@burdenoff/microfe-auth 2026.718.1 → 2026.718.2

package/dist/auth/pages/SSOClearPage.js

@@ -1,37 +1,31 @@
-import { useEffect as e } from "react";
-import { clearLocalAuthState as t } from "@burdenoff/fe-libs/shared/components";
-import { useSearchParams as n } from "react-router-dom";
-import { jsx as r } from "react/jsx-runtime";
-import { clearShellSsoCookies as i } from "@burdenoff/fe-libs/shared/utils";
-import { BrandedSplash as a } from "@burdenoff/fe-libs/ui";
-import { getAuthBridge as o } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
+import { isAllowedSsoOrigin as e } from "../utils/ssoOrigins.js";
+import { useEffect as t } from "react";
+import { clearLocalAuthState as n } from "@burdenoff/fe-libs/shared/components";
+import { useSearchParams as r } from "react-router-dom";
+import { jsx as i } from "react/jsx-runtime";
+import { clearShellSsoCookies as a } from "@burdenoff/fe-libs/shared/utils";
+import { BrandedSplash as o } from "@burdenoff/fe-libs/ui";
+import { getAuthBridge as s } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
 //#region src/auth/pages/SSOClearPage.tsx
-var s = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
-function c(e) {
-	if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
-	if (e.protocol !== "https:") return !1;
-	for (let t of s) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `admin.${t}` || e.hostname === `alphaadmin.${t}` || e.hostname === `www.${t}`) return !0;
-	return !1;
-}
-function l(e) {
-	if (!e) return "/auth/login?reason=logout";
+function c(t) {
+	if (!t) return "/auth/login?reason=logout";
 	try {
-		let t = new URL(e, window.location.origin);
-		if (t.origin === window.location.origin || c(t)) return t.href;
+		let n = new URL(t, window.location.origin);
+		if (n.origin === window.location.origin || e(n)) return n.href;
 	} catch {}
 	return "/auth/login?reason=logout";
 }
-function u() {
-	let [s] = n();
-	return e(() => {
-		let e = l(s.get("returnTo"));
+function l() {
+	let [e] = r();
+	return t(() => {
+		let t = c(e.get("returnTo"));
 		try {
-			t(), i(), o()?.notifyLogoutAll();
+			n(), a(), s()?.notifyLogoutAll();
 		} catch {}
-		window.location.replace(e);
-	}, [s]), /* @__PURE__ */ r(a, { label: "Signing you out…" });
+		window.location.replace(t);
+	}, [e]), /* @__PURE__ */ i(o, { label: "Signing you out…" });
 }
 //#endregion
-export { u as SSOClearPage };
+export { l as SSOClearPage };
 
 //# sourceMappingURL=SSOClearPage.js.map

package/dist/auth/pages/SSOClearPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n *   product.com (logout)\n *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n *         — wipes bridge-host localStorage + bf-sso cookie\n *     → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n      // first-party post-logout return targets. Without these, a logout that\n      // detours through the bridge host's /auth/sso-clear rejects the admin\n      // returnTo and strands the operator on app.burdenoff.com/auth/login\n      // instead of returning to the admin origin (BOFF-4120). Mirrors\n      // SSORelayPage.isAllowedRelayTarget and SSODepositPage.isAllowedReturnUrl.\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/auth/login?reason=logout\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n    try {\n      clearLocalAuthState();\n      clearShellSsoCookies();\n      // Broadcast to any same-origin shells still listening so they drop the\n      // session immediately too (best-effort — only fires on the bridge\n      // host's origin, which is the only place where iframe storage isn't\n      // partitioned cross-product).\n      getAuthBridge()?.notifyLogoutAll();\n    } catch {\n      /* ignore — proceed with the redirect regardless */\n    }\n\n    window.location.replace(returnTo);\n  }, [searchParams]);\n\n  return <BrandedSplash label=\"Signing you out…\" />;\n}\n"],"mappings":";;;;;;;;AA4BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAO7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAoBxC,QAlBA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC;AAEhE,MAAI;AAOF,GANA,GAAqB,EACrB,GAAsB,EAKtB,GAAe,EAAE,iBAAiB;UAC5B;AAIR,SAAO,SAAS,QAAQ,EAAS;IAChC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,oBAAqB,CAAA"}
+{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n *   product.com (logout)\n *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n *         — wipes bridge-host localStorage + bf-sso cookie\n *     → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { isAllowedSsoOrigin } from \"../utils/ssoOrigins\";\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/auth/login?reason=logout\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedSsoOrigin(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n    try {\n      clearLocalAuthState();\n      clearShellSsoCookies();\n      // Broadcast to any same-origin shells still listening so they drop the\n      // session immediately too (best-effort — only fires on the bridge\n      // host's origin, which is the only place where iframe storage isn't\n      // partitioned cross-product).\n      getAuthBridge()?.notifyLogoutAll();\n    } catch {\n      /* ignore — proceed with the redirect regardless */\n    }\n\n    window.location.replace(returnTo);\n  }, [searchParams]);\n\n  return <BrandedSplash label=\"Signing you out…\" />;\n}\n"],"mappings":";;;;;;;;;AA6BA,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAoBxC,QAlBA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC;AAEhE,MAAI;AAOF,GANA,GAAqB,EACrB,GAAsB,EAKtB,GAAe,EAAE,iBAAiB;UAC5B;AAIR,SAAO,SAAS,QAAQ,EAAS;IAChC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,oBAAqB,CAAA"}

