@burdenoff/fe-libs 2026.510.126

package/dist/shared/providers/shell/AuthProvider.d.ts

@@ -0,0 +1,58 @@
+import { ReactNode } from 'react';
+import { ProfileUser, AuthTokens, ProfileMeta } from './ProfileStorageManager';
+export type { ProfileUser as User, AuthTokens, ProfileMeta };
+export interface Account {
+    id: string;
+    email: string;
+    name: string;
+    firstName?: string;
+    lastName?: string;
+    avatar?: string;
+    isActive?: boolean;
+    lastLogin?: string;
+}
+export interface AuthContextValue {
+    user: ProfileUser | null;
+    tokens: AuthTokens | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    login: (user: ProfileUser, accessToken: string, refreshToken?: string) => void;
+    logout: () => void;
+    updateUser: (user: Partial<ProfileUser>) => void;
+    refreshAccessToken: () => Promise<void>;
+    hasPermission: (permission: string) => boolean;
+    setWorkspaceToken: (token: string | null) => void;
+    workspaceToken: string | null;
+    mfaRequired: boolean;
+    mfaChallengeId: string | null;
+    setMfaState: (required: boolean, challengeId?: string | null) => void;
+    activeProfileId: string | null;
+    accounts: Account[];
+    switchAccount: (accountId: string) => void;
+    addAccount: (user: ProfileUser, accessToken: string, refreshToken?: string) => void;
+    removeAccount: (accountId: string) => void;
+    logoutAll: () => void;
+    currentUser: ProfileUser | null;
+}
+export interface AuthProviderProps {
+    children: ReactNode;
+    onTokenExpired?: () => void;
+    /** Called when a session is about to expire (5 minutes before). Use to show warning toast. */
+    onSessionExpiringSoon?: () => void;
+    onRefreshToken?: (refreshToken: string) => Promise<{
+        accessToken: string;
+        refreshToken?: string;
+        expiresAt?: number;
+    }>;
+    /** URL of the auth session bridge page (e.g., /auth/session-bridge). Enables cross-domain auth. */
+    bridgeUrl?: string;
+    /** Comma-separated allowed origins for the bridge postMessage (e.g., "http://localhost:5149,...") */
+    bridgeAllowedOrigins?: string;
+    /** Enable debug logging for the auth bridge */
+    bridgeDebug?: boolean;
+    /** Called when the auth bridge has finished initializing (responded or timed out) */
+    onBridgeReady?: () => void;
+}
+export declare function AuthProvider({ children, onTokenExpired, onSessionExpiringSoon, onRefreshToken, bridgeUrl, bridgeAllowedOrigins, bridgeDebug, onBridgeReady, }: AuthProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function useAuth(): AuthContextValue;
+//# sourceMappingURL=AuthProvider.d.ts.map

package/dist/shared/providers/shell/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAkBjB,MAAM,yBAAyB,CAAC;AAwBjC,YAAY,EAAE,WAAW,IAAI,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAE7D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,CACL,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,KAClB,IAAI,CAAC;IACV,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACjD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAE/C,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAClD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAE9B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAEtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,CACV,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,KAClB,IAAI,CAAC;IACV,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,SAAS,EAAE,MAAM,IAAI,CAAC;IAEtB,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACjC;AAwID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;IACnC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QACjD,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,mGAAmG;IACnG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,SAAS,EACT,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,EAAE,iBAAiB,2CAqqBnB;AAED,wBAAgB,OAAO,qBAMtB"}

