@burdenoff/microfe-auth 2026.624.1 → 2026.624.3

package/dist/auth/hooks/index.js

@@ -9,6 +9,7 @@ import "./useApiKeyOperations.js";
 import "./useAppOperations.js";
 import "./useWorkspaceOperations.js";
 import "./useContextSwitcherData.js";
+import "./useActiveContextBootstrapMirror.js";
 import "./useDelegationOperations.js";
 import "./useUserOperations.js";
 import "./useSsoOperations.js";

package/dist/auth/hooks/useActiveContextBootstrapMirror.js

@@ -0,0 +1,27 @@
+import { useEffect as e } from "react";
+//#region src/auth/hooks/useActiveContextBootstrapMirror.ts
+function t({ storeOrganizationId: t, storeWorkspaceId: n, storeProjectId: r, activeOrganizationId: i, activeWorkspaceId: a, activeProjectId: o, storeWorkspaces: s, storeProjects: c, setOrganization: l, setWorkspace: u, setProject: d }) {
+	e(() => {
+		t && !i && l(t);
+		let e = i || t, f = !!n && !!e && !!s?.some((t) => t.id === n && t.organizationId === e);
+		n && !a && f && u(n);
+		let p = a || (f ? n : null), m = !!r && !!p && !!c?.some((e) => e.id === r && e.workspaceId === p);
+		r && !o && m && d(r);
+	}, [
+		t,
+		n,
+		r,
+		i,
+		a,
+		o,
+		s,
+		c,
+		l,
+		u,
+		d
+	]);
+}
+//#endregion
+export { t as useActiveContextBootstrapMirror };
+
+//# sourceMappingURL=useActiveContextBootstrapMirror.js.map

package/dist/auth/hooks/useActiveContextBootstrapMirror.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useActiveContextBootstrapMirror.js","names":[],"sources":["../../../src/auth/hooks/useActiveContextBootstrapMirror.ts"],"sourcesContent":["import { useEffect } from \"react\";\n\ntype ContextId = string | null | undefined;\n\ninterface MirrorWorkspace {\n  id: string;\n  organizationId?: string | null;\n}\n\ninterface MirrorProject {\n  id: string;\n  workspaceId?: string | null;\n}\n\nexport interface ActiveContextBootstrapMirrorArgs {\n  /** Auth-store `currentOrganizationId` */\n  storeOrganizationId: ContextId;\n  /** Auth-store `currentWorkspaceId` */\n  storeWorkspaceId: ContextId;\n  /** Auth-store `currentProjectId` */\n  storeProjectId: ContextId;\n  /** ActiveContext `organizationId` */\n  activeOrganizationId: ContextId;\n  /** ActiveContext `workspaceId` */\n  activeWorkspaceId: ContextId;\n  /** ActiveContext `projectId` */\n  activeProjectId: ContextId;\n  /**\n   * The auth store's loaded `workspaces`. Used to verify that\n   * `storeWorkspaceId` actually belongs to the organization being mirrored\n   * before it is filled. If omitted, the workspace axis is never mirrored\n   * (safe default — better no workspace than one from the wrong org).\n   */\n  storeWorkspaces?: ReadonlyArray<MirrorWorkspace>;\n  /**\n   * The auth store's loaded `projects`. Used to verify that `storeProjectId`\n   * actually belongs to the workspace being mirrored before it is filled. If\n   * omitted, the project axis is never mirrored.\n   */\n  storeProjects?: ReadonlyArray<MirrorProject>;\n  /**\n   * ActiveContext setters. Must be **stable references** (they are, coming\n   * from `ActiveContextProvider`'s memoized value) — passing inline arrows\n   * makes this effect re-run every render. Likewise prefer stable references\n   * for `storeWorkspaces` / `storeProjects` (e.g. a shallow-equal Zustand\n   * selector or `useMemo`); a new array reference each render re-runs the\n   * effect. Re-runs are harmless (the fills are idempotent), just wasted work.\n   */\n  setOrganization: (organizationId: string | null) => void;\n  setWorkspace: (workspaceId: string | null) => void;\n  setProject: (projectId: string | null) => void;\n}\n\n/**\n * One-way, **fill-only** mirror of the auth store's org / workspace / project\n * ids into ActiveContext, for app-shell headers / context switchers.\n *\n * Some context ids are derived programmatically in the Zustand auth store\n * without a paired ActiveContext write:\n * - the bootstrap in `useContextSwitcherData` auto-selects an organization\n *   (`setCurrentOrganizationId`) and, on the persisted-workspace path, a\n *   workspace (`setCurrentWorkspaceId`) without calling `setActiveContext`;\n * - `useProjectSyncEffect` / `selectWorkspace` auto-select a project.\n *\n * ActiveContext is the source of truth for the URL + storage + the props passed\n * to workspace MFEs and the workspace-token context, so those store-only ids\n * must reach it — otherwise e.g. a fresh `defaultWorkspaceId` login leaves\n * `organizationId` undefined and the token / MFE context break until the user\n * reselects.\n *\n * The rule is **fill, never override**: copy a store id into ActiveContext only\n * when ActiveContext has no value for that axis yet. We must NOT overwrite a\n * non-null ActiveContext value, because:\n *  1. it would clobber an explicit selection — a switch handler's write, or a\n *     deep-link / browser-back `?workspace=`/`?project=` that the router already\n *     applied; and\n *  2. overriding is exactly what turns this into a two-store ping-pong — the\n *     store→AC and AC→store effects each read the other's pre-commit value and\n *     swap the ids every commit until React throws \"Maximum update depth\n *     exceeded\" (error #185). Filling only nulls is self-terminating: once the\n *     axis is set the guard is false forever, so it can never alternate.\n *\n * Cross-context safety: a value is filled only when it provably belongs to the\n * parent context being mirrored, validated against the loaded store metadata —\n * the **workspace** must belong to the target organization (`storeWorkspaces`),\n * and the **project** must belong to the target workspace (`storeProjects`).\n * The store can transiently hold a stale child id after its parent advanced\n * (e.g. `useContextSwitcherData` copies a new org into the store before the new\n * org's — unpersisted — workspace list loads, leaving `currentWorkspaceId`\n * pointing at the previous org; or the workspace advances to B while the\n * project still points at A). Gating on loaded metadata means such a stale id\n * isn't in the list yet, so it is not mirrored until it is genuinely valid.\n *\n * See BOFF-2805.\n */\nexport function useActiveContextBootstrapMirror({\n  storeOrganizationId,\n  storeWorkspaceId,\n  storeProjectId,\n  activeOrganizationId,\n  activeWorkspaceId,\n  activeProjectId,\n  storeWorkspaces,\n  storeProjects,\n  setOrganization,\n  setWorkspace,\n  setProject,\n}: ActiveContextBootstrapMirrorArgs): void {\n  useEffect(() => {\n    if (storeOrganizationId && !activeOrganizationId) {\n      setOrganization(storeOrganizationId);\n    }\n\n    // Fill the workspace only when it provably belongs to the organization\n    // ActiveContext is on (or is being filled this pass). Guards against\n    // publishing a (org, workspace) pair from two different orgs while the\n    // store's org has advanced but its (unpersisted) workspace list / current\n    // workspace id has not caught up.\n    const targetOrganizationId = activeOrganizationId || storeOrganizationId;\n    const workspaceBelongsToTargetOrganization =\n      !!storeWorkspaceId &&\n      !!targetOrganizationId &&\n      !!storeWorkspaces?.some(\n        (workspace) =>\n          workspace.id === storeWorkspaceId &&\n          workspace.organizationId === targetOrganizationId,\n      );\n\n    if (\n      storeWorkspaceId &&\n      !activeWorkspaceId &&\n      workspaceBelongsToTargetOrganization\n    ) {\n      setWorkspace(storeWorkspaceId);\n    }\n\n    // Fill the project only when it provably belongs to the workspace\n    // ActiveContext is on (or is being filled this pass). Prevents a stale\n    // project from a previously-selected workspace leaking across a switch.\n    // Fall back to the store workspace only when it is being filled this pass;\n    // otherwise (e.g. workspace fill skipped because its metadata hasn't\n    // loaded) we'd let a project fill without its parent workspace present,\n    // an inconsistent (org, null, project) state.\n    const targetWorkspaceId =\n      activeWorkspaceId ||\n      (workspaceBelongsToTargetOrganization ? storeWorkspaceId : null);\n    const projectBelongsToTargetWorkspace =\n      !!storeProjectId &&\n      !!targetWorkspaceId &&\n      !!storeProjects?.some(\n        (project) =>\n          project.id === storeProjectId &&\n          project.workspaceId === targetWorkspaceId,\n      );\n\n    if (storeProjectId && !activeProjectId && projectBelongsToTargetWorkspace) {\n      setProject(storeProjectId);\n    }\n  }, [\n    storeOrganizationId,\n    storeWorkspaceId,\n    storeProjectId,\n    activeOrganizationId,\n    activeWorkspaceId,\n    activeProjectId,\n    storeWorkspaces,\n    storeProjects,\n    setOrganization,\n    setWorkspace,\n    setProject,\n  ]);\n}\n"],"mappings":";;AA+FA,SAAgB,EAAgC,EAC9C,wBACA,qBACA,mBACA,yBACA,sBACA,oBACA,oBACA,kBACA,oBACA,iBACA,iBACyC;AACzC,SAAgB;AACd,EAAI,KAAuB,CAAC,KAC1B,EAAgB,EAAoB;EAQtC,IAAM,IAAuB,KAAwB,GAC/C,IACJ,CAAC,CAAC,KACF,CAAC,CAAC,KACF,CAAC,CAAC,GAAiB,MAChB,MACC,EAAU,OAAO,KACjB,EAAU,mBAAmB,EAChC;AAEH,EACE,KACA,CAAC,KACD,KAEA,EAAa,EAAiB;EAUhC,IAAM,IACJ,MACC,IAAuC,IAAmB,OACvD,IACJ,CAAC,CAAC,KACF,CAAC,CAAC,KACF,CAAC,CAAC,GAAe,MACd,MACC,EAAQ,OAAO,KACf,EAAQ,gBAAgB,EAC3B;AAEH,EAAI,KAAkB,CAAC,KAAmB,KACxC,EAAW,EAAe;IAE3B;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC"}

package/dist/auth/index.js

@@ -10,6 +10,7 @@ import "./hooks/usePasswordOperations.js";
 import "./hooks/useSessionOperations.js";
 import "./hooks/useWorkspaceOperations.js";
 import "./hooks/useContextSwitcherData.js";
+import "./hooks/useActiveContextBootstrapMirror.js";
 import "./hooks/useUserOperations.js";
 import "./hooks/index.js";
 import "./hooks/useWorkspaceToken.js";

package/dist/auth/pages/SSOClearPage.js

@@ -5,7 +5,7 @@ import { jsx as r } from "react/jsx-runtime";
 import { clearShellSsoCookies as i } from "@burdenoff/fe-libs/shared/utils";
 import { getAuthBridge as a } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
 //#region src/auth/pages/SSOClearPage.tsx
-var o = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai".split(","));
+var o = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
 function s(e) {
 	if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
 	if (e.protocol !== "https:") return !1;

package/dist/auth/pages/SSOClearPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n *   product.com (logout)\n *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n *         — wipes bridge-host localStorage + bf-sso cookie\n *     → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/auth/login?reason=logout\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n    try {\n      clearLocalAuthState();\n      clearShellSsoCookies();\n      // Broadcast to any same-origin shells still listening so they drop the\n      // session immediately too (best-effort — only fires on the bridge\n      // host's origin, which is the only place where iframe storage isn't\n      // partitioned cross-product).\n      getAuthBridge()?.notifyLogoutAll();\n    } catch {\n      /* ignore — proceed with the redirect regardless */\n    }\n\n    window.location.replace(returnTo);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA2BA,IAAM,IAAyB,IAAI,IAAI,qkBAkCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAoBxC,QAlBA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC;AAEhE,MAAI;AAOF,GANA,GAAqB,EACrB,GAAsB,EAKtB,GAAe,EAAE,iBAAiB;UAC5B;AAIR,SAAO,SAAS,QAAQ,EAAS;IAChC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}
+{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n *   product.com (logout)\n *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n *         — wipes bridge-host localStorage + bf-sso cookie\n *     → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/auth/login?reason=logout\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n    try {\n      clearLocalAuthState();\n      clearShellSsoCookies();\n      // Broadcast to any same-origin shells still listening so they drop the\n      // session immediately too (best-effort — only fires on the bridge\n      // host's origin, which is the only place where iframe storage isn't\n      // partitioned cross-product).\n      getAuthBridge()?.notifyLogoutAll();\n    } catch {\n      /* ignore — proceed with the redirect regardless */\n    }\n\n    window.location.replace(returnTo);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA2BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAoBxC,QAlBA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC;AAEhE,MAAI;AAOF,GANA,GAAqB,EACrB,GAAsB,EAKtB,GAAe,EAAE,iBAAiB;UAC5B;AAIR,SAAO,SAAS,QAAQ,EAAS;IAChC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}

