@burdenoff/fe-libs 2026.518.6 → 2026.519.1

package/dist/shared/providers/shell/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAkBjB,MAAM,yBAAyB,CAAC;AAwBjC,YAAY,EAAE,WAAW,IAAI,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAE7D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/E,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACjD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAE/C,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAClD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAE9B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAEtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACpF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,SAAS,EAAE,MAAM,IAAI,CAAC;IAEtB,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACjC;AAiID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;IACnC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QACjD,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,mGAAmG;IACnG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,SAAS,EACT,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,EAAE,iBAAiB,2CAkpBnB;AAED,wBAAgB,OAAO,qBAMtB"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/shared/providers/shell/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAkBjB,MAAM,yBAAyB,CAAC;AAyBjC,YAAY,EAAE,WAAW,IAAI,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAE7D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/E,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACjD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAE/C,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAClD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAE9B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAEtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACpF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,SAAS,EAAE,MAAM,IAAI,CAAC;IAEtB,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACjC;AA2JD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;IACnC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QACjD,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,mGAAmG;IACnG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,SAAS,EACT,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,EAAE,iBAAiB,2CAiqBnB;AAED,wBAAgB,OAAO,qBAMtB"}

package/dist/shared/providers/shell/AuthProvider.js

@@ -1,13 +1,14 @@
 import { resolveGatewayUrls as e } from "../../config/gatewayUrls.js";
-import { PROFILE_STORAGE_CHANGE_EVENT as t, addProfile as n, getActiveProfileId as r, getProfileTokens as i, getProfileUser as a, getProfileWorkspaceToken as o, getProfiles as s, loginProfile as c, logoutAllProfiles as ee, removeProfile as l, resolveActiveProfileId as u, setActiveProfileId as d, setProfileTokens as f, setProfileUser as te, setProfileWorkspaceToken as ne, setProfiles as p, switchProfile as re } from "./ProfileStorageManager.js";
-import { clearShellSsoCookies as m, isSharedSsoCookieDomain as ie, isTrustedSsoOrigin as h, readShellSsoCookie as g, setShellSsoCookies as ae } from "../../utils/authCookie.js";
-import { getAuthBridge as _, initAuthBridge as oe, isAuthBridgeInitialized as se } from "./AuthBridgeClient.js";
