@burdenoff/fe-libs 2026.518.5 → 2026.518.7

package/dist/shared/components/SSORedirectGuard.d.ts

@@ -20,6 +20,21 @@ export declare function markSSORedirectAttempt(relayOrigin: string, returnTo: st
  *
  * Call this from ProtectedRoute or LandingOrDashboardRedirect
  * before showing login page.
+ *
+ * Two discovery paths:
+ *   1. `bf-sso` cookie on the current origin pointing at a different
+ *      product origin (set during a previous same-origin login). Used when
+ *      the cookie can travel cross-subdomain (e.g. *.local.burdenoff.com).
+ *      Falls through silently otherwise.
+ *   2. Central bridge host (alphaapp/app.burdenoff.com) fallback: cross
+ *      eTLD+1 product hostnames can't share cookies with each other, so we
+ *      optimistically redirect to the bridge host's `/auth/sso-relay`. The
+ *      bridge host reads ITS own (first-party, unpartitioned) localStorage
+ *      — which receives tokens from every product login via the deposit
+ *      flow — and bounces them back to the original product origin via
+ *      `/auth/sso-callback#sso=...`. On no central session the bridge
+ *      bounces back with `?sso_failed=1` and `isAutoSSOSuppressed` keeps
+ *      the user on the login screen.
  */
 export declare function getSSORedirectUrl(returnPath?: string): string | null;
 /**

package/dist/shared/components/SSORedirectGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SSORedirectGuard.d.ts","sourceRoot":"","sources":["../../../src/shared/components/SSORedirectGuard.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoGH,wBAAgB,qBAAqB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM1F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBlF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,IAAI,OAAO,CA6BlC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyC9F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CA6B1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,4CAMjC"}
+{"version":3,"file":"SSORedirectGuard.d.ts","sourceRoot":"","sources":["../../../src/shared/components/SSORedirectGuard.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAqGH,wBAAgB,qBAAqB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM1F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqCpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,IAAI,OAAO,CA6BlC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyC9F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CA6B1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,4CAMjC"}

package/dist/shared/components/SSORedirectGuard.js

@@ -1,13 +1,14 @@
-import { clearActiveContextStorage as e } from "../providers/shell/ActiveContextStorage.js";
-import { clearShellSsoCookies as t, isSharedSsoCookieDomain as n, isTrustedSsoOrigin as r, readShellSsoCookie as i } from "../utils/authCookie.js";
-import { jsx as a } from "react/jsx-runtime";
+import { resolveAuthBridgeConfig as e } from "../config/authBridgeUrls.js";
+import { clearActiveContextStorage as t } from "../providers/shell/ActiveContextStorage.js";
+import { clearShellSsoCookies as n, isSharedSsoCookieDomain as r, isTrustedSsoOrigin as i, readShellSsoCookie as a } from "../utils/authCookie.js";
+import { jsx as o } from "react/jsx-runtime";
 //#region src/shared/components/SSORedirectGuard.tsx
-var o = "bf-sso-relay-attempt", s = 120 * 1e3, c = [
+var s = "bf-sso-relay-attempt", c = 120 * 1e3, l = [
 	"sso_failed",
 	"sso-failed",
 	"sso-attempted"
 ];
-function l(e) {
+function u(e) {
 	if (typeof window > "u") return null;
 	try {
 		let t = `${window.location.pathname}${window.location.search}${window.location.hash}`, n = new URL(e ?? t, window.location.origin);
