GatewayProvider, useGateway, useGatewayClient, useSafeGateway, useSafeGatewayClient, type GatewayContextValue, type GatewayProviderProps, } from './GatewayContext';
+export { graphqlFetch, getStoredAuthToken, getStoredWorkspaceToken, getStoredWorkspaceId, getStoredLocale, getStoredOrganizationId, resolveGatewayUrl, type GraphQLFetchOptions, type GraphQLResponse, } from './fetch';
+export { getWorkspaceTokenPayload, isWorkspaceTokenValidForContext, type WorkspaceTokenContext, type WorkspaceTokenPayload, } from './workspaceToken';
+export { SSELink, type SSELinkOptions } from './links/sse-link';
+export { ApolloClient, InMemoryCache, type NormalizedCacheObject, } from '@apollo/client/core';
+export { ApolloProvider, useQuery, useMutation, useLazyQuery, useSubscription, useApolloClient, } from '@apollo/client/react';
+export { gql } from '@apollo/client/core';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/graphql/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/graphql/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,OAAO,GACb,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,cAAc,EACd,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/shared/graphql/links/sse-link.d.ts

@@ -0,0 +1,48 @@
+import { ApolloLink, Observable, FetchResult, Operation } from '@apollo/client/core';
+export interface SSELinkOptions {
+    /** SSE endpoint URL */
+    url: string;
+    /** Optional headers to include with requests */
+    headers?: Record<string, string>;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * SSE Link for GraphQL Yoga subscriptions
+ *
+ * GraphQL Yoga uses Server-Sent Events (SSE) for subscriptions over HTTP.
+ * This is more compatible with serverless and edge deployments than WebSockets.
+ *
+ * SSE Format:
+ * - event: next\ndata: {...}\n\n - Subscription data
+ * - event: complete\n\n - Subscription ended
+ * - event: error\ndata: {...}\n\n - Error occurred
+ *
+ * @example
+ * ```ts
+ * import { SSELink } from '@burdenoff/fe-libs/shared/graphql/links/sse-link';
+ *
+ * const sseLink = new SSELink({
+ *   url: 'https://gw-wspace.local.burdenoff.com/workspaces/graphql/stream',
+ *   headers: {
+ *     authorization: `Bearer ${token}`,
+ *   },
+ * });
+ * ```
+ */
+export declare class SSELink extends ApolloLink {
+    private url;
+    private headers;
+    private debug;
+    constructor(options: SSELinkOptions);
+    /**
+     * Update headers (useful for token refresh)
+     */
+    setHeaders(headers: Record<string, string>): void;
+    /**
+     * Update the authorization header
+     */
+    setAuthToken(token: string | null): void;
+    request(operation: Operation): Observable<FetchResult>;
+}
+//# sourceMappingURL=sse-link.d.ts.map

package/dist/shared/graphql/links/sse-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-link.d.ts","sourceRoot":"","sources":["../../../../src/shared/graphql/links/sse-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGlE,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,OAAQ,SAAQ,UAAU;IACrC,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,KAAK,CAAU;gBAEX,OAAO,EAAE,cAAc;IAOnC;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAIjD;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAQxC,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC;CAoKvD"}