package/dist/auth/pages/SSODepositPage.js

@@ -1,52 +1,46 @@
 import { useAuthStore as e } from "../store/authStore.js";
-import { useEffect as t } from "react";
-import { useSearchParams as n } from "react-router-dom";
-import { jsx as r } from "react/jsx-runtime";
-import { setSSoCookie as i } from "@burdenoff/fe-libs/shared/utils";
-import { BrandedSplash as a } from "@burdenoff/fe-libs/ui";
-import { getAuthBridge as o } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
+import { isAllowedSsoOrigin as t } from "../utils/ssoOrigins.js";
+import { useEffect as n } from "react";
+import { useSearchParams as r } from "react-router-dom";
+import { jsx as i } from "react/jsx-runtime";
+import { setSSoCookie as a } from "@burdenoff/fe-libs/shared/utils";
+import { BrandedSplash as o } from "@burdenoff/fe-libs/ui";
+import { getAuthBridge as s } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
 //#region src/auth/pages/SSODepositPage.tsx
-var s = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
 function c(e) {
-	if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
-	if (e.protocol !== "https:") return !1;
-	for (let t of s) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `admin.${t}` || e.hostname === `alphaadmin.${t}` || e.hostname === `www.${t}`) return !0;
-	return !1;
-}
-function l(e) {
 	if (!e) return "/";
 	try {
-		let t = new URL(e, window.location.origin);
-		if (t.origin === window.location.origin || c(t)) return t.href;
+		let n = new URL(e, window.location.origin);
+		if (n.origin === window.location.origin || t(n)) return n.href;
 	} catch {}
 	return "/";
 }
-function u() {
-	let [s] = n();
-	return t(() => {
-		let t = l(s.get("returnTo")), n = window.location.hash;
-		if (!n.startsWith("#sso=")) {
-			window.location.replace(t);
+function l() {
+	let [t] = r();
+	return n(() => {
+		let n = c(t.get("returnTo")), r = window.location.hash;
+		if (!r.startsWith("#sso=")) {
+			window.location.replace(n);
 			return;
 		}
 		try {
-			let r = n.slice(5), { profileId: a, tokens: s, user: c, profiles: l } = JSON.parse(atob(r));
-			if (!a || !s) {
-				window.location.replace(t);
+			let t = r.slice(5), { profileId: i, tokens: o, user: c, profiles: l } = JSON.parse(atob(t));
+			if (!i || !o) {
+				window.location.replace(n);
 				return;
 			}
-			localStorage.setItem(`bf-p-${a}-tokens`, s), c && localStorage.setItem(`bf-p-${a}-user`, c), l && localStorage.setItem("bf-profiles", l), sessionStorage.setItem("bf-active-profile", a), i(a), e.getState().loadFromProfile(a), window.dispatchEvent(new Event("bf-profile-storage-change")), o()?.notifyLogin({
+			localStorage.setItem(`bf-p-${i}-tokens`, o), c && localStorage.setItem(`bf-p-${i}-user`, c), l && localStorage.setItem("bf-profiles", l), sessionStorage.setItem("bf-active-profile", i), a(i), e.getState().loadFromProfile(i), window.dispatchEvent(new Event("bf-profile-storage-change")), s()?.notifyLogin({
 				user: c ? JSON.parse(c) : null,
-				tokens: s ? JSON.parse(s) : null,
-				activeProfileId: a,
+				tokens: o ? JSON.parse(o) : null,
+				activeProfileId: i,
 				profiles: l ? JSON.parse(l) : []
-			}), window.location.replace(t);
+			}), window.location.replace(n);
 		} catch {
-			window.location.replace(t);
+			window.location.replace(n);
 		}
-	}, [s]), /* @__PURE__ */ r(a, { label: "Signing you in…" });
+	}, [t]), /* @__PURE__ */ i(o, { label: "Signing you in…" });
 }
 //#endregion
-export { u as SSODepositPage };
+export { l as SSODepositPage };
 
