@burdenoff/microfe-auth 2026.523.1 → 2026.525.1

package/dist/auth/hooks/useSsoOperations.d.ts

@@ -1,65 +0,0 @@
-import { AuthResult, SSOConfig } from '../types';
-
-interface GetSSOConfigResponse {
-    getSSOConfig: SSOConfig | null;
-}
-interface GetSSOConfigVariables {
-    tenantId: string;
-}
-export interface SSOConfigInput {
-    entityId: string;
-    ssoUrl: string;
-    sloUrl?: string;
-    certificate: string;
-    enabled?: boolean;
-    metadata?: Record<string, unknown>;
-}
-export interface SAMLRequestResult {
-    requestId: string;
-    ssoUrl: string;
-    samlRequest: string;
-}
-export interface ExternalOIDCAuthUrlResult {
-    authUrl: string;
-    state: string;
-    nonce: string;
-    codeVerifier: string;
-    relayState?: string;
-}
-export interface OIDCConfig {
-    issuer: string;
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    userinfoEndpoint: string;
-    jwksUri: string;
-    registrationEndpoint?: string;
-    scopesSupported: string[];
-    responseTypesSupported: string[];
-    grantTypesSupported: string[];
-}
-/**
- * Hook for SSO/SAML operations
- */
-export declare function useSsoOperations(tenantId?: string): {
-    initiateSsoLogin: (targetTenantId: string, relayState?: string) => Promise<void>;
-    handleSamlCallback: (samlResponse: string, relayState?: string) => Promise<AuthResult>;
-    saveSsoConfig: (configOrTenantId: SSOConfigInput | string, config?: SSOConfigInput) => Promise<SSOConfig>;
-    deleteSsoConfig: (targetTenantId?: string) => Promise<boolean>;
-    getOidcAuthUrl: (clientId: string, redirectUri: string, scopes?: string[]) => Promise<string>;
-    exchangeOidcCode: (code: string, clientId: string, redirectUri: string) => Promise<AuthResult>;
-    validateOidcState: (state: string) => boolean;
-    initiateExternalOidcLogin: (targetTenantId: string, redirectPath?: string) => Promise<void>;
-    handleExternalOidcCallback: (code: string, state: string) => Promise<AuthResult>;
-    isExternalOidcCallback: () => boolean;
-    ssoConfig: SSOConfig | undefined;
-    oidcConfig: OIDCConfig | undefined;
-    isLoading: boolean;
-    isGeneratingRequest: boolean;
-    isAuthenticating: boolean;
-    isSaving: boolean;
-    isDeleting: boolean;
-    isGeneratingOidcUrl: boolean;
-    refetchConfig: (variables?: Partial<GetSSOConfigVariables> | undefined) => Promise<import("@apollo/client").ApolloClient.QueryResult<GetSSOConfigResponse>>;
-};
-export {};
-//# sourceMappingURL=useSsoOperations.d.ts.map

package/dist/auth/hooks/useSsoOperations.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useSsoOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useSsoOperations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAQ,MAAM,UAAU,CAAC;AAwB5D,UAAU,oBAAoB;IAC5B,YAAY,EAAE,SAAS,GAAG,IAAI,CAAC;CAChC;AAED,UAAU,qBAAqB;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkFD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAiCD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM;uCAkD9B,MAAM,eACT,MAAM,KAClB,OAAO,CAAC,IAAI,CAAC;uCA0CA,MAAM,eACP,MAAM,KAClB,OAAO,CAAC,UAAU,CAAC;sCAwNF,cAAc,GAAG,MAAM,WAChC,cAAc,KACtB,OAAO,CAAC,SAAS,CAAC;uCAyB2B,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;+BAsB7D,MAAM,eACH,MAAM,WACX,MAAM,EAAE,KACf,OAAO,CAAC,MAAM,CAAC;6BAgCV,MAAM,YACF,MAAM,eACH,MAAM,KAClB,OAAO,CAAC,UAAU,CAAC;+BAoGY,MAAM,KAAG,OAAO;gDAhWhC,MAAM,iBACP,MAAM,KACpB,OAAO,CAAC,IAAI,CAAC;uCA8CR,MAAM,SACL,MAAM,KACZ,OAAO,CAAC,UAAU,CAAC;kCAsGa,OAAO;;;;;;;;;;EAqP3C"}