package/dist/auth/pages/SSODepositPage.js

@@ -5,7 +5,7 @@ import { jsx as r } from "react/jsx-runtime";
 import { setSSoCookie as i } from "@burdenoff/fe-libs/shared/utils";
 import { getAuthBridge as a } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
 //#region src/auth/pages/SSODepositPage.tsx
-var o = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai".split(","));
+var o = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
 function s(e) {
 	if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
 	if (e.protocol !== "https:") return !1;

package/dist/auth/pages/SSODepositPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n *   1. A later top-level visit to the bridge host renders authenticated.\n *   2. Other product origins can discover the session via\n *      `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n *   product.com/auth/login    → user signs in\n *   product.com               → POST-success redirect to:\n *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n *                             → writes tokens here, sets bf-sso cookie\n *   <returnTo>                → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n      // valid post-deposit return targets. Without these, a login that lands on\n      // the bridge host falls back to \"/\" instead of returning to the admin app.\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/\";\n}\n\nexport function SSODepositPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      window.location.replace(returnTo);\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5);\n      const payload = JSON.parse(atob(encoded)) as {\n        profileId?: string;\n        tokens?: string;\n        user?: string;\n        profiles?: string;\n      };\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(returnTo);\n        return;\n      }\n\n      // First-party (unpartitioned) writes on the bridge host origin —\n      // future top-level visits here see the session.\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the same-origin auth bridge so any other open shells on\n      // this origin pick up the new session immediately.\n      getAuthBridge()?.notifyLogin({\n        user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n        tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n        activeProfileId: profileId,\n        profiles: profiles\n          ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n          : [],\n      });\n\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(returnTo);\n    }\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA6BA,IAAM,IAAyB,IAAI,IAAI,qkBAkCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAI7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAiB;CAC/B,IAAM,CAAC,KAAgB,GAAiB;AAyDxC,QAvDA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC,EAC1D,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAC7B,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAOvB,EAAE,cAAW,WAAQ,SAAM,gBANjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAQzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,EAAS;AACjC;;AA4BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAI5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAQ,KAAK,MAAM,EAAK,GAA+B;IAC7D,QAAQ,IAAU,KAAK,MAAM,EAAO,GAA+B;IACnE,iBAAiB;IACjB,UAAU,IACL,KAAK,MAAM,EAAS,GACrB,EAAE;IACP,CAAC,EAEF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,EAAS;;IAElC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}
+{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n *   1. A later top-level visit to the bridge host renders authenticated.\n *   2. Other product origins can discover the session via\n *      `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n *   product.com/auth/login    → user signs in\n *   product.com               → POST-success redirect to:\n *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n *                             → writes tokens here, sets bf-sso cookie\n *   <returnTo>                → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n      // valid post-deposit return targets. Without these, a login that lands on\n      // the bridge host falls back to \"/\" instead of returning to the admin app.\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/\";\n}\n\nexport function SSODepositPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      window.location.replace(returnTo);\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5);\n      const payload = JSON.parse(atob(encoded)) as {\n        profileId?: string;\n        tokens?: string;\n        user?: string;\n        profiles?: string;\n      };\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(returnTo);\n        return;\n      }\n\n      // First-party (unpartitioned) writes on the bridge host origin —\n      // future top-level visits here see the session.\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the same-origin auth bridge so any other open shells on\n      // this origin pick up the new session immediately.\n      getAuthBridge()?.notifyLogin({\n        user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n        tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n        activeProfileId: profileId,\n        profiles: profiles\n          ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n          : [],\n      });\n\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(returnTo);\n    }\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;AA6BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAI7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAiB;CAC/B,IAAM,CAAC,KAAgB,GAAiB;AAyDxC,QAvDA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC,EAC1D,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAC7B,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAOvB,EAAE,cAAW,WAAQ,SAAM,gBANjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAQzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,EAAS;AACjC;;AA4BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAI5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAQ,KAAK,MAAM,EAAK,GAA+B;IAC7D,QAAQ,IAAU,KAAK,MAAM,EAAO,GAA+B;IACnE,iBAAiB;IACjB,UAAU,IACL,KAAK,MAAM,EAAS,GACrB,EAAE;IACP,CAAC,EAEF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,EAAS;;IAElC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}

package/dist/auth/pages/SSORelayPage.js

@@ -2,7 +2,7 @@ import { useEffect as e } from "react";
 import { useSearchParams as t } from "react-router-dom";
 import { jsx as n } from "react/jsx-runtime";
 //#region src/auth/pages/SSORelayPage.tsx
-var r = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai".split(",")), i = "relayChain", a = "sso_failed", o = new Set(["localhost", "127.0.0.1"]), s = {
+var r = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(",")), i = "relayChain", a = "sso_failed", o = new Set(["localhost", "127.0.0.1"]), s = {
 	"bf-sso": /(?:^|;\s*)bf-sso=([^;]*)/,
 	"bf-sso-profile": /(?:^|;\s*)bf-sso-profile=([^;]*)/
 };