@@ -16,87 +17,93 @@ function l(e) {
 		return null;
 	}
 }
-function u(e) {
-	return e === "/auth" || e.startsWith("/auth/");
-}
 function d(e) {
-	return c.some((t) => e.searchParams.has(t));
+	return e === "/auth" || e.startsWith("/auth/");
 }
 function f(e) {
-	if (d(e)) return t(), !0;
-	if (u(e.pathname)) return !0;
-	let n = e.searchParams.get("reason");
-	return n === "session-expired" || n === "logout";
+	return l.some((t) => e.searchParams.has(t));
+}
+function p(e) {
+	if (f(e)) return n(), !0;
+	if (d(e.pathname)) return !0;
+	let t = e.searchParams.get("reason");
+	return t === "session-expired" || t === "logout";
 }
-function p() {
+function m() {
 	try {
-		sessionStorage.removeItem(o);
+		sessionStorage.removeItem(s);
 	} catch {}
 }
-function m() {
+function h() {
 	if (typeof window > "u") return null;
 	try {
-		let e = sessionStorage.getItem(o);
+		let e = sessionStorage.getItem(s);
 		if (!e) return null;
 		let t = JSON.parse(e);
-		return typeof t.relayOrigin != "string" || typeof t.returnTo != "string" || typeof t.startedAt != "number" || Date.now() - t.startedAt > s ? (p(), null) : {
+		return typeof t.relayOrigin != "string" || typeof t.returnTo != "string" || typeof t.startedAt != "number" || Date.now() - t.startedAt > c ? (m(), null) : {
 			relayOrigin: t.relayOrigin,
 			returnTo: t.returnTo,
 			startedAt: t.startedAt
 		};
 	} catch {
-		return p(), null;
+		return m(), null;
 	}
 }
-function h(e) {
+function g(e) {
 	try {
 		return new URL(e).origin;
 	} catch {
 		return null;
 	}
 }
-function g(e) {
-	let t = l(e);
-	return !t || f(t);
+function _(e) {
+	let t = u(e);
+	return !t || p(t);
 }
-function _(e, t) {
-	let n = h(e), r = l(t), i = m();
+function v(e, t) {
+	let n = g(e), r = u(t), i = h();
 	return !!(n && r && i?.returnTo === r.href);
 }
-function v(e, t) {
+function y(e, t) {
 	if (typeof window > "u") return;
-	let n = h(e), r = l(t);
+	let n = g(e), r = u(t);
 	if (!(!n || !r)) try {
 		let e = {
 			relayOrigin: n,
 			returnTo: r.href,
 			startedAt: Date.now()
 		};
-		sessionStorage.setItem(o, JSON.stringify(e));
+		sessionStorage.setItem(s, JSON.stringify(e));
 	} catch {}
 }
-function y(e) {
+function b(t) {
 	try {
-		let t = l(e);
-		if (!t || f(t)) return null;
-		let n = i();
-		if (!n?.origin || !r(n.origin)) return null;
-		let a = new URL(n.origin).origin;
-		return !a || a === window.location.origin || _(a, t.href) ? null : (v(a, t.href), `${a}/auth/sso-relay?returnTo=${encodeURIComponent(t.href)}`);
+		let n = u(t);
+		if (!n || p(n)) return null;
+		let r = window.location.origin, o = a();
+		if (o?.origin && i(o.origin)) {
+			let e = new URL(o.origin).origin;
+			if (e && e !== r && !v(e, n.href)) return y(e, n.href), `${e}/auth/sso-relay?returnTo=${encodeURIComponent(n.href)}`;
+		}
+		try {
+			let t = e(), i = new URL(t.url).origin;
+			if (i && i !== r && !v(i, n.href)) return y(i, n.href), `${i}/auth/sso-relay?returnTo=${encodeURIComponent(n.href)}`;
+		} catch {}
+		return null;
 	} catch {
 		return null;
 	}
 }
-function b() {
+function x() {
 	try {
-		if (i()) return !1;
+		if (a()) return !1;
 		let e = sessionStorage.getItem("bf-active-profile");
-		return !e || !localStorage.getItem(`bf-p-${e}-tokens`) || !n() ? !1 : (S(), !0);
+		return !e || !localStorage.getItem(`bf-p-${e}-tokens`) || !r() ? !1 : (C(), !0);
 	} catch {
 		return !1;
 	}
 }
-async function x(e, t) {
+async function S(e, t) {
 	try {
 		let n = await fetch(e, {
 			method: "POST",
@@ -113,22 +120,22 @@ async function x(e, t) {
 		return !1;
 	}
 }
