@burdenoff/microfe-auth 2026.510.127

package/dist/auth/hooks/useWorkspaceToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useWorkspaceToken.js","names":[],"sources":["../../../src/auth/hooks/useWorkspaceToken.ts"],"sourcesContent":["import { useState, useCallback } from \"react\";\nimport { graphqlFetch } from \"@burdenoff/fe-libs/shared/graphql/fetch\";\nimport { useAuthStore } from \"../store/authStore\";\n\n/**\n * Workspace token management hook\n *\n * Provides functions to issue, refresh, and verify workspace tokens.\n * Automatically updates the auth store with new tokens.\n *\n * API Flow:\n * - Calls workspace gateway (https://gw-wspace.local.burdenoff.com/workspaces/graphql)\n * - Gateway federates wspace-auth-svc which handles token operations\n * - Auth token (from global-auth-svc) goes in Authorization header\n *\n * Usage:\n * ```tsx\n * const { issueToken, refreshToken, verifyToken, isLoading, error } = useWorkspaceToken({\n *   workspaceGatewayUrl: 'https://gw-wspace.local.burdenoff.com/workspaces/graphql'\n * });\n *\n * // After login and organization/workspace selection\n * await issueToken(organizationId, workspaceId);\n *\n * // Refresh token before expiry (uses stored org/workspace IDs)\n * await refreshToken();\n * ```\n */\nexport interface UseWorkspaceTokenOptions {\n  /**\n   * URL of workspace gateway GraphQL endpoint\n   * Default: https://gw-wspace.local.burdenoff.com/workspaces/graphql\n   *\n   * Note: This should point to the workspace gateway, NOT directly to wspace-auth-svc.\n   * The gateway federates wspace-auth-svc and handles routing.\n   */\n  workspaceGatewayUrl?: string;\n}\n\nexport interface WorkspaceTokenPayload {\n  sub: string; // User ID\n  workspaceId: string;\n  tenantId?: string;\n  email?: string;\n  username?: string;\n  role?: string;\n  scopes: string[];\n  iat: number;\n  exp: number;\n}\n\nexport function useWorkspaceToken(options: UseWorkspaceTokenOptions = {}) {\n  const {\n    workspaceGatewayUrl = \"https://gw-wspace.local.burdenoff.com/workspaces/graphql\",\n  } = options;\n\n  const [isLoading, setIsLoading] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  /**\n   * Issue a new workspace token for the given workspace\n   *\n   * @param organizationId - Organization ID (required)\n   * @param workspaceId - Workspace ID (optional, auto-resolves to first accessible)\n   * @param projectId - Project ID (optional, auto-resolves to first accessible)\n   * @param scopes - Requested scopes (optional, defaults to full access)\n   */\n  const issueToken = useCallback(\n    async (\n      organizationId: string,\n      workspaceId?: string,\n      projectId?: string,\n      scopes?: string[],\n    ): Promise<string> => {\n      setIsLoading(true);\n      setError(null);\n\n      try {\n        const accessToken = useAuthStore.getState().accessToken;\n\n        if (!accessToken) {\n          throw new Error(\"No access token available. Please login first.\");\n        }\n\n        const response = await graphqlFetch<{\n          issueWorkspaceToken: {\n            success: boolean;\n            token: string;\n            expiresAt: string;\n            organizationId: string;\n            workspaceId: string;\n            projectId?: string;\n            scopes: string[];\n            error?: { code?: string; message?: string };\n          };\n        }>({\n          gateway: \"workspace\",\n          query: `\n            mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n              issueWorkspaceToken(input: $input) {\n                success\n                token\n                expiresAt\n                organizationId\n                workspaceId\n                projectId\n                scopes\n                error {\n                  code\n                  message\n                }\n              }\n            }\n          `,\n          variables: {\n            input: {\n              organizationId,\n              ...(workspaceId && { workspaceId }),\n              ...(projectId && { projectId }),\n              ...(scopes && { scopes }),\n            },\n          },\n          authToken: accessToken,\n        });\n\n        const result = response.data?.issueWorkspaceToken;\n\n        if (!result?.success || !result?.token) {\n          const errorMsg =\n            typeof result?.error?.message === \"string\"\n              ? result.error.message\n              : typeof result?.error === \"string\"\n                ? result.error\n                : \"Failed to issue workspace token\";\n          throw new Error(errorMsg);\n        }\n\n        useAuthStore.getState().setWorkspaceToken(result.token);\n        useAuthStore.getState().setCurrentWorkspaceId(result.workspaceId);\n\n        setIsLoading(false);\n        return result.token;\n      } catch (err) {\n        const errorMessage =\n          err instanceof Error ? err.message : \"Unknown error occurred\";\n        console.error(\"[useWorkspaceToken] Error issuing token:\", errorMessage);\n        setError(errorMessage);\n        setIsLoading(false);\n        throw err;\n      }\n    },\n    [workspaceGatewayUrl],\n  );\n\n  /**\n   * Verify a workspace token\n   *\n   * @param token - Optional token to verify (uses stored token if not provided)\n   */\n  const verifyToken = useCallback(\n    async (token?: string): Promise<WorkspaceTokenPayload> => {\n      setIsLoading(true);\n      setError(null);\n\n      try {\n        const { workspaceToken } = useAuthStore.getState();\n        const tokenToVerify = token || workspaceToken;\n\n        if (!tokenToVerify) {\n          throw new Error(\"No workspace token available to verify\");\n        }\n\n        const response = await graphqlFetch<{\n          verifyWorkspaceToken: {\n            valid: boolean;\n            payload?: WorkspaceTokenPayload;\n            error?: { code?: string; message?: string };\n          };\n        }>({\n          gateway: \"workspace\",\n          query: `\n            query VerifyWorkspaceToken($token: String!) {\n              verifyWorkspaceToken(token: $token) {\n                valid\n                payload {\n                  sub\n                  workspaceId\n                  