package/dist/auth/hooks/useTokenRefresh.d.ts

@@ -1,56 +0,0 @@
-/**
- * Automatic workspace token refresh hook
- *
- * Monitors the workspace token and automatically refreshes it
- * 5 minutes before expiry. This ensures uninterrupted access to
- * workspace resources.
- *
- * Usage:
- * ```tsx
- * // In your root App component
- * function App() {
- *   useTokenRefresh({
- *     workspaceAuthServiceUrl: 'http://localhost:3730/graphql',
- *     refreshBeforeExpiry: 5 * 60 * 1000, // 5 minutes
- *   });
- *
- *   return <AppContent />;
- * }
- * ```
- */
-export interface UseTokenRefreshOptions {
-    /**
-     * URL of workspace auth service GraphQL endpoint
-     * Default: http://localhost:3730/graphql
-     */
-    workspaceAuthServiceUrl?: string;
-    /**
-     * Time before expiry to refresh token (in milliseconds)
-     * Default: 5 minutes (300000ms)
-     */
-    refreshBeforeExpiry?: number;
-    /**
-     * Enable/disable auto-refresh
-     * Default: true
-     */
-    enabled?: boolean;
-    /**
-     * Callback when token refresh succeeds
-     */
-    onRefreshSuccess?: (token: string) => void;
-    /**
-     * Callback when token refresh fails
-     */
-    onRefreshError?: (error: Error) => void;
-}
-export declare function useTokenRefresh(options?: UseTokenRefreshOptions): {
-    /**
-     * Manually trigger a token refresh
-     */
-    manualRefresh: () => Promise<string>;
-    /**
-     * Check if auto-refresh is currently scheduled
-     */
-    isScheduled: boolean;
-};
-//# sourceMappingURL=useTokenRefresh.d.ts.map

package/dist/auth/hooks/useTokenRefresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useTokenRefresh.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useTokenRefresh.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAE3C;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACzC;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B;IAyGhE;;OAEG;;IAGH;;OAEG;;EAGN"}

package/dist/auth/hooks/useUserOperations.d.ts

@@ -1,33 +0,0 @@
-import { User, UserConnection, UserFilterInput, PaginationInput, DeleteUserResult } from '../types';
-
-interface UpdateUserProfileInput {
-    avatar?: string;
-    username?: string;
-    firstName?: string;
-    lastName?: string;
-    name?: string;
-    phoneNumber?: string;
-    defaultWorkspaceId?: string;
-    language?: string;
-    timezone?: string;
-}
-interface AdminUpdateUserInput extends UpdateUserProfileInput {
-    role?: string;
-    status?: string;
-    emailVerified?: boolean;
-}
-/**
- * Hook for user management operations
- */
-export declare function useUserOperations(): {
-    getUser: (id: string) => Promise<User | null>;
-    listUsers: (filter?: UserFilterInput, pagination?: PaginationInput) => Promise<UserConnection>;
-    updateCurrentUserProfile: (input: UpdateUserProfileInput) => Promise<User>;
-    updateUser: (id: string, input: AdminUpdateUserInput) => Promise<User>;
-    deleteUser: (id: string) => Promise<DeleteUserResult>;
-    hardDeleteUser: (id: string) => Promise<DeleteUserResult>;
-    currentUser: User | null;
-    isLoading: boolean;
-};
-export {};
-//# sourceMappingURL=useUserOperations.d.ts.map