package/dist/shared/providers/shell/AuthProvider.js

@@ -0,0 +1,391 @@
+import { resolveGatewayUrls as e } from "../../config/gatewayUrls.js";
+import { PROFILE_STORAGE_CHANGE_EVENT as t, addProfile as n, getActiveProfileId as r, getProfileTokens as i, getProfileUser as a, getProfileWorkspaceToken as o, getProfiles as s, loginProfile as c, logoutAllProfiles as ee, removeProfile as l, resolveActiveProfileId as u, setActiveProfileId as d, setProfileTokens as f, setProfileUser as te, setProfileWorkspaceToken as ne, setProfiles as p, switchProfile as re } from "./ProfileStorageManager.js";
+import { clearShellSsoCookies as m, isSharedSsoCookieDomain as ie, isTrustedSsoOrigin as h, readShellSsoCookie as g, setShellSsoCookies as ae } from "../../utils/authCookie.js";
+import { getAuthBridge as _, initAuthBridge as oe, isAuthBridgeInitialized as se } from "./AuthBridgeClient.js";
+import { checkRemoteSLO as ce, checkSLO as le, clearLocalAuthState as v, hasRecentSSORedirectAttempt as y, markSSORedirectAttempt as b, shouldSkipSSORedirect as x } from "../../components/SSORedirectGuard.js";
+import { createContext as S, useCallback as C, useContext as w, useEffect as T, useMemo as ue, useRef as de, useState as E } from "react";
+import { jsx as fe } from "react/jsx-runtime";
+//#region src/shared/providers/shell/AuthProvider.tsx
+var D = S(null);
+function O(e) {
+	try {
+		let t = e.split(".");
+		if (t.length !== 3) return null;
+		let n = JSON.parse(atob(t[1].replace(/-/g, "+").replace(/_/g, "/")));
+		return typeof n.exp == "number" ? n.exp * 1e3 : null;
+	} catch {
+		return null;
+	}
+}
+function k(e) {
+	return e.trigger;
+}
+function A(e, t, n) {
+	let r = (Array.isArray(e.profiles) ? e.profiles : []).map((e) => {
+		let t = typeof e.id == "string" ? e.id : null, n = typeof e.email == "string" ? e.email : null;
+		return !t || !n ? null : {
+			id: t,
+			email: n,
+			name: typeof e.name == "string" && e.name.trim().length > 0 ? e.name : n,
+			avatar: typeof e.avatar == "string" ? e.avatar : void 0,
+			lastLogin: typeof e.lastLogin == "string" ? e.lastLogin : (/* @__PURE__ */ new Date()).toISOString()
+		};
+	}).filter((e) => e !== null);
+	return r.some((e) => e.id === t) ? r : [...r, {
+		id: t,
+		email: n.email,
+		name: n.name ?? `${n.firstName ?? ""} ${n.lastName ?? ""}`.trim(),
+		avatar: n.avatar,
+		lastLogin: (/* @__PURE__ */ new Date()).toISOString()
+	}];
+}
+function pe(e) {
+	let n = k(e);
+	if (n === "logout" || n === "logout_all") return v(), !0;
+	if (!e.activeProfileId || !e.user || !e.tokens) return !1;
+	let r = e.activeProfileId, i = e.user, { workspaceToken: a, ...o } = e.tokens;
+	return p(A(e, r, i)), te(r, i), f(r, o), ne(r, a ?? null), d(r), window.dispatchEvent(new Event(t)), !0;
+}
+function j(e) {
+	if (!e) return !1;
+	try {
+		return !!(localStorage.getItem(`bf-p-${e}-tokens`) && localStorage.getItem(`bf-p-${e}-user`));
+	} catch {
+		return !1;
+	}
+}
+function M(e) {
+	try {
+		if (x()) return null;
+		let t = g();
+		if (!t?.origin || !h(t.origin)) return null;
+		let n = new URL(t.origin).origin, r = new URL(e).origin;
+		if (n === window.location.origin || n === r || j(t.id)) return null;
+		let i = window.location.href;
+		return y(n, i) ? null : (b(n, i), `${n}/auth/sso-relay?returnTo=${encodeURIComponent(i)}`);
+	} catch {
+		return null;
+	}
+}
+function N({ children: p, onTokenExpired: h, onSessionExpiringSoon: v, onRefreshToken: S, bridgeUrl: w, bridgeAllowedOrigins: k, bridgeDebug: A, onBridgeReady: j }) {