-function S() {
+function C() {
 	try {
-		let n = localStorage.getItem("bf-profiles");
-		if (n) {
-			let e = JSON.parse(n);
-			for (let t of e) localStorage.removeItem(`bf-p-${t.id}-tokens`), localStorage.removeItem(`bf-p-${t.id}-user`), localStorage.removeItem(`bf-p-${t.id}-workspace-token`), localStorage.removeItem(`bf-p-${t.id}-context`), localStorage.removeItem(`bf-p-${t.id}-auth-storage`), sessionStorage.removeItem(`bf-p-${t.id}-session-workspace-token`);
+		let e = localStorage.getItem("bf-profiles");
+		if (e) {
+			let t = JSON.parse(e);
+			for (let e of t) localStorage.removeItem(`bf-p-${e.id}-tokens`), localStorage.removeItem(`bf-p-${e.id}-user`), localStorage.removeItem(`bf-p-${e.id}-workspace-token`), localStorage.removeItem(`bf-p-${e.id}-context`), localStorage.removeItem(`bf-p-${e.id}-auth-storage`), sessionStorage.removeItem(`bf-p-${e.id}-session-workspace-token`);
 		}
 		for (let e of Object.keys(localStorage)) e.startsWith("bf-p-") && e.endsWith("-auth-storage") && localStorage.removeItem(e);
-		localStorage.removeItem("bf-profiles"), localStorage.removeItem("auth-storage"), sessionStorage.removeItem("bf-active-profile"), e(), t(), window.dispatchEvent(new Event("bf-auth-state-cleared")), window.dispatchEvent(new Event("bf-profile-storage-change"));
+		localStorage.removeItem("bf-profiles"), localStorage.removeItem("auth-storage"), sessionStorage.removeItem("bf-active-profile"), t(), n(), window.dispatchEvent(new Event("bf-auth-state-cleared")), window.dispatchEvent(new Event("bf-profile-storage-change"));
 	} catch {}
 }
-function C() {
-	return /* @__PURE__ */ a("div", {
+function w() {
+	return /* @__PURE__ */ o("div", {
 		className: "flex items-center justify-center min-h-screen",
-		children: /* @__PURE__ */ a("div", { className: "animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent" })
+		children: /* @__PURE__ */ o("div", { className: "animate-spin rounded-full h-8 w-8 border-2 border-action-primary-bg border-t-transparent" })
 	});
 }
 //#endregion
-export { C as SSORedirectSpinner, x as checkRemoteSLO, b as checkSLO, S as clearLocalAuthState, y as getSSORedirectUrl, _ as hasRecentSSORedirectAttempt, v as markSSORedirectAttempt, g as shouldSkipSSORedirect };
+export { w as SSORedirectSpinner, S as checkRemoteSLO, x as checkSLO, C as clearLocalAuthState, b as getSSORedirectUrl, v as hasRecentSSORedirectAttempt, y as markSSORedirectAttempt, _ as shouldSkipSSORedirect };

package/dist/shared/providers/shell/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAkBjB,MAAM,yBAAyB,CAAC;AAwBjC,YAAY,EAAE,WAAW,IAAI,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAE7D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/E,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACjD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAE/C,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAClD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAE9B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAEtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACpF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,SAAS,EAAE,MAAM,IAAI,CAAC;IAEtB,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACjC;AAiID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;IACnC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QACjD,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,mGAAmG;IACnG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,SAAS,EACT,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,EAAE,iBAAiB,2CAkpBnB;AAED,wBAAgB,OAAO,qBAMtB"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAkBjB,MAAM,yBAAyB,CAAC;AAyBjC,YAAY,EAAE,WAAW,IAAI,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAE7D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/E,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACjD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAE/C,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAClD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAE9B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAEtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACpF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,SAAS,EAAE,MAAM,IAAI,CAAC;IAEtB,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACjC;AA2JD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;IACnC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QACjD,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,mGAAmG;IACnG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,SAAS,EACT,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,EAAE,iBAAiB,2CAiqBnB;AAED,wBAAgB,OAAO,qBAMtB"}

package/dist/shared/providers/shell/AuthProvider.js

@@ -1,13 +1,14 @@
 import { resolveGatewayUrls as e } from "../../config/gatewayUrls.js";
-import { PROFILE_STORAGE_CHANGE_EVENT as t, addProfile as n, getActiveProfileId as r, getProfileTokens as i, getProfileUser as a, getProfileWorkspaceToken as o, getProfiles as s, loginProfile as c, logoutAllProfiles as ee, removeProfile as l, resolveActiveProfileId as u, setActiveProfileId as d, setProfileTokens as f, setProfileUser as te, setProfileWorkspaceToken as ne, setProfiles as p, switchProfile as re } from "./ProfileStorageManager.js";
-import { clearShellSsoCookies as m, isSharedSsoCookieDomain as ie, isTrustedSsoOrigin as h, readShellSsoCookie as g, setShellSsoCookies as ae } from "../../utils/authCookie.js";
-import { getAuthBridge as _, initAuthBridge as oe, isAuthBridgeInitialized as se } from "./AuthBridgeClient.js";
-import { checkRemoteSLO as ce, checkSLO as le, clearLocalAuthState as v, hasRecentSSORedirectAttempt as y, markSSORedirectAttempt as b, shouldSkipSSORedirect as x } from "../../components/SSORedirectGuard.js";
-import { createContext as S, useCallback as C, useContext as w, useEffect as T, useMemo as ue, useRef as de, useState as E } from "react";
-import { jsx as fe } from "react/jsx-runtime";
+import { resolveAuthBridgeConfig as t } from "../../config/authBridgeUrls.js";
+import { PROFILE_STORAGE_CHANGE_EVENT as n, addProfile as r, getActiveProfileId as i, getProfileTokens as a, getProfileUser as o, getProfileWorkspaceToken as s, getProfiles as c, loginProfile as ee, logoutAllProfiles as te, removeProfile as l, resolveActiveProfileId as u, setActiveProfileId as d, setProfileTokens as f, setProfileUser as p, setProfileWorkspaceToken as m, setProfiles as h, switchProfile as ne } from "./ProfileStorageManager.js";
+import { clearShellSsoCookies as g, isSharedSsoCookieDomain as re, isTrustedSsoOrigin as _, readShellSsoCookie as v, setShellSsoCookies as ie } from "../../utils/authCookie.js";
+import { getAuthBridge as y, initAuthBridge as ae, isAuthBridgeInitialized as oe } from "./AuthBridgeClient.js";
+import { checkRemoteSLO as se, checkSLO as ce, clearLocalAuthState as b, hasRecentSSORedirectAttempt as x, markSSORedirectAttempt as S, shouldSkipSSORedirect as C } from "../../components/SSORedirectGuard.js";
+import { createContext as w, useCallback as T, useContext as E, useEffect as D, useMemo as le, useRef as ue, useState as O } from "react";
+import { jsx as de } from "react/jsx-runtime";
 //#region src/shared/providers/shell/AuthProvider.tsx
-var D = S(null);
-function O(e) {
+var k = w(null);
+function A(e) {
 	try {