tenantId\n                  email\n                  username\n                  role\n                  scopes\n                  iat\n                  exp\n                }\n                error {\n                  code\n                  message\n                }\n              }\n            }\n          `,\n          variables: { token: tokenToVerify },\n        });\n\n        const result = response.data?.verifyWorkspaceToken;\n\n        if (!result?.valid) {\n          const errorMsg =\n            typeof result?.error?.message === \"string\"\n              ? result.error.message\n              : typeof result?.error === \"string\"\n                ? result.error\n                : \"Token verification failed\";\n          throw new Error(errorMsg);\n        }\n\n        setIsLoading(false);\n        return result.payload!;\n      } catch (err) {\n        const errorMessage =\n          err instanceof Error ? err.message : \"Unknown error occurred\";\n        console.error(\n          \"[useWorkspaceToken] Error verifying token:\",\n          errorMessage,\n        );\n        setError(errorMessage);\n        setIsLoading(false);\n        throw err;\n      }\n    },\n    [workspaceGatewayUrl],\n  );\n\n  /**\n   * Refresh the workspace token\n   */\n  const refreshToken = useCallback(async (): Promise<string> => {\n    const { currentOrganizationId, currentWorkspaceId } =\n      useAuthStore.getState();\n    if (!currentOrganizationId) {\n      throw new Error(\"No organization ID in store. Please login first.\");\n    }\n    return issueToken(currentOrganizationId, currentWorkspaceId ?? undefined);\n  }, [issueToken]);\n\n  /**\n   * Decode a JWT token to get its payload (client-side only, no verification)\n   */\n  const decodeToken = useCallback((token: string): WorkspaceTokenPayload => {\n    try {\n      const base64Url = token.split(\".\")[1];\n      const base64 = base64Url.replace(/-/g, \"+\").replace(/_/g, \"/\");\n      const jsonPayload = decodeURIComponent(\n        atob(base64)\n          .split(\"\")\n          .map((c) => \"%\" + (\"00\" + c.charCodeAt(0).toString(16)).slice(-2))\n          .join(\"\"),\n      );\n      return JSON.parse(jsonPayload);\n    } catch {\n      throw new Error(\"Failed to decode token\");\n    }\n  }, []);\n\n  /**\n   * Check if a token is expired (client-side check)\n   */\n  const isTokenExpired = useCallback(\n    (token?: string): boolean => {\n      try {\n        const { workspaceToken } = useAuthStore.getState();\n        const tokenToCheck = token || workspaceToken;\n\n        if (!tokenToCheck) return true;\n\n        const payload = decodeToken(tokenToCheck);\n        const now = Math.floor(Date.now() / 1000);\n\n        return payload.exp < now;\n      } catch {\n        return true;\n      }\n    },\n    [decodeToken],\n  );\n\n  /**\n   * Get time until token expiry in milliseconds\n   */\n  const getTimeUntilExpiry = useCallback(\n    (token?: string): number => {\n      try {\n        const { workspaceToken } = useAuthStore.getState();\n        const tokenToCheck = token || workspaceToken;\n\n        if (!tokenToCheck) return 0;\n\n        const payload = decodeToken(tokenToCheck);\n        const now = Math.floor(Date.now() / 1000);\n        const timeUntilExpiry = (payload.exp - now) * 1000; // Convert to ms\n\n        return Math.max(0, timeUntilExpiry);\n      } catch {\n        return 0;\n      }\n    },\n    [decodeToken],\n  );\n\n  return {\n    issueToken,\n    refreshToken,\n    verifyToken,\n    decodeToken,\n    isTokenExpired,\n    getTimeUntilExpiry,\n    isLoading,\n    error,\n  };\n}\n"],"mappings":";;;;AAmDA,SAAgB,EAAkB,IAAoC,EAAE,EAAE;CACxE,IAAM,EACJ,yBAAsB,+DACpB,GAEE,CAAC,GAAW,KAAgB,EAAS,GAAM,EAC3C,CAAC,GAAO,KAAY,EAAwB,KAAK,EAUjD,IAAa,EACjB,OACE,GACA,GACA,GACA,MACoB;AAEpB,EADA,EAAa,GAAK,EAClB,EAAS,KAAK;AAEd,MAAI;GACF,IAAM,IAAc,EAAa,UAAU,CAAC;AAE5C,OAAI,CAAC,EACH,OAAU,MAAM,iDAAiD;GA4CnE,IAAM,KAzCW,MAAM,EAWpB;IACD,SAAS;IACT,OAAO;IAiBP,WAAW,EACT,OAAO;KACL;KACA,GAAI,KAAe,EAAE,gBAAa;KAClC,GAAI,KAAa,EAAE,cAAW;KAC9B,GAAI,KAAU,EAAE,WAAQ;KACzB,EACF;IACD,WAAW;IACZ,CAAC,EAEsB,MAAM;AAE9B,OAAI,CAAC,GAAQ,WAAW,CAAC,GAAQ,OAAO;IACtC,IAAM,IACJ,OAAO,GAAQ,OAAO,WAAY,WAC9B,EAAO,MAAM,UACb,OAAO,GAAQ,SAAU,WACvB,EAAO,QACP;AACR,UAAU,MAAM,EAAS;;AAO3B,UAJA,EAAa,UAAU,CAAC,kBAAkB,EAAO,MAAM,EACvD,EAAa,UAAU,CAAC,sBAAsB,EAAO,YAAY,EAEjE,EAAa,GAAM,EACZ,EAAO;WACP,GAAK;GACZ,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAIvC,SAHA,QAAQ,MAAM,4CAA4C,EAAa,EACvE,EAAS,EAAa,EACtB,EAAa,GAAM,EACb;;IAGV,CAAC,EAAoB,CACtB,EAOK,IAAc,EAClB,OAAO,MAAmD;AAExD,EADA,EAAa,GAAK,EAClB,EAAS,KAAK;AAEd,MAAI;GACF,IAAM,EAAE,sBAAmB,EAAa,UAAU,EAC5C,IAAgB,KAAS;AAE/B,OAAI,CAAC,EACH,OAAU,MAAM,yCAAyC;GAoC3D,IAAM,KAjCW,MAAM,EAMpB;IACD,SAAS;IACT,OAAO;IAsBP,WAAW,EAAE,OAAO,GAAe;IACpC,CAAC,EAEsB,MAAM;AAE9B,OAAI,CAAC,GAAQ,OAAO;IAClB,IAAM,IACJ,OAAO,GAAQ,OAAO,WAAY,WAC9B,EAAO,MAAM,UACb,OAAO,GAAQ,SAAU,WACvB,EAAO,QACP;AACR,UAAU,MAAM,EAAS;;AAI3B,UADA,EAAa,GAAM,EACZ,EAAO;WACP,GAAK;GACZ,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAOvC,SANA,QAAQ,MACN,8CACA,EACD,EACD,EAAS,EAAa,EACtB,EAAa,GAAM,EACb;;IAGV,CAAC,EAAoB,CACtB,EAKK,IAAe,EAAY,YAA6B;EAC5D,IAAM,EAAE,0BAAuB,0BAC7B,EAAa,UAAU;AACzB,MAAI,CAAC,EACH,OAAU,MAAM,mDAAmD;AAErE,SAAO,EAAW,GAAuB,KAAsB,KAAA,EAAU;IACxE,CAAC,EAAW,CAAC,EAKV,IAAc,GAAa,MAAyC;AACxE,MAAI;GAEF,IAAM,IADY,EAAM,MAAM,IAAI,CAAC,GACV,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,EACxD,IAAc,mBAClB,KAAK,EAAO,CACT,MAAM,GAAG,CACT,KAAK,MAAM,OAAO,OAAO,EAAE,WAAW,EAAE,CAAC,SAAS,GAAG,EAAE,MAAM,GAAG,CAAC,CACjE,KAAK,GAAG,CACZ;AACD,UAAO,KAAK,MAAM,EAAY;UACxB;AACN,SAAU,MAAM,yBAAyB;;IAE1C,EAAE,CAAC;AA+CN,QAAO;EACL;EACA;EACA;EACA;EACA,gBA/CqB,GACpB,MAA4B;AAC3B,OAAI;IACF,IAAM,EAAE,sBAAmB,EAAa,UAAU,EAC5C,IAAe,KAAS;AAE9B,QAAI,CAAC,EAAc,QAAO;IAE1B,IAAM,IAAU,EAAY,EAAa,EACnC,IAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AAEzC,WAAO,EAAQ,MAAM;WACf;AACN,WAAO;;KAGX,CAAC,EAAY,CACd;EA+BC,oBA1ByB,GACxB,MAA2B;AAC1B,OAAI;IACF,IAAM,EAAE,sBAAmB,EAAa,UAAU,EAC5C,IAAe,KAAS;AAE9B,QAAI,CAAC,EAAc,QAAO;IAE1B,IAAM,IAAU,EAAY,EAAa,EACnC,IAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,EACnC,KAAmB,EAAQ,MAAM,KAAO;AAE9C,WAAO,KAAK,IAAI,GAAG,EAAgB;WAC7B;AACN,WAAO;;KAGX,CAAC,EAAY,CACd;EASC;EACA;EACD"}