 //# sourceMappingURL=SSODepositPage.js.map

package/dist/auth/pages/SSODepositPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n *   1. A later top-level visit to the bridge host renders authenticated.\n *   2. Other product origins can discover the session via\n *      `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n *   product.com/auth/login    → user signs in\n *   product.com               → POST-success redirect to:\n *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n *                             → writes tokens here, sets bf-sso cookie\n *   <returnTo>                → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_RETURN_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n      // valid post-deposit return targets. Without these, a login that lands on\n      // the bridge host falls back to \"/\" instead of returning to the admin app.\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/\";\n}\n\nexport function SSODepositPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      window.location.replace(returnTo);\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5);\n      const payload = JSON.parse(atob(encoded)) as {\n        profileId?: string;\n        tokens?: string;\n        user?: string;\n        profiles?: string;\n      };\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(returnTo);\n        return;\n      }\n\n      // First-party (unpartitioned) writes on the bridge host origin —\n      // future top-level visits here see the session.\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the same-origin auth bridge so any other open shells on\n      // this origin pick up the new session immediately.\n      getAuthBridge()?.notifyLogin({\n        user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n        tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n        activeProfileId: profileId,\n        profiles: profiles\n          ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n          : [],\n      });\n\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(returnTo);\n    }\n  }, [searchParams]);\n\n  return <BrandedSplash label=\"Signing you in…\" />;\n}\n"],"mappings":";;;;;;;;AA8BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAI7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAiB;CAC/B,IAAM,CAAC,KAAgB,GAAiB;AAyDxC,QAvDA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC,EAC1D,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAC7B,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAOvB,EAAE,cAAW,WAAQ,SAAM,gBANjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAQzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,EAAS;AACjC;;AA4BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAI5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAQ,KAAK,MAAM,EAAK,GAA+B;IAC7D,QAAQ,IAAU,KAAK,MAAM,EAAO,GAA+B;IACnE,iBAAiB;IACjB,UAAU,IACL,KAAK,MAAM,EAAS,GACrB,EAAE;IACP,CAAC,EAEF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,EAAS;;IAElC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,mBAAoB,CAAA"}
+{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n *   1. A later top-level visit to the bridge host renders authenticated.\n *   2. Other product origins can discover the session via\n *      `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n *   product.com/auth/login    → user signs in\n *   product.com               → POST-success redirect to:\n *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n *                             → writes tokens here, sets bf-sso cookie\n *   <returnTo>                → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { isAllowedSsoOrigin } from \"../utils/ssoOrigins\";\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n  if (!returnTo) return \"/\";\n  try {\n    const url = new URL(returnTo, window.location.origin);\n    if (url.origin === window.location.origin || isAllowedSsoOrigin(url)) {\n      return url.href;\n    }\n  } catch {\n    /* ignore */\n  }\n  return \"/\";\n}\n\nexport function SSODepositPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n    const hash = window.location.hash;\n\n    if (!hash.startsWith(\"#sso=\")) {\n      window.location.replace(returnTo);\n      return;\n    }\n\n    try {\n      const encoded = hash.slice(5);\n      const payload = JSON.parse(atob(encoded)) as {\n        profileId?: string;\n        tokens?: string;\n        user?: string;\n        profiles?: string;\n      };\n      const { profileId, tokens, user, profiles } = payload;\n\n      if (!profileId || !tokens) {\n        window.location.replace(returnTo);\n        return;\n      }\n\n      // First-party (unpartitioned) writes on the bridge host origin —\n      // future top-level visits here see the session.\n      localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n      if (user) {\n        localStorage.setItem(`bf-p-${profileId}-user`, user);\n      }\n      if (profiles) {\n        localStorage.setItem(\"bf-profiles\", profiles);\n      }\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      setSSoCookie(profileId);\n      useAuthStore.getState().loadFromProfile(profileId);\n      window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n      // Notify the same-origin auth bridge so any other open shells on\n      // this origin pick up the new session immediately.\n      getAuthBridge()?.notifyLogin({\n        user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n        tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n        activeProfileId: profileId,\n        profiles: profiles\n          ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n          : [],\n      });\n\n      window.location.replace(returnTo);\n    } catch {\n      window.location.replace(returnTo);\n    }\n  }, [searchParams]);\n\n  return <BrandedSplash label=\"Signing you in…\" />;\n}\n"],"mappings":";;;;;;;;;AA+BA,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAiB;CAC/B,IAAM,CAAC,KAAgB,GAAiB;AAyDxC,QAvDA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC,EAC1D,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAC7B,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAOvB,EAAE,cAAW,WAAQ,SAAM,gBANjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAQzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,EAAS;AACjC;;AA4BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAI5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAQ,KAAK,MAAM,EAAK,GAA+B;IAC7D,QAAQ,IAAU,KAAK,MAAM,EAAO,GAA+B;IACnE,iBAAiB;IACjB,UAAU,IACL,KAAK,MAAM,EAAS,GACrB,EAAE;IACP,CAAC,EAEF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,EAAS;;IAElC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,mBAAoB,CAAA"}