package/dist/shared/graphql/links/sse-link.js

@@ -0,0 +1,88 @@
+import { ApolloLink as e, Observable as t } from "@apollo/client/core";
+import { print as n } from "graphql";
+//#region src/shared/graphql/links/sse-link.ts
+var r = class extends e {
+	url;
+	headers;
+	debug;
+	constructor(e) {
+		super(), this.url = e.url, this.headers = e.headers || {}, this.debug = e.debug ?? !1;
+	}
+	setHeaders(e) {
+		this.headers = {
+			...this.headers,
+			...e
+		};
+	}
+	setAuthToken(e) {
+		e ? this.headers.authorization = `Bearer ${e}` : delete this.headers.authorization;
+	}
+	request(e) {
+		return new t((t) => {
+			let r = JSON.stringify({
+				query: n(e.query),
+				variables: e.variables,
+				operationName: e.operationName
+			}), i = new AbortController(), a = e.getContext().headers ?? {};
+			return this.debug && console.log("[SSELink] Starting subscription:", e.operationName, "context-header-keys:", Object.keys(a)), fetch(this.url, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Accept: "text/event-stream",
+					...this.headers,
+					...a
+				},
+				body: r,
+				signal: i.signal
+			}).then(async (e) => {
+				if (this.debug && console.log("[SSELink] Response received, status:", e.status), !e.ok) throw Error(`HTTP error! status: ${e.status}`);
+				let n = e.body?.getReader();
+				if (!n) throw Error("No response body");
+				let r = new TextDecoder(), i = "";
+				for (;;) {
+					let { done: e, value: a } = await n.read();
+					if (e) {
+						this.debug && console.log("[SSELink] Stream ended");
+						break;
+					}
+					i += r.decode(a, { stream: !0 });
+					let o = i.split("\n\n");
+					i = o.pop() || "";
+					for (let e of o) {
+						if (!e.trim()) continue;
+						let n = e.split("\n"), r = "", i = "";
+						for (let e of n) e.startsWith("event:") ? r = e.slice(6).trim() : e.startsWith("data:") && (i = e.slice(5).trim());
+						if (this.debug && console.log("[SSELink] Parsed event:", r, "data length:", i.length), r === "complete") {
+							this.debug && console.log("[SSELink] Subscription completed"), t.complete();
+							return;
+						}
+						if (r === "error") {
+							let e = i ? JSON.parse(i) : { message: "Subscription error" };
+							t.error(Error(e.message || "Subscription error"));
+							return;
+						}
+						if (r === "next" && i) try {
+							let e = JSON.parse(i);
+							this.debug && console.log("[SSELink] Emitting data:", e), t.next(e);
+						} catch (e) {
+							console.error("[SSELink] Failed to parse SSE data:", e, i);
+						}
+						else if (i && !r) try {
+							let e = JSON.parse(i);
+							this.debug && console.log("[SSELink] Emitting data (no event type):", e), t.next(e);
+						} catch (e) {
+							console.error("[SSELink] Failed to parse SSE data:", e);
+						}
+					}
+				}
+				t.complete();
+			}).catch((e) => {
+				e.name !== "AbortError" && (console.error("[SSELink] Error:", e), t.error(e));
+			}), () => {
+				this.debug && console.log("[SSELink] Subscription cleanup"), i.abort();
+			};
+		});
+	}
+};
+//#endregion
+export { r as SSELink };

package/dist/shared/graphql/security.d.ts

@@ -0,0 +1,13 @@
+type Geography = {
+    country?: string;
+    currency?: string;
+    timezone?: string;
+};
+export declare function getValidAccessTokenFromStorage(tokensRaw: string | null): string | null;
+export declare function sanitizeGeography(input: Geography | null): Geography | null;
+export declare function isSafeRedirectTarget(target: string, baseOrigin?: string): boolean;
+export declare function redirectToSafeLocation(target: string, fallback?: string, baseOrigin?: string): boolean;
+export declare function validateGatewayBaseUrl(value: string): string;
+export declare function sanitizeExtraHeaders(headers?: Record<string, string>): Record<string, string> | undefined;
+export {};
+//# sourceMappingURL=security.d.ts.map

package/dist/shared/graphql/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/shared/graphql/security.ts"],"names":[],"mappings":"AAkBA,KAAK,SAAS,GAAG;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAiBF,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,MAAM,GAAG,IAAI,CAyBf;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CA6B3E;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,MAA+B,GAC1C,OAAO,CAeT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,MAAY,EACtB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqB5D;AAED,wBAAgB,oBAAoB,CAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAQpC"}