package/dist/auth/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Auth Microfrontend
+ *
+ * Provides authentication, security settings, and account management interface
+ * for the Burdenoff multi-tenant platform.
+ *
+ * Features:
+ * - User authentication (signIn, signUp, signOut, refreshToken)
+ * - MFA (TOTP, SMS, Email, WebAuthn)
+ * - OAuth and SAML SSO
+ * - Magic Link authentication
+ * - Workspace token management
+ * - User management (admin)
+ *
+ * Note: API Key management, App management, and App-user delegations
+ * have been consolidated into microfe-devportal.
+ *
+ * @example
+ * ```tsx
+ * import { AuthRoot, type AuthRootProps } from '@burdenoff/microfe-auth';
+ *
+ * function App() {
+ *   const props: AuthRootProps = {
+ *     basePath: '/auth',
+ *     navigate: (path) => router.push(path),
+ *     apiGatewayUrl: 'https://gw-global.local.burdenoff.com',
+ *     authToken: 'token',
+ *     onAuthSuccess: (user) => shellLogin(user),
+ *     onLogout: () => shellLogout(),
+ *   };
+ *
+ *   return <AuthRoot {...props} />;
+ * }
+ * ```
+ */
+export { AuthRoot } from './AuthRoot';
+export type { AuthRootProps, User, UserRole, UserStatus, UserConnection, UserFilterInput, PaginationInput, } from './types';
+export type { AuthType, AuthMethod, AuthMethodConfig, AuthStrategyHealth, AuthPayload, AuthResult, SignInInput, SignUpInput, ChangePasswordInput, } from './types';
+export type { MFAMethod, MFASetupResult, MFAVerifyInput } from './types';
+export type { OAuthInput, SAMLInput, SAMLRequestResult } from './types';
+export type { AuthContext, MagicLinkSendResult } from './types';
+export type { Organization, OrganizationConnection } from './types';
+export type { Project, ProjectStatus, ProjectConnection } from './types';
+export type { Workspace, WorkspaceSecretStatus, WorkspaceSecretInfo, WorkspaceTokenResponse, GenerateWorkspaceTokenInput, RotateWorkspaceSecretInput, SecretRotationResponse, } from './types';
+export type { TokenValidationError, TokenValidationResponse, ValidateTokensInput, } from './types';
+export type { EmailVerificationResult, ResendVerificationResult, PasswordResetRequestResult, DeleteUserResult, } from './types';
+export type { Session, MfaDevice, OAuthAccount, SecurityAudit, OAuthProvider, SecurityEventType, TrustedDevice, SSOConfig, PasswordStrength, } from './types';
+export { useAuth } from './providers/AuthProvider';
+export { useAuthOperations, useMfaOperations, useSessionOperations, usePasswordOperations, useAuthStore, } from './hooks';
+export { useWorkspaceOperations } from './hooks';
+export { useUserOperations } from './hooks';
+export { useWorkspaceToken } from './hooks/useWorkspaceToken';
+export { useTokenRefresh } from './hooks/useTokenRefresh';
+export { useContextSwitcherData, useWorkspaceSyncEffect, useProjectSyncEffect, } from './hooks';
+export { useMyWorkspaces } from './hooks';
+export type { UseContextSwitcherDataOptions } from './hooks';
+export { WorkspaceSelector } from './components/workspace/WorkspaceSelector';
+export type { WorkspaceSelectorProps } from './components/workspace/WorkspaceSelector';
+export { UserProfileMenu } from './components/profile/UserProfileMenu';
+export type { UserProfileMenuProps } from './components/profile/UserProfileMenu';
+export { SSORelayPage } from './pages/SSORelayPage';
+export { SSORelayCallbackPage } from './pages/SSORelayCallbackPage';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC,YAAY,EACV,aAAa,EACb,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAGjB,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAGxE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAGhE,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAGpE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAGzE,YAAY,EACV,SAAS,EACT,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,OAAO,EACP,SAAS,EACT,YAAY,EACZ,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,SAAS,EACT,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAGnD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,GACb,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,YAAY,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAGvF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAGjF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,18 @@
+import "./providers/AuthProvider.js";
+import "./store/authStore.js";
+import "./hooks/useAuthOperations.js";
+import "./hooks/useMfaOperations.js";
+import "./hooks/usePasswordOperations.js";
+import "./hooks/useSessionOperations.js";
+import "./hooks/useWorkspaceOperations.js";
+import "./hooks/useMyWorkspaces.js";
+import "./hooks/useContextSwitcherData.js";
+import "./hooks/useUserOperations.js";
+import "./hooks/index.js";
+import "./pages/SSORelayPage.js";
+import "./pages/SSORelayCallbackPage.js";
+import "./AuthRoot.js";
+import "./hooks/useWorkspaceToken.js";
+import "./hooks/useTokenRefresh.js";
+import "./components/workspace/WorkspaceSelector.js";
+import "./components/profile/UserProfileMenu.js";