 		let t = e.split(".");
 		if (t.length !== 3) return null;
@@ -17,10 +18,10 @@ function O(e) {
 		return null;
 	}
 }
-function k(e) {
+function j(e) {
 	return e.trigger;
 }
-function A(e, t, n) {
+function M(e, t, n) {
 	let r = (Array.isArray(e.profiles) ? e.profiles : []).map((e) => {
 		let t = typeof e.id == "string" ? e.id : null, n = typeof e.email == "string" ? e.email : null;
 		return !t || !n ? null : {
@@ -39,14 +40,25 @@ function A(e, t, n) {
 		lastLogin: (/* @__PURE__ */ new Date()).toISOString()
 	}];
 }
-function pe(e) {
-	let n = k(e);
-	if (n === "logout" || n === "logout_all") return v(), !0;
+function fe(e) {
+	let t = j(e);
+	if (t === "logout" || t === "logout_all") return b(), !0;
 	if (!e.activeProfileId || !e.user || !e.tokens) return !1;
 	let r = e.activeProfileId, i = e.user, { workspaceToken: a, ...o } = e.tokens;
-	return p(A(e, r, i)), te(r, i), f(r, o), ne(r, a ?? null), d(r), window.dispatchEvent(new Event(t)), !0;
+	return h(M(e, r, i)), p(r, i), f(r, o), m(r, a ?? null), d(r), window.dispatchEvent(new Event(n)), !0;
 }
-function j(e) {
+function N() {
+	if (typeof window > "u") return null;
+	try {
+		let e = t(), n = new URL(e.url).origin;
+		if (n === window.location.origin) return null;
+		let r = `${window.location.origin}/auth/login?reason=logout`;
+		return `${n}/auth/sso-clear?returnTo=${encodeURIComponent(r)}`;
+	} catch {
+		return null;
+	}
+}
+function P(e) {
 	if (!e) return !1;
 	try {
 		return !!(localStorage.getItem(`bf-p-${e}-tokens`) && localStorage.getItem(`bf-p-${e}-user`));
@@ -54,37 +66,37 @@ function j(e) {
 		return !1;
 	}
 }
-function M(e) {
+function F(e) {
 	try {
-		if (x()) return null;
-		let t = g();
-		if (!t?.origin || !h(t.origin)) return null;
+		if (C()) return null;
+		let t = v();
+		if (!t?.origin || !_(t.origin)) return null;
 		let n = new URL(t.origin).origin, r = new URL(e).origin;
-		if (n === window.location.origin || n === r || j(t.id)) return null;
+		if (n === window.location.origin || n === r || P(t.id)) return null;
 		let i = window.location.href;
-		return y(n, i) ? null : (b(n, i), `${n}/auth/sso-relay?returnTo=${encodeURIComponent(i)}`);
+		return x(n, i) ? null : (S(n, i), `${n}/auth/sso-relay?returnTo=${encodeURIComponent(i)}`);
 	} catch {
 		return null;
 	}
 }
-function N({ children: p, onTokenExpired: h, onSessionExpiringSoon: v, onRefreshToken: S, bridgeUrl: w, bridgeAllowedOrigins: k, bridgeDebug: A, onBridgeReady: j }) {
-	let N = de(!1), [P, F] = E(() => u()), [I, L] = E(() => P ? a(P) : null), [R, z] = E(() => P ? i(P) : null), [B, V] = E(() => P ? o(P) : null), [H, U] = E(() => {
-		if (P && a(P)) return !1;
+function I({ children: t, onTokenExpired: h, onSessionExpiringSoon: _, onRefreshToken: b, bridgeUrl: w, bridgeAllowedOrigins: E, bridgeDebug: j, onBridgeReady: M }) {
+	let P = ue(!1), [I, L] = O(() => u()), [R, z] = O(() => I ? o(I) : null), [B, V] = O(() => I ? a(I) : null), [H, U] = O(() => I ? s(I) : null), [W, G] = O(() => {
+		if (I && o(I)) return !1;
 		if (w) try {
-			let e = g()?.id ?? null;
+			let e = v()?.id ?? null;
 			if (e && localStorage.getItem(`bf-p-${e}-tokens`)) return !1;
 		} catch {}
 		return !!w;
-	}), [me, W] = E(!1), [G, K] = E(null), [q, J] = E(() => s().map((e) => ({
+	}), [pe, K] = O(!1), [me, q] = O(null), [he, J] = O(() => c().map((e) => ({
 		id: e.id,
 		email: e.email,
 		name: e.name,
 		avatar: e.avatar,
-		isActive: e.id === P,
+		isActive: e.id === I,
 		lastLogin: e.lastLogin
-	}))), Y = C(() => {
-		let e = r();
-		J(s().map((t) => ({
+	}))), Y = T(() => {
+		let e = i();
+		J(c().map((t) => ({