package/dist/auth/hooks/useUserOperations.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useUserOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useUserOperations.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,IAAI,EACJ,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAC;AA2DlB,UAAU,sBAAsB;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,oBAAqB,SAAQ,sBAAsB;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,wBAAgB,iBAAiB;kBAuClB,MAAM,KAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;yBAsB7B,eAAe,eACX,eAAe,KAC3B,OAAO,CAAC,cAAc,CAAC;sCAyBZ,sBAAsB,KAAG,OAAO,CAAC,IAAI,CAAC;qBAgCzC,MAAM,SAAS,oBAAoB,KAAG,OAAO,CAAC,IAAI,CAAC;qBA0BnD,MAAM,KAAG,OAAO,CAAC,gBAAgB,CAAC;yBA0BlC,MAAM,KAAG,OAAO,CAAC,gBAAgB,CAAC;;;EAiChD"}

package/dist/auth/hooks/useWorkspaceOperations.d.ts

@@ -1,35 +0,0 @@
-import { useMutation } from '@apollo/client/react';
-import { WorkspaceTokenResponse, SecretRotationResponse, RotateWorkspaceSecretInput } from '../types';
-
-/**
- * Hook for workspace token and secret operations
- */
-export declare function useWorkspaceOperations(): {
-    generateWorkspaceToken: (_workspaceId: string) => Promise<WorkspaceTokenResponse>;
-    switchWorkspace: (workspaceId: string) => Promise<WorkspaceTokenResponse>;
-    createWorkspaceSecret: (_workspaceId: string) => Promise<boolean>;
-    rotateWorkspaceSecret: (_input: RotateWorkspaceSecretInput) => Promise<SecretRotationResponse>;
-    revokeWorkspaceSecret: (_workspaceId: string) => Promise<boolean>;
-    revokeWorkspaceToken: (_token: string, _reason?: string) => Promise<boolean>;
-    revokeAllMyWorkspaceTokens: (_reason?: string) => Promise<number>;
-    clearWorkspace: () => void;
-    createWorkspaceMutation: useMutation.MutationFunction<unknown, {
-        [x: string]: any;
-    }, import('@apollo/client').ApolloCache>;
-    updateWorkspaceMutation: useMutation.MutationFunction<unknown, {
-        [x: string]: any;
-    }, import('@apollo/client').ApolloCache>;
-    addWorkspaceMemberMutation: useMutation.MutationFunction<unknown, {
-        [x: string]: any;
-    }, import('@apollo/client').ApolloCache>;
-    updateWorkspaceMemberMutation: useMutation.MutationFunction<unknown, {
-        [x: string]: any;
-    }, import('@apollo/client').ApolloCache>;
-    removeWorkspaceMemberMutation: useMutation.MutationFunction<unknown, {
-        [x: string]: any;
-    }, import('@apollo/client').ApolloCache>;
-    currentWorkspaceId: string | null;
-    workspaceToken: string | null;
-    isLoading: boolean;
-};
-//# sourceMappingURL=useWorkspaceOperations.d.ts.map

package/dist/auth/hooks/useWorkspaceOperations.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useWorkspaceOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useWorkspaceOperations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AASnD,OAAO,KAAK,EACV,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,UAAU,CAAC;AAalB;;GAEG;AACH,wBAAgB,sBAAsB;2CAqBpB,MAAM,KACnB,OAAO,CAAC,sBAAsB,CAAC;mCAcnB,MAAM,KAClB,OAAO,CAAC,sBAAsB,CAAC;0CAalB,MAAM,KACnB,OAAO,CAAC,OAAO,CAAC;oCAYT,0BAA0B,KACjC,OAAO,CAAC,sBAAsB,CAAC;0CAclB,MAAM,KACnB,OAAO,CAAC,OAAO,CAAC;mCAYT,MAAM,YACJ,MAAM,KACf,OAAO,CAAC,OAAO,CAAC;2CAYP,MAAM,KACf,OAAO,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;EAmCnB"}