-import { checkRemoteSLO as ce, checkSLO as le, clearLocalAuthState as v, hasRecentSSORedirectAttempt as y, markSSORedirectAttempt as b, shouldSkipSSORedirect as x } from "../../components/SSORedirectGuard.js";
-import { createContext as S, useCallback as C, useContext as w, useEffect as T, useMemo as ue, useRef as de, useState as E } from "react";
-import { jsx as fe } from "react/jsx-runtime";
+import { resolveAuthBridgeConfig as t } from "../../config/authBridgeUrls.js";
+import { PROFILE_STORAGE_CHANGE_EVENT as n, addProfile as r, getActiveProfileId as i, getProfileTokens as a, getProfileUser as o, getProfileWorkspaceToken as s, getProfiles as c, loginProfile as ee, logoutAllProfiles as te, removeProfile as l, resolveActiveProfileId as u, setActiveProfileId as d, setProfileTokens as f, setProfileUser as p, setProfileWorkspaceToken as m, setProfiles as h, switchProfile as ne } from "./ProfileStorageManager.js";
+import { clearShellSsoCookies as g, isSharedSsoCookieDomain as re, isTrustedSsoOrigin as _, readShellSsoCookie as v, setShellSsoCookies as ie } from "../../utils/authCookie.js";
+import { getAuthBridge as y, initAuthBridge as ae, isAuthBridgeInitialized as oe } from "./AuthBridgeClient.js";
+import { checkRemoteSLO as se, checkSLO as ce, clearLocalAuthState as b, hasRecentSSORedirectAttempt as x, markSSORedirectAttempt as S, shouldSkipSSORedirect as C } from "../../components/SSORedirectGuard.js";
+import { createContext as w, useCallback as T, useContext as E, useEffect as D, useMemo as le, useRef as ue, useState as O } from "react";
+import { jsx as de } from "react/jsx-runtime";
 //#region src/shared/providers/shell/AuthProvider.tsx
-var D = S(null);
-function O(e) {
+var k = w(null);
+function A(e) {
 	try {
 		let t = e.split(".");
 		if (t.length !== 3) return null;
@@ -17,10 +18,10 @@ function O(e) {
 		return null;
 	}
 }
-function k(e) {
+function j(e) {
 	return e.trigger;
 }
-function A(e, t, n) {
+function M(e, t, n) {
 	let r = (Array.isArray(e.profiles) ? e.profiles : []).map((e) => {
 		let t = typeof e.id == "string" ? e.id : null, n = typeof e.email == "string" ? e.email : null;
 		return !t || !n ? null : {
@@ -39,14 +40,25 @@ function A(e, t, n) {
 		lastLogin: (/* @__PURE__ */ new Date()).toISOString()
 	}];
 }
-function pe(e) {
-	let n = k(e);
-	if (n === "logout" || n === "logout_all") return v(), !0;
+function fe(e) {
+	let t = j(e);
+	if (t === "logout" || t === "logout_all") return b(), !0;
 	if (!e.activeProfileId || !e.user || !e.tokens) return !1;
 	let r = e.activeProfileId, i = e.user, { workspaceToken: a, ...o } = e.tokens;
-	return p(A(e, r, i)), te(r, i), f(r, o), ne(r, a ?? null), d(r), window.dispatchEvent(new Event(t)), !0;
+	return h(M(e, r, i)), p(r, i), f(r, o), m(r, a ?? null), d(r), window.dispatchEvent(new Event(n)), !0;
 }
-function j(e) {
+function N() {
+	if (typeof window > "u") return null;
+	try {
+		let e = t(), n = new URL(e.url).origin;
+		if (n === window.location.origin) return null;
+		let r = `${window.location.origin}/auth/login?reason=logout`;
+		return `${n}/auth/sso-clear?returnTo=${encodeURIComponent(r)}`;
+	} catch {
+		return null;
+	}
+}
+function P(e) {
 	if (!e) return !1;
 	try {
 		return !!(localStorage.getItem(`bf-p-${e}-tokens`) && localStorage.getItem(`bf-p-${e}-user`));
@@ -54,37 +66,37 @@ function j(e) {