package/dist/auth/pages/SSORelayPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSORelayPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayPage.tsx"],"sourcesContent":["/**\n * SSORelayPage — Cross-domain SSO token relay.\n *\n * This page is loaded on the ORIGIN where the user is logged in.\n * It reads tokens from localStorage and redirects to the TARGET domain's\n * /auth/sso-callback with the tokens in a URL fragment (not query param\n * for security — fragments are not sent to servers).\n *\n * Flow:\n * 1. User visits productA.com → not logged in → detects SSO cookie\n * 2. Redirect to productB.com/auth/sso-relay?returnTo=productA.com/dashboard\n *    (productB is where the user IS logged in — identified by cookie)\n * 3. This page reads tokens from productB's localStorage\n * 4. Redirects to productA.com/auth/sso-callback#token=<base64-encoded-tokens>\n * 5. SSORelayCallbackPage on productA decodes and stores tokens, redirects to /dashboard\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\n\nconst ALLOWED_RELAY_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nconst RELAY_CHAIN_PARAM = \"relayChain\";\nconst RELAY_FAILED_PARAM = \"sso_failed\";\nconst LOCAL_HOSTNAMES = new Set([\"localhost\", \"127.0.0.1\"]);\n\nconst SSO_COOKIE_PATTERNS = {\n  \"bf-sso\": /(?:^|;\\s*)bf-sso=([^;]*)/,\n  \"bf-sso-profile\": /(?:^|;\\s*)bf-sso-profile=([^;]*)/,\n} as const;\n\nfunction isAllowedRelayTarget(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") {\n    return true;\n  }\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) {\n    return true;\n  }\n  if (url.protocol !== \"https:\") {\n    return false;\n  }\n  for (const domain of ALLOWED_RELAY_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n      // first-party SSO relay targets. Without these the relay-back to the\n      // admin shell fails isAllowedRelayTarget() and SSORelayPage falls through\n      // to window.location.replace(\"/\"), stranding the user on app.burdenoff.com.\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction clearRelayCookies(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      document.cookie = `${cookieName}=; path=/; max-age=0`;\n      if (domain) {\n        document.cookie = `${cookieName}=; path=/; domain=${domain}; max-age=0`;\n      }\n      if (hostname && !LOCAL_HOSTNAMES.has(hostname)) {\n        document.cookie = `${cookieName}=; path=/; domain=${hostname}; max-age=0`;\n      }\n    }\n  } catch {\n    /* best effort */\n  }\n}\n\nfunction getRelayChain(): string[] {\n  try {\n    return (\n      new URLSearchParams(window.location.search).get(RELAY_CHAIN_PARAM) || \"\"\n    )\n      .split(\"|\")\n      .filter((origin) => origin.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction getFailedReturnTo(returnTo: string): string {\n  try {\n    const targetUrl = new URL(returnTo, window.location.origin);\n    if (\n      targetUrl.origin !== window.location.origin &&\n      !isAllowedRelayTarget(targetUrl)\n    ) {\n      return \"/auth/login\";\n    }\n    targetUrl.searchParams.set(RELAY_FAILED_PARAM, \"1\");\n    return targetUrl.href;\n  } catch {\n    return \"/auth/login?sso_failed=1\";\n  }\n}\n\nfunction readSsoCookieProfileId(): string | null {\n  return readSsoCookieData()?.id ?? null;\n}\n\nfunction readSsoCookieData(): {\n  id: string | null;\n  origin: string | null;\n} | null {\n  try {\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      const match = document.cookie.match(SSO_COOKIE_PATTERNS[cookieName]);\n      if (!match) continue;\n\n      const parsed = JSON.parse(decodeURIComponent(match[1])) as\n        | string\n        | { id?: unknown; origin?: unknown };\n      if (typeof parsed === \"string\") return { id: parsed, origin: null };\n      if (typeof parsed.id === \"string\" && parsed.id.length > 0) {\n        return {\n          id: parsed.id,\n          origin: typeof parsed.origin === \"string\" ? parsed.origin : null,\n        };\n      }\n    }\n  } catch {\n    return null;\n  }\n  return null;\n}\n\nfunction redirectToCookieRelayOrigin(returnTo: string): boolean {\n  try {\n    const ssoCookie = readSsoCookieData();\n    if (!ssoCookie?.origin) return false;\n\n    const relayUrl = new URL(ssoCookie.origin);\n    if (!isAllowedRelayTarget(relayUrl)) return false;\n    if (relayUrl.origin === window.location.origin) return false;\n\n    const relayChain = getRelayChain();\n    if (relayChain.includes(relayUrl.origin) || relayChain.length >= 3) {\n      return false;\n    }\n\n    const nextRelayUrl = new URL(\"/auth/sso-relay\", relayUrl.origin);\n    nextRelayUrl.searchParams.set(\"returnTo\", returnTo);\n    nextRelayUrl.searchParams.set(\n      RELAY_CHAIN_PARAM,\n      Array.from(new Set([...relayChain, window.location.origin])).join(\"|\"),\n    );\n\n    window.location.replace(nextRelayUrl.href);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction readProfilesRaw(): string | null {\n  return localStorage.getItem(\"bf-profiles\");\n}\n\nfunction readProfileIds(): string[] {\n  try {\n    const profilesRaw = readProfilesRaw();\n    const profiles = profilesRaw\n      ? (JSON.parse(profilesRaw) as Array<{ id?: unknown }>)\n      : [];\n    return profiles\n      .map((profile) => profile.id)\n      .filter((id): id is string => typeof id === \"string\" && id.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction resolveRelayProfileId(): string | null {\n  const candidates = [\n    readSsoCookieProfileId(),\n    sessionStorage.getItem(\"bf-active-profile\"),\n    ...readProfileIds(),\n  ].filter((id): id is string => typeof id === \"string\" && id.length > 0);\n\n  for (const profileId of Array.from(new Set(candidates))) {\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    if (tokensRaw && userRaw) {\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      return profileId;\n    }\n  }\n\n  return null;\n}\n\nexport function SSORelayPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = searchParams.get(\"returnTo\");\n    if (!returnTo) {\n      // No return URL — just show a blank page\n      return;\n    }\n\n    // Read tokens from localStorage (this origin has them). Prefer the shared\n    // SSO cookie profile because a relay often runs in a new tab with empty\n    // sessionStorage and stale historical profiles in localStorage.\n    const profileId = resolveRelayProfileId();\n    if (!profileId) {\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    const profilesRaw = readProfilesRaw();\n\n    if (!tokensRaw || !userRaw) {\n      // No tokens — redirect back without them\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    // Encode the auth state as a base64 URL fragment\n    const payload = {\n      profileId,\n      tokens: tokensRaw,\n      user: userRaw,\n      profiles: profilesRaw,\n    };\n    const encoded = btoa(JSON.stringify(payload));\n\n    // Build the callback URL on the target domain\n    // Parse returnTo to get the target origin\n    let callbackUrl: string;\n    try {\n      const targetUrl = new URL(returnTo);\n      if (!isAllowedRelayTarget(targetUrl)) {\n        window.location.replace(\"/\");\n        return;\n      }\n      const returnPath = targetUrl.pathname + targetUrl.search;\n      callbackUrl = `${targetUrl.origin}/auth/sso-callback?returnTo=${encodeURIComponent(returnPath)}#sso=${encoded}`;\n    } catch {\n      // returnTo is a relative path — can't do cross-domain relay\n      window.location.replace(returnTo);\n      return;\n    }\n\n    // Redirect to the callback\n    window.location.replace(callbackUrl);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;AAoBA,IAAM,IAAwB,IAAI,IAAI,qkBAkCrC,CAAC,EAEI,IAAoB,cACpB,IAAqB,cACrB,IAAkB,IAAI,IAAI,CAAC,aAAa,YAAY,CAAC,EAErD,IAAsB;CAC1B,UAAU;CACV,kBAAkB;CACnB;AAED,SAAS,EAAqB,GAAmB;AAI/C,KAHI,EAAI,aAAa,eAAe,EAAI,aAAa,eAGjD,EAAI,SAAS,SAAS,uBAAuB,CAC/C,QAAO;AAET,KAAI,EAAI,aAAa,SACnB,QAAO;AAET,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAK7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,IAA0B;AACjC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AACJ,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,CAKnD,CAJA,SAAS,SAAS,GAAG,EAAW,uBAC5B,MACF,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAO,eAEzD,KAAY,CAAC,EAAgB,IAAI,EAAS,KAC5C,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAS;SAG3D;;AAKV,SAAS,IAA0B;AACjC,KAAI;AACF,UACE,IAAI,gBAAgB,OAAO,SAAS,OAAO,CAAC,IAAI,EAAkB,IAAI,IAErE,MAAM,IAAI,CACV,QAAQ,MAAW,EAAO,SAAS,EAAE;SAClC;AACN,SAAO,EAAE;;;AAIb,SAAS,EAAkB,GAA0B;AACnD,KAAI;EACF,IAAM,IAAY,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAQ3D,SANE,EAAU,WAAW,OAAO,SAAS,UACrC,CAAC,EAAqB,EAAU,GAEzB,iBAET,EAAU,aAAa,IAAI,GAAoB,IAAI,EAC5C,EAAU;SACX;AACN,SAAO;;;AAIX,SAAS,IAAwC;AAC/C,QAAO,GAAmB,EAAE,MAAM;;AAGpC,SAAS,IAGA;AACP,KAAI;AACF,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,EAAW;GAC9D,IAAM,IAAQ,SAAS,OAAO,MAAM,EAAoB,GAAY;AACpE,OAAI,CAAC,EAAO;GAEZ,IAAM,IAAS,KAAK,MAAM,mBAAmB,EAAM,GAAG,CAAC;AAGvD,OAAI,OAAO,KAAW,SAAU,QAAO;IAAE,IAAI;IAAQ,QAAQ;IAAM;AACnE,OAAI,OAAO,EAAO,MAAO,YAAY,EAAO,GAAG,SAAS,EACtD,QAAO;IACL,IAAI,EAAO;IACX,QAAQ,OAAO,EAAO,UAAW,WAAW,EAAO,SAAS;IAC7D;;SAGC;AACN,SAAO;;AAET,QAAO;;AAGT,SAAS,EAA4B,GAA2B;AAC9D,KAAI;EACF,IAAM,IAAY,GAAmB;AACrC,MAAI,CAAC,GAAW,OAAQ,QAAO;EAE/B,IAAM,IAAW,IAAI,IAAI,EAAU,OAAO;AAE1C,MADI,CAAC,EAAqB,EAAS,IAC/B,EAAS,WAAW,OAAO,SAAS,OAAQ,QAAO;EAEvD,IAAM,IAAa,GAAe;AAClC,MAAI,EAAW,SAAS,EAAS,OAAO,IAAI,EAAW,UAAU,EAC/D,QAAO;EAGT,IAAM,IAAe,IAAI,IAAI,mBAAmB,EAAS,OAAO;AAQhE,SAPA,EAAa,aAAa,IAAI,YAAY,EAAS,EACnD,EAAa,aAAa,IACxB,GACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,GAAY,OAAO,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CACvE,EAED,OAAO,SAAS,QAAQ,EAAa,KAAK,EACnC;SACD;AACN,SAAO;;;AAIX,SAAS,IAAiC;AACxC,QAAO,aAAa,QAAQ,cAAc;;AAG5C,SAAS,IAA2B;AAClC,KAAI;EACF,IAAM,IAAc,GAAiB;AAIrC,UAHiB,IACZ,KAAK,MAAM,EAAY,GACxB,EAAE,EAEH,KAAK,MAAY,EAAQ,GAAG,CAC5B,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;SAClE;AACN,SAAO,EAAE;;;AAIb,SAAS,IAAuC;CAC9C,IAAM,IAAa;EACjB,GAAwB;EACxB,eAAe,QAAQ,oBAAoB;EAC3C,GAAG,GAAgB;EACpB,CAAC,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;AAEvE,MAAK,IAAM,KAAa,MAAM,KAAK,IAAI,IAAI,EAAW,CAAC,EAAE;EACvD,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO;AAC9D,MAAI,KAAa,EAEf,QADA,eAAe,QAAQ,qBAAqB,EAAU,EAC/C;;AAIX,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AA8DxC,QA5DA,QAAgB;EACd,IAAM,IAAW,EAAa,IAAI,WAAW;AAC7C,MAAI,CAAC,EAEH;EAMF,IAAM,IAAY,GAAuB;AACzC,MAAI,CAAC,GAAW;AACd,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAGF,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO,EACxD,IAAc,GAAiB;AAErC,MAAI,CAAC,KAAa,CAAC,GAAS;AAE1B,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAUF,IAAM,IAAU,KAAK,KAAK,UANV;GACd;GACA,QAAQ;GACR,MAAM;GACN,UAAU;GACX,CAC2C,CAAC,EAIzC;AACJ,MAAI;GACF,IAAM,IAAY,IAAI,IAAI,EAAS;AACnC,OAAI,CAAC,EAAqB,EAAU,EAAE;AACpC,WAAO,SAAS,QAAQ,IAAI;AAC5B;;GAEF,IAAM,IAAa,EAAU,WAAW,EAAU;AAClD,OAAc,GAAG,EAAU,OAAO,8BAA8B,mBAAmB,EAAW,CAAC,OAAO;UAChG;AAEN,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAIF,SAAO,SAAS,QAAQ,EAAY;IACnC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}
+{"version":3,"file":"SSORelayPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayPage.tsx"],"sourcesContent":["/**\n * SSORelayPage — Cross-domain SSO token relay.\n *\n * This page is loaded on the ORIGIN where the user is logged in.\n * It reads tokens from localStorage and redirects to the TARGET domain's\n * /auth/sso-callback with the tokens in a URL fragment (not query param\n * for security — fragments are not sent to servers).\n *\n * Flow:\n * 1. User visits productA.com → not logged in → detects SSO cookie\n * 2. Redirect to productB.com/auth/sso-relay?returnTo=productA.com/dashboard\n *    (productB is where the user IS logged in — identified by cookie)\n * 3. This page reads tokens from productB's localStorage\n * 4. Redirects to productA.com/auth/sso-callback#token=<base64-encoded-tokens>\n * 5. SSORelayCallbackPage on productA decodes and stores tokens, redirects to /dashboard\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\n\nconst ALLOWED_RELAY_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nconst RELAY_CHAIN_PARAM = \"relayChain\";\nconst RELAY_FAILED_PARAM = \"sso_failed\";\nconst LOCAL_HOSTNAMES = new Set([\"localhost\", \"127.0.0.1\"]);\n\nconst SSO_COOKIE_PATTERNS = {\n  \"bf-sso\": /(?:^|;\\s*)bf-sso=([^;]*)/,\n  \"bf-sso-profile\": /(?:^|;\\s*)bf-sso-profile=([^;]*)/,\n} as const;\n\nfunction isAllowedRelayTarget(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") {\n    return true;\n  }\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) {\n    return true;\n  }\n  if (url.protocol !== \"https:\") {\n    return false;\n  }\n  for (const domain of ALLOWED_RELAY_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n      // first-party SSO relay targets. Without these the relay-back to the\n      // admin shell fails isAllowedRelayTarget() and SSORelayPage falls through\n      // to window.location.replace(\"/\"), stranding the user on app.burdenoff.com.\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction clearRelayCookies(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      document.cookie = `${cookieName}=; path=/; max-age=0`;\n      if (domain) {\n        document.cookie = `${cookieName}=; path=/; domain=${domain}; max-age=0`;\n      }\n      if (hostname && !LOCAL_HOSTNAMES.has(hostname)) {\n        document.cookie = `${cookieName}=; path=/; domain=${hostname}; max-age=0`;\n      }\n    }\n  } catch {\n    /* best effort */\n  }\n}\n\nfunction getRelayChain(): string[] {\n  try {\n    return (\n      new URLSearchParams(window.location.search).get(RELAY_CHAIN_PARAM) || \"\"\n    )\n      .split(\"|\")\n      .filter((origin) => origin.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction getFailedReturnTo(returnTo: string): string {\n  try {\n    const targetUrl = new URL(returnTo, window.location.origin);\n    if (\n      targetUrl.origin !== window.location.origin &&\n      !isAllowedRelayTarget(targetUrl)\n    ) {\n      return \"/auth/login\";\n    }\n    targetUrl.searchParams.set(RELAY_FAILED_PARAM, \"1\");\n    return targetUrl.href;\n  } catch {\n    return \"/auth/login?sso_failed=1\";\n  }\n}\n\nfunction readSsoCookieProfileId(): string | null {\n  return readSsoCookieData()?.id ?? null;\n}\n\nfunction readSsoCookieData(): {\n  id: string | null;\n  origin: string | null;\n} | null {\n  try {\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      const match = document.cookie.match(SSO_COOKIE_PATTERNS[cookieName]);\n      if (!match) continue;\n\n      const parsed = JSON.parse(decodeURIComponent(match[1])) as\n        | string\n        | { id?: unknown; origin?: unknown };\n      if (typeof parsed === \"string\") return { id: parsed, origin: null };\n      if (typeof parsed.id === \"string\" && parsed.id.length > 0) {\n        return {\n          id: parsed.id,\n          origin: typeof parsed.origin === \"string\" ? parsed.origin : null,\n        };\n      }\n    }\n  } catch {\n    return null;\n  }\n  return null;\n}\n\nfunction redirectToCookieRelayOrigin(returnTo: string): boolean {\n  try {\n    const ssoCookie = readSsoCookieData();\n    if (!ssoCookie?.origin) return false;\n\n    const relayUrl = new URL(ssoCookie.origin);\n    if (!isAllowedRelayTarget(relayUrl)) return false;\n    if (relayUrl.origin === window.location.origin) return false;\n\n    const relayChain = getRelayChain();\n    if (relayChain.includes(relayUrl.origin) || relayChain.length >= 3) {\n      return false;\n    }\n\n    const nextRelayUrl = new URL(\"/auth/sso-relay\", relayUrl.origin);\n    nextRelayUrl.searchParams.set(\"returnTo\", returnTo);\n    nextRelayUrl.searchParams.set(\n      RELAY_CHAIN_PARAM,\n      Array.from(new Set([...relayChain, window.location.origin])).join(\"|\"),\n    );\n\n    window.location.replace(nextRelayUrl.href);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction readProfilesRaw(): string | null {\n  return localStorage.getItem(\"bf-profiles\");\n}\n\nfunction readProfileIds(): string[] {\n  try {\n    const profilesRaw = readProfilesRaw();\n    const profiles = profilesRaw\n      ? (JSON.parse(profilesRaw) as Array<{ id?: unknown }>)\n      : [];\n    return profiles\n      .map((profile) => profile.id)\n      .filter((id): id is string => typeof id === \"string\" && id.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction resolveRelayProfileId(): string | null {\n  const candidates = [\n    readSsoCookieProfileId(),\n    sessionStorage.getItem(\"bf-active-profile\"),\n    ...readProfileIds(),\n  ].filter((id): id is string => typeof id === \"string\" && id.length > 0);\n\n  for (const profileId of Array.from(new Set(candidates))) {\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    if (tokensRaw && userRaw) {\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      return profileId;\n    }\n  }\n\n  return null;\n}\n\nexport function SSORelayPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = searchParams.get(\"returnTo\");\n    if (!returnTo) {\n      // No return URL — just show a blank page\n      return;\n    }\n\n    // Read tokens from localStorage (this origin has them). Prefer the shared\n    // SSO cookie profile because a relay often runs in a new tab with empty\n    // sessionStorage and stale historical profiles in localStorage.\n    const profileId = resolveRelayProfileId();\n    if (!profileId) {\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    const profilesRaw = readProfilesRaw();\n\n    if (!tokensRaw || !userRaw) {\n      // No tokens — redirect back without them\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    // Encode the auth state as a base64 URL fragment\n    const payload = {\n      profileId,\n      tokens: tokensRaw,\n      user: userRaw,\n      profiles: profilesRaw,\n    };\n    const encoded = btoa(JSON.stringify(payload));\n\n    // Build the callback URL on the target domain\n    // Parse returnTo to get the target origin\n    let callbackUrl: string;\n    try {\n      const targetUrl = new URL(returnTo);\n      if (!isAllowedRelayTarget(targetUrl)) {\n        window.location.replace(\"/\");\n        return;\n      }\n      const returnPath = targetUrl.pathname + targetUrl.search;\n      callbackUrl = `${targetUrl.origin}/auth/sso-callback?returnTo=${encodeURIComponent(returnPath)}#sso=${encoded}`;\n    } catch {\n      // returnTo is a relative path — can't do cross-domain relay\n      window.location.replace(returnTo);\n      return;\n    }\n\n    // Redirect to the callback\n    window.location.replace(callbackUrl);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;AAoBA,IAAM,IAAwB,IAAI,IAAI,8qBAwCrC,CAAC,EAEI,IAAoB,cACpB,IAAqB,cACrB,IAAkB,IAAI,IAAI,CAAC,aAAa,YAAY,CAAC,EAErD,IAAsB;CAC1B,UAAU;CACV,kBAAkB;CACnB;AAED,SAAS,EAAqB,GAAmB;AAI/C,KAHI,EAAI,aAAa,eAAe,EAAI,aAAa,eAGjD,EAAI,SAAS,SAAS,uBAAuB,CAC/C,QAAO;AAET,KAAI,EAAI,aAAa,SACnB,QAAO;AAET,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAK7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,IAA0B;AACjC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AACJ,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,CAKnD,CAJA,SAAS,SAAS,GAAG,EAAW,uBAC5B,MACF,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAO,eAEzD,KAAY,CAAC,EAAgB,IAAI,EAAS,KAC5C,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAS;SAG3D;;AAKV,SAAS,IAA0B;AACjC,KAAI;AACF,UACE,IAAI,gBAAgB,OAAO,SAAS,OAAO,CAAC,IAAI,EAAkB,IAAI,IAErE,MAAM,IAAI,CACV,QAAQ,MAAW,EAAO,SAAS,EAAE;SAClC;AACN,SAAO,EAAE;;;AAIb,SAAS,EAAkB,GAA0B;AACnD,KAAI;EACF,IAAM,IAAY,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAQ3D,SANE,EAAU,WAAW,OAAO,SAAS,UACrC,CAAC,EAAqB,EAAU,GAEzB,iBAET,EAAU,aAAa,IAAI,GAAoB,IAAI,EAC5C,EAAU;SACX;AACN,SAAO;;;AAIX,SAAS,IAAwC;AAC/C,QAAO,GAAmB,EAAE,MAAM;;AAGpC,SAAS,IAGA;AACP,KAAI;AACF,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,EAAW;GAC9D,IAAM,IAAQ,SAAS,OAAO,MAAM,EAAoB,GAAY;AACpE,OAAI,CAAC,EAAO;GAEZ,IAAM,IAAS,KAAK,MAAM,mBAAmB,EAAM,GAAG,CAAC;AAGvD,OAAI,OAAO,KAAW,SAAU,QAAO;IAAE,IAAI;IAAQ,QAAQ;IAAM;AACnE,OAAI,OAAO,EAAO,MAAO,YAAY,EAAO,GAAG,SAAS,EACtD,QAAO;IACL,IAAI,EAAO;IACX,QAAQ,OAAO,EAAO,UAAW,WAAW,EAAO,SAAS;IAC7D;;SAGC;AACN,SAAO;;AAET,QAAO;;AAGT,SAAS,EAA4B,GAA2B;AAC9D,KAAI;EACF,IAAM,IAAY,GAAmB;AACrC,MAAI,CAAC,GAAW,OAAQ,QAAO;EAE/B,IAAM,IAAW,IAAI,IAAI,EAAU,OAAO;AAE1C,MADI,CAAC,EAAqB,EAAS,IAC/B,EAAS,WAAW,OAAO,SAAS,OAAQ,QAAO;EAEvD,IAAM,IAAa,GAAe;AAClC,MAAI,EAAW,SAAS,EAAS,OAAO,IAAI,EAAW,UAAU,EAC/D,QAAO;EAGT,IAAM,IAAe,IAAI,IAAI,mBAAmB,EAAS,OAAO;AAQhE,SAPA,EAAa,aAAa,IAAI,YAAY,EAAS,EACnD,EAAa,aAAa,IACxB,GACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,GAAY,OAAO,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CACvE,EAED,OAAO,SAAS,QAAQ,EAAa,KAAK,EACnC;SACD;AACN,SAAO;;;AAIX,SAAS,IAAiC;AACxC,QAAO,aAAa,QAAQ,cAAc;;AAG5C,SAAS,IAA2B;AAClC,KAAI;EACF,IAAM,IAAc,GAAiB;AAIrC,UAHiB,IACZ,KAAK,MAAM,EAAY,GACxB,EAAE,EAEH,KAAK,MAAY,EAAQ,GAAG,CAC5B,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;SAClE;AACN,SAAO,EAAE;;;AAIb,SAAS,IAAuC;CAC9C,IAAM,IAAa;EACjB,GAAwB;EACxB,eAAe,QAAQ,oBAAoB;EAC3C,GAAG,GAAgB;EACpB,CAAC,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;AAEvE,MAAK,IAAM,KAAa,MAAM,KAAK,IAAI,IAAI,EAAW,CAAC,EAAE;EACvD,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO;AAC9D,MAAI,KAAa,EAEf,QADA,eAAe,QAAQ,qBAAqB,EAAU,EAC/C;;AAIX,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AA8DxC,QA5DA,QAAgB;EACd,IAAM,IAAW,EAAa,IAAI,WAAW;AAC7C,MAAI,CAAC,EAEH;EAMF,IAAM,IAAY,GAAuB;AACzC,MAAI,CAAC,GAAW;AACd,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAGF,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO,EACxD,IAAc,GAAiB;AAErC,MAAI,CAAC,KAAa,CAAC,GAAS;AAE1B,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAUF,IAAM,IAAU,KAAK,KAAK,UANV;GACd;GACA,QAAQ;GACR,MAAM;GACN,UAAU;GACX,CAC2C,CAAC,EAIzC;AACJ,MAAI;GACF,IAAM,IAAY,IAAI,IAAI,EAAS;AACnC,OAAI,CAAC,EAAqB,EAAU,EAAE;AACpC,WAAO,SAAS,QAAQ,IAAI;AAC5B;;GAEF,IAAM,IAAa,EAAU,WAAW,EAAU;AAClD,OAAc,GAAG,EAAU,OAAO,8BAA8B,mBAAmB,EAAW,CAAC,OAAO;UAChG;AAEN,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAIF,SAAO,SAAS,QAAQ,EAAY;IACnC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}