+	let N = de(!1), [P, F] = E(() => u()), [I, L] = E(() => P ? a(P) : null), [R, z] = E(() => P ? i(P) : null), [B, V] = E(() => P ? o(P) : null), [H, U] = E(() => {
+		if (P && a(P)) return !1;
+		if (w) try {
+			let e = g()?.id ?? null;
+			if (e && localStorage.getItem(`bf-p-${e}-tokens`)) return !1;
+		} catch {}
+		return !!w;
+	}), [me, W] = E(!1), [G, K] = E(null), [q, J] = E(() => s().map((e) => ({
+		id: e.id,
+		email: e.email,
+		name: e.name,
+		avatar: e.avatar,
+		isActive: e.id === P,
+		lastLogin: e.lastLogin
+	}))), Y = C(() => {
+		let e = r();
+		J(s().map((t) => ({
+			id: t.id,
+			email: t.email,
+			name: t.name,
+			avatar: t.avatar,
+			isActive: t.id === e,
+			lastLogin: t.lastLogin
+		})));
+	}, []);
+	T(() => {
+		if (!w) return;
+		try {
+			let e = new URL(w).pathname;
+			if (window.location.pathname === e) {
+				U(!1), j?.();
+				return;
+			}
+		} catch {
+			U(!1), j?.();
+			return;
+		}
+		if (se()) {
+			U(!1), j?.();
+			return;
+		}
+		let e = () => {
+			U(!1), j?.();
+		}, t = (t) => {
+			N.current = !0;
+			try {
+				if (w) {
+					let e = M(w);
+					if (e) {
+						window.location.replace(e);
+						return;
+					}
+				}
+				pe(t);
+				let e = u();
+				if (e) F(e), L(a(e)), z(i(e)), V(o(e)), Y();
+				else {
+					if (w && !t.user && !t.tokens) try {
+						let e = new URL(w).origin, t = window.location.origin, n = M(w);
+						if (n) {
+							window.location.replace(n);
+							return;
+						}
+						if (e !== t && !x()) {
+							let t = window.location.href;
+							if (y(e, t)) return;
+							b(e, t), window.location.replace(`${e}/auth/sso-relay?returnTo=${encodeURIComponent(t)}`);
+							return;
+						}
+					} catch {}
+					F(null), L(null), z(null), V(null), J([]);
+				}
+			} finally {
+				N.current = !1, e();
+			}
+		}, n = setTimeout(() => {
+			e();
+		}, 5e3);
+		return oe({
+			bridgeUrl: w,
+			allowedOrigins: k,
+			onStateChanged: t,
+			debug: A ?? !1
+		}), () => {
+			clearTimeout(n);
+		};
+	}, [
+		w,
+		k,
+		A,
+		j,
+		Y
+	]);
+	let he = C((e, t, n) => {
+		let r = O(t) ?? Date.now() + 3600 * 1e3, i = {
+			accessToken: t,
+			refreshToken: n,
+			expiresAt: r
+		}, a = c(e, i);
+		F(a), L(e), z(i), V(null), W(!1), K(null), Y();
+		try {
+			ae(a, window.location.origin);
+		} catch {}
+		N.current || _()?.notifyLogin({
+			user: e,
+			tokens: {
+				accessToken: t,
+				refreshToken: n,
+				expiresAt: r
+			},
+			activeAccountId: a,
+			activeProfileId: a,
+			profiles: s()
+		});
+	}, [Y]), X = C(() => {
+		P && l(P);
+		let e = u();
+		e ? (F(e), L(a(e)), z(i(e)), V(o(e))) : (F(null), L(null), z(null), V(null)), W(!1), K(null), Y();
+		try {
+			m();
+		} catch {}
+		N.current || _()?.notifyLogout();
+	}, [P, Y]), ge = C((e) => {
+		if (!I || !P) return;
+		let t = {
+			...I,
+			...e
+		};
+		L(t), te(P, t), n({
+			id: P,
+			email: t.email,
+			name: t.name ?? `${t.firstName ?? ""} ${t.lastName ?? ""}`.trim(),
+			avatar: t.avatar,
+			lastLogin: (/* @__PURE__ */ new Date()).toISOString()
+		}), Y();
+	}, [
+		I,
+		P,
+		Y
+	]), Z = C(async () => {
+		if (!(!R?.refreshToken || !S || !P)) {
+			U(!0);
+			try {
+				let e = await S(R.refreshToken), t = O(e.accessToken), n = e.expiresAt ?? t ?? Date.now() + 3600 * 1e3, r = {
+					accessToken: e.accessToken,
+					refreshToken: e.refreshToken ?? R.refreshToken,
+					expiresAt: n
+				};
+				z(r), f(P, r), N.current || _()?.notifyTokenRefresh({
+					accessToken: r.accessToken,
+					refreshToken: r.refreshToken,
+					expiresAt: r.expiresAt
+				});
+			} catch (e) {