package/dist/auth/hooks/useWorkspaceToken.d.ts

@@ -1,56 +0,0 @@
-/**
- * Workspace token management hook
- *
- * Provides functions to issue, refresh, and verify workspace tokens.
- * Automatically updates the auth store with new tokens.
- *
- * API Flow:
- * - Calls workspace gateway (https://gw-wspace.local.burdenoff.com/workspaces/graphql)
- * - Gateway federates wspace-auth-svc which handles token operations
- * - Auth token (from global-auth-svc) goes in Authorization header
- *
- * Usage:
- * ```tsx
- * const { issueToken, refreshToken, verifyToken, isLoading, error } = useWorkspaceToken({
- *   workspaceGatewayUrl: 'https://gw-wspace.local.burdenoff.com/workspaces/graphql'
- * });
- *
- * // After login and organization/workspace selection
- * await issueToken(organizationId, workspaceId);
- *
- * // Refresh token before expiry (uses stored org/workspace IDs)
- * await refreshToken();
- * ```
- */
-export interface UseWorkspaceTokenOptions {
-    /**
-     * URL of workspace gateway GraphQL endpoint
-     * Default: https://gw-wspace.local.burdenoff.com/workspaces/graphql
-     *
-     * Note: This should point to the workspace gateway, NOT directly to wspace-auth-svc.
-     * The gateway federates wspace-auth-svc and handles routing.
-     */
-    workspaceGatewayUrl?: string;
-}
-export interface WorkspaceTokenPayload {
-    sub: string;
-    workspaceId: string;
-    tenantId?: string;
-    email?: string;
-    username?: string;
-    role?: string;
-    scopes: string[];
-    iat: number;
-    exp: number;
-}
-export declare function useWorkspaceToken(options?: UseWorkspaceTokenOptions): {
-    issueToken: (organizationId: string, workspaceId?: string, projectId?: string, scopes?: string[]) => Promise<string>;
-    refreshToken: () => Promise<string>;
-    verifyToken: (token?: string) => Promise<WorkspaceTokenPayload>;
-    decodeToken: (token: string) => WorkspaceTokenPayload;
-    isTokenExpired: (token?: string) => boolean;
-    getTimeUntilExpiry: (token?: string) => number;
-    isLoading: boolean;
-    error: string | null;
-};
-//# sourceMappingURL=useWorkspaceToken.d.ts.map

package/dist/auth/hooks/useWorkspaceToken.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useWorkspaceToken.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useWorkspaceToken.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B;iCAkBlD,MAAM,gBACR,MAAM,cACR,MAAM,WACT,MAAM,EAAE,KAChB,OAAO,CAAC,MAAM,CAAC;wBAoKuB,OAAO,CAAC,MAAM,CAAC;0BA7EzC,MAAM,KAAG,OAAO,CAAC,qBAAqB,CAAC;yBAyFhB,MAAM,KAAG,qBAAqB;6BAoB3D,MAAM,KAAG,OAAO;iCAsBhB,MAAM,KAAG,MAAM;;;EA6B3B"}