 		return !1;
 	}
 }
-function M(e) {
+function F(e) {
 	try {
-		if (x()) return null;
-		let t = g();
-		if (!t?.origin || !h(t.origin)) return null;
+		if (C()) return null;
+		let t = v();
+		if (!t?.origin || !_(t.origin)) return null;
 		let n = new URL(t.origin).origin, r = new URL(e).origin;
-		if (n === window.location.origin || n === r || j(t.id)) return null;
+		if (n === window.location.origin || n === r || P(t.id)) return null;
 		let i = window.location.href;
-		return y(n, i) ? null : (b(n, i), `${n}/auth/sso-relay?returnTo=${encodeURIComponent(i)}`);
+		return x(n, i) ? null : (S(n, i), `${n}/auth/sso-relay?returnTo=${encodeURIComponent(i)}`);
 	} catch {
 		return null;
 	}
 }
-function N({ children: p, onTokenExpired: h, onSessionExpiringSoon: v, onRefreshToken: S, bridgeUrl: w, bridgeAllowedOrigins: k, bridgeDebug: A, onBridgeReady: j }) {
-	let N = de(!1), [P, F] = E(() => u()), [I, L] = E(() => P ? a(P) : null), [R, z] = E(() => P ? i(P) : null), [B, V] = E(() => P ? o(P) : null), [H, U] = E(() => {
-		if (P && a(P)) return !1;
+function I({ children: t, onTokenExpired: h, onSessionExpiringSoon: _, onRefreshToken: b, bridgeUrl: w, bridgeAllowedOrigins: E, bridgeDebug: j, onBridgeReady: M }) {
+	let P = ue(!1), [I, L] = O(() => u()), [R, z] = O(() => I ? o(I) : null), [B, V] = O(() => I ? a(I) : null), [H, U] = O(() => I ? s(I) : null), [W, G] = O(() => {
+		if (I && o(I)) return !1;
 		if (w) try {
-			let e = g()?.id ?? null;
+			let e = v()?.id ?? null;
 			if (e && localStorage.getItem(`bf-p-${e}-tokens`)) return !1;
 		} catch {}
 		return !!w;
-	}), [me, W] = E(!1), [G, K] = E(null), [q, J] = E(() => s().map((e) => ({
+	}), [pe, K] = O(!1), [me, q] = O(null), [he, J] = O(() => c().map((e) => ({
 		id: e.id,
 		email: e.email,
 		name: e.name,
 		avatar: e.avatar,
-		isActive: e.id === P,
+		isActive: e.id === I,
 		lastLogin: e.lastLogin
-	}))), Y = C(() => {
-		let e = r();
-		J(s().map((t) => ({
+	}))), Y = T(() => {
+		let e = i();
+		J(c().map((t) => ({
 			id: t.id,
 			email: t.email,
 			name: t.name,
@@ -93,85 +105,85 @@ function N({ children: p, onTokenExpired: h, onSessionExpiringSoon: v, onRefresh
 			lastLogin: t.lastLogin
 		})));
 	}, []);
-	T(() => {
+	D(() => {
 		if (!w) return;
 		try {
 			let e = new URL(w).pathname;
 			if (window.location.pathname === e) {
-				U(!1), j?.();
+				G(!1), M?.();
 				return;
 			}
 		} catch {
-			U(!1), j?.();
+			G(!1), M?.();
 			return;
 		}
-		if (se()) {
-			U(!1), j?.();
+		if (oe()) {
+			G(!1), M?.();
 			return;
 		}
 		let e = () => {
-			U(!1), j?.();
+			G(!1), M?.();
 		}, t = (t) => {
-			N.current = !0;
+			P.current = !0;
 			try {
 				if (w) {
-					let e = M(w);
+					let e = F(w);
 					if (e) {
 						window.location.replace(e);
 						return;
 					}
 				}
-				pe(t);
+				fe(t);
 				let e = u();
-				if (e) F(e), L(a(e)), z(i(e)), V(o(e)), Y();
+				if (e) L(e), z(o(e)), V(a(e)), U(s(e)), Y();
 				else {
 					if (w && !t.user && !t.tokens) try {
-						let e = new URL(w).origin, t = window.location.origin, n = M(w);
+						let e = new URL(w).origin, t = window.location.origin, n = F(w);
 						if (n) {
 							window.location.replace(n);
 							return;
 						}
-						if (e !== t && !x()) {