package/dist/auth/pages/ApiKeysPage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * API keys management page with professional UI
+ */
+export declare function ApiKeysPage(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=ApiKeysPage.d.ts.map

package/dist/auth/pages/ApiKeysPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeysPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/ApiKeysPage.tsx"],"names":[],"mappings":"AAwCA;;GAEG;AACH,wBAAgB,WAAW,4CA0e1B"}

package/dist/auth/pages/AppsPage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Apps CRUDL page for managing OAuth applications
+ */
+export declare function AppsPage(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=AppsPage.d.ts.map

package/dist/auth/pages/AppsPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppsPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/AppsPage.tsx"],"names":[],"mappings":"AAyCA;;GAEG;AACH,wBAAgB,QAAQ,4CAkjCvB"}

package/dist/auth/pages/AuditLogPage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Security audit log page
+ */
+export declare function AuditLogPage(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=AuditLogPage.d.ts.map

package/dist/auth/pages/AuditLogPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLogPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/AuditLogPage.tsx"],"names":[],"mappings":"AAiCA;;GAEG;AACH,wBAAgB,YAAY,4CA8H3B"}

package/dist/auth/pages/AuditLogPage.js

@@ -0,0 +1,129 @@
+import { AlertIcon as e } from "../components/AuthIcons.js";
+import { formatDateTime as t } from "../utils/formatters.js";
+import { useI18n as n } from "@burdenoff/fe-libs/shared/providers/shell";
+import { jsx as r, jsxs as i } from "react/jsx-runtime";
+import { useFeatureFlagDetails as a } from "@burdenoff/fe-libs/shared/feature-flags";
+import { useQuery as o } from "@apollo/client/react";
+import { gql as s } from "@apollo/client";
+//#region src/auth/pages/AuditLogPage.tsx
+var c = s`
+  query AuthAuditLogs($pagination: PaginationInput) {
+    authAuditLogs(pagination: $pagination) {
+      id
+      action
+      description
+      ipAddress
+      userAgent
+      createdAt
+    }
+  }
+`;
+function l() {
+	let { t: s } = n(), l = (e, t) => {
+		let n = s(e);
+		return n === e ? t : n;
+	}, u = a("auth.audit-log")?.value === !0, { data: d, loading: f, error: p } = o(c, {
+		skip: !u,
+		fetchPolicy: "cache-and-network",
+		variables: { pagination: {
+			limit: 50,
+			offset: 0
+		} }
+	}), m = d?.authAuditLogs ?? [];
+	if (!u) return /* @__PURE__ */ r("div", {
+		className: "max-w-4xl mx-auto p-6",
+		children: /* @__PURE__ */ i("div", {
+			className: "text-center py-16 border-2 border-dashed border-border-subtle rounded-xl",
+			children: [
+				/* @__PURE__ */ r("div", {
+					className: "w-16 h-16 mx-auto mb-4 rounded-full bg-status-warning-bg-subtle flex items-center justify-center",
+					children: /* @__PURE__ */ r(e, { className: "w-8 h-8 text-status-warning-text" })
+				}),
+				/* @__PURE__ */ r("h2", {
+					className: "text-xl font-semibold text-text-primary mb-2",
+					children: l("auth.auditLog.notAvailable", "Page Not Available")
+				}),
+				/* @__PURE__ */ r("p", {
+					className: "text-text-secondary",
+					children: l("auth.auditLog.notEnabled", "The Security Audit Log is not enabled for your account.")
+				})
+			]
+		})
+	});
+	let h = (e) => {
+		switch (e) {
+			case "LOGIN_SUCCESS": return "OK";
+			case "LOGIN_FAILURE": return "ER";
+			case "LOGOUT": return "LO";
+			case "PASSWORD_CHANGE": return "PW";
+			case "MFA_ENABLED":
+			case "MFA_VERIFIED": return "MF";
+			case "ANOMALY_DETECTED": return "AL";
+			default: return "AU";
+		}
+	};
+	return /* @__PURE__ */ i("div", {
+		className: "max-w-4xl mx-auto p-6",
+		children: [/* @__PURE__ */ r("h1", {
+			className: "text-3xl font-semibold text-text-primary mb-8",
+			children: l("auth.auditLog.title", "Security Audit Log")
+		}), f ? /* @__PURE__ */ r("div", {
+			className: "text-center py-12",
+			children: /* @__PURE__ */ r("p", {
+				className: "text-text-secondary",
+				children: l("auth.auditLog.loading", "Loading audit events...")
+			})
+		}) : p ? /* @__PURE__ */ r("div", {
+			className: "text-center py-12 border border-status-error-border rounded-xl bg-status-error-bg-subtle",
+			children: /* @__PURE__ */ r("p", {
+				className: "text-status-error-text",
+				children: l("auth.auditLog.error", "Unable to load audit events")
+			})
+		}) : m.length === 0 ? /* @__PURE__ */ r("div", {
+			className: "text-center py-12",
+			children: /* @__PURE__ */ r("p", {
+				className: "text-text-secondary",
+				children: l("auth.auditLog.noEvents", "No security events recorded")
+			})
+		}) : /* @__PURE__ */ r("div", {
+			className: "space-y-4",
+			children: m.map((e) => /* @__PURE__ */ r("div", {
+				className: "p-6 rounded-xl border border-border-subtle bg-bg-surface shadow-sm",
+				children: /* @__PURE__ */ i("div", {
+					className: "flex items-start gap-4",
+					children: [
+						/* @__PURE__ */ r("div", {
+							className: "flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-bg-muted text-xs font-semibold text-text-secondary",
+							children: h(e.action)
+						}),
+						/* @__PURE__ */ i("div", {
+							className: "flex-1",
+							children: [
+								/* @__PURE__ */ r("h3", {
+									className: "text-lg font-medium text-text-primary mb-1",
+									children: e.action.replace(/_/g, " ")
+								}),
+								/* @__PURE__ */ r("p", {
+									className: "text-sm text-text-secondary mb-2",
+									children: t(e.createdAt)
+								}),
+								/* @__PURE__ */ i("p", {
+									className: "text-sm text-text-secondary",
+									children: [e.description ?? l("auth.auditLog.defaultDescription", "Authentication event"), e.ipAddress && ` • ${e.ipAddress}`]
+								})
+							]
+						}),
+						e.action.includes("FAILURE") && /* @__PURE__ */ r("span", {
+							className: "px-3 py-1 rounded-full bg-status-error-bg-subtle text-status-error-text text-sm font-medium",
+							children: l("auth.auditLog.failed", "Failed")
+						})
+					]
+				})
+			}, e.id))
+		})]
+	});
+}
+//#endregion
+export { l as AuditLogPage };
+
+//# sourceMappingURL=AuditLogPage.js.map