package/dist/auth/pages/SessionBridgePage.js

@@ -1,7 +1,7 @@
 import { useEffect as e, useRef as t } from "react";
 import { jsx as n } from "react/jsx-runtime";
 //#region src/auth/pages/SessionBridgePage.tsx
-var r = "burdenoff-auth-bridge", i = "bf-p", a = "bf-profiles", o = "bf-active-profile", s = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai".split(","));
+var r = "burdenoff-auth-bridge", i = "bf-p", a = "bf-profiles", o = "bf-active-profile", s = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
 function c(e) {
 	try {
 		let t = new URL(e);

package/dist/auth/pages/SessionBridgePage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionBridgePage.js","names":[],"sources":["../../../src/auth/pages/SessionBridgePage.tsx"],"sourcesContent":["/**\n * SessionBridgePage — Cross-Domain Auth Session Bridge (Profile-Scoped)\n *\n * Embedded as hidden iframe by other app shells. Manages profile-scoped\n * auth tokens in localStorage and relays state via postMessage.\n *\n * Storage uses ProfileStorageManager keys:\n *   bf-profiles, bf-p-{id}-user, bf-p-{id}-tokens, bf-p-{id}-workspace-token\n *   bf-active-profile (sessionStorage, per-tab)\n *\n * URL: /auth/session-bridge\n */\n\nimport { useEffect, useRef } from \"react\";\n\nconst BRIDGE_SOURCE = \"burdenoff-auth-bridge\";\nconst BF_PREFIX = \"bf-p\";\nconst BF_PROFILES = \"bf-profiles\";\nconst BF_ACTIVE = \"bf-active-profile\";\n\ninterface BridgeMessage {\n  type: string;\n  payload?: Record<string, unknown>;\n  source?: string;\n}\n\n/**\n * Dynamically validates allowed origins for the auth bridge.\n * Accepts all Burdenoff product domains (prod + alpha + local dev).\n */\nconst ALLOWED_PRODUCT_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n]);\n\nfunction isAllowedOrigin(origin: string): boolean {\n  try {\n    const url = new URL(origin);\n    // Allow all localhost ports (local dev)\n    if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") {\n      return true;\n    }\n    // Allow *.local.burdenoff.com (local dev with nginx)\n    if (url.hostname.endsWith(\".local.burdenoff.com\")) {\n      return true;\n    }\n    // Allow app.{domain} and alphaapp.{domain} for all known product domains\n    for (const domain of ALLOWED_PRODUCT_DOMAINS) {\n      if (\n        url.hostname === domain ||\n        url.hostname === `app.${domain}` ||\n        url.hostname === `alphaapp.${domain}` ||\n        // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com)\n        // embed this bridge iframe too. Without trusting their origin, the\n        // bridge ignores their postMessages and the admin shell never receives\n        // the shared session.\n        url.hostname === `admin.${domain}` ||\n        url.hostname === `alphaadmin.${domain}` ||\n        url.hostname === `www.${domain}`\n      ) {\n        return true;\n      }\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\nfunction readAuthState(): Record<string, unknown> {\n  try {\n    const profiles = localStorage.getItem(BF_PROFILES);\n    let activeId = sessionStorage.getItem(BF_ACTIVE);\n\n    // Fall back: if sessionStorage is empty but localStorage has profiles,\n    // pick the first profile (same logic as resolveActiveProfileId)\n    if (!activeId && profiles) {\n      try {\n        const profileList = JSON.parse(profiles) as Array<{ id: string }>;\n        if (profileList.length > 0) {\n          activeId = profileList[0].id;\n          sessionStorage.setItem(BF_ACTIVE, activeId);\n        }\n      } catch {\n        // ignore\n      }\n    }\n\n    if (!activeId) {\n      return {\n        user: null,\n        tokens: null,\n        profiles: profiles ? JSON.parse(profiles) : [],\n        activeProfileId: null,\n      };\n    }\n    const user = localStorage.getItem(`${BF_PREFIX}-${activeId}-user`);\n    const tokens = localStorage.getItem(`${BF_PREFIX}-${activeId}-tokens`);\n    const wsToken = localStorage.getItem(\n      `${BF_PREFIX}-${activeId}-workspace-token`,\n    );\n\n    return {\n      user: user ? JSON.parse(user) : null,\n      tokens: tokens\n        ? { ...JSON.parse(tokens), workspaceToken: wsToken ?? undefined }\n        : null,\n      profiles: profiles ? JSON.parse(profiles) : [],\n      activeProfileId: activeId,\n    };\n  } catch {\n    return { user: null, tokens: null, profiles: [], activeProfileId: null };\n  }\n}\n\nfunction writeAuthState(payload: Record<string, unknown>): void {\n  const profileId =\n    (payload.activeProfileId as string) ??\n    ((payload.user as Record<string, unknown>)?.id as string) ??\n    sessionStorage.getItem(BF_ACTIVE);\n  if (!profileId) return;\n\n  if (payload.user) {\n    localStorage.setItem(\n      `${BF_PREFIX}-${profileId}-user`,\n      JSON.stringify(payload.user),\n    );\n  }\n  if (payload.tokens && typeof payload.tokens === \"object\") {\n    const t = payload.tokens as Record<string, unknown>;\n    const { workspaceToken, ...rest } = t;\n    localStorage.setItem(\n      `${BF_PREFIX}-${profileId}-tokens`,\n      JSON.stringify(rest),\n    );\n    if (workspaceToken) {\n      localStorage.setItem(\n        `${BF_PREFIX}-${profileId}-workspace-token`,\n        String(workspaceToken),\n      );\n    }\n  }\n  if (payload.profiles) {\n    localStorage.setItem(BF_PROFILES, JSON.stringify(payload.profiles));\n  }\n  sessionStorage.setItem(BF_ACTIVE, profileId);\n}\n\nfunction clearAuthState(): void {\n  const activeId = sessionStorage.getItem(BF_ACTIVE);\n  if (activeId) {\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-user`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-tokens`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-workspace-token`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-auth-storage`);\n    // Remove from profiles list\n    try {\n      const raw = localStorage.getItem(BF_PROFILES);\n      const profiles = raw ? JSON.parse(raw) : [];\n      localStorage.setItem(\n        BF_PROFILES,\n        JSON.stringify(\n          profiles.filter((p: { id: string }) => p.id !== activeId),\n        ),\n      );\n    } catch {\n      /* ignore */\n    }\n    sessionStorage.removeItem(BF_ACTIVE);\n  }\n  localStorage.removeItem(\"auth-storage\");\n}\n\nfunction clearAllAuthState(): void {\n  // Get all profiles and remove their data\n  try {\n    const raw = localStorage.getItem(BF_PROFILES);\n    const profiles: Array<{ id: string }> = raw ? JSON.parse(raw) : [];\n    for (const p of profiles) {\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-user`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-tokens`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-workspace-token`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-auth-storage`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-context`);\n    }\n  } catch {\n    /* ignore */\n  }\n  for (const key of Object.keys(localStorage)) {\n    if (key.startsWith(`${BF_PREFIX}-`) && key.endsWith(\"-auth-storage\")) {\n      localStorage.removeItem(key);\n    }\n  }\n  localStorage.removeItem(BF_PROFILES);\n  localStorage.removeItem(\"auth-storage\");\n  sessionStorage.removeItem(BF_ACTIVE);\n}\n\n// SSO cookie helpers (shared domain cookie for local dev fast-path)\nconst SSO_COOKIE_NAME = \"bf-sso-profile\";\nconst SHELL_SSO_COOKIE_NAME = \"bf-sso\";\nfunction setSSoCookieBridge(profileId: string, origin: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const cookieValue = JSON.stringify({ id: profileId, origin });\n    document.cookie = `${SSO_COOKIE_NAME}=${encodeURIComponent(cookieValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction setShellSsoCookieBridge(profileId: string, origin: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const ssoValue = JSON.stringify({ id: profileId, origin });\n    document.cookie = `${SHELL_SSO_COOKIE_NAME}=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction clearSSoCookieBridge(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    document.cookie = `${SSO_COOKIE_NAME}=; path=/; max-age=0`;\n    document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; max-age=0`;\n    if (domain) {\n      document.cookie = `${SSO_COOKIE_NAME}=; path=/; domain=${domain}; max-age=0`;\n      document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; domain=${domain}; max-age=0`;\n    }\n    if (hostname && ![\"localhost\", \"127.0.0.1\"].includes(hostname)) {\n      document.cookie = `${SSO_COOKIE_NAME}=; path=/; domain=${hostname}; max-age=0`;\n      document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; domain=${hostname}; max-age=0`;\n    }\n  } catch {\n    /* ignore */\n  }\n}\n\nexport function SessionBridgePage() {\n  const connectedParents = useRef<Set<MessageEventSource>>(new Set());\n  const initialReadySent = useRef(false);\n  const readySentTo = useRef<Set<MessageEventSource>>(new Set());\n  const storageAccessGranted = useRef(false);\n\n  // Request unpartitioned storage access (Storage Access API).\n  // This is critical for cross-domain SSO in modern browsers that\n  // partition third-party iframe localStorage.\n  useEffect(() => {\n    async function requestAccess() {\n      try {\n        // Check if Storage Access API is available\n        if (!document.requestStorageAccess) {\n          storageAccessGranted.current = true;\n          return;\n        }\n        // Check if we already have access\n        const hasAccess = await document.hasStorageAccess();\n        if (hasAccess) {\n          storageAccessGranted.current = true;\n          return;\n        }\n        // Request unpartitioned storage access\n        await document.requestStorageAccess();\n        storageAccessGranted.current = true;\n      } catch {\n        // Storage Access API not available or denied — fall through\n        // to cookie-based fallback. localStorage will be partitioned.\n        storageAccessGranted.current = false;\n      }\n    }\n    void requestAccess();\n  }, []);\n\n  useEffect(() => {\n    function isOriginAllowed(origin: string): boolean {\n      return isAllowedOrigin(origin);\n    }\n\n    function broadcastToAll(\n      message: BridgeMessage,\n      excludeSource?: MessageEventSource | null,\n    ): void {\n      if (window.parent && window.parent !== window) {\n        window.parent.postMessage(message, \"*\");\n      }\n      connectedParents.current.forEach((parent) => {\n        if (parent !== excludeSource && \"postMessage\" in parent) {\n          (parent as Window).postMessage(message, \"*\");\n        }\n      });\n    }\n\n    function handleMessage(event: MessageEvent): void {\n      if (!isOriginAllowed(event.origin)) return;\n      const message = event.data as BridgeMessage;\n      if (!message?.type || message.source === BRIDGE_SOURCE) return;\n\n      switch (message.type) {\n        case \"AUTH_INIT\": {\n          if (event.source) connectedParents.current.add(event.source);\n\n          // If the parent sends its current auth state in AUTH_INIT,\n          // store it so other cross-domain shells can pick it up.