+						if (e !== t && !C()) {
 							let t = window.location.href;
-							if (y(e, t)) return;
-							b(e, t), window.location.replace(`${e}/auth/sso-relay?returnTo=${encodeURIComponent(t)}`);
+							if (x(e, t)) return;
+							S(e, t), window.location.replace(`${e}/auth/sso-relay?returnTo=${encodeURIComponent(t)}`);
 							return;
 						}
 					} catch {}
-					F(null), L(null), z(null), V(null), J([]);
+					L(null), z(null), V(null), U(null), J([]);
 				}
 			} finally {
-				N.current = !1, e();
+				P.current = !1, e();
 			}
 		}, n = setTimeout(() => {
 			e();
 		}, 5e3);
-		return oe({
+		return ae({
 			bridgeUrl: w,
-			allowedOrigins: k,
+			allowedOrigins: E,
 			onStateChanged: t,
-			debug: A ?? !1
+			debug: j ?? !1
 		}), () => {
 			clearTimeout(n);
 		};
 	}, [
 		w,
-		k,
-		A,
+		E,
 		j,
+		M,
 		Y
 	]);
-	let he = C((e, t, n) => {
-		let r = O(t) ?? Date.now() + 3600 * 1e3, i = {
+	let ge = T((e, t, n) => {
+		let r = A(t) ?? Date.now() + 3600 * 1e3, i = {
 			accessToken: t,
 			refreshToken: n,
 			expiresAt: r
-		}, a = c(e, i);
-		F(a), L(e), z(i), V(null), W(!1), K(null), Y();
+		}, a = ee(e, i);
+		L(a), z(e), V(i), U(null), K(!1), q(null), Y();
 		try {
-			ae(a, window.location.origin);
+			ie(a, window.location.origin);
 		} catch {}
-		N.current || _()?.notifyLogin({
+		P.current || y()?.notifyLogin({
 			user: e,
 			tokens: {
 				accessToken: t,
@@ -180,43 +192,45 @@ function N({ children: p, onTokenExpired: h, onSessionExpiringSoon: v, onRefresh
 			},
 			activeAccountId: a,
 			activeProfileId: a,
-			profiles: s()
+			profiles: c()
 		});
-	}, [Y]), X = C(() => {
-		P && l(P);
+	}, [Y]), X = T(() => {
+		I && l(I);
 		let e = u();
-		e ? (F(e), L(a(e)), z(i(e)), V(o(e))) : (F(null), L(null), z(null), V(null)), W(!1), K(null), Y();
+		e ? (L(e), z(o(e)), V(a(e)), U(s(e))) : (L(null), z(null), V(null), U(null)), K(!1), q(null), Y();
 		try {
-			m();
+			g();
 		} catch {}
-		N.current || _()?.notifyLogout();
-	}, [P, Y]), ge = C((e) => {
-		if (!I || !P) return;
+		P.current || y()?.notifyLogout();
+		let t = N();
+		t && !P.current && window.location.replace(t);
+	}, [I, Y]), _e = T((e) => {
+		if (!R || !I) return;
 		let t = {
-			...I,
+			...R,
 			...e
 		};
-		L(t), te(P, t), n({
-			id: P,
+		z(t), p(I, t), r({
+			id: I,
 			email: t.email,
 			name: t.name ?? `${t.firstName ?? ""} ${t.lastName ?? ""}`.trim(),
 			avatar: t.avatar,
 			lastLogin: (/* @__PURE__ */ new Date()).toISOString()
 		}), Y();
 	}, [
+		R,
 		I,
-		P,
 		Y
-	]), Z = C(async () => {
-		if (!(!R?.refreshToken || !S || !P)) {
-			U(!0);
+	]), Z = T(async () => {
+		if (!(!B?.refreshToken || !b || !I)) {
+			G(!0);
 			try {
-				let e = await S(R.refreshToken), t = O(e.accessToken), n = e.expiresAt ?? t ?? Date.now() + 3600 * 1e3, r = {
+				let e = await b(B.refreshToken), t = A(e.accessToken), n = e.expiresAt ?? t ?? Date.now() + 3600 * 1e3, r = {
 					accessToken: e.accessToken,
-					refreshToken: e.refreshToken ?? R.refreshToken,
+					refreshToken: e.refreshToken ?? B.refreshToken,
 					expiresAt: n
 				};
-				z(r), f(P, r), N.current || _()?.notifyTokenRefresh({
+				V(r), f(I, r), P.current || y()?.notifyTokenRefresh({
 					accessToken: r.accessToken,