package/dist/auth/pages/AuditLogPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLogPage.js","names":[],"sources":["../../../src/auth/pages/AuditLogPage.tsx"],"sourcesContent":["import { gql } from \"@apollo/client\";\nimport { useQuery } from \"@apollo/client/react\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useFeatureFlagDetails } from \"@burdenoff/fe-libs/shared/feature-flags\";\nimport { formatDateTime } from \"../utils\";\nimport { AlertIcon } from \"../components/AuthIcons\";\n\ninterface AuthAuditLogEntry {\n  id: string;\n  action: string;\n  description?: string | null;\n  ipAddress?: string | null;\n  userAgent?: string | null;\n  createdAt: string;\n}\n\ninterface AuthAuditLogsQueryResult {\n  authAuditLogs: AuthAuditLogEntry[];\n}\n\nconst AUTH_AUDIT_LOGS_QUERY = gql`\n  query AuthAuditLogs($pagination: PaginationInput) {\n    authAuditLogs(pagination: $pagination) {\n      id\n      action\n      description\n      ipAddress\n      userAgent\n      createdAt\n    }\n  }\n`;\n\n/**\n * Security audit log page\n */\nexport function AuditLogPage() {\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n\n  // Default-deny: only show when the flag is explicitly enabled in the system.\n  // useFeatureFlag uses default-allow (returns true when not found), so we use\n  // useFeatureFlagDetails + explicit value check instead.\n  const auditLogFlag = useFeatureFlagDetails(\"auth.audit-log\");\n  const showAuditLog = auditLogFlag?.value === true;\n  const { data, loading, error } = useQuery<AuthAuditLogsQueryResult>(\n    AUTH_AUDIT_LOGS_QUERY,\n    {\n      skip: !showAuditLog,\n      fetchPolicy: \"cache-and-network\",\n      variables: { pagination: { limit: 50, offset: 0 } },\n    },\n  );\n  const auditLogs = data?.authAuditLogs ?? [];\n\n  if (!showAuditLog) {\n    return (\n      <div className=\"max-w-4xl mx-auto p-6\">\n        <div className=\"text-center py-16 border-2 border-dashed border-border-subtle rounded-xl\">\n          <div className=\"w-16 h-16 mx-auto mb-4 rounded-full bg-status-warning-bg-subtle flex items-center justify-center\">\n            <AlertIcon className=\"w-8 h-8 text-status-warning-text\" />\n          </div>\n          <h2 className=\"text-xl font-semibold text-text-primary mb-2\">\n            {tr(\"auth.auditLog.notAvailable\", \"Page Not Available\")}\n          </h2>\n          <p className=\"text-text-secondary\">\n            {tr(\n              \"auth.auditLog.notEnabled\",\n              \"The Security Audit Log is not enabled for your account.\",\n            )}\n          </p>\n        </div>\n      </div>\n    );\n  }\n\n  const getEventMarker = (eventType: string) => {\n    switch (eventType) {\n      case \"LOGIN_SUCCESS\":\n        return \"OK\";\n      case \"LOGIN_FAILURE\":\n        return \"ER\";\n      case \"LOGOUT\":\n        return \"LO\";\n      case \"PASSWORD_CHANGE\":\n        return \"PW\";\n      case \"MFA_ENABLED\":\n      case \"MFA_VERIFIED\":\n        return \"MF\";\n      case \"ANOMALY_DETECTED\":\n        return \"AL\";\n      default:\n        return \"AU\";\n    }\n  };\n\n  return (\n    <div className=\"max-w-4xl mx-auto p-6\">\n      <h1 className=\"text-3xl font-semibold text-text-primary mb-8\">\n        {tr(\"auth.auditLog.title\", \"Security Audit Log\")}\n      </h1>\n\n      {loading ? (\n        <div className=\"text-center py-12\">\n          <p className=\"text-text-secondary\">\n            {tr(\"auth.auditLog.loading\", \"Loading audit events...\")}\n          </p>\n        </div>\n      ) : error ? (\n        <div className=\"text-center py-12 border border-status-error-border rounded-xl bg-status-error-bg-subtle\">\n          <p className=\"text-status-error-text\">\n            {tr(\"auth.auditLog.error\", \"Unable to load audit events\")}\n          </p>\n        </div>\n      ) : auditLogs.length === 0 ? (\n        <div className=\"text-center py-12\">\n          <p className=\"text-text-secondary\">\n            {tr(\"auth.auditLog.noEvents\", \"No security events recorded\")}\n          </p>\n        </div>\n      ) : (\n        <div className=\"space-y-4\">\n          {auditLogs.map((event) => (\n            <div\n              key={event.id}\n              className=\"p-6 rounded-xl border border-border-subtle bg-bg-surface shadow-sm\"\n            >\n              <div className=\"flex items-start gap-4\">\n                <div className=\"flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-bg-muted text-xs font-semibold text-text-secondary\">\n                  {getEventMarker(event.action)}\n                </div>\n                <div className=\"flex-1\">\n                  <h3 className=\"text-lg font-medium text-text-primary mb-1\">\n                    {event.action.replace(/_/g, \" \")}\n                  </h3>\n                  <p className=\"text-sm text-text-secondary mb-2\">\n                    {formatDateTime(event.createdAt)}\n                  </p>\n                  <p className=\"text-sm text-text-secondary\">\n                    {event.description ??\n                      tr(\n                        \"auth.auditLog.defaultDescription\",\n                        \"Authentication event\",\n                      )}\n                    {event.ipAddress && ` • ${event.ipAddress}`}\n                  </p>\n                </div>\n                {event.action.includes(\"FAILURE\") && (\n                  <span className=\"px-3 py-1 rounded-full bg-status-error-bg-subtle text-status-error-text text-sm font-medium\">\n                    {tr(\"auth.auditLog.failed\", \"Failed\")}\n                  </span>\n                )}\n              </div>\n            </div>\n          ))}\n        </div>\n      )}\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;AAoBA,IAAM,IAAwB,CAAG;;;;;;;;;;;;AAgBjC,SAAgB,IAAe;CAC7B,IAAM,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAOnC,IADe,EAAsB,iBAAiB,EACzB,UAAU,IACvC,EAAE,SAAM,YAAS,aAAU,EAC/B,GACA;EACE,MAAM,CAAC;EACP,aAAa;EACb,WAAW,EAAE,YAAY;GAAE,OAAO;GAAI,QAAQ;GAAG,EAAE;EACpD,CACF,EACK,IAAY,GAAM,iBAAiB,EAAE;AAE3C,KAAI,CAAC,EACH,QACE,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD;GAAK,WAAU;aAAf;IACE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,GAAD,EAAW,WAAU,oCAAqC,CAAA;KACtD,CAAA;IACN,kBAAC,MAAD;KAAI,WAAU;eACX,EAAG,8BAA8B,qBAAqB;KACpD,CAAA;IACL,kBAAC,KAAD;KAAG,WAAU;eACV,EACC,4BACA,0DACD;KACC,CAAA;IACA;;EACF,CAAA;CAIV,IAAM,KAAkB,MAAsB;AAC5C,UAAQ,GAAR;GACE,KAAK,gBACH,QAAO;GACT,KAAK,gBACH,QAAO;GACT,KAAK,SACH,QAAO;GACT,KAAK,kBACH,QAAO;GACT,KAAK;GACL,KAAK,eACH,QAAO;GACT,KAAK,mBACH,QAAO;GACT,QACE,QAAO;;;AAIb,QACE,kBAAC,OAAD;EAAK,WAAU;YAAf,CACE,kBAAC,MAAD;GAAI,WAAU;aACX,EAAG,uBAAuB,qBAAqB;GAC7C,CAAA,EAEJ,IACC,kBAAC,OAAD;GAAK,WAAU;aACb,kBAAC,KAAD;IAAG,WAAU;cACV,EAAG,yBAAyB,0BAA0B;IACrD,CAAA;GACA,CAAA,GACJ,IACF,kBAAC,OAAD;GAAK,WAAU;aACb,kBAAC,KAAD;IAAG,WAAU;cACV,EAAG,uBAAuB,8BAA8B;IACvD,CAAA;GACA,CAAA,GACJ,EAAU,WAAW,IACvB,kBAAC,OAAD;GAAK,WAAU;aACb,kBAAC,KAAD;IAAG,WAAU;cACV,EAAG,0BAA0B,8BAA8B;IAC1D,CAAA;GACA,CAAA,GAEN,kBAAC,OAAD;GAAK,WAAU;aACZ,EAAU,KAAK,MACd,kBAAC,OAAD;IAEE,WAAU;cAEV,kBAAC,OAAD;KAAK,WAAU;eAAf;MACE,kBAAC,OAAD;OAAK,WAAU;iBACZ,EAAe,EAAM,OAAO;OACzB,CAAA;MACN,kBAAC,OAAD;OAAK,WAAU;iBAAf;QACE,kBAAC,MAAD;SAAI,WAAU;mBACX,EAAM,OAAO,QAAQ,MAAM,IAAI;SAC7B,CAAA;QACL,kBAAC,KAAD;SAAG,WAAU;mBACV,EAAe,EAAM,UAAU;SAC9B,CAAA;QACJ,kBAAC,KAAD;SAAG,WAAU;mBAAb,CACG,EAAM,eACL,EACE,oCACA,uBACD,EACF,EAAM,aAAa,MAAM,EAAM,YAC9B;;QACA;;MACL,EAAM,OAAO,SAAS,UAAU,IAC/B,kBAAC,QAAD;OAAM,WAAU;iBACb,EAAG,wBAAwB,SAAS;OAChC,CAAA;MAEL;;IACF,EA7BC,EAAM,GA6BP,CACN;GACE,CAAA,CAEJ"}

package/dist/auth/pages/DelegationsPage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Delegations management page - shows apps that can act on behalf of the user
+ */
+export declare function DelegationsPage(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=DelegationsPage.d.ts.map

package/dist/auth/pages/DelegationsPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DelegationsPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/DelegationsPage.tsx"],"names":[],"mappings":"AAiIA;;GAEG;AACH,wBAAgB,eAAe,4CAwkB9B"}

package/dist/auth/pages/EmailVerifyPage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Email verification page with professional design
+ */
+export declare function EmailVerifyPage(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=EmailVerifyPage.d.ts.map

package/dist/auth/pages/EmailVerifyPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailVerifyPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/EmailVerifyPage.tsx"],"names":[],"mappings":"AAoBA;;GAEG;AACH,wBAAgB,eAAe,4CAqP9B"}