package/dist/shared/graphql/security.js

@@ -0,0 +1,84 @@
+//#region src/shared/graphql/security.ts
+var e = new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1"
+]), t = new Set([
+	"authorization",
+	"cookie",
+	"x-actor-id",
+	"x-actor-type",
+	"x-consent-granted-by",
+	"x-consent-scope",
+	"x-consent-granted-at",
+	"x-consent-expires-at",
+	"x-rbac-bypass",
+	"x-bypass-source",
+	"x-bypass-timestamp"
+]), n = /^[A-Z]{2}$/, r = /^[A-Z]{3}$/, i = /^[A-Za-z_]+(?:\/[A-Za-z0-9_+-]+)+$/;
+function a(e) {
+	let t = e.split(".");
+	if (t.length !== 3) return null;
+	try {
+		let e = t[1].replace(/-/g, "+").replace(/_/g, "/"), n = e.padEnd(Math.ceil(e.length / 4) * 4, "=");
+		return JSON.parse(atob(n));
+	} catch {
+		return null;
+	}
+}
+function o(e) {
+	if (!e) return null;
+	try {
+		let t = JSON.parse(e);
+		if (typeof t.accessToken != "string" || t.accessToken.length === 0) return null;
+		let n = a(t.accessToken);
+		return !n || typeof n.exp != "number" ? null : n.exp > Math.floor(Date.now() / 1e3) ? t.accessToken : null;
+	} catch {
+		return null;
+	}
+}
+function s(e) {
+	if (!e) return null;
+	let t = {};
+	if (typeof e.country == "string") {
+		let r = e.country.trim().toUpperCase();
+		n.test(r) && (t.country = r);
+	}
+	if (typeof e.currency == "string") {
+		let n = e.currency.trim().toUpperCase();
+		r.test(n) && (t.currency = n);
+	}
+	if (typeof e.timezone == "string") {
+		let n = e.timezone.trim();
+		n.length <= 100 && i.test(n) && (t.timezone = n);
+	}
+	return Object.keys(t).length > 0 ? t : null;
+}
+function c(e, t = window.location.origin) {
+	if (!e.trim()) return !1;
+	try {
+		let n = new URL(t), r = new URL(e, t);
+		return (r.protocol === "https:" || r.protocol === "http:") && r.origin === n.origin;
+	} catch {
+		return !1;
+	}
+}
+function l(e, t = "/", n) {
+	let r = c(e, n) ? e : t;
+	return c(r, n) ? (window.location.assign(r), !0) : !1;
+}
+function u(t) {
+	let n;
+	try {
+		n = new URL(t);
+	} catch {
+		throw Error("Gateway URL must be a valid absolute URL");
+	}
+	if (n.protocol === "https:" || n.protocol === "http:" && e.has(n.hostname.toLowerCase())) return n.toString().replace(/\/$/, "");
+	throw Error("Gateway URL must use HTTPS unless it targets localhost");
+}
+function d(e) {
+	if (e) return Object.fromEntries(Object.entries(e).filter(([e]) => !t.has(e.toLowerCase())));
+}
+//#endregion
+export { o as getValidAccessTokenFromStorage, l as redirectToSafeLocation, d as sanitizeExtraHeaders, s as sanitizeGeography, u as validateGatewayBaseUrl };

package/dist/shared/graphql/workspaceToken.d.ts

@@ -0,0 +1,13 @@
+export interface WorkspaceTokenContext {
+    workspaceId?: string | null;
+    organizationId?: string | null;
+    tenantId?: string | null;
+    projectId?: string | null;
+}
+export interface WorkspaceTokenPayload extends WorkspaceTokenContext {
+    exp?: number;
+    tokenType?: string;
+}
+export declare function getWorkspaceTokenPayload(token: string): WorkspaceTokenPayload | null;
+export declare function isWorkspaceTokenValidForContext(token: string | null | undefined, expected: WorkspaceTokenContext, expiryBufferMs?: number): token is string;
+//# sourceMappingURL=workspaceToken.d.ts.map