 					refreshToken: r.refreshToken,
 					expiresAt: r.expiresAt
@@ -224,168 +238,170 @@ function N({ children: p, onTokenExpired: h, onSessionExpiringSoon: v, onRefresh
 			} catch (e) {
 				console.error("Failed to refresh token:", e), X(), h?.();
 			} finally {
-				U(!1);
+				G(!1);
 			}
 		}
 	}, [
-		R,
-		S,
-		P,
+		B,
+		b,
+		I,
 		X,
 		h
-	]), _e = C((e) => I?.permissions ? I.permissions.includes(e) || I.permissions.includes("*") : !1, [I]), Q = C((e) => {
-		V(e), P && ne(P, e);
-	}, [P]), ve = C((e, t) => {
-		W(e), K(t ?? null);
-	}, []), ye = C((e) => {
-		if (!re(e)) {
+	]), Q = T((e) => R?.permissions ? R.permissions.includes(e) || R.permissions.includes("*") : !1, [R]), ve = T((e) => {
+		U(e), I && m(I, e);
+	}, [I]), ye = T((e, t) => {
+		K(e), q(t ?? null);
+	}, []), be = T((e) => {
+		if (!ne(e)) {
 			console.error(`Profile ${e} not found`);
 			return;
 		}
-		F(e), L(a(e)), z(i(e)), V(o(e)), W(!1), K(null), Y(), N.current || _()?.notifyAccountSwitch(e);
-	}, [Y]), be = C((e, t, n) => {
-		c(e, {
+		L(e), z(o(e)), V(a(e)), U(s(e)), K(!1), q(null), Y(), P.current || y()?.notifyAccountSwitch(e);
+	}, [Y]), xe = T((e, t, n) => {
+		ee(e, {
 			accessToken: t,
 			refreshToken: n,
-			expiresAt: O(t) ?? Date.now() + 3600 * 1e3
-		}), P && d(P), Y();
-	}, [P, Y]), xe = C((e) => {
-		if (e === P) {
+			expiresAt: A(t) ?? Date.now() + 3600 * 1e3
+		}), I && d(I), Y();
+	}, [I, Y]), Se = T((e) => {
+		if (e === I) {
 			console.error("Cannot remove active account — logout first");
 			return;
 		}
 		l(e), Y();
-	}, [P, Y]), Se = C(() => {
-		ee(), F(null), L(null), z(null), V(null), W(!1), K(null), J([]);
+	}, [I, Y]), Ce = T(() => {
+		te(), L(null), z(null), V(null), U(null), K(!1), q(null), J([]);
 		try {
-			m();
+			g();
 		} catch {}
-		N.current || _()?.notifyLogoutAll();
+		P.current || y()?.notifyLogoutAll();
+		let e = N();
+		e && !P.current && window.location.replace(e);
 	}, []);
-	T(() => {
-		if (!R?.expiresAt) return;
-		let e = R.expiresAt - Date.now();
+	D(() => {
+		if (!B?.expiresAt) return;
+		let e = B.expiresAt - Date.now();
 		if (e <= 0) {
-			S && R?.refreshToken ? Z() : h?.();
+			b && B?.refreshToken ? Z() : h?.();
 			return;
 		}
 		let t = [];
-		if (S && R?.refreshToken) {
+		if (b && B?.refreshToken) {
 			let n = Math.max(0, e - 300 * 1e3);
 			t.push(setTimeout(() => {
 				Z();
 			}, n));
 		}
-		if (v) {
+		if (_) {
 			let n = Math.max(0, e - 300 * 1e3);
 			t.push(setTimeout(() => {
-				v();
+				_();
 			}, n));
 		}
-		return (!S || !R?.refreshToken) && t.push(setTimeout(() => {
+		return (!b || !B?.refreshToken) && t.push(setTimeout(() => {
 			h?.();
 		}, e)), () => t.forEach(clearTimeout);
 	}, [
-		R?.expiresAt,
-		R?.refreshToken,
+		B?.expiresAt,
+		B?.refreshToken,
 		Z,
-		S,
+		b,
 		h,
-		v
+		_
 	]);
-	let Ce = C(() => {
+	let we = T(() => {
 		let e = u();
 		if (!e) {
-			(I || R) && (L(null), z(null), V(null), F(null), J([]));
+			(R || B) && (z(null), V(null), U(null), L(null), J([]));
 			return;
 		}
-		let t = i(e), n = o(e), r = a(e);
-		e !== P && F(e), t?.accessToken !== R?.accessToken && z(t), n !== B && V(n), r && r.id !== I?.id && L(r), Y();
+		let t = a(e), n = s(e), r = o(e);