 			id: t.id,
 			email: t.email,
 			name: t.name,
@@ -93,85 +105,85 @@ function N({ children: p, onTokenExpired: h, onSessionExpiringSoon: v, onRefresh
 			lastLogin: t.lastLogin
 		})));
 	}, []);
-	T(() => {
+	D(() => {
 		if (!w) return;
 		try {
 			let e = new URL(w).pathname;
 			if (window.location.pathname === e) {
-				U(!1), j?.();
+				G(!1), M?.();
 				return;
 			}
 		} catch {
-			U(!1), j?.();
+			G(!1), M?.();
 			return;
 		}
-		if (se()) {
-			U(!1), j?.();
+		if (oe()) {
+			G(!1), M?.();
 			return;
 		}
 		let e = () => {
-			U(!1), j?.();
+			G(!1), M?.();
 		}, t = (t) => {
-			N.current = !0;
+			P.current = !0;
 			try {
 				if (w) {
-					let e = M(w);
+					let e = F(w);
 					if (e) {
 						window.location.replace(e);
 						return;
 					}
 				}
-				pe(t);
+				fe(t);
 				let e = u();
-				if (e) F(e), L(a(e)), z(i(e)), V(o(e)), Y();
+				if (e) L(e), z(o(e)), V(a(e)), U(s(e)), Y();
 				else {
 					if (w && !t.user && !t.tokens) try {
-						let e = new URL(w).origin, t = window.location.origin, n = M(w);
+						let e = new URL(w).origin, t = window.location.origin, n = F(w);
 						if (n) {
 							window.location.replace(n);
 							return;
 						}
-						if (e !== t && !x()) {
+						if (e !== t && !C()) {
 							let t = window.location.href;
-							if (y(e, t)) return;
-							b(e, t), window.location.replace(`${e}/auth/sso-relay?returnTo=${encodeURIComponent(t)}`);
+							if (x(e, t)) return;
+							S(e, t), window.location.replace(`${e}/auth/sso-relay?returnTo=${encodeURIComponent(t)}`);
 							return;
 						}
 					} catch {}
-					F(null), L(null), z(null), V(null), J([]);
+					L(null), z(null), V(null), U(null), J([]);
 				}
 			} finally {
-				N.current = !1, e();
+				P.current = !1, e();
 			}
 		}, n = setTimeout(() => {
 			e();
 		}, 5e3);
-		return oe({
+		return ae({
 			bridgeUrl: w,
-			allowedOrigins: k,
+			allowedOrigins: E,
 			onStateChanged: t,
-			debug: A ?? !1
+			debug: j ?? !1
 		}), () => {
 			clearTimeout(n);
 		};
 	}, [
 		w,
-		k,
-		A,
+		E,
 		j,
+		M,
 		Y
 	]);
-	let he = C((e, t, n) => {
-		let r = O(t) ?? Date.now() + 3600 * 1e3, i = {
+	let ge = T((e, t, n) => {
+		let r = A(t) ?? Date.now() + 3600 * 1e3, i = {
 			accessToken: t,
 			refreshToken: n,
 			expiresAt: r
-		}, a = c(e, i);
-		F(a), L(e), z(i), V(null), W(!1), K(null), Y();
+		}, a = ee(e, i);
+		L(a), z(e), V(i), U(null), K(!1), q(null), Y();
 		try {
-			ae(a, window.location.origin);
+			ie(a, window.location.origin);
 		} catch {}
-		N.current || _()?.notifyLogin({
+		P.current || y()?.notifyLogin({
 			user: e,
 			tokens: {
 				accessToken: t,
@@ -180,43 +192,45 @@ function N({ children: p, onTokenExpired: h, onSessionExpiringSoon: v, onRefresh
 			},
 			activeAccountId: a,
 			activeProfileId: a,
-			profiles: s()
+			profiles: c()
 		});
-	}, [Y]), X = C(() => {
-		P && l(P);
+	}, [Y]), X = T(() => {
+		I && l(I);
 		let e = u();
-		e ? (F(e), L(a(e)), z(i(e)), V(o(e))) : (F(null), L(null), z(null), V(null)), W(!1), K(null), Y();
+		e ? (L(e), z(o(e)), V(a(e)), U(s(e))) : (L(null), z(null), V(null), U(null)), K(!1), q(null), Y();
 		try {
-			m();
+			g();
 		} catch {}
-		N.current || _()?.notifyLogout();
-	}, [P, Y]), ge = C((e) => {
-		if (!I || !P) return;
+		P.current || y()?.notifyLogout();
+		let t = N();
+		t && !P.current && window.location.replace(t);
+	}, [I, Y]), _e = T((e) => {
+		if (!R || !I) return;
 		let t = {
-			...I,
+			...R,
 			...e
 		};
-		L(t), te(P, t), n({
-			id: P,
+		z(t), p(I, t), r({
+			id: I,
 			email: t.email,
 			name: t.name ?? `${t.firstName ?? ""} ${t.lastName ?? ""}`.trim(),