package/dist/auth/pages/EmailVerifyPage.js

@@ -0,0 +1,166 @@
+import { useAuthStore as e } from "../store/authStore.js";
+import { useAuthOperations as t } from "../hooks/useAuthOperations.js";
+import "../hooks/index.js";
+import { AuthLayout as n } from "../components/AuthLayout.js";
+import { SpinnerIcon as r } from "../components/AuthIcons.js";
+import { useCallback as i, useEffect as a, useRef as o, useState as s } from "react";
+import { useSearchParams as c } from "react-router-dom";
+import { useI18n as l } from "@burdenoff/fe-libs/shared/providers/shell";
+import { Fragment as u, jsx as d, jsxs as f } from "react/jsx-runtime";
+//#region src/auth/pages/EmailVerifyPage.tsx
+var p = 5;
+function m(e) {
+	let t = "/auth/login", n = e ? `${t}?email=${encodeURIComponent(e)}` : t;
+	window.location.href = n;
+}
+function h() {
+	let { t: h } = l(), g = (e, t) => {
+		let n = h(e);
+		return n === e ? t : n;
+	}, [_] = c(), v = _.get("token"), y = _.get("email"), { verifyEmail: b, resendVerification: x } = t(), S = e((e) => e.user), [C, w] = s("verifying"), [T, E] = s(y || void 0), [D, O] = s(!1), [k, A] = s(!1), [j, M] = s(p), N = o(!1);
+	a(() => {
+		if (!v || N.current) return;
+		let e = `auth:verifyEmail:inflight:${v}`;
+		if (!(typeof window < "u" && window.sessionStorage.getItem(e))) {
+			N.current = !0;
+			try {
+				window.sessionStorage.setItem(e, "1");
+			} catch {}
+			b(v).then((e) => {
+				e.success ? (w("success"), e.email && E(e.email)) : w("error");
+			}).catch(() => w("error"));
+		}
+	}, [v]), a(() => {
+		if (C !== "success") return;
+		let e = setInterval(() => {
+			M((t) => t <= 1 ? (clearInterval(e), m(T), 0) : t - 1);
+		}, 1e3);
+		return () => clearInterval(e);
+	}, [C, T]);
+	let P = async () => {
+		let e = y || S?.email;
+		if (!e) {
+			console.error("No email available for resend");
+			return;
+		}
+		O(!0);
+		try {
+			await x(e), A(!0);
+		} catch (e) {
+			console.error("Failed to resend verification:", e);
+		} finally {
+			O(!1);
+		}
+	}, F = i(() => {
+		m(T);
+	}, [T]), I = i(() => {
+		m();
+	}, []);
+	return C === "verifying" ? /* @__PURE__ */ d(n, {
+		title: g("auth.emailVerify.verifyingTitle", "Verifying your email"),
+		subtitle: g("auth.emailVerify.verifyingSubtitle", "Please wait while we confirm your email address"),
+		children: /* @__PURE__ */ f("div", {
+			className: "flex flex-col items-center justify-center py-12",
+			children: [/* @__PURE__ */ d("div", {
+				className: "w-16 h-16 rounded-full bg-[var(--color-bg-accent)] flex items-center justify-center mb-6",
+				children: /* @__PURE__ */ d(r, { className: "w-8 h-8 text-[var(--color-text-link)] animate-spin" })
+			}), /* @__PURE__ */ d("p", {
+				className: "text-[var(--color-text-secondary)]",
+				children: g("auth.emailVerify.moment", "This will only take a moment...")
+			})]
+		})
+	}) : C === "success" ? /* @__PURE__ */ d(n, {
+		title: g("auth.emailVerify.verifiedTitle", "Email verified!"),
+		subtitle: g("auth.emailVerify.verifiedSubtitle", "Your email address has been confirmed"),
+		children: /* @__PURE__ */ f("div", {
+			className: "flex flex-col items-center justify-center py-6",
+			children: [
+				/* @__PURE__ */ d("div", {
+					className: "w-20 h-20 rounded-full bg-[var(--color-status-success-bg-subtle)] flex items-center justify-center mb-6",
+					children: /* @__PURE__ */ d("svg", {
+						className: "w-10 h-10 text-[var(--color-status-success-text)]",
+						fill: "none",
+						viewBox: "0 0 24 24",
+						stroke: "currentColor",
+						children: /* @__PURE__ */ d("path", {
+							strokeLinecap: "round",
+							strokeLinejoin: "round",
+							strokeWidth: 2,
+							d: "M5 13l4 4L19 7"
+						})
+					})
+				}),
+				/* @__PURE__ */ d("p", {
+					className: "text-center text-[var(--color-text-secondary)] mb-6",
+					children: g("auth.emailVerify.successMessage", "Your email has been successfully verified. You can now sign in to access all features.")
+				}),
+				/* @__PURE__ */ f("p", {
+					className: "text-center text-sm text-[var(--color-text-tertiary)] mb-6",
+					children: [
+						g("auth.emailVerify.redirecting", "Redirecting to sign in in"),
+						" ",
+						/* @__PURE__ */ d("span", {
+							className: "font-semibold text-[var(--color-text-primary)]",
+							children: j
+						}),
+						" ",
+						g("auth.emailVerify.seconds", "seconds...")
+					]
+				}),
+				/* @__PURE__ */ d("button", {
+					onClick: F,
+					className: "auth-primary-button w-full px-4 py-3 font-semibold",
+					children: g("auth.emailVerify.continueSignIn", "Continue to sign in now")
+				})
+			]
+		})
+	}) : /* @__PURE__ */ d(n, {
+		title: g("auth.emailVerify.failedTitle", "Verification failed"),
+		subtitle: g("auth.emailVerify.failedSubtitle", "We couldn't verify your email address"),
+		children: /* @__PURE__ */ f("div", {
+			className: "flex flex-col items-center justify-center py-6",
+			children: [
+				/* @__PURE__ */ d("div", {
+					className: "w-20 h-20 rounded-full bg-[var(--color-status-error-bg-subtle)] flex items-center justify-center mb-6",
+					children: /* @__PURE__ */ d("svg", {
+						className: "w-10 h-10 text-[var(--color-status-error-text)]",
+						fill: "none",
+						viewBox: "0 0 24 24",
+						stroke: "currentColor",
+						children: /* @__PURE__ */ d("path", {
+							strokeLinecap: "round",
+							strokeLinejoin: "round",
+							strokeWidth: 2,
+							d: "M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+						})
+					})
+				}),
+				/* @__PURE__ */ d("p", {
+					className: "text-center text-[var(--color-text-secondary)] mb-8",
+					children: g("auth.emailVerify.invalidLink", "The verification link is invalid or has expired. Please request a new verification email.")
+				}),
+				k ? /* @__PURE__ */ d("div", {
+					className: "w-full p-4 rounded-xl bg-[var(--color-status-success-bg-subtle)] border border-[var(--color-status-success-border)] text-center mb-4",
+					children: /* @__PURE__ */ d("p", {
+						className: "text-sm text-[var(--color-status-success-text)]",
+						children: g("auth.emailVerify.emailSent", "Verification email sent! Please check your inbox.")
+					})
+				}) : /* @__PURE__ */ d("button", {
+					onClick: P,
+					disabled: D,
+					className: "auth-primary-button mb-4 flex w-full items-center justify-center gap-2 px-4 py-3 font-semibold",
+					children: D ? /* @__PURE__ */ f(u, { children: [/* @__PURE__ */ d(r, { className: "w-5 h-5 animate-spin" }), /* @__PURE__ */ d("span", { children: "Sending..." })] }) : g("auth.emailVerify.resend", "Resend verification email")
+				}),
+				/* @__PURE__ */ d("button", {
+					onClick: I,
+					className: "w-full py-3 px-4 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] font-medium hover:bg-[var(--color-bg-sunken)] transition-all",
+					children: g("auth.emailVerify.backToSignIn", "Back to sign in")
+				})
+			]
+		})
+	});
+}
+//#endregion
+export { h as EmailVerifyPage };
+
+//# sourceMappingURL=EmailVerifyPage.js.map