+		e !== I && L(e), t?.accessToken !== B?.accessToken && V(t), n !== H && U(n), r && r.id !== R?.id && z(r), Y();
 	}, [
+		B,
 		R,
+		H,
 		I,
-		B,
-		P,
 		Y
 	]);
-	T(() => {
-		let e = () => Ce();
-		window.addEventListener(t, e), window.addEventListener("storage", e);
-		let n = setInterval(e, 1e4);
+	D(() => {
+		let e = () => we();
+		window.addEventListener(n, e), window.addEventListener("storage", e);
+		let t = setInterval(e, 1e4);
 		return () => {
-			window.removeEventListener(t, e), window.removeEventListener("storage", e), clearInterval(n);
+			window.removeEventListener(n, e), window.removeEventListener("storage", e), clearInterval(t);
 		};
-	}, [Ce]), T(() => {
-		if (!R?.accessToken || !w) return;
+	}, [we]), D(() => {
+		if (!B?.accessToken || !w) return;
 		let t = async () => {
 			if (document.visibilityState === "visible") try {
-				if (le()) {
-					F(null), L(null), z(null), V(null), J([]);
+				if (ce()) {
+					L(null), z(null), V(null), U(null), J([]);
 					return;
 				}
-				if (ie()) return;
-				await ce(`${e().globalBaseUrl}/global/graphql`, R.accessToken) && X();
+				if (re()) return;
+				await se(`${e().globalBaseUrl}/global/graphql`, B.accessToken) && X();
 			} catch {}
 		};
 		return document.addEventListener("visibilitychange", t), () => document.removeEventListener("visibilitychange", t);
 	}, [
-		R?.accessToken,
+		B?.accessToken,
 		w,
 		X
 	]);
-	let $ = ue(() => !!I && !!R, [I, R]), we = ue(() => ({
-		user: I,
-		tokens: R,
+	let $ = le(() => !!R && !!B, [R, B]), Te = le(() => ({
+		user: R,
+		tokens: B,
 		isAuthenticated: $,
-		isLoading: H,
-		login: he,
+		isLoading: W,
+		login: ge,
 		logout: X,
-		updateUser: ge,
+		updateUser: _e,
 		refreshAccessToken: Z,
-		hasPermission: _e,
-		setWorkspaceToken: Q,
-		workspaceToken: B,
-		mfaRequired: me,
-		mfaChallengeId: G,
-		setMfaState: ve,
-		activeProfileId: P,
-		accounts: q,
-		switchAccount: ye,
-		addAccount: be,
-		removeAccount: xe,
-		logoutAll: Se,
-		currentUser: I
+		hasPermission: Q,
+		setWorkspaceToken: ve,
+		workspaceToken: H,
+		mfaRequired: pe,
+		mfaChallengeId: me,
+		setMfaState: ye,
+		activeProfileId: I,
+		accounts: he,
+		switchAccount: be,
+		addAccount: xe,
+		removeAccount: Se,
+		logoutAll: Ce,
+		currentUser: R
 	}), [
-		I,
 		R,
+		B,
 		$,
-		H,
-		he,
-		X,
+		W,
 		ge,
-		Z,
+		X,
 		_e,
+		Z,
 		Q,
-		B,
-		me,
-		G,
 		ve,
-		P,
-		q,
+		H,
+		pe,
+		me,
 		ye,
+		I,
+		he,
 		be,
 		xe,
-		Se
+		Se,
+		Ce
 	]);
-	return /* @__PURE__ */ fe(D.Provider, {
-		value: we,
-		children: p
+	return /* @__PURE__ */ de(k.Provider, {
+		value: Te,
+		children: t
 	});
 }
-function P() {
-	let e = w(D);
+function L() {
+	let e = E(k);
 	if (!e) throw Error("useAuth must be used within an AuthProvider");
 	return e;
 }
 //#endregion
-export { N as AuthProvider, P as useAuth };
+export { I as AuthProvider, L as useAuth };

package/dist/shared/utils/apollo.d.ts

@@ -9,5 +9,18 @@ export interface CreateApolloClientOptions {
     retryDelay?: number;
 }
 export declare function withBrowserTraceHeader(headersInit?: HeadersInit): Headers;
+/**
+ * Decide whether an Apollo link error should be retried. Exported so it
+ * can be unit-tested independently of an ApolloClient instance.