+				console.error("Failed to refresh token:", e), X(), h?.();
+			} finally {
+				U(!1);
+			}
+		}
+	}, [
+		R,
+		S,
+		P,
+		X,
+		h
+	]), _e = C((e) => I?.permissions ? I.permissions.includes(e) || I.permissions.includes("*") : !1, [I]), Q = C((e) => {
+		V(e), P && ne(P, e);
+	}, [P]), ve = C((e, t) => {
+		W(e), K(t ?? null);
+	}, []), ye = C((e) => {
+		if (!re(e)) {
+			console.error(`Profile ${e} not found`);
+			return;
+		}
+		F(e), L(a(e)), z(i(e)), V(o(e)), W(!1), K(null), Y(), N.current || _()?.notifyAccountSwitch(e);
+	}, [Y]), be = C((e, t, n) => {
+		c(e, {
+			accessToken: t,
+			refreshToken: n,
+			expiresAt: O(t) ?? Date.now() + 3600 * 1e3
+		}), P && d(P), Y();
+	}, [P, Y]), xe = C((e) => {
+		if (e === P) {
+			console.error("Cannot remove active account — logout first");
+			return;
+		}
+		l(e), Y();
+	}, [P, Y]), Se = C(() => {
+		ee(), F(null), L(null), z(null), V(null), W(!1), K(null), J([]);
+		try {
+			m();
+		} catch {}
+		N.current || _()?.notifyLogoutAll();
+	}, []);
+	T(() => {
+		if (!R?.expiresAt) return;
+		let e = R.expiresAt - Date.now();
+		if (e <= 0) {
+			S && R?.refreshToken ? Z() : h?.();
+			return;
+		}
+		let t = [];
+		if (S && R?.refreshToken) {
+			let n = Math.max(0, e - 300 * 1e3);
+			t.push(setTimeout(() => {
+				Z();
+			}, n));
+		}
+		if (v) {
+			let n = Math.max(0, e - 300 * 1e3);
+			t.push(setTimeout(() => {
+				v();
+			}, n));
+		}
+		return (!S || !R?.refreshToken) && t.push(setTimeout(() => {
+			h?.();
+		}, e)), () => t.forEach(clearTimeout);
+	}, [
+		R?.expiresAt,
+		R?.refreshToken,
+		Z,
+		S,
+		h,
+		v
+	]);
+	let Ce = C(() => {
+		let e = u();
+		if (!e) {
+			(I || R) && (L(null), z(null), V(null), F(null), J([]));
+			return;
+		}
+		let t = i(e), n = o(e), r = a(e);
+		e !== P && F(e), t?.accessToken !== R?.accessToken && z(t), n !== B && V(n), r && r.id !== I?.id && L(r), Y();
+	}, [
+		R,
+		I,
+		B,
+		P,
+		Y
+	]);
+	T(() => {
+		let e = () => Ce();
+		window.addEventListener(t, e), window.addEventListener("storage", e);
+		let n = setInterval(e, 1e4);
+		return () => {
+			window.removeEventListener(t, e), window.removeEventListener("storage", e), clearInterval(n);
+		};
+	}, [Ce]), T(() => {
+		if (!R?.accessToken || !w) return;
+		let t = async () => {
+			if (document.visibilityState === "visible") try {
+				if (le()) {
+					F(null), L(null), z(null), V(null), J([]);
+					return;
+				}
+				if (ie()) return;
+				await ce(`${e().globalBaseUrl}/global/graphql`, R.accessToken) && X();
+			} catch {}
+		};
+		return document.addEventListener("visibilitychange", t), () => document.removeEventListener("visibilitychange", t);
+	}, [
+		R?.accessToken,
+		w,
+		X
+	]);
+	let $ = ue(() => !!I && !!R, [I, R]), we = ue(() => ({
+		user: I,
+		tokens: R,
+		isAuthenticated: $,
+		isLoading: H,
+		login: he,
+		logout: X,
+		updateUser: ge,
+		refreshAccessToken: Z,
+		hasPermission: _e,
+		setWorkspaceToken: Q,
+		workspaceToken: B,
+		mfaRequired: me,
+		mfaChallengeId: G,
+		setMfaState: ve,
+		activeProfileId: P,
+		accounts: q,
+		switchAccount: ye,
+		addAccount: be,
+		removeAccount: xe,
+		logoutAll: Se,
+		currentUser: I
+	}), [
+		I,
+		R,
+		$,
+		H,
+		he,
+		X,
+		ge,
+		Z,
+		_e,
+		Q,
+		B,
+		me,
+		G,
+		ve,
+		P,
+		q,
+		ye,
+		be,
+		xe,
+		Se
+	]);
+	return /* @__PURE__ */ fe(D.Provider, {
+		value: we,
+		children: p
+	});
+}
+function P() {
+	let e = w(D);
+	if (!e) throw Error("useAuth must be used within an AuthProvider");
+	return e;
+}
+//#endregion
+export { N as AuthProvider, P as useAuth };