package/dist/auth/pages/SSORelayPage.js

@@ -1,42 +1,37 @@
-import { useEffect as e } from "react";
-import { useSearchParams as t } from "react-router-dom";
-import { jsx as n } from "react/jsx-runtime";
+import { isAllowedSsoOrigin as e } from "../utils/ssoOrigins.js";
+import { useEffect as t } from "react";
+import { useSearchParams as n } from "react-router-dom";
+import { jsx as r } from "react/jsx-runtime";
 //#region src/auth/pages/SSORelayPage.tsx
-var r = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(",")), i = "relayChain", a = "sso_failed", o = new Set(["localhost", "127.0.0.1"]), s = {
+var i = "relayChain", a = "sso_failed", o = new Set(["localhost", "127.0.0.1"]), s = {
 	"bf-sso": /(?:^|;\s*)bf-sso=([^;]*)/,
 	"bf-sso-profile": /(?:^|;\s*)bf-sso-profile=([^;]*)/
 };
-function c(e) {
-	if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
-	if (e.protocol !== "https:") return !1;
-	for (let t of r) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `admin.${t}` || e.hostname === `alphaadmin.${t}` || e.hostname === `www.${t}`) return !0;
-	return !1;
-}
-function l() {
+function c() {
 	try {
 		let e = window.location.hostname, t = e.endsWith(".local.burdenoff.com") ? ".local.burdenoff.com" : void 0;
 		for (let n of ["bf-sso", "bf-sso-profile"]) document.cookie = `${n}=; path=/; max-age=0`, t && (document.cookie = `${n}=; path=/; domain=${t}; max-age=0`), e && !o.has(e) && (document.cookie = `${n}=; path=/; domain=${e}; max-age=0`);
 	} catch {}
 }
-function u() {
+function l() {
 	try {
 		return (new URLSearchParams(window.location.search).get(i) || "").split("|").filter((e) => e.length > 0);
 	} catch {
 		return [];
 	}
 }
-function d(e) {
+function u(t) {
 	try {
-		let t = new URL(e, window.location.origin);
-		return t.origin !== window.location.origin && !c(t) ? "/auth/login" : (t.searchParams.set(a, "1"), t.href);
+		let n = new URL(t, window.location.origin);
+		return n.origin !== window.location.origin && !e(n) ? "/auth/login" : (n.searchParams.set(a, "1"), n.href);
 	} catch {
 		return "/auth/login?sso_failed=1";
 	}
 }
-function f() {
-	return p()?.id ?? null;
+function d() {
+	return f()?.id ?? null;
 }
-function p() {
+function f() {
 	try {
 		for (let e of ["bf-sso", "bf-sso-profile"]) {
 			let t = document.cookie.match(s[e]);
@@ -56,36 +51,36 @@ function p() {
 	}
 	return null;
 }
-function m(e) {
+function p(t) {
 	try {
-		let t = p();
-		if (!t?.origin) return !1;
-		let n = new URL(t.origin);
-		if (!c(n) || n.origin === window.location.origin) return !1;
-		let r = u();
-		if (r.includes(n.origin) || r.length >= 3) return !1;
-		let a = new URL("/auth/sso-relay", n.origin);
-		return a.searchParams.set("returnTo", e), a.searchParams.set(i, Array.from(new Set([...r, window.location.origin])).join("|")), window.location.replace(a.href), !0;
+		let n = f();
+		if (!n?.origin) return !1;
+		let r = new URL(n.origin);
+		if (!e(r) || r.origin === window.location.origin) return !1;