\n          if (message.payload && typeof message.payload === \"object\") {\n            const initPayload = message.payload as Record<string, unknown>;\n            if (initPayload.user && initPayload.tokens) {\n              writeAuthState(initPayload);\n            }\n          }\n\n          const state = readAuthState();\n          if (event.source && \"postMessage\" in event.source) {\n            (event.source as Window).postMessage(\n              { type: \"AUTH_STATE\", payload: state, source: BRIDGE_SOURCE },\n              event.origin,\n            );\n            if (!readySentTo.current.has(event.source)) {\n              readySentTo.current.add(event.source);\n              (event.source as Window).postMessage(\n                { type: \"AUTH_BRIDGE_READY\", source: BRIDGE_SOURCE },\n                event.origin,\n              );\n            }\n          }\n          break;\n        }\n        case \"AUTH_LOGIN\": {\n          if (message.payload) {\n            writeAuthState(message.payload);\n            // Set SSO cookie for cross-domain fast-path detection\n            const loginPayload = message.payload as Record<string, unknown>;\n            const loginProfileId =\n              (loginPayload.activeProfileId as string) ??\n              ((loginPayload.user as Record<string, unknown>)?.id as string);\n            if (loginProfileId) {\n              clearSSoCookieBridge();\n              setSSoCookieBridge(loginProfileId, event.origin);\n              setShellSsoCookieBridge(loginProfileId, event.origin);\n            }\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"login\" },\n                source: BRIDGE_SOURCE,\n              },\n              event.source,\n            );\n          }\n          break;\n        }\n        case \"AUTH_LOGOUT\": {\n          clearAuthState();\n          clearSSoCookieBridge();\n          broadcastToAll(\n            {\n              type: \"AUTH_STATE_CHANGED\",\n              payload: { ...readAuthState(), trigger: \"logout\" },\n              source: BRIDGE_SOURCE,\n            },\n            event.source,\n          );\n          break;\n        }\n        case \"AUTH_LOGOUT_ALL\": {\n          clearAllAuthState();\n          clearSSoCookieBridge();\n          broadcastToAll(\n            {\n              type: \"AUTH_STATE_CHANGED\",\n              payload: { ...readAuthState(), trigger: \"logout_all\" },\n              source: BRIDGE_SOURCE,\n            },\n            event.source,\n          );\n          break;\n        }\n        case \"AUTH_TOKEN_REFRESH\": {\n          if (message.payload?.tokens) {\n            writeAuthState({ tokens: message.payload.tokens });\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"refresh\" },\n                source: BRIDGE_SOURCE,\n              },\n              event.source,\n            );\n          }\n          break;\n        }\n        case \"AUTH_ACCOUNT_SWITCH\": {\n          if (message.payload) {\n            writeAuthState(message.payload);\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"account_switch\" },\n                source: BRIDGE_SOURCE,\n              },\n              event.source,\n            );\n          }\n          break;\n        }\n      }\n    }\n\n    function handleStorageChange(event: StorageEvent): void {\n      if (event.key?.startsWith(BF_PREFIX) || event.key === BF_PROFILES) {\n        broadcastToAll({\n          type: \"AUTH_STATE_CHANGED\",\n          payload: { ...readAuthState(), trigger: \"storage_sync\" },\n          source: BRIDGE_SOURCE,\n        });\n      }\n    }\n\n    window.addEventListener(\"message\", handleMessage);\n    window.addEventListener(\"storage\", handleStorageChange);\n\n    // Send initial AUTH_BRIDGE_READY to parent (only once, guard against StrictMode double-mount)\n    if (\n      window.parent &&\n      window.parent !== window &&\n      !initialReadySent.current\n    ) {\n      initialReadySent.current = true;\n      window.parent.postMessage(\n        { type: \"AUTH_BRIDGE_READY\", source: BRIDGE_SOURCE },\n        \"*\",\n      );\n    }\n\n    return () => {\n      window.removeEventListener(\"message\", handleMessage);\n      window.removeEventListener(\"storage\", handleStorageChange);\n      // Don't clear connectedParents or readySentTo on cleanup to maintain state across StrictMode remounts\n    };\n  }, []);\n\n  return (\n    <div\n      id=\"auth-session-bridge-root\"\n      data-bridge=\"active\"\n      style={{ display: \"none\" }}\n    />\n  );\n}\n"],"mappings":";;;AAeA,IAAM,IAAgB,yBAChB,IAAY,QACZ,IAAc,eACd,IAAY,qBAYZ,IAA0B,IAAI,IAAI,qkBAkCvC,CAAC;AAEF,SAAS,EAAgB,GAAyB;AAChD,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,EAAO;AAM3B,MAJI,EAAI,aAAa,eAAe,EAAI,aAAa,eAIjD,EAAI,SAAS,SAAS,uBAAuB,CAC/C,QAAO;AAGT,OAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAK7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,SAAO;SACD;AACN,SAAO;;;AAIX,SAAS,IAAyC;AAChD,KAAI;EACF,IAAM,IAAW,aAAa,QAAQ,EAAY,EAC9C,IAAW,eAAe,QAAQ,EAAU;AAIhD,MAAI,CAAC,KAAY,EACf,KAAI;GACF,IAAM,IAAc,KAAK,MAAM,EAAS;AACxC,GAAI,EAAY,SAAS,MACvB,IAAW,EAAY,GAAG,IAC1B,eAAe,QAAQ,GAAW,EAAS;UAEvC;AAKV,MAAI,CAAC,EACH,QAAO;GACL,MAAM;GACN,QAAQ;GACR,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;GAC9C,iBAAiB;GAClB;EAEH,IAAM,IAAO,aAAa,QAAQ,GAAG,EAAU,GAAG,EAAS,OAAO,EAC5D,IAAS,aAAa,QAAQ,GAAG,EAAU,GAAG,EAAS,SAAS,EAChE,IAAU,aAAa,QAC3B,GAAG,EAAU,GAAG,EAAS,kBAC1B;AAED,SAAO;GACL,MAAM,IAAO,KAAK,MAAM,EAAK,GAAG;GAChC,QAAQ,IACJ;IAAE,GAAG,KAAK,MAAM,EAAO;IAAE,gBAAgB,KAAW,KAAA;IAAW,GAC/D;GACJ,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;GAC9C,iBAAiB;GAClB;SACK;AACN,SAAO;GAAE,MAAM;GAAM,QAAQ;GAAM,UAAU,EAAE;GAAE,iBAAiB;GAAM;;;AAI5E,SAAS,EAAe,GAAwC;CAC9D,IAAM,IACH,EAAQ,mBACP,EAAQ,MAAkC,MAC5C,eAAe,QAAQ,EAAU;AAC9B,QAQL;MANI,EAAQ,QACV,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,QAC1B,KAAK,UAAU,EAAQ,KAAK,CAC7B,EAEC,EAAQ,UAAU,OAAO,EAAQ,UAAW,UAAU;GAExD,IAAM,EAAE,mBAAgB,GAAG,MADjB,EAAQ;AAMlB,GAJA,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,UAC1B,KAAK,UAAU,EAAK,CACrB,EACG,KACF,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,mBAC1B,OAAO,EAAe,CACvB;;AAML,EAHI,EAAQ,YACV,aAAa,QAAQ,GAAa,KAAK,UAAU,EAAQ,SAAS,CAAC,EAErE,eAAe,QAAQ,GAAW,EAAU;;;AAG9C,SAAS,IAAuB;CAC9B,IAAM,IAAW,eAAe,QAAQ,EAAU;AAClD,KAAI,GAAU;AAIZ,EAHA,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,OAAO,EACxD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,SAAS,EAC1D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,kBAAkB,EACnE,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,eAAe;AAEhE,MAAI;GACF,IAAM,IAAM,aAAa,QAAQ,EAAY,EACvC,IAAW,IAAM,KAAK,MAAM,EAAI,GAAG,EAAE;AAC3C,gBAAa,QACX,GACA,KAAK,UACH,EAAS,QAAQ,MAAsB,EAAE,OAAO,EAAS,CAC1D,CACF;UACK;AAGR,iBAAe,WAAW,EAAU;;AAEtC,cAAa,WAAW,eAAe;;AAGzC,SAAS,IAA0B;AAEjC,KAAI;EACF,IAAM,IAAM,aAAa,QAAQ,EAAY,EACvC,IAAkC,IAAM,KAAK,MAAM,EAAI,GAAG,EAAE;AAClE,OAAK,IAAM,KAAK,EAKd,CAJA,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,OAAO,EACpD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,SAAS,EACtD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,kBAAkB,EAC/D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,eAAe,EAC5D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,UAAU;SAEnD;AAGR,MAAK,IAAM,KAAO,OAAO,KAAK,aAAa,CACzC,CAAI,EAAI,WAAW,GAAG,EAAU,GAAG,IAAI,EAAI,SAAS,gBAAgB,IAClE,aAAa,WAAW,EAAI;AAKhC,CAFA,aAAa,WAAW,EAAY,EACpC,aAAa,WAAW,eAAe,EACvC,eAAe,WAAW,EAAU;;AAItC,IAAM,IAAkB,kBAClB,IAAwB;AAC9B,SAAS,EAAmB,GAAmB,GAAsB;AACnE,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAc,KAAK,UAAU;GAAE,IAAI;GAAW;GAAQ,CAAC;AAC7D,WAAS,SAAS,GAAG,EAAgB,GAAG,mBAAmB,EAAY,GAAG,EAAW,wBAAwB,EAAW;SAClH;;AAKV,SAAS,EAAwB,GAAmB,GAAsB;AACxE,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAAE,IAAI;GAAW;GAAQ,CAAC;AAC1D,WAAS,SAAS,GAAG,EAAsB,GAAG,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;SACrH;;AAKV,SAAS,IAA6B;AACpC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AAOJ,EANA,SAAS,SAAS,GAAG,EAAgB,uBACrC,SAAS,SAAS,GAAG,EAAsB,uBACvC,MACF,SAAS,SAAS,GAAG,EAAgB,oBAAoB,EAAO,cAChE,SAAS,SAAS,GAAG,EAAsB,oBAAoB,EAAO,eAEpE,KAAY,CAAC,CAAC,aAAa,YAAY,CAAC,SAAS,EAAS,KAC5D,SAAS,SAAS,GAAG,EAAgB,oBAAoB,EAAS,cAClE,SAAS,SAAS,GAAG,EAAsB,oBAAoB,EAAS;SAEpE;;AAKV,SAAgB,IAAoB;CAClC,IAAM,IAAmB,kBAAgC,IAAI,KAAK,CAAC,EAC7D,IAAmB,EAAO,GAAM,EAChC,IAAc,kBAAgC,IAAI,KAAK,CAAC,EACxD,IAAuB,EAAO,GAAM;AAsM1C,QAjMA,QAAgB;EACd,eAAe,IAAgB;AAC7B,OAAI;AAEF,QAAI,CAAC,SAAS,sBAAsB;AAClC,OAAqB,UAAU;AAC/B;;AAIF,QADkB,MAAM,SAAS,kBAAkB,EACpC;AACb,OAAqB,UAAU;AAC/B;;AAIF,IADA,MAAM,SAAS,sBAAsB,EACrC,EAAqB,UAAU;WACzB;AAGN,MAAqB,UAAU;;;AAG9B,KAAe;IACnB,EAAE,CAAC,EAEN,QAAgB;EACd,SAAS,EAAgB,GAAyB;AAChD,UAAO,EAAgB,EAAO;;EAGhC,SAAS,EACP,GACA,GACM;AAIN,GAHI,OAAO,UAAU,OAAO,WAAW,UACrC,OAAO,OAAO,YAAY,GAAS,IAAI,EAEzC,EAAiB,QAAQ,SAAS,MAAW;AAC3C,IAAI,MAAW,KAAiB,iBAAiB,KAC9C,EAAkB,YAAY,GAAS,IAAI;KAE9C;;EAGJ,SAAS,EAAc,GAA2B;AAChD,OAAI,CAAC,EAAgB,EAAM,OAAO,CAAE;GACpC,IAAM,IAAU,EAAM;AAClB,UAAC,GAAS,QAAQ,EAAQ,WAAW,GAEzC,SAAQ,EAAQ,MAAhB;IACE,KAAK,aAAa;AAKhB,SAJI,EAAM,UAAQ,EAAiB,QAAQ,IAAI,EAAM,OAAO,EAIxD,EAAQ,WAAW,OAAO,EAAQ,WAAY,UAAU;MAC1D,IAAM,IAAc,EAAQ;AAC5B,MAAI,EAAY,QAAQ,EAAY,UAClC,EAAe,EAAY;;KAI/B,IAAM,IAAQ,GAAe;AAC7B,KAAI,EAAM,UAAU,iBAAiB,EAAM,WACxC,EAAM,OAAkB,YACvB;MAAE,MAAM;MAAc,SAAS;MAAO,QAAQ;MAAe,EAC7D,EAAM,OACP,EACI,EAAY,QAAQ,IAAI,EAAM,OAAO,KACxC,EAAY,QAAQ,IAAI,EAAM,OAAO,EACpC,EAAM,OAAkB,YACvB;MAAE,MAAM;MAAqB,QAAQ;MAAe,EACpD,EAAM,OACP;AAGL;;IAEF,KAAK;AACH,SAAI,EAAQ,SAAS;AACnB,QAAe,EAAQ,QAAQ;MAE/B,IAAM,IAAe,EAAQ,SACvB,IACH,EAAa,mBACZ,EAAa,MAAkC;AAMnD,MALI,MACF,GAAsB,EACtB,EAAmB,GAAgB,EAAM,OAAO,EAChD,EAAwB,GAAgB,EAAM,OAAO,GAEvD,EACE;OACE,MAAM;OACN,SAAS;QAAE,GAAG,GAAe;QAAE,SAAS;QAAS;OACjD,QAAQ;OACT,EACD,EAAM,OACP;;AAEH;IAEF,KAAK;AAGH,KAFA,GAAgB,EAChB,GAAsB,EACtB,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAU;MAClD,QAAQ;MACT,EACD,EAAM,OACP;AACD;IAEF,KAAK;AAGH,KAFA,GAAmB,EACnB,GAAsB,EACtB,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAc;MACtD,QAAQ;MACT,EACD,EAAM,OACP;AACD;IAEF,KAAK;AACH,KAAI,EAAQ,SAAS,WACnB,EAAe,EAAE,QAAQ,EAAQ,QAAQ,QAAQ,CAAC,EAClD,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAW;MACnD,QAAQ;MACT,EACD,EAAM,OACP;AAEH;IAEF,KAAK;AACH,KAAI,EAAQ,YACV,EAAe,EAAQ,QAAQ,EAC/B,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAkB;MAC1D,QAAQ;MACT,EACD,EAAM,OACP;AAEH;;;EAKN,SAAS,EAAoB,GAA2B;AACtD,IAAI,EAAM,KAAK,WAAW,EAAU,IAAI,EAAM,QAAQ,MACpD,EAAe;IACb,MAAM;IACN,SAAS;KAAE,GAAG,GAAe;KAAE,SAAS;KAAgB;IACxD,QAAQ;IACT,CAAC;;AAoBN,SAhBA,OAAO,iBAAiB,WAAW,EAAc,EACjD,OAAO,iBAAiB,WAAW,EAAoB,EAIrD,OAAO,UACP,OAAO,WAAW,UAClB,CAAC,EAAiB,YAElB,EAAiB,UAAU,IAC3B,OAAO,OAAO,YACZ;GAAE,MAAM;GAAqB,QAAQ;GAAe,EACpD,IACD,SAGU;AAEX,GADA,OAAO,oBAAoB,WAAW,EAAc,EACpD,OAAO,oBAAoB,WAAW,EAAoB;;IAG3D,EAAE,CAAC,EAGJ,kBAAC,OAAD;EACE,IAAG;EACH,eAAY;EACZ,OAAO,EAAE,SAAS,QAAQ;EAC1B,CAAA"}