package/dist/auth/pages/EmailVerifyPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailVerifyPage.js","names":[],"sources":["../../../src/auth/pages/EmailVerifyPage.tsx"],"sourcesContent":["import { useEffect, useState, useCallback, useRef } from \"react\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { useAuthOperations } from \"../hooks\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { AuthLayout } from \"../components/AuthLayout\";\nimport { SpinnerIcon } from \"../components/AuthIcons\";\n\nconst REDIRECT_DELAY = 5; // seconds\n\n/**\n * Navigate to login page with optional email pre-fill\n * Uses window.location.href for reliable navigation (works in new tabs)\n */\nfunction navigateToLogin(email?: string) {\n  const baseUrl = \"/auth/login\";\n  const url = email ? `${baseUrl}?email=${encodeURIComponent(email)}` : baseUrl;\n  window.location.href = url;\n}\n\n/**\n * Email verification page with professional design\n */\nexport function EmailVerifyPage() {\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n\n  const [searchParams] = useSearchParams();\n  const token = searchParams.get(\"token\");\n  const urlEmail = searchParams.get(\"email\");\n  const { verifyEmail, resendVerification } = useAuthOperations();\n  const user = useAuthStore((state) => state.user);\n  const [status, setStatus] = useState<\"verifying\" | \"success\" | \"error\">(\n    \"verifying\",\n  );\n  const [verifiedEmail, setVerifiedEmail] = useState<string | undefined>(\n    urlEmail || undefined,\n  );\n  const [isResending, setIsResending] = useState(false);\n  const [resendSuccess, setResendSuccess] = useState(false);\n  const [countdown, setCountdown] = useState(REDIRECT_DELAY);\n\n  // Guard against duplicate calls. useRef alone resets across remounts\n  // (StrictMode, Suspense resolution of the lazy Auth root, HMR), so we\n  // additionally key on the token via sessionStorage — any remount for the\n  // same token short-circuits instead of firing a second mutation.\n  const verificationInitiatedRef = useRef(false);\n\n  useEffect(() => {\n    if (!token || verificationInitiatedRef.current) return;\n\n    const storageKey = `auth:verifyEmail:inflight:${token}`;\n    if (\n      typeof window !== \"undefined\" &&\n      window.sessionStorage.getItem(storageKey)\n    ) {\n      return;\n    }\n    verificationInitiatedRef.current = true;\n    try {\n      window.sessionStorage.setItem(storageKey, \"1\");\n    } catch {\n      // sessionStorage unavailable (private mode, SSR); ref guard still applies.\n    }\n\n    verifyEmail(token)\n      .then((result) => {\n        if (result.success) {\n          setStatus(\"success\");\n          if (result.email) setVerifiedEmail(result.email);\n        } else {\n          setStatus(\"error\");\n        }\n      })\n      .catch(() => setStatus(\"error\"));\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [token]);\n\n  // Auto-redirect countdown after successful verification\n  useEffect(() => {\n    if (status !== \"success\") return;\n\n    const timer = setInterval(() => {\n      setCountdown((prev) => {\n        if (prev <= 1) {\n          clearInterval(timer);\n          navigateToLogin(verifiedEmail);\n          return 0;\n        }\n        return prev - 1;\n      });\n    }, 1000);\n\n    return () => clearInterval(timer);\n  }, [status, verifiedEmail]);\n\n  const handleResend = async () => {\n    const resendEmail = urlEmail || user?.email;\n    if (!resendEmail) {\n      console.error(\"No email available for resend\");\n      return;\n    }\n    setIsResending(true);\n    try {\n      await resendVerification(resendEmail);\n      setResendSuccess(true);\n    } catch (err) {\n      console.error(\"Failed to resend verification:\", err);\n    } finally {\n      setIsResending(false);\n    }\n  };\n\n  const handleContinueToLogin = useCallback(() => {\n    navigateToLogin(verifiedEmail);\n  }, [verifiedEmail]);\n\n  const handleBackToLogin = useCallback(() => {\n    navigateToLogin();\n  }, []);\n\n  if (status === \"verifying\") {\n    return (\n      <AuthLayout\n        title={tr(\"auth.emailVerify.verifyingTitle\", \"Verifying your email\")}\n        subtitle={tr(\n          \"auth.emailVerify.verifyingSubtitle\",\n          \"Please wait while we confirm your email address\",\n        )}\n      >\n        {/* Loading Spinner */}\n        <div className=\"flex flex-col items-center justify-center py-12\">\n          <div className=\"w-16 h-16 rounded-full bg-[var(--color-bg-accent)] flex items-center justify-center mb-6\">\n            <SpinnerIcon className=\"w-8 h-8 text-[var(--color-text-link)] animate-spin\" />\n          </div>\n          <p className=\"text-[var(--color-text-secondary)]\">\n            {tr(\"auth.emailVerify.moment\", \"This will only take a moment...\")}\n          </p>\n        </div>\n      </AuthLayout>\n    );\n  }\n\n  if (status === \"success\") {\n    return (\n      <AuthLayout\n        title={tr(\"auth.emailVerify.verifiedTitle\", \"Email verified!\")}\n        subtitle={tr(\n          \"auth.emailVerify.verifiedSubtitle\",\n          \"Your email address has been confirmed\",\n        )}\n      >\n        {/* Success Icon */}\n        <div className=\"flex flex-col items-center justify-center py-6\">\n          <div className=\"w-20 h-20 rounded-full bg-[var(--color-status-success-bg-subtle)] flex items-center justify-center mb-6\">\n            <svg\n              className=\"w-10 h-10 text-[var(--color-status-success-text)]\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M5 13l4 4L19 7\"\n              />\n            </svg>\n          </div>\n\n          <p className=\"text-center text-[var(--color-text-secondary)] mb-6\">\n            {tr(\n              \"auth.emailVerify.successMessage\",\n              \"Your email has been successfully verified. You can now sign in to access all features.\",\n            )}\n          </p>\n\n          <p className=\"text-center text-sm text-[var(--color-text-tertiary)] mb-6\">\n            {tr(\"auth.emailVerify.redirecting\", \"Redirecting to sign in in\")}{\" \"}\n            <span className=\"font-semibold text-[var(--color-text-primary)]\">\n              {countdown}\n            </span>{\" \"}\n            {tr(\"auth.emailVerify.seconds\", \"seconds...