+		let a = l();
+		if (a.includes(r.origin) || a.length >= 3) return !1;
+		let o = new URL("/auth/sso-relay", r.origin);
+		return o.searchParams.set("returnTo", t), o.searchParams.set(i, Array.from(new Set([...a, window.location.origin])).join("|")), window.location.replace(o.href), !0;
 	} catch {
 		return !1;
 	}
 }
-function h() {
+function m() {
 	return localStorage.getItem("bf-profiles");
 }
-function g() {
+function h() {
 	try {
-		let e = h();
+		let e = m();
 		return (e ? JSON.parse(e) : []).map((e) => e.id).filter((e) => typeof e == "string" && e.length > 0);
 	} catch {
 		return [];
 	}
 }
-function _() {
+function g() {
 	let e = [
-		f(),
+		d(),
 		sessionStorage.getItem("bf-active-profile"),
-		...g()
+		...h()
 	].filter((e) => typeof e == "string" && e.length > 0);
 	for (let t of Array.from(new Set(e))) {
 		let e = localStorage.getItem(`bf-p-${t}-tokens`), n = localStorage.getItem(`bf-p-${t}-user`);
@@ -93,51 +88,51 @@ function _() {
 	}
 	return null;
 }
-function v() {
-	let [r] = t();
-	return e(() => {
-		let e = r.get("returnTo");
-		if (!e) {
+function _() {
+	let [i] = n();
+	return t(() => {
+		let t = i.get("returnTo");
+		if (!t) {
 			window.location.replace("/");
 			return;
 		}
-		let t = _();
-		if (!t) {
-			if (m(e)) return;
-			l(), window.location.replace(d(e));
+		let n = g();
+		if (!n) {
+			if (p(t)) return;
+			c(), window.location.replace(u(t));
 			return;
 		}
-		let n = localStorage.getItem(`bf-p-${t}-tokens`), i = localStorage.getItem(`bf-p-${t}-user`), a = h();
-		if (!n || !i) {
-			if (m(e)) return;
-			l(), window.location.replace(d(e));
+		let r = localStorage.getItem(`bf-p-${n}-tokens`), a = localStorage.getItem(`bf-p-${n}-user`), o = m();
+		if (!r || !a) {
+			if (p(t)) return;
+			c(), window.location.replace(u(t));
 			return;
 		}
-		let o = btoa(JSON.stringify({
-			profileId: t,
-			tokens: n,
-			user: i,
-			profiles: a
-		})), s;
+		let s = btoa(JSON.stringify({
+			profileId: n,
+			tokens: r,
+			user: a,
+			profiles: o
+		})), l;
 		try {
-			let t = new URL(e);
-			if (!c(t)) {
+			let n = new URL(t);
+			if (!e(n)) {
 				window.location.replace("/");
 				return;
 			}
-			let n = t.pathname + t.search;
-			s = `${t.origin}/auth/sso-callback?returnTo=${encodeURIComponent(n)}#sso=${o}`;
+			let r = n.pathname + n.search;
+			l = `${n.origin}/auth/sso-callback?returnTo=${encodeURIComponent(r)}#sso=${s}`;
 		} catch {
-			window.location.replace(e);
+			window.location.replace(t);
 			return;
 		}
-		window.location.replace(s);
-	}, [r]), /* @__PURE__ */ n("div", {
+		window.location.replace(l);
+	}, [i]), /* @__PURE__ */ r("div", {
 		className: "flex items-center justify-center min-h-screen bg-bg-canvas",
-		children: /* @__PURE__ */ n("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
+		children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
 	});
 }
 //#endregion
-export { v as SSORelayPage };
+export { _ as SSORelayPage };
 