+{"version":3,"file":"SessionBridgePage.js","names":[],"sources":["../../../src/auth/pages/SessionBridgePage.tsx"],"sourcesContent":["/**\n * SessionBridgePage — Cross-Domain Auth Session Bridge (Profile-Scoped)\n *\n * Embedded as hidden iframe by other app shells. Manages profile-scoped\n * auth tokens in localStorage and relays state via postMessage.\n *\n * Storage uses ProfileStorageManager keys:\n *   bf-profiles, bf-p-{id}-user, bf-p-{id}-tokens, bf-p-{id}-workspace-token\n *   bf-active-profile (sessionStorage, per-tab)\n *\n * URL: /auth/session-bridge\n */\n\nimport { useEffect, useRef } from \"react\";\n\nconst BRIDGE_SOURCE = \"burdenoff-auth-bridge\";\nconst BF_PREFIX = \"bf-p\";\nconst BF_PROFILES = \"bf-profiles\";\nconst BF_ACTIVE = \"bf-active-profile\";\n\ninterface BridgeMessage {\n  type: string;\n  payload?: Record<string, unknown>;\n  source?: string;\n}\n\n/**\n * Dynamically validates allowed origins for the auth bridge.\n * Accepts all Burdenoff product domains (prod + alpha + local dev).\n */\nconst ALLOWED_PRODUCT_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedOrigin(origin: string): boolean {\n  try {\n    const url = new URL(origin);\n    // Allow all localhost ports (local dev)\n    if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") {\n      return true;\n    }\n    // Allow *.local.burdenoff.com (local dev with nginx)\n    if (url.hostname.endsWith(\".local.burdenoff.com\")) {\n      return true;\n    }\n    // Allow app.{domain} and alphaapp.{domain} for all known product domains\n    for (const domain of ALLOWED_PRODUCT_DOMAINS) {\n      if (\n        url.hostname === domain ||\n        url.hostname === `app.${domain}` ||\n        url.hostname === `alphaapp.${domain}` ||\n        // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com)\n        // embed this bridge iframe too. Without trusting their origin, the\n        // bridge ignores their postMessages and the admin shell never receives\n        // the shared session.\n        url.hostname === `admin.${domain}` ||\n        url.hostname === `alphaadmin.${domain}` ||\n        url.hostname === `www.${domain}`\n      ) {\n        return true;\n      }\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\nfunction readAuthState(): Record<string, unknown> {\n  try {\n    const profiles = localStorage.getItem(BF_PROFILES);\n    let activeId = sessionStorage.getItem(BF_ACTIVE);\n\n    // Fall back: if sessionStorage is empty but localStorage has profiles,\n    // pick the first profile (same logic as resolveActiveProfileId)\n    if (!activeId && profiles) {\n      try {\n        const profileList = JSON.parse(profiles) as Array<{ id: string }>;\n        if (profileList.length > 0) {\n          activeId = profileList[0].id;\n          sessionStorage.setItem(BF_ACTIVE, activeId);\n        }\n      } catch {\n        // ignore\n      }\n    }\n\n    if (!activeId) {\n      return {\n        user: null,\n        tokens: null,\n        profiles: profiles ? JSON.parse(profiles) : [],\n        activeProfileId: null,\n      };\n    }\n    const user = localStorage.getItem(`${BF_PREFIX}-${activeId}-user`);\n    const tokens = localStorage.getItem(`${BF_PREFIX}-${activeId}-tokens`);\n    const wsToken = localStorage.getItem(\n      `${BF_PREFIX}-${activeId}-workspace-token`,\n    );\n\n    return {\n      user: user ? JSON.parse(user) : null,\n      tokens: tokens\n        ? { ...JSON.parse(tokens), workspaceToken: wsToken ?? undefined }\n        : null,\n      profiles: profiles ? JSON.parse(profiles) : [],\n      activeProfileId: activeId,\n    };\n  } catch {\n    return { user: null, tokens: null, profiles: [], activeProfileId: null };\n  }\n}\n\nfunction writeAuthState(payload: Record<string, unknown>): void {\n  const profileId =\n    (payload.activeProfileId as string) ??\n    ((payload.user as Record<string, unknown>)?.id as string) ??\n    sessionStorage.getItem(BF_ACTIVE);\n  if (!profileId) return;\n\n  if (payload.user) {\n    localStorage.setItem(\n      `${BF_PREFIX}-${profileId}-user`,\n      JSON.stringify(payload.user),\n    );\n  }\n  if (payload.tokens && typeof payload.tokens === \"object\") {\n    const t = payload.tokens as Record<string, unknown>;\n    const { workspaceToken, ...rest } = t;\n    localStorage.setItem(\n      `${BF_PREFIX}-${profileId}-tokens`,\n      JSON.stringify(rest),\n    );\n    if (workspaceToken) {\n      localStorage.setItem(\n        `${BF_PREFIX}-${profileId}-workspace-token`,\n        String(workspaceToken),\n      );\n    }\n  }\n  if (payload.profiles) {\n    localStorage.setItem(BF_PROFILES, JSON.stringify(payload.profiles));\n  }\n  sessionStorage.setItem(BF_ACTIVE, profileId);\n}\n\nfunction clearAuthState(): void {\n  const activeId = sessionStorage.getItem(BF_ACTIVE);\n  if (activeId) {\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-user`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-tokens`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-workspace-token`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-auth-storage`);\n    // Remove from profiles list\n    try {\n      const raw = localStorage.getItem(BF_PROFILES);\n      const profiles = raw ? JSON.parse(raw) : [];\n      localStorage.setItem(\n        BF_PROFILES,\n        JSON.stringify(\n          profiles.filter((p: { id: string }) => p.id !== activeId),\n        ),\n      );\n    } catch {\n      /* ignore */\n    }\n    sessionStorage.removeItem(BF_ACTIVE);\n  }\n  localStorage.removeItem(\"auth-storage\");\n}\n\nfunction clearAllAuthState(): void {\n  // Get all profiles and remove their data\n  try {\n    const raw = localStorage.getItem(BF_PROFILES);\n    const profiles: Array<{ id: string }> = raw ? JSON.parse(raw) : [];\n    for (const p of profiles) {\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-user`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-tokens`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-workspace-token`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-auth-storage`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-context`);\n    }\n  } catch {\n    /* ignore */\n  }\n  for (const key of Object.keys(localStorage)) {\n    if (key.startsWith(`${BF_PREFIX}-`) && key.endsWith(\"-auth-storage\")) {\n      localStorage.removeItem(key);\n    }\n  }\n  localStorage.removeItem(BF_PROFILES);\n  localStorage.removeItem(\"auth-storage\");\n  sessionStorage.removeItem(BF_ACTIVE);\n}\n\n// SSO cookie helpers (shared domain cookie for local dev fast-path)\nconst SSO_COOKIE_NAME = \"bf-sso-profile\";\nconst SHELL_SSO_COOKIE_NAME = \"bf-sso\";\nfunction setSSoCookieBridge(profileId: string, origin: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const cookieValue = JSON.stringify({ id: profileId, origin });\n    document.cookie = `${SSO_COOKIE_NAME}=${encodeURIComponent(cookieValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction setShellSsoCookieBridge(profileId: string, origin: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const ssoValue = JSON.stringify({ id: profileId, origin });\n    document.cookie = `${SHELL_SSO_COOKIE_NAME}=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction clearSSoCookieBridge(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    document.cookie = `${SSO_COOKIE_NAME}=; path=/; max-age=0`;\n    document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; max-age=0`;\n    if (domain) {\n      document.cookie = `${SSO_COOKIE_NAME}=; path=/; domain=${domain}; max-age=0`;\n      document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; domain=${domain}; max-age=0`;\n    }\n    if (hostname && ![\"localhost\", \"127.0.0.1\"].includes(hostname)) {\n      document.cookie = `${SSO_COOKIE_NAME}=; path=/; domain=${hostname}; max-age=0`;\n      document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; domain=${hostname}; max-age=0`;\n    }\n  } catch {\n    /* ignore */\n  }\n}\n\nexport function SessionBridgePage() {\n  const connectedParents = useRef<Set<MessageEventSource>>(new Set());\n  const initialReadySent = useRef(false);\n  const readySentTo = useRef<Set<MessageEventSource>>(new Set());\n  const storageAccessGranted = useRef(false);\n\n  // Request unpartitioned storage access (Storage Access API).\n  // This is critical for cross-domain SSO in modern browsers that\n  // partition third-party iframe localStorage.\n  useEffect(() => {\n    async function requestAccess() {\n      try {\n        // Check if Storage Access API is available\n        if (!document.requestStorageAccess) {\n          storageAccessGranted.current = true;\n          return;\n        }\n        // Check if we already have access\n        const hasAccess = await document.hasStorageAccess();\n        if (hasAccess) {\n          storageAccessGranted.current = true;\n          return;\n        }\n        // Request unpartitioned storage access\n        await document.requestStorageAccess();\n        storageAccessGranted.current = true;\n      } catch {\n        // Storage Access API not available or denied — fall through\n        // to cookie-based fallback. localStorage will be partitioned.\n        storageAccessGranted.current = false;\n      }\n    }\n    void requestAccess();\n  }, []);\n\n  useEffect(() => {\n    function isOriginAllowed(origin: string): boolean {\n      return isAllowedOrigin(origin);\n    }\n\n    function broadcastToAll(\n      message: BridgeMessage,\n      excludeSource?: MessageEventSource | null,\n    ): void {\n      if (window.parent && window.parent !== window) {\n        window.parent.postMessage(message, \"*\");\n      }\n      connectedParents.current.forEach((parent) => {\n        if (parent !== excludeSource && \"postMessage\" in parent) {\n          (parent as Window).postMessage(message, \"*\");\n        }\n      });\n    }\n\n    function handleMessage(event: MessageEvent): void {\n      if (!isOriginAllowed(event.origin)) return;\n      const message = event.data as BridgeMessage;\n      if (!message?.type || message.source === BRIDGE_SOURCE) return;\n\n      switch (message.type) {\n        case \"AUTH_INIT\": {\n          if (event.source) connectedParents.current.add(event.source);\n\n          // If the parent sends its current auth state in AUTH_INIT,\n          // store it so other cross-domain shells can pick it up.