package/dist/auth/index.d.ts

@@ -1,63 +0,0 @@
-/**
- * Auth Microfrontend
- *
- * Provides authentication, security settings, and account management interface
- * for the Burdenoff multi-tenant platform.
- *
- * Features:
- * - User authentication (signIn, signUp, signOut, refreshToken)
- * - MFA (TOTP, SMS, Email, WebAuthn)
- * - OAuth and SAML SSO
- * - Magic Link authentication
- * - Workspace token management
- * - User management (admin)
- *
- * Note: API Key management, App management, and App-user delegations
- * have been consolidated into microfe-devportal.
- *
- * @example
- * ```tsx
- * import { AuthRoot, type AuthRootProps } from '@burdenoff/microfe-auth';
- *
- * function App() {
- *   const props: AuthRootProps = {
- *     basePath: '/auth',
- *     navigate: (path) => router.push(path),
- *     apiGatewayUrl: 'https://gw-global.local.burdenoff.com',
- *     authToken: 'token',
- *     onAuthSuccess: (user) => shellLogin(user),
- *     onLogout: () => shellLogout(),
- *   };
- *
- *   return <AuthRoot {...props} />;
- * }
- * ```
- */
-export { AuthRoot } from './AuthRoot';
-export type { AuthRootProps, User, UserRole, UserStatus, UserConnection, UserFilterInput, PaginationInput, } from './types';
-export type { AuthType, AuthMethod, AuthMethodConfig, AuthStrategyHealth, AuthPayload, AuthResult, SignInInput, SignUpInput, ChangePasswordInput, } from './types';
-export type { MFAMethod, MFASetupResult, MFAVerifyInput } from './types';
-export type { OAuthInput, SAMLInput, SAMLRequestResult } from './types';
-export type { AuthContext, MagicLinkSendResult } from './types';
-export type { Organization, OrganizationConnection } from './types';
-export type { Project, ProjectStatus, ProjectConnection } from './types';
-export type { Workspace, WorkspaceSecretStatus, WorkspaceSecretInfo, WorkspaceTokenResponse, GenerateWorkspaceTokenInput, RotateWorkspaceSecretInput, SecretRotationResponse, } from './types';
-export type { TokenValidationError, TokenValidationResponse, ValidateTokensInput, } from './types';
-export type { EmailVerificationResult, ResendVerificationResult, PasswordResetRequestResult, DeleteUserResult, } from './types';
-export type { Session, MfaDevice, OAuthAccount, SecurityAudit, OAuthProvider, SecurityEventType, TrustedDevice, SSOConfig, PasswordStrength, } from './types';
-export { useAuth } from './providers/AuthProvider';
-export { useAuthOperations, useMfaOperations, useSessionOperations, usePasswordOperations, useAuthStore, } from './hooks';
-export { useWorkspaceOperations } from './hooks';
-export { useUserOperations } from './hooks';
-export { useWorkspaceToken } from './hooks/useWorkspaceToken';
-export { useTokenRefresh } from './hooks/useTokenRefresh';
-export { useContextSwitcherData, useWorkspaceSyncEffect, useProjectSyncEffect, } from './hooks';
-export { useMyWorkspaces } from './hooks';
-export type { UseContextSwitcherDataOptions } from './hooks';
-export { WorkspaceSelector } from './components/workspace/WorkspaceSelector';
-export type { WorkspaceSelectorProps } from './components/workspace/WorkspaceSelector';
-export { UserProfileMenu } from './components/profile/UserProfileMenu';
-export type { UserProfileMenuProps } from './components/profile/UserProfileMenu';
-export { SSORelayPage } from './pages/SSORelayPage';
-export { SSORelayCallbackPage } from './pages/SSORelayCallbackPage';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC,YAAY,EACV,aAAa,EACb,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAGjB,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAGxE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAGhE,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAGpE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAGzE,YAAY,EACV,SAAS,EACT,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,OAAO,EACP,SAAS,EACT,YAAY,EACZ,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,SAAS,EACT,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAGnD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,GACb,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,YAAY,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAGvF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAGjF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/auth/pages/AuditLogPage.d.ts

@@ -1,12 +0,0 @@
-/**
- * Security audit log page with pagination and export
- *
- * Fragment: AuditLogEntry_AuthAuditLog (graphql/operations/global/fragments/AuditLogEntry.fragment.graphql)
- * Query: AuthAuditLogs (graphql/operations/global/queries/auditLog.graphql)
- *
- * TODO: When authAuditLogs backend migrates to AuthAuditLogConnection type,
- *   update this query to use: authAuditLogs { auditLogs: [...], totalCount, hasMore }
- *   and remove the client-side hasMore approximation below.
- */
-export declare function AuditLogPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=AuditLogPage.d.ts.map

package/dist/auth/pages/AuditLogPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuditLogPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/AuditLogPage.tsx"],"names":[],"mappings":"AAcA;;;;;;;;;GASG;AACH,wBAAgB,YAAY,4CA4Q3B"}