 //# sourceMappingURL=SSORelayPage.js.map

package/dist/auth/pages/SSORelayPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SSORelayPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayPage.tsx"],"sourcesContent":["/**\n * SSORelayPage — Cross-domain SSO token relay.\n *\n * This page is loaded on the ORIGIN where the user is logged in.\n * It reads tokens from localStorage and redirects to the TARGET domain's\n * /auth/sso-callback with the tokens in a URL fragment (not query param\n * for security — fragments are not sent to servers).\n *\n * Flow:\n * 1. User visits productA.com → not logged in → detects SSO cookie\n * 2. Redirect to productB.com/auth/sso-relay?returnTo=productA.com/dashboard\n *    (productB is where the user IS logged in — identified by cookie)\n * 3. This page reads tokens from productB's localStorage\n * 4. Redirects to productA.com/auth/sso-callback#token=<base64-encoded-tokens>\n * 5. SSORelayCallbackPage on productA decodes and stores tokens, redirects to /dashboard\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\n\nconst ALLOWED_RELAY_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nconst RELAY_CHAIN_PARAM = \"relayChain\";\nconst RELAY_FAILED_PARAM = \"sso_failed\";\nconst LOCAL_HOSTNAMES = new Set([\"localhost\", \"127.0.0.1\"]);\n\nconst SSO_COOKIE_PATTERNS = {\n  \"bf-sso\": /(?:^|;\\s*)bf-sso=([^;]*)/,\n  \"bf-sso-profile\": /(?:^|;\\s*)bf-sso-profile=([^;]*)/,\n} as const;\n\nfunction isAllowedRelayTarget(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") {\n    return true;\n  }\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) {\n    return true;\n  }\n  if (url.protocol !== \"https:\") {\n    return false;\n  }\n  for (const domain of ALLOWED_RELAY_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n      // first-party SSO relay targets. Without these the relay-back to the\n      // admin shell fails isAllowedRelayTarget() and SSORelayPage falls through\n      // to window.location.replace(\"/\"), stranding the user on app.burdenoff.com.\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction clearRelayCookies(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      document.cookie = `${cookieName}=; path=/; max-age=0`;\n      if (domain) {\n        document.cookie = `${cookieName}=; path=/; domain=${domain}; max-age=0`;\n      }\n      if (hostname && !LOCAL_HOSTNAMES.has(hostname)) {\n        document.cookie = `${cookieName}=; path=/; domain=${hostname}; max-age=0`;\n      }\n    }\n  } catch {\n    /* best effort */\n  }\n}\n\nfunction getRelayChain(): string[] {\n  try {\n    return (\n      new URLSearchParams(window.location.search).get(RELAY_CHAIN_PARAM) || \"\"\n    )\n      .split(\"|\")\n      .filter((origin) => origin.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction getFailedReturnTo(returnTo: string): string {\n  try {\n    const targetUrl = new URL(returnTo, window.location.origin);\n    if (\n      targetUrl.origin !== window.location.origin &&\n      !isAllowedRelayTarget(targetUrl)\n    ) {\n      return \"/auth/login\";\n    }\n    targetUrl.searchParams.set(RELAY_FAILED_PARAM, \"1\");\n    return targetUrl.href;\n  } catch {\n    return \"/auth/login?sso_failed=1\";\n  }\n}\n\nfunction readSsoCookieProfileId(): string | null {\n  return readSsoCookieData()?.id ?? null;\n}\n\nfunction readSsoCookieData(): {\n  id: string | null;\n  origin: string | null;\n} | null {\n  try {\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      const match = document.cookie.match(SSO_COOKIE_PATTERNS[cookieName]);\n      if (!match) continue;\n\n      const parsed = JSON.parse(decodeURIComponent(match[1])) as\n        | string\n        | { id?: unknown; origin?: unknown };\n      if (typeof parsed === \"string\") return { id: parsed, origin: null };\n      if (typeof parsed.id === \"string\" && parsed.id.length > 0) {\n        return {\n          id: parsed.id,\n          origin: typeof parsed.origin === \"string\" ? parsed.origin : null,\n        };\n      }\n    }\n  } catch {\n    return null;\n  }\n  return null;\n}\n\nfunction redirectToCookieRelayOrigin(returnTo: string): boolean {\n  try {\n    const ssoCookie = readSsoCookieData();\n    if (!ssoCookie?.origin) return false;\n\n    const relayUrl = new URL(ssoCookie.origin);\n    if (!isAllowedRelayTarget(relayUrl)) return false;\n    if (relayUrl.origin === window.location.origin) return false;\n\n    const relayChain = getRelayChain();\n    if (relayChain.includes(relayUrl.origin) || relayChain.