package/dist/shared/graphql/workspaceToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceToken.d.ts","sourceRoot":"","sources":["../../../src/shared/graphql/workspaceToken.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,GACZ,qBAAqB,GAAG,IAAI,CAc9B;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,QAAQ,EAAE,qBAAqB,EAC/B,cAAc,SAAS,GACtB,KAAK,IAAI,MAAM,CAkCjB"}

package/dist/shared/graphql/workspaceToken.js

@@ -0,0 +1,33 @@
+//#region src/shared/graphql/workspaceToken.ts
+function e(e) {
+	try {
+		let [, t] = e.split(".");
+		if (!t || typeof globalThis.atob != "function") return null;
+		let n = t.replace(/-/g, "+").replace(/_/g, "/"), r = n.padEnd(Math.ceil(n.length / 4) * 4, "=");
+		return JSON.parse(globalThis.atob(r));
+	} catch {
+		return null;
+	}
+}
+function t(e, t) {
+	let n = e[t];
+	return typeof n == "string" && n.length > 0 ? n : void 0;
+}
+function n(n) {
+	let r = e(n);
+	return r ? {
+		workspaceId: t(r, "workspaceId"),
+		organizationId: t(r, "organizationId"),
+		tenantId: t(r, "tenantId"),
+		projectId: t(r, "projectId"),
+		tokenType: t(r, "tokenType"),
+		exp: typeof r.exp == "number" ? r.exp : void 0
+	} : null;
+}
+function r(e, t, r = 3e4) {
+	if (!e) return !1;
+	let i = n(e);
+	return !(!i || i.exp && i.exp * 1e3 <= Date.now() + r || t.workspaceId && i.workspaceId !== t.workspaceId || t.organizationId && i.organizationId !== t.organizationId || t.tenantId && i.tenantId !== t.tenantId || t.projectId && i.projectId !== t.projectId);
+}
+//#endregion
+export { n as getWorkspaceTokenPayload, r as isWorkspaceTokenValidForContext };

package/dist/shared/help/HelpButton.d.ts

@@ -0,0 +1,25 @@
+import { FC } from 'react';
+export interface HelpButtonProps {
+    /** Additional CSS classes */
+    className?: string;
+    /** Button variant */
+    variant?: "default" | "ghost" | "icon";
+    /** Show label text */
+    showLabel?: boolean;
+    /** Label text */
+    label?: string;
+}
+/**
+ * HelpButton component
+ *
+ * @example
+ * ```tsx
+ * // Icon only
+ * <HelpButton variant="icon" />
+ *
+ * // With label
+ * <HelpButton showLabel label="Help & Support" />
+ * ```
+ */
+export declare const HelpButton: FC<HelpButtonProps>;
+//# sourceMappingURL=HelpButton.d.ts.map

package/dist/shared/help/HelpButton.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HelpButton.d.ts","sourceRoot":"","sources":["../../../src/shared/help/HelpButton.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAGhC,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;IACvC,sBAAsB;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,EAAE,EAAE,CAAC,eAAe,CAwC1C,CAAC"}

package/dist/shared/help/HelpPanel.d.ts

@@ -0,0 +1,10 @@
+import { FC } from 'react';
+export interface HelpPanelProps {
+    /** Additional CSS classes */
+    className?: string;
+}
+/**
+ * HelpPanel component
+ */
+export declare const HelpPanel: FC<HelpPanelProps>;
+//# sourceMappingURL=HelpPanel.d.ts.map

package/dist/shared/help/HelpPanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HelpPanel.d.ts","sourceRoot":"","sources":["../../../src/shared/help/HelpPanel.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAKhC,MAAM,WAAW,cAAc;IAC7B,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA2ID;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,EAAE,CAAC,cAAc,CAmTxC,CAAC"}