package/dist/auth/pages/EmailVerifyPage.d.ts

@@ -1,5 +0,0 @@
-/**
- * Email verification page with professional design
- */
-export declare function EmailVerifyPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=EmailVerifyPage.d.ts.map

package/dist/auth/pages/EmailVerifyPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"EmailVerifyPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/EmailVerifyPage.tsx"],"names":[],"mappings":"AAoBA;;GAEG;AACH,wBAAgB,eAAe,4CAqP9B"}

package/dist/auth/pages/LoginPage.d.ts

@@ -1,6 +0,0 @@
-/**
- * Login page with professional design
- * Provides email/password login and social OAuth options
- */
-export declare function LoginPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=LoginPage.d.ts.map

package/dist/auth/pages/LoginPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"LoginPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/LoginPage.tsx"],"names":[],"mappings":"AA4DA;;;GAGG;AACH,wBAAgB,SAAS,4CA4kCxB"}

package/dist/auth/pages/MagicLinkPage.d.ts

@@ -1,6 +0,0 @@
-/**
- * Magic Link authentication page
- * Supports both sending magic links and verifying them via token
- */
-export declare function MagicLinkPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=MagicLinkPage.d.ts.map

package/dist/auth/pages/MagicLinkPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"MagicLinkPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/MagicLinkPage.tsx"],"names":[],"mappings":"AAuDA;;;GAGG;AACH,wBAAgB,aAAa,4CAuT5B"}

package/dist/auth/pages/MfaSetupPage.d.ts

@@ -1,5 +0,0 @@
-/**
- * MFA setup and management page with professional UI
- */
-export declare function MfaSetupPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=MfaSetupPage.d.ts.map

package/dist/auth/pages/MfaSetupPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"MfaSetupPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/MfaSetupPage.tsx"],"names":[],"mappings":"AAcA;;GAEG;AACH,wBAAgB,YAAY,4CAkhB3B"}

package/dist/auth/pages/MfaVerifyPage.d.ts

@@ -1,7 +0,0 @@
-/**
- * MFA verification page with professional design
- * Shown when user needs to verify MFA code during login
- * Handles both regular login MFA and SSO MFA flows
- */
-export declare function MfaVerifyPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=MfaVerifyPage.d.ts.map

package/dist/auth/pages/MfaVerifyPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"MfaVerifyPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/MfaVerifyPage.tsx"],"names":[],"mappings":"AAcA;;;;GAIG;AACH,wBAAgB,aAAa,4CAgT5B"}

package/dist/auth/pages/OAuthCallbackPage.d.ts

@@ -1,7 +0,0 @@
-/**
- * OAuth Callback Page
- * Handles the redirect from OAuth providers (Google, GitHub, Microsoft)
- * Extracts the authorization code and completes the authentication flow
- */
-export declare function OAuthCallbackPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=OAuthCallbackPage.d.ts.map

package/dist/auth/pages/OAuthCallbackPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"OAuthCallbackPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/OAuthCallbackPage.tsx"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,wBAAgB,iBAAiB,4CAsLhC"}

package/dist/auth/pages/PasswordResetPage.d.ts

@@ -1,6 +0,0 @@
-/**
- * Password reset page with professional design
- * Handles both requesting reset and completing reset with token
- */
-export declare function PasswordResetPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=PasswordResetPage.d.ts.map

package/dist/auth/pages/PasswordResetPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PasswordResetPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/PasswordResetPage.tsx"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,wBAAgB,iBAAiB,4CAmiBhC"}

package/dist/auth/pages/ReactivatePage.d.ts

@@ -1,6 +0,0 @@
-/**
- * Account Reactivation Page
- * Allows users to reactivate their deactivated accounts
- */
-export declare function ReactivatePage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=ReactivatePage.d.ts.map