package/dist/shared/providers/shell/AuthTokenProvider.d.ts

@@ -0,0 +1,22 @@
+import { ReactNode } from 'react';
+export interface AuthTokenContextValue {
+    accessToken: string | null;
+    workspaceToken: string | null;
+    workspaceId: string | null;
+    userId: string | null;
+    getAccessToken: () => string | null;
+    getWorkspaceToken: () => string | null;
+    getWorkspaceAuthToken: () => string | null;
+    reloadFromStorage: () => void;
+    isAuthenticated: boolean;
+    hasWorkspaceToken: boolean;
+}
+export interface AuthTokenProviderProps {
+    children: ReactNode;
+    debug?: boolean;
+    onTokenChange?: (accessToken: string | null, workspaceToken: string | null) => void;
+    onWorkspaceChange?: (workspaceId: string | null) => void;
+}
+export declare function AuthTokenProvider({ children, debug, onTokenChange, onWorkspaceChange, }: AuthTokenProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function useAuthToken(): AuthTokenContextValue;
+//# sourceMappingURL=AuthTokenProvider.d.ts.map

package/dist/shared/providers/shell/AuthTokenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthTokenProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/AuthTokenProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAKL,KAAK,SAAS,EAIf,MAAM,OAAO,CAAC;AAkBf,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACpC,iBAAiB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACvC,qBAAqB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC3C,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,SAAS,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,CACd,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,KAC1B,IAAI,CAAC;IACV,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;CAC1D;AA0GD,wBAAgB,iBAAiB,CAAC,EAChC,QAAQ,EACR,KAAa,EACb,aAAa,EACb,iBAAiB,GAClB,EAAE,sBAAsB,2CAwGxB;AAED,wBAAgB,YAAY,IAAI,qBAAqB,CAMpD"}