 			avatar: t.avatar,
 			lastLogin: (/* @__PURE__ */ new Date()).toISOString()
 		}), Y();
 	}, [
+		R,
 		I,
-		P,
 		Y
-	]), Z = C(async () => {
-		if (!(!R?.refreshToken || !S || !P)) {
-			U(!0);
+	]), Z = T(async () => {
+		if (!(!B?.refreshToken || !b || !I)) {
+			G(!0);
 			try {
-				let e = await S(R.refreshToken), t = O(e.accessToken), n = e.expiresAt ?? t ?? Date.now() + 3600 * 1e3, r = {
+				let e = await b(B.refreshToken), t = A(e.accessToken), n = e.expiresAt ?? t ?? Date.now() + 3600 * 1e3, r = {
 					accessToken: e.accessToken,
-					refreshToken: e.refreshToken ?? R.refreshToken,
+					refreshToken: e.refreshToken ?? B.refreshToken,
 					expiresAt: n
 				};
-				z(r), f(P, r), N.current || _()?.notifyTokenRefresh({
+				V(r), f(I, r), P.current || y()?.notifyTokenRefresh({
 					accessToken: r.accessToken,
 					refreshToken: r.refreshToken,
 					expiresAt: r.expiresAt
@@ -224,168 +238,170 @@ function N({ children: p, onTokenExpired: h, onSessionExpiringSoon: v, onRefresh
 			} catch (e) {
 				console.error("Failed to refresh token:", e), X(), h?.();
 			} finally {
-				U(!1);
+				G(!1);
 			}
 		}
 	}, [
-		R,
-		S,
-		P,
+		B,
+		b,
+		I,
 		X,
 		h
-	]), _e = C((e) => I?.permissions ? I.permissions.includes(e) || I.permissions.includes("*") : !1, [I]), Q = C((e) => {
-		V(e), P && ne(P, e);
-	}, [P]), ve = C((e, t) => {
-		W(e), K(t ?? null);
-	}, []), ye = C((e) => {
-		if (!re(e)) {
+	]), Q = T((e) => R?.permissions ? R.permissions.includes(e) || R.permissions.includes("*") : !1, [R]), ve = T((e) => {
+		U(e), I && m(I, e);
+	}, [I]), ye = T((e, t) => {
+		K(e), q(t ?? null);
+	}, []), be = T((e) => {
+		if (!ne(e)) {
 			console.error(`Profile ${e} not found`);
 			return;
 		}
-		F(e), L(a(e)), z(i(e)), V(o(e)), W(!1), K(null), Y(), N.current || _()?.notifyAccountSwitch(e);
-	}, [Y]), be = C((e, t, n) => {
-		c(e, {
+		L(e), z(o(e)), V(a(e)), U(s(e)), K(!1), q(null), Y(), P.current || y()?.notifyAccountSwitch(e);
+	}, [Y]), xe = T((e, t, n) => {
+		ee(e, {
 			accessToken: t,
 			refreshToken: n,
-			expiresAt: O(t) ?? Date.now() + 3600 * 1e3
-		}), P && d(P), Y();
-	}, [P, Y]), xe = C((e) => {
-		if (e === P) {
+			expiresAt: A(t) ?? Date.now() + 3600 * 1e3
+		}), I && d(I), Y();
+	}, [I, Y]), Se = T((e) => {
+		if (e === I) {
 			console.error("Cannot remove active account — logout first");
 			return;
 		}
 		l(e), Y();
-	}, [P, Y]), Se = C(() => {
-		ee(), F(null), L(null), z(null), V(null), W(!1), K(null), J([]);
+	}, [I, Y]), Ce = T(() => {
+		te(), L(null), z(null), V(null), U(null), K(!1), q(null), J([]);
 		try {
-			m();
+			g();
 		} catch {}
-		N.current || _()?.notifyLogoutAll();
+		P.current || y()?.notifyLogoutAll();
+		let e = N();
+		e && !P.current && window.location.replace(e);
 	}, []);
-	T(() => {
-		if (!R?.expiresAt) return;
-		let e = R.expiresAt - Date.now();
+	D(() => {
+		if (!B?.expiresAt) return;
+		let e = B.expiresAt - Date.now();
 		if (e <= 0) {
-			S && R?.refreshToken ? Z() : h?.();
+			b && B?.refreshToken ? Z() : h?.();
 			return;
 		}
 		let t = [];
-		if (S && R?.refreshToken) {
+		if (b && B?.refreshToken) {
 			let n = Math.max(0, e - 300 * 1e3);
 			t.push(setTimeout(() => {
 				Z();
 			}, n));
 		}
-		if (v) {
+		if (_) {
 			let n = Math.max(0, e - 300 * 1e3);
 			t.push(setTimeout(() => {
-				v();
+				_();
 			}, n));
 		}
-		return (!S || !R?.refreshToken) && t.push(setTimeout(() => {
+		return (!b || !B?.refreshToken) && t.push(setTimeout(() => {
 			h?.();
 		}, e)), () => t.forEach(clearTimeout);
 	}, [
-		R?.expiresAt,