package/dist/auth/pages/ReactivatePage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ReactivatePage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/ReactivatePage.tsx"],"names":[],"mappings":"AAYA;;;GAGG;AACH,wBAAgB,cAAc,4CAyR7B"}

package/dist/auth/pages/RegisterPage.d.ts

@@ -1,5 +0,0 @@
-/**
- * Registration page with professional design
- */
-export declare function RegisterPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=RegisterPage.d.ts.map

package/dist/auth/pages/RegisterPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RegisterPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/RegisterPage.tsx"],"names":[],"mappings":"AAyBA;;GAEG;AACH,wBAAgB,YAAY,4CAwoB3B"}

package/dist/auth/pages/SSOClearPage.d.ts

@@ -1,22 +0,0 @@
-/**
- * SSOClearPage — Cross-Domain Logout at the Central Bridge Host
- *
- * Companion to SSODepositPage. When a user signs out on a product origin,
- * the product app cleared its own localStorage / cookies but the bridge
- * host (alphaapp/app.burdenoff.com) still held the deposited session in
- * first-party (unpartitioned) localStorage. A later visit to any product
- * would then bridge-host-relay that stale session back, effectively
- * undoing the logout.
- *
- * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect
- * here via a top-level navigation:
- *
- *   product.com (logout)
- *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>
- *         — wipes bridge-host localStorage + bf-sso cookie
- *     → <returnTo>
- *
- * URL: /auth/sso-clear
- */
-export declare function SSOClearPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=SSOClearPage.d.ts.map

package/dist/auth/pages/SSOClearPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SSOClearPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/SSOClearPage.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA0EH,wBAAgB,YAAY,4CA0B3B"}

package/dist/auth/pages/SSODepositPage.d.ts

@@ -1,24 +0,0 @@
-/**
- * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host
- *
- * Loaded as a top-level navigation (NOT an iframe) on the bridge host
- * (alphaapp/app.burdenoff.com) right after a user signs in on any other
- * product origin. It receives the freshly-issued tokens in the URL fragment
- * (`#sso=<base64>` — fragments are never sent to servers) and stores them
- * in this origin's first-party (unpartitioned) localStorage so that:
- *
- *   1. A later top-level visit to the bridge host renders authenticated.
- *   2. Other product origins can discover the session via
- *      `/auth/sso-relay?returnTo=...` against this host.
- *
- * Flow:
- *   product.com/auth/login    → user signs in
- *   product.com               → POST-success redirect to:
- *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>
- *                             → writes tokens here, sets bf-sso cookie
- *   <returnTo>                → user lands back at intended dashboard
- *
- * URL: /auth/sso-deposit
- */
-export declare function SSODepositPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=SSODepositPage.d.ts.map

package/dist/auth/pages/SSODepositPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SSODepositPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/SSODepositPage.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA0EH,wBAAgB,cAAc,4CA+D7B"}

package/dist/auth/pages/SSORelayCallbackPage.d.ts

@@ -1,8 +0,0 @@
-/**
- * SSORelayCallbackPage — Receives tokens from the SSO relay and stores them locally.
- *
- * Tokens arrive in the URL fragment (#sso=<base64>) which is never sent to servers.
- * After storing in localStorage, redirects to the returnTo path.
- */
-export declare function SSORelayCallbackPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=SSORelayCallbackPage.d.ts.map

package/dist/auth/pages/SSORelayCallbackPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SSORelayCallbackPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/SSORelayCallbackPage.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoBH,wBAAgB,oBAAoB,4CA0DnC"}

package/dist/auth/pages/SSORelayPage.d.ts

@@ -1,18 +0,0 @@
-/**
- * SSORelayPage — Cross-domain SSO token relay.
- *
- * This page is loaded on the ORIGIN where the user is logged in.
- * It reads tokens from localStorage and redirects to the TARGET domain's
- * /auth/sso-callback with the tokens in a URL fragment (not query param
- * for security — fragments are not sent to servers).
- *
- * Flow:
- * 1. User visits productA.com → not logged in → detects SSO cookie
- * 2. Redirect to productB.com/auth/sso-relay?returnTo=productA.com/dashboard
- *    (productB is where the user IS logged in — identified by cookie)
- * 3. This page reads tokens from productB's localStorage
- * 4. Redirects to productA.com/auth/sso-callback#token=<base64-encoded-tokens>
- * 5. SSORelayCallbackPage on productA decodes and stores tokens, redirects to /dashboard
- */
-export declare function SSORelayPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=SSORelayPage.d.ts.map