\n          if (message.payload && typeof message.payload === \"object\") {\n            const initPayload = message.payload as Record<string, unknown>;\n            if (initPayload.user && initPayload.tokens) {\n              writeAuthState(initPayload);\n            }\n          }\n\n          const state = readAuthState();\n          if (event.source && \"postMessage\" in event.source) {\n            (event.source as Window).postMessage(\n              { type: \"AUTH_STATE\", payload: state, source: BRIDGE_SOURCE },\n              event.origin,\n            );\n            if (!readySentTo.current.has(event.source)) {\n              readySentTo.current.add(event.source);\n              (event.source as Window).postMessage(\n                { type: \"AUTH_BRIDGE_READY\", source: BRIDGE_SOURCE },\n                event.origin,\n              );\n            }\n          }\n          break;\n        }\n        case \"AUTH_LOGIN\": {\n          if (message.payload) {\n            writeAuthState(message.payload);\n            // Set SSO cookie for cross-domain fast-path detection\n            const loginPayload = message.payload as Record<string, unknown>;\n            const loginProfileId =\n              (loginPayload.activeProfileId as string) ??\n              ((loginPayload.user as Record<string, unknown>)?.id as string);\n            if (loginProfileId) {\n              clearSSoCookieBridge();\n              setSSoCookieBridge(loginProfileId, event.origin);\n              setShellSsoCookieBridge(loginProfileId, event.origin);\n            }\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"login\" },\n                source: BRIDGE_SOURCE,\n              },\n              event.source,\n            );\n          }\n          break;\n        }\n        case \"AUTH_LOGOUT\": {\n          clearAuthState();\n          clearSSoCookieBridge();\n          broadcastToAll(\n            {\n              type: \"AUTH_STATE_CHANGED\",\n              payload: { ...readAuthState(), trigger: \"logout\" },\n              source: BRIDGE_SOURCE,\n            },\n            event.source,\n          );\n          break;\n        }\n        case \"AUTH_LOGOUT_ALL\": {\n          clearAllAuthState();\n          clearSSoCookieBridge();\n          broadcastToAll(\n            {\n              type: \"AUTH_STATE_CHANGED\",\n              payload: { ...readAuthState(), trigger: \"logout_all\" },\n              source: BRIDGE_SOURCE,\n            },\n            event.source,\n          );\n          break;\n        }\n        case \"AUTH_TOKEN_REFRESH\": {\n          if (message.payload?.tokens) {\n            writeAuthState({ tokens: message.payload.tokens });\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"refresh\" },\n                source: BRIDGE_SOURCE,\n              },\n              event.source,\n            );\n          }\n          break;\n        }\n        case \"AUTH_ACCOUNT_SWITCH\": {\n          if (message.payload) {\n            writeAuthState(message.payload);\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"account_switch\" },\n                source: BRIDGE_SOURCE,\n              },\n              event.source,\n            );\n          }\n          break;\n        }\n      }\n    }\n\n    function handleStorageChange(event: StorageEvent): void {\n      if (event.key?.startsWith(BF_PREFIX) || event.key === BF_PROFILES) {\n        broadcastToAll({\n          type: \"AUTH_STATE_CHANGED\",\n          payload: { ...readAuthState(), trigger: \"storage_sync\" },\n          source: BRIDGE_SOURCE,\n        });\n      }\n    }\n\n    window.addEventListener(\"message\", handleMessage);\n    window.addEventListener(\"storage\", handleStorageChange);\n\n    // Send initial AUTH_BRIDGE_READY to parent (only once, guard against StrictMode double-mount)\n    if (\n      window.parent &&\n      window.parent !== window &&\n      !initialReadySent.current\n    ) {\n      initialReadySent.current = true;\n      window.parent.postMessage(\n        { type: \"AUTH_BRIDGE_READY\", source: BRIDGE_SOURCE },\n        \"*\",\n      );\n    }\n\n    return () => {\n      window.removeEventListener(\"message\", handleMessage);\n      window.removeEventListener(\"storage\", handleStorageChange);\n      // Don't clear connectedParents or readySentTo on cleanup to maintain state across StrictMode remounts\n    };\n  }, []);\n\n  return (\n    <div\n      id=\"auth-session-bridge-root\"\n      data-bridge=\"active\"\n      style={{ display: \"none\" }}\n    />\n  );\n}\n"],"mappings":";;;AAeA,IAAM,IAAgB,yBAChB,IAAY,QACZ,IAAc,eACd,IAAY,qBAYZ,IAA0B,IAAI,IAAI,8qBAwCvC,CAAC;AAEF,SAAS,EAAgB,GAAyB;AAChD,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,EAAO;AAM3B,MAJI,EAAI,aAAa,eAAe,EAAI,aAAa,eAIjD,EAAI,SAAS,SAAS,uBAAuB,CAC/C,QAAO;AAGT,OAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAK7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,SAAO;SACD;AACN,SAAO;;;AAIX,SAAS,IAAyC;AAChD,KAAI;EACF,IAAM,IAAW,aAAa,QAAQ,EAAY,EAC9C,IAAW,eAAe,QAAQ,EAAU;AAIhD,MAAI,CAAC,KAAY,EACf,KAAI;GACF,IAAM,IAAc,KAAK,MAAM,EAAS;AACxC,GAAI,EAAY,SAAS,MACvB,IAAW,EAAY,GAAG,IAC1B,eAAe,QAAQ,GAAW,EAAS;UAEvC;AAKV,MAAI,CAAC,EACH,QAAO;GACL,MAAM;GACN,QAAQ;GACR,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;GAC9C,iBAAiB;GAClB;EAEH,IAAM,IAAO,aAAa,QAAQ,GAAG,EAAU,GAAG,EAAS,OAAO,EAC5D,IAAS,aAAa,QAAQ,GAAG,EAAU,GAAG,EAAS,SAAS,EAChE,IAAU,aAAa,QAC3B,GAAG,EAAU,GAAG,EAAS,kBAC1B;AAED,SAAO;GACL,MAAM,IAAO,KAAK,MAAM,EAAK,GAAG;GAChC,QAAQ,IACJ;IAAE,GAAG,KAAK,MAAM,EAAO;IAAE,gBAAgB,KAAW,KAAA;IAAW,GAC/D;GACJ,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;GAC9C,iBAAiB;GAClB;SACK;AACN,SAAO;GAAE,MAAM;GAAM,QAAQ;GAAM,UAAU,EAAE;GAAE,iBAAiB;GAAM;;;AAI5E,SAAS,EAAe,GAAwC;CAC9D,IAAM,IACH,EAAQ,mBACP,EAAQ,MAAkC,MAC5C,eAAe,QAAQ,EAAU;AAC9B,QAQL;MANI,EAAQ,QACV,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,QAC1B,KAAK,UAAU,EAAQ,KAAK,CAC7B,EAEC,EAAQ,UAAU,OAAO,EAAQ,UAAW,UAAU;GAExD,IAAM,EAAE,mBAAgB,GAAG,MADjB,EAAQ;AAMlB,GAJA,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,UAC1B,KAAK,UAAU,EAAK,CACrB,EACG,KACF,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,mBAC1B,OAAO,EAAe,CACvB;;AAML,EAHI,EAAQ,YACV,aAAa,QAAQ,GAAa,KAAK,UAAU,EAAQ,SAAS,CAAC,EAErE,eAAe,QAAQ,GAAW,EAAU;;;AAG9C,SAAS,IAAuB;CAC9B,IAAM,IAAW,eAAe,QAAQ,EAAU;AAClD,KAAI,GAAU;AAIZ,EAHA,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,OAAO,EACxD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,SAAS,EAC1D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,kBAAkB,EACnE,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,eAAe;AAEhE,MAAI;GACF,IAAM,IAAM,aAAa,QAAQ,EAAY,EACvC,IAAW,IAAM,KAAK,MAAM,EAAI,GAAG,EAAE;AAC3C,gBAAa,QACX,GACA,KAAK,UACH,EAAS,QAAQ,MAAsB,EAAE,OAAO,EAAS,CAC1D,CACF;UACK;AAGR,iBAAe,WAAW,EAAU;;AAEtC,cAAa,WAAW,eAAe;;AAGzC,SAAS,IAA0B;AAEjC,KAAI;EACF,IAAM,IAAM,aAAa,QAAQ,EAAY,EACvC,IAAkC,IAAM,KAAK,MAAM,EAAI,GAAG,EAAE;AAClE,OAAK,IAAM,KAAK,EAKd,CAJA,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,OAAO,EACpD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,SAAS,EACtD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,kBAAkB,EAC/D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,eAAe,EAC5D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,UAAU;SAEnD;AAGR,MAAK,IAAM,KAAO,OAAO,KAAK,aAAa,CACzC,CAAI,EAAI,WAAW,GAAG,EAAU,GAAG,IAAI,EAAI,SAAS,gBAAgB,IAClE,aAAa,WAAW,EAAI;AAKhC,CAFA,aAAa,WAAW,EAAY,EACpC,aAAa,WAAW,eAAe,EACvC,eAAe,WAAW,EAAU;;AAItC,IAAM,IAAkB,kBAClB,IAAwB;AAC9B,SAAS,EAAmB,GAAmB,GAAsB;AACnE,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAc,KAAK,UAAU;GAAE,IAAI;GAAW;GAAQ,CAAC;AAC7D,WAAS,SAAS,GAAG,EAAgB,GAAG,mBAAmB,EAAY,GAAG,EAAW,wBAAwB,EAAW;SAClH;;AAKV,SAAS,EAAwB,GAAmB,GAAsB;AACxE,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAAE,IAAI;GAAW;GAAQ,CAAC;AAC1D,WAAS,SAAS,GAAG,EAAsB,GAAG,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;SACrH;;AAKV,SAAS,IAA6B;AACpC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AAOJ,EANA,SAAS,SAAS,GAAG,EAAgB,uBACrC,SAAS,SAAS,GAAG,EAAsB,uBACvC,MACF,SAAS,SAAS,GAAG,EAAgB,oBAAoB,EAAO,cAChE,SAAS,SAAS,GAAG,EAAsB,oBAAoB,EAAO,eAEpE,KAAY,CAAC,CAAC,aAAa,YAAY,CAAC,SAAS,EAAS,KAC5D,SAAS,SAAS,GAAG,EAAgB,oBAAoB,EAAS,cAClE,SAAS,SAAS,GAAG,EAAsB,oBAAoB,EAAS;SAEpE;;AAKV,SAAgB,IAAoB;CAClC,IAAM,IAAmB,kBAAgC,IAAI,KAAK,CAAC,EAC7D,IAAmB,EAAO,GAAM,EAChC,IAAc,kBAAgC,IAAI,KAAK,CAAC,EACxD,IAAuB,EAAO,GAAM;AAsM1C,QAjMA,QAAgB;EACd,eAAe,IAAgB;AAC7B,OAAI;AAEF,QAAI,CAAC,SAAS,sBAAsB;AAClC,OAAqB,UAAU;AAC/B;;AAIF,QADkB,MAAM,SAAS,kBAAkB,EACpC;AACb,OAAqB,UAAU;AAC/B;;AAIF,IADA,MAAM,SAAS,sBAAsB,EACrC,EAAqB,UAAU;WACzB;AAGN,MAAqB,UAAU;;;AAG9B,KAAe;IACnB,EAAE,CAAC,EAEN,QAAgB;EACd,SAAS,EAAgB,GAAyB;AAChD,UAAO,EAAgB,EAAO;;EAGhC,SAAS,EACP,GACA,GACM;AAIN,GAHI,OAAO,UAAU,OAAO,WAAW,UACrC,OAAO,OAAO,YAAY,GAAS,IAAI,EAEzC,EAAiB,QAAQ,SAAS,MAAW;AAC3C,IAAI,MAAW,KAAiB,iBAAiB,KAC9C,EAAkB,YAAY,GAAS,IAAI;KAE9C;;EAGJ,SAAS,EAAc,GAA2B;AAChD,OAAI,CAAC,EAAgB,EAAM,OAAO,CAAE;GACpC,IAAM,IAAU,EAAM;AAClB,UAAC,GAAS,QAAQ,EAAQ,WAAW,GAEzC,SAAQ,EAAQ,MAAhB;IACE,KAAK,aAAa;AAKhB,SAJI,EAAM,UAAQ,EAAiB,QAAQ,IAAI,EAAM,OAAO,EAIxD,EAAQ,WAAW,OAAO,EAAQ,WAAY,UAAU;MAC1D,IAAM,IAAc,EAAQ;AAC5B,MAAI,EAAY,QAAQ,EAAY,UAClC,EAAe,EAAY;;KAI/B,IAAM,IAAQ,GAAe;AAC7B,KAAI,EAAM,UAAU,iBAAiB,EAAM,WACxC,EAAM,OAAkB,YACvB;MAAE,MAAM;MAAc,SAAS;MAAO,QAAQ;MAAe,EAC7D,EAAM,OACP,EACI,EAAY,QAAQ,IAAI,EAAM,OAAO,KACxC,EAAY,QAAQ,IAAI,EAAM,OAAO,EACpC,EAAM,OAAkB,YACvB;MAAE,MAAM;MAAqB,QAAQ;MAAe,EACpD,EAAM,OACP;AAGL;;IAEF,KAAK;AACH,SAAI,EAAQ,SAAS;AACnB,QAAe,EAAQ,QAAQ;MAE/B,IAAM,IAAe,EAAQ,SACvB,IACH,EAAa,mBACZ,EAAa,MAAkC;AAMnD,MALI,MACF,GAAsB,EACtB,EAAmB,GAAgB,EAAM,OAAO,EAChD,EAAwB,GAAgB,EAAM,OAAO,GAEvD,EACE;OACE,MAAM;OACN,SAAS;QAAE,GAAG,GAAe;QAAE,SAAS;QAAS;OACjD,QAAQ;OACT,EACD,EAAM,OACP;;AAEH;IAEF,KAAK;AAGH,KAFA,GAAgB,EAChB,GAAsB,EACtB,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAU;MAClD,QAAQ;MACT,EACD,EAAM,OACP;AACD;IAEF,KAAK;AAGH,KAFA,GAAmB,EACnB,GAAsB,EACtB,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAc;MACtD,QAAQ;MACT,EACD,EAAM,OACP;AACD;IAEF,KAAK;AACH,KAAI,EAAQ,SAAS,WACnB,EAAe,EAAE,QAAQ,EAAQ,QAAQ,QAAQ,CAAC,EAClD,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAW;MACnD,QAAQ;MACT,EACD,EAAM,OACP;AAEH;IAEF,KAAK;AACH,KAAI,EAAQ,YACV,EAAe,EAAQ,QAAQ,EAC/B,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAkB;MAC1D,QAAQ;MACT,EACD,EAAM,OACP;AAEH;;;EAKN,SAAS,EAAoB,GAA2B;AACtD,IAAI,EAAM,KAAK,WAAW,EAAU,IAAI,EAAM,QAAQ,MACpD,EAAe;IACb,MAAM;IACN,SAAS;KAAE,GAAG,GAAe;KAAE,SAAS;KAAgB;IACxD,QAAQ;IACT,CAAC;;AAoBN,SAhBA,OAAO,iBAAiB,WAAW,EAAc,EACjD,OAAO,iBAAiB,WAAW,EAAoB,EAIrD,OAAO,UACP,OAAO,WAAW,UAClB,CAAC,EAAiB,YAElB,EAAiB,UAAU,IAC3B,OAAO,OAAO,YACZ;GAAE,MAAM;GAAqB,QAAQ;GAAe,EACpD,IACD,SAGU;AAEX,GADA,OAAO,oBAAoB,WAAW,EAAc,EACpD,OAAO,oBAAoB,WAAW,EAAoB;;IAG3D,EAAE,CAAC,EAGJ,kBAAC,OAAD;EACE,IAAG;EACH,eAAY;EACZ,OAAO,EAAE,SAAS,QAAQ;EAC1B,CAAA"}