-		R?.refreshToken,
+		B?.expiresAt,
+		B?.refreshToken,
 		Z,
-		S,
+		b,
 		h,
-		v
+		_
 	]);
-	let Ce = C(() => {
+	let we = T(() => {
 		let e = u();
 		if (!e) {
-			(I || R) && (L(null), z(null), V(null), F(null), J([]));
+			(R || B) && (z(null), V(null), U(null), L(null), J([]));
 			return;
 		}
-		let t = i(e), n = o(e), r = a(e);
-		e !== P && F(e), t?.accessToken !== R?.accessToken && z(t), n !== B && V(n), r && r.id !== I?.id && L(r), Y();
+		let t = a(e), n = s(e), r = o(e);
+		e !== I && L(e), t?.accessToken !== B?.accessToken && V(t), n !== H && U(n), r && r.id !== R?.id && z(r), Y();
 	}, [
+		B,
 		R,
+		H,
 		I,
-		B,
-		P,
 		Y
 	]);
-	T(() => {
-		let e = () => Ce();
-		window.addEventListener(t, e), window.addEventListener("storage", e);
-		let n = setInterval(e, 1e4);
+	D(() => {
+		let e = () => we();
+		window.addEventListener(n, e), window.addEventListener("storage", e);
+		let t = setInterval(e, 1e4);
 		return () => {
-			window.removeEventListener(t, e), window.removeEventListener("storage", e), clearInterval(n);
+			window.removeEventListener(n, e), window.removeEventListener("storage", e), clearInterval(t);
 		};
-	}, [Ce]), T(() => {
-		if (!R?.accessToken || !w) return;
+	}, [we]), D(() => {
+		if (!B?.accessToken || !w) return;
 		let t = async () => {
 			if (document.visibilityState === "visible") try {
-				if (le()) {
-					F(null), L(null), z(null), V(null), J([]);
+				if (ce()) {
+					L(null), z(null), V(null), U(null), J([]);
 					return;
 				}
-				if (ie()) return;
-				await ce(`${e().globalBaseUrl}/global/graphql`, R.accessToken) && X();
+				if (re()) return;
+				await se(`${e().globalBaseUrl}/global/graphql`, B.accessToken) && X();
 			} catch {}
 		};
 		return document.addEventListener("visibilitychange", t), () => document.removeEventListener("visibilitychange", t);
 	}, [
-		R?.accessToken,
+		B?.accessToken,
 		w,
 		X
 	]);
-	let $ = ue(() => !!I && !!R, [I, R]), we = ue(() => ({
-		user: I,
-		tokens: R,
+	let $ = le(() => !!R && !!B, [R, B]), Te = le(() => ({
+		user: R,
+		tokens: B,
 		isAuthenticated: $,
-		isLoading: H,
-		login: he,
+		isLoading: W,
+		login: ge,
 		logout: X,
-		updateUser: ge,
+		updateUser: _e,
 		refreshAccessToken: Z,
-		hasPermission: _e,
-		setWorkspaceToken: Q,
-		workspaceToken: B,
-		mfaRequired: me,
-		mfaChallengeId: G,
-		setMfaState: ve,
-		activeProfileId: P,
-		accounts: q,
-		switchAccount: ye,
-		addAccount: be,
-		removeAccount: xe,
-		logoutAll: Se,
-		currentUser: I
+		hasPermission: Q,
+		setWorkspaceToken: ve,
+		workspaceToken: H,
+		mfaRequired: pe,
+		mfaChallengeId: me,
+		setMfaState: ye,
+		activeProfileId: I,
+		accounts: he,
+		switchAccount: be,
+		addAccount: xe,
+		removeAccount: Se,
+		logoutAll: Ce,
+		currentUser: R
 	}), [
-		I,
 		R,
+		B,
 		$,
-		H,
-		he,
-		X,
+		W,
 		ge,
-		Z,
+		X,
 		_e,
+		Z,
 		Q,
-		B,
-		me,
-		G,
 		ve,
-		P,
-		q,
+		H,
+		pe,
+		me,
 		ye,
+		I,
+		he,
 		be,
 		xe,
-		Se
+		Se,
+		Ce
 	]);
-	return /* @__PURE__ */ fe(D.Provider, {
-		value: we,
-		children: p
+	return /* @__PURE__ */ de(k.Provider, {
+		value: Te,
+		children: t
 	});
 }
-function P() {
-	let e = w(D);
+function L() {
+	let e = E(k);
 	if (!e) throw Error("useAuth must be used within an AuthProvider");
 	return e;
 }
 //#endregion
-export { N as AuthProvider, P as useAuth };
+export { I as AuthProvider, L as useAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/fe-libs",
-  "version": "2026.518.5",
+  "version": "2026.518.7",
   "description": "Burdenoff frontend primitives and domain libraries",
   "type": "module",
   "imports": {