package/dist/shared/providers/shell/AuthTokenProvider.js

@@ -0,0 +1,125 @@
+import { getProfileWorkspaceToken as e, resolveActiveProfileId as t } from "./ProfileStorageManager.js";
+import { readActiveContextValueWithUrlPrecedence as n } from "./ActiveContextStorage.js";
+import { isWorkspaceTokenValidForContext as r } from "../../graphql/workspaceToken.js";
+import { createContext as i, useCallback as a, useContext as o, useEffect as s, useMemo as c, useRef as l, useState as u } from "react";
+import { jsx as d } from "react/jsx-runtime";
+//#region src/shared/providers/shell/AuthTokenProvider.tsx
+var f = "bf-p", p = "bf-active-profile", m = i(null);
+function h(e) {
+	try {
+		let t = localStorage.getItem(`${f}-${e}-tokens`);
+		return t ? JSON.parse(t) : null;
+	} catch {
+		return null;
+	}
+}
+function g(t) {
+	return e(t);
+}
+function _(e) {
+	try {
+		let t = localStorage.getItem(`${f}-${e}-auth-storage`);
+		return t ? JSON.parse(t) : null;
+	} catch {
+		return null;
+	}
+}
+function v(e) {
+	try {
+		let t = localStorage.getItem(`${f}-${e}-user`);
+		return t ? JSON.parse(t) : null;
+	} catch {
+		return null;
+	}
+}
+function y(e) {
+	try {
+		let t = localStorage.getItem(`${f}-${e}-context`);
+		return t ? JSON.parse(t) : null;
+	} catch {
+		return null;
+	}
+}
+function b() {
+	let e = t();
+	if (!e) return {
+		accessToken: null,
+		workspaceToken: null,
+		workspaceId: null,
+		userId: null,
+		isAuthenticated: !1
+	};
+	let i = h(e), a = _(e), o = g(e) ?? a?.state?.workspaceToken ?? null, s = v(e), c = y(e), l = n("workspace") ?? c?.workspaceId ?? a?.state?.currentWorkspaceId ?? null, u = r(o, {
+		workspaceId: l,
+		organizationId: n("organization")
+	}) ? o : null;
+	return {
+		accessToken: i?.accessToken ?? a?.state?.accessToken ?? null,
+		workspaceToken: u,
+		workspaceId: l,
+		userId: s?.id ?? a?.state?.user?.id ?? null,
+		isAuthenticated: !!(i?.accessToken ?? a?.state?.accessToken) && !!(s?.id ?? a?.state?.user?.id)
+	};
+}
+function x({ children: e, debug: t = !1, onTokenChange: n, onWorkspaceChange: r }) {
+	let [i, o] = u(b), h = l(i.accessToken), g = l(i.workspaceToken);
+	s(() => {
+		h.current = i.accessToken, g.current = i.workspaceToken;
+	}, [i.accessToken, i.workspaceToken]);
+	let _ = a(() => {
+		let e = b();
+		o(e), t && console.log("[AuthTokenProvider] Reloaded from profile storage:", {
+			hasAccessToken: !!e.accessToken,
+			hasWorkspaceToken: !!e.workspaceToken,
+			userId: e.userId
+		});
+	}, [t]);
+	s(() => {
+		let e = (e) => {
+			(e.key?.startsWith(f) || e.key === p) && _();
+		};
+		return window.addEventListener("storage", e), () => window.removeEventListener("storage", e);
+	}, [_]), s(() => {
+		let e = () => {
+			t && console.log("[AuthTokenProvider] Detected same-tab profile storage change"), _();
+		};
+		return window.addEventListener("bf-profile-storage-change", e), () => window.removeEventListener("bf-profile-storage-change", e);
+	}, [_, t]), s(() => {
+		n?.(i.accessToken, i.workspaceToken);
+	}, [
+		i.accessToken,
+		i.workspaceToken,
+		n
+	]), s(() => {
+		r?.(i.workspaceId);
+	}, [i.workspaceId, r]);
+	let v = a(() => h.current, []), y = a(() => g.current, []), x = a(() => g.current || h.current, []), S = c(() => ({
+		accessToken: i.accessToken,
+		workspaceToken: i.workspaceToken,
+		workspaceId: i.workspaceId,
+		userId: i.userId,
+		getAccessToken: v,
+		getWorkspaceToken: y,
+		getWorkspaceAuthToken: x,
+		reloadFromStorage: _,
+		isAuthenticated: i.isAuthenticated,
+		hasWorkspaceToken: !!i.workspaceToken
+	}), [
+		i,
+		v,
+		y,
+		x,
+		_
+	]);
+	return /* @__PURE__ */ d(m.Provider, {
+		value: S,
+		children: e
+	});
+}
+function S() {
+	let e = o(m);
+	if (!e) throw Error("useAuthToken must be used within AuthTokenProvider");
+	return e;
+}
+//#endregion
+export { x as AuthTokenProvider, S as useAuthToken };