+ *
+ * Retries any unrecognised error (default-true) so genuine transient
+ * network / 5xx failures still benefit from the link's retry budget;
+ * permanent failures are filtered via three signals, in order:
+ *   1. Numeric `statusCode` (Apollo Client 4's `ServerError`)
+ *   2. `errors[].extensions.code` (GraphQL response auth codes)
+ *   3. Substring match on `message` (fallback for link errors that
+ *      surface auth codes only in their message string)
+ */
+export declare function shouldRetryApolloError(error: unknown): boolean;
 export declare function createApolloClient(options: CreateApolloClientOptions): ApolloClient;
 //# sourceMappingURL=apollo.d.ts.map

package/dist/shared/utils/apollo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apollo.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/apollo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAQ,MAAM,gBAAgB,CAAC;AAYnE,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,sBAAsB,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAMzE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,YAAY,CA0HnF"}
+{"version":3,"file":"apollo.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/apollo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAQ,MAAM,gBAAgB,CAAC;AAanE,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,sBAAsB,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAMzE;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiC9D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,YAAY,CAyHnF"}

package/dist/shared/utils/apollo.js

@@ -9,48 +9,60 @@ function c(t) {
 	let n = new Headers(t);
 	return n.has("traceparent") || n.set("traceparent", e().traceparent), n;
 }
-function l(e) {
-	let { uri: l, getAuthToken: u, onAuthError: d, onNetworkError: f, cache: p = new n(), retryAttempts: m = 3, retryDelay: h = 1e3 } = e, g = new o({
+var l = new Set([
+	401,
+	403,
+	413
+]);
+function u(e) {
+	if (!e) return !1;
+	let t = e.statusCode;
+	if (typeof t == "number" && l.has(t) || e.errors?.some((e) => e.extensions?.code === "UNAUTHENTICATED" || e.extensions?.code === "FORBIDDEN")) return !1;
+	let n = e.message;
+	return !(n && /UNAUTHENTICATED|FORBIDDEN/.test(n));
+}
+function d(e) {
+	let { uri: l, getAuthToken: d, onAuthError: f, onNetworkError: p, cache: m = new n(), retryAttempts: h = 3, retryDelay: g = 1e3 } = e, _ = new o({
 		delay: {
-			initial: h,
-			max: h * 4,
+			initial: g,
+			max: g * 4,
 			jitter: !0
 		},
 		attempts: {
-			max: m,
-			retryIf: (e) => !!e && !e.message.includes("401") && !e.message.includes("403")
+			max: h,
+			retryIf: u
 		}
-	}), _ = a(({ error: e }) => {
+	}), v = a(({ error: e }) => {
 		let t = e.errors;
 		t ? t.forEach((e) => {
-			console.error(`[GraphQL error]: Message: ${e.message}, Location: ${JSON.stringify(e.locations)}, Path: ${e.path}`), (e.extensions?.code === "UNAUTHENTICATED" || e.extensions?.code === "FORBIDDEN") && d?.();
-		}) : e && (console.error(`[Network error]: ${e.message}`), f?.(e));
-	}), v = s((e, { headers: t }) => {
-		let n = u?.();
+			console.error(`[GraphQL error]: Message: ${e.message}, Location: ${JSON.stringify(e.locations)}, Path: ${e.path}`), (e.extensions?.code === "UNAUTHENTICATED" || e.extensions?.code === "FORBIDDEN") && f?.();
+		}) : e && (console.error(`[Network error]: ${e.message}`), p?.(e));
+	}), y = s((e, { headers: t }) => {
+		let n = d?.();
 		console.log("[fe-libs apollo] getAuthToken returned:", n ? n.substring(0, 20) + "..." : "null");
 		let r = { headers: {
 			...t,
 			...n ? { authorization: `Bearer ${n}` } : {}
 		} };
 		return console.log("[fe-libs apollo] Authorization header:", r.headers.authorization ? r.headers.authorization.substring(0, 30) + "..." : "MISSING"), r;
-	}), y = fetch, b = ((e, t) => fetch(e, {
+	}), b = fetch, x = ((e, t) => fetch(e, {
 		...t,
 		headers: c(t?.headers)
 	}));
-	return y.preconnect && (b.preconnect = y.preconnect), new t({
+	return b.preconnect && (x.preconnect = b.preconnect), new t({
 		link: r([
-			g,
 			_,
 			v,
+			y,
 			new i({
 				uri: l,
 				credentials: "include",
-				batchMax: 50,
+				batchMax: 10,
 				batchInterval: 100,
-				fetch: b
+				fetch: x
 			})
 		]),
-		cache: p,
+		cache: m,
 		defaultOptions: {
 			watchQuery: {
 				fetchPolicy: "cache-and-network",
@@ -65,4 +77,4 @@ function l(e) {
 	});
 }
 //#endregion
-export { l as createApolloClient };
+export { d as createApolloClient };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/fe-libs",
-  "version": "2026.518.6",
+  "version": "2026.519.1",
   "description": "Burdenoff frontend primitives and domain libraries",
   "type": "module",
   "imports": {