package/dist/auth/pages/SSORelayPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SSORelayPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/SSORelayPage.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAgNH,wBAAgB,YAAY,4CAoE3B"}

package/dist/auth/pages/SecurityPage.d.ts

@@ -1,5 +0,0 @@
-/**
- * Security Dashboard - Main hub for all authentication features
- */
-export declare function SecurityPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=SecurityPage.d.ts.map

package/dist/auth/pages/SecurityPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SecurityPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/SecurityPage.tsx"],"names":[],"mappings":"AA2LA;;GAEG;AACH,wBAAgB,YAAY,4CA+tB3B"}

package/dist/auth/pages/SessionBridgePage.d.ts

@@ -1,14 +0,0 @@
-/**
- * SessionBridgePage — Cross-Domain Auth Session Bridge (Profile-Scoped)
- *
- * Embedded as hidden iframe by other app shells. Manages profile-scoped
- * auth tokens in localStorage and relays state via postMessage.
- *
- * Storage uses ProfileStorageManager keys:
- *   bf-profiles, bf-p-{id}-user, bf-p-{id}-tokens, bf-p-{id}-workspace-token
- *   bf-active-profile (sessionStorage, per-tab)
- *
- * URL: /auth/session-bridge
- */
-export declare function SessionBridgePage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=SessionBridgePage.d.ts.map

package/dist/auth/pages/SessionBridgePage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SessionBridgePage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/SessionBridgePage.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA0QH,wBAAgB,iBAAiB,4CAiNhC"}

package/dist/auth/pages/SessionsPage.d.ts

@@ -1,8 +0,0 @@
-/**
- * Active sessions management page with professional UI
- *
- * Fragment: SessionCard_Session (src/operations/global/fragments/SessionCard.fragment.graphql)
- * Query: ActiveSessions (src/operations/global/queries/sessions.graphql)
- */
-export declare function SessionsPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=SessionsPage.d.ts.map

package/dist/auth/pages/SessionsPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SessionsPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/SessionsPage.tsx"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,wBAAgB,YAAY,4CAoe3B"}

package/dist/auth/pages/SsoCallbackPage.d.ts

@@ -1,8 +0,0 @@
-/**
- * SSO Callback Page
- * Handles redirects from:
- * - SAML ACS server (with token/refreshToken in query params)
- * - OIDC Authorization Server (with code/state in query params)
- */
-export declare function SsoCallbackPage(): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=SsoCallbackPage.d.ts.map

package/dist/auth/pages/SsoCallbackPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SsoCallbackPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/SsoCallbackPage.tsx"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,wBAAgB,eAAe,4CAqW9B"}

package/dist/auth/pages/SsoConfigPage.d.ts

@@ -1,13 +0,0 @@
-interface SsoConfigPageProps {
-    /** When true, skips the enterprise-plan gate so admins always see the full UI */
-    bypassEnterprisePlanGate?: boolean;
-}
-/**
- * SSO Configuration page for managing SAML/OIDC enterprise SSO.
- * Admin only - allows configuring Identity Provider settings.
- * In admin-app context, bypassEnterprisePlanGate=true and tenant/org/workspace
- * scoping is read from URL search params (?tenant=&org=&workspace=).
- */
-export declare function SsoConfigPage({ bypassEnterprisePlanGate, }: SsoConfigPageProps): import("react/jsx-runtime").JSX.Element;
-export {};
-//# sourceMappingURL=SsoConfigPage.d.ts.map