package/dist/shared/providers/shell/ContextManagerProvider.d.ts

@@ -0,0 +1,56 @@
+import { ReactNode } from 'react';
+import { User as ProfileUser } from './AuthProvider';
+/**
+ * Unified context value available to all components and microfrontends.
+ */
+export interface ContextManagerValue {
+    /** Current user ID (null if not authenticated) */
+    userId: string | null;
+    /** Full user object */
+    user: ProfileUser | null;
+    /** Access token (JWT) */
+    accessToken: string | null;
+    /** Workspace-scoped token (JWT) */
+    workspaceToken: string | null;
+    /** Whether the user is authenticated */
+    isAuthenticated: boolean;
+    /** Active profile ID (for multi-account) */
+    activeProfileId: string | null;
+    /** Currently selected organization ID */
+    organizationId: string | null;
+    /** Currently selected workspace ID */
+    workspaceId: string | null;
+    /** Currently selected project ID */
+    projectId: string | null;
+    /** Currently selected tenant ID */
+    tenantId: string | null;
+}
+export interface ContextManagerProviderProps {
+    children: ReactNode;
+}
+/**
+ * ContextManagerProvider
+ *
+ * Wraps the React tree to provide unified context access.
+ * Must be rendered inside both AuthProvider and ActiveContextProvider.
+ */
+export declare function ContextManagerProvider({ children, }: ContextManagerProviderProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * Hook to access the unified context manager.
+ *
+ * Returns all context data (user, auth, org, workspace, project, tenant)
+ * from a single hook call.
+ *
+ * @example
+ * ```tsx
+ * const ctx = useContextManager();
+ *
+ * // Check auth
+ * if (!ctx.isAuthenticated) return <LoginRedirect />;
+ *
+ * // Use context IDs
+ * fetchData({ workspaceId: ctx.workspaceId, orgId: ctx.organizationId });
+ * ```
+ */
+export declare function useContextManager(): ContextManagerValue;
+//# sourceMappingURL=ContextManagerProvider.d.ts.map

package/dist/shared/providers/shell/ContextManagerProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContextManagerProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/ContextManagerProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAE3E,OAAO,EAAW,KAAK,IAAI,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGnE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAElC,kDAAkD;IAClD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uBAAuB;IACvB,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,yBAAyB;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mCAAmC;IACnC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,4CAA4C;IAC5C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAG/B,yCAAyC;IACzC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sCAAsC;IACtC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oCAAoC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAID,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,GACT,EAAE,2BAA2B,2CAsC7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,IAAI,mBAAmB,CASvD"}