\")}\n          </p>\n\n          <button\n            onClick={handleContinueToLogin}\n            className=\"auth-primary-button w-full px-4 py-3 font-semibold\"\n          >\n            {tr(\"auth.emailVerify.continueSignIn\", \"Continue to sign in now\")}\n          </button>\n        </div>\n      </AuthLayout>\n    );\n  }\n\n  // Error state\n  return (\n    <AuthLayout\n      title={tr(\"auth.emailVerify.failedTitle\", \"Verification failed\")}\n      subtitle={tr(\n        \"auth.emailVerify.failedSubtitle\",\n        \"We couldn't verify your email address\",\n      )}\n    >\n      <div className=\"flex flex-col items-center justify-center py-6\">\n        {/* Error Icon */}\n        <div className=\"w-20 h-20 rounded-full bg-[var(--color-status-error-bg-subtle)] flex items-center justify-center mb-6\">\n          <svg\n            className=\"w-10 h-10 text-[var(--color-status-error-text)]\"\n            fill=\"none\"\n            viewBox=\"0 0 24 24\"\n            stroke=\"currentColor\"\n          >\n            <path\n              strokeLinecap=\"round\"\n              strokeLinejoin=\"round\"\n              strokeWidth={2}\n              d=\"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z\"\n            />\n          </svg>\n        </div>\n\n        <p className=\"text-center text-[var(--color-text-secondary)] mb-8\">\n          {tr(\n            \"auth.emailVerify.invalidLink\",\n            \"The verification link is invalid or has expired. Please request a new verification email.\",\n          )}\n        </p>\n\n        {resendSuccess ? (\n          <div className=\"w-full p-4 rounded-xl bg-[var(--color-status-success-bg-subtle)] border border-[var(--color-status-success-border)] text-center mb-4\">\n            <p className=\"text-sm text-[var(--color-status-success-text)]\">\n              {tr(\n                \"auth.emailVerify.emailSent\",\n                \"Verification email sent! Please check your inbox.\",\n              )}\n            </p>\n          </div>\n        ) : (\n          <button\n            onClick={handleResend}\n            disabled={isResending}\n            className=\"auth-primary-button mb-4 flex w-full items-center justify-center gap-2 px-4 py-3 font-semibold\"\n          >\n            {isResending ? (\n              <>\n                <SpinnerIcon className=\"w-5 h-5 animate-spin\" />\n                <span>Sending...</span>\n              </>\n            ) : (\n              tr(\"auth.emailVerify.resend\", \"Resend verification email\")\n            )}\n          </button>\n        )}\n\n        <button\n          onClick={handleBackToLogin}\n          className=\"w-full py-3 px-4 rounded-xl border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] text-[var(--color-text-primary)] font-medium hover:bg-[var(--color-bg-sunken)] transition-all\"\n        >\n          {tr(\"auth.emailVerify.backToSignIn\", \"Back to sign in\")}\n        </button>\n      </div>\n    </AuthLayout>\n  );\n}\n"],"mappings":";;;;;;;;;;AAQA,IAAM,IAAiB;AAMvB,SAAS,EAAgB,GAAgB;CACvC,IAAM,IAAU,eACV,IAAM,IAAQ,GAAG,EAAQ,SAAS,mBAAmB,EAAM,KAAK;AACtE,QAAO,SAAS,OAAO;;AAMzB,SAAgB,IAAkB;CAChC,IAAM,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAGnC,CAAC,KAAgB,GAAiB,EAClC,IAAQ,EAAa,IAAI,QAAQ,EACjC,IAAW,EAAa,IAAI,QAAQ,EACpC,EAAE,gBAAa,0BAAuB,GAAmB,EACzD,IAAO,GAAc,MAAU,EAAM,KAAK,EAC1C,CAAC,GAAQ,KAAa,EAC1B,YACD,EACK,CAAC,GAAe,KAAoB,EACxC,KAAY,KAAA,EACb,EACK,CAAC,GAAa,KAAkB,EAAS,GAAM,EAC/C,CAAC,GAAe,KAAoB,EAAS,GAAM,EACnD,CAAC,GAAW,KAAgB,EAAS,EAAe,EAMpD,IAA2B,EAAO,GAAM;AAiC9C,CA/BA,QAAgB;AACd,MAAI,CAAC,KAAS,EAAyB,QAAS;EAEhD,IAAM,IAAa,6BAA6B;AAE9C,eAAO,SAAW,OAClB,OAAO,eAAe,QAAQ,EAAW,GAI3C;KAAyB,UAAU;AACnC,OAAI;AACF,WAAO,eAAe,QAAQ,GAAY,IAAI;WACxC;AAIR,KAAY,EAAM,CACf,MAAM,MAAW;AAChB,IAAI,EAAO,WACT,EAAU,UAAU,EAChB,EAAO,SAAO,EAAiB,EAAO,MAAM,IAEhD,EAAU,QAAQ;KAEpB,CACD,YAAY,EAAU,QAAQ,CAAC;;IAEjC,CAAC,EAAM,CAAC,EAGX,QAAgB;AACd,MAAI,MAAW,UAAW;EAE1B,IAAM,IAAQ,kBAAkB;AAC9B,MAAc,MACR,KAAQ,KACV,cAAc,EAAM,EACpB,EAAgB,EAAc,EACvB,KAEF,IAAO,EACd;KACD,IAAK;AAER,eAAa,cAAc,EAAM;IAChC,CAAC,GAAQ,EAAc,CAAC;CAE3B,IAAM,IAAe,YAAY;EAC/B,IAAM,IAAc,KAAY,GAAM;AACtC,MAAI,CAAC,GAAa;AAChB,WAAQ,MAAM,gCAAgC;AAC9C;;AAEF,IAAe,GAAK;AACpB,MAAI;AAEF,GADA,MAAM,EAAmB,EAAY,EACrC,EAAiB,GAAK;WACf,GAAK;AACZ,WAAQ,MAAM,kCAAkC,EAAI;YAC5C;AACR,KAAe,GAAM;;IAInB,IAAwB,QAAkB;AAC9C,IAAgB,EAAc;IAC7B,CAAC,EAAc,CAAC,EAEb,IAAoB,QAAkB;AAC1C,KAAiB;IAChB,EAAE,CAAC;AA8EN,QA5EI,MAAW,cAEX,kBAAC,GAAD;EACE,OAAO,EAAG,mCAAmC,uBAAuB;EACpE,UAAU,EACR,sCACA,kDACD;YAGD,kBAAC,OAAD;GAAK,WAAU;aAAf,CACE,kBAAC,OAAD;IAAK,WAAU;cACb,kBAAC,GAAD,EAAa,WAAU,sDAAuD,CAAA;IAC1E,CAAA,EACN,kBAAC,KAAD;IAAG,WAAU;cACV,EAAG,2BAA2B,kCAAkC;IAC/D,CAAA,CACA;;EACK,CAAA,GAIb,MAAW,YAEX,kBAAC,GAAD;EACE,OAAO,EAAG,kCAAkC,kBAAkB;EAC9D,UAAU,EACR,qCACA,wCACD;YAGD,kBAAC,OAAD;GAAK,WAAU;aAAf;IACE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD;MACE,WAAU;MACV,MAAK;MACL,SAAQ;MACR,QAAO;gBAEP,kBAAC,QAAD;OACE,eAAc;OACd,gBAAe;OACf,aAAa;OACb,GAAE;OACF,CAAA;MACE,CAAA;KACF,CAAA;IAEN,kBAAC,KAAD;KAAG,WAAU;eACV,EACC,mCACA,yFACD;KACC,CAAA;IAEJ,kBAAC,KAAD;KAAG,WAAU;eAAb;MACG,EAAG,gCAAgC,4BAA4B;MAAE;MAClE,kBAAC,QAAD;OAAM,WAAU;iBACb;OACI,CAAA;MAAC;MACP,EAAG,4BAA4B,aAAa;MAC3C;;IAEJ,kBAAC,UAAD;KACE,SAAS;KACT,WAAU;eAET,EAAG,mCAAmC,0BAA0B;KAC1D,CAAA;IACL;;EACK,CAAA,GAMf,kBAAC,GAAD;EACE,OAAO,EAAG,gCAAgC,sBAAsB;EAChE,UAAU,EACR,mCACA,wCACD;YAED,kBAAC,OAAD;GAAK,WAAU;aAAf;IAEE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD;MACE,WAAU;MACV,MAAK;MACL,SAAQ;MACR,QAAO;gBAEP,kBAAC,QAAD;OACE,eAAc;OACd,gBAAe;OACf,aAAa;OACb,GAAE;OACF,CAAA;MACE,CAAA;KACF,CAAA;IAEN,kBAAC,KAAD;KAAG,WAAU;eACV,EACC,gCACA,4FACD;KACC,CAAA;IAEH,IACC,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,KAAD;MAAG,WAAU;gBACV,EACC,8BACA,oDACD;MACC,CAAA;KACA,CAAA,GAEN,kBAAC,UAAD;KACE,SAAS;KACT,UAAU;KACV,WAAU;eAET,IACC,kBAAA,GAAA,EAAA,UAAA,CACE,kBAAC,GAAD,EAAa,WAAU,wBAAyB,CAAA,EAChD,kBAAC,QAAD,EAAA,UAAM,cAAiB,CAAA,CACtB,EAAA,CAAA,GAEH,EAAG,2BAA2B,4BAA4B;KAErD,CAAA;IAGX,kBAAC,UAAD;KACE,SAAS;KACT,WAAU;eAET,EAAG,iCAAiC,kBAAkB;KAChD,CAAA;IACL;;EACK,CAAA"}

package/dist/auth/pages/LoginPage.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Login page with professional design
+ * Provides email/password login and social OAuth options
+ */
+export declare function LoginPage(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=LoginPage.d.ts.map

package/dist/auth/pages/LoginPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/LoginPage.tsx"],"names":[],"mappings":"AA0DA;;;GAGG;AACH,wBAAgB,SAAS,4CAsgCxB"}