package/dist/index.js

@@ -11,10 +11,11 @@ import { usePasswordOperations as c } from "./auth/hooks/usePasswordOperations.j
 import { useSessionOperations as l } from "./auth/hooks/useSessionOperations.js";
 import { useWorkspaceOperations as u } from "./auth/hooks/useWorkspaceOperations.js";
 import { useContextSwitcherData as d, useProjectSyncEffect as f, useWorkspaceSyncEffect as p } from "./auth/hooks/useContextSwitcherData.js";
-import { useUserOperations as m } from "./auth/hooks/useUserOperations.js";
-import { useWorkspaceToken as h } from "./auth/hooks/useWorkspaceToken.js";
-import { useTokenRefresh as g } from "./auth/hooks/useTokenRefresh.js";
-import { WorkspaceSelector as _ } from "./auth/components/workspace/WorkspaceSelector.js";
-import { UserProfileMenu as v } from "./auth/components/profile/UserProfileMenu.js";
+import { useActiveContextBootstrapMirror as m } from "./auth/hooks/useActiveContextBootstrapMirror.js";
+import { useUserOperations as h } from "./auth/hooks/useUserOperations.js";
+import { useWorkspaceToken as g } from "./auth/hooks/useWorkspaceToken.js";
+import { useTokenRefresh as _ } from "./auth/hooks/useTokenRefresh.js";
+import { WorkspaceSelector as v } from "./auth/components/workspace/WorkspaceSelector.js";
+import { UserProfileMenu as y } from "./auth/components/profile/UserProfileMenu.js";
 import "./auth/index.js";
-export { o as AuthRoot, a as SSORelayCallbackPage, i as SSORelayPage, v as UserProfileMenu, _ as WorkspaceSelector, e as useAuth, n as useAuthOperations, t as useAuthStore, d as useContextSwitcherData, s as useMfaOperations, r as useMyWorkspaces, c as usePasswordOperations, f as useProjectSyncEffect, l as useSessionOperations, g as useTokenRefresh, m as useUserOperations, u as useWorkspaceOperations, p as useWorkspaceSyncEffect, h as useWorkspaceToken };
+export { o as AuthRoot, a as SSORelayCallbackPage, i as SSORelayPage, y as UserProfileMenu, v as WorkspaceSelector, m as useActiveContextBootstrapMirror, e as useAuth, n as useAuthOperations, t as useAuthStore, d as useContextSwitcherData, s as useMfaOperations, r as useMyWorkspaces, c as usePasswordOperations, f as useProjectSyncEffect, l as useSessionOperations, _ as useTokenRefresh, h as useUserOperations, u as useWorkspaceOperations, p as useWorkspaceSyncEffect, g as useWorkspaceToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/microfe-auth",
-  "version": "2026.624.1",
+  "version": "2026.624.3",
   "description": "Auth microfrontend for Burdenoff products",
   "type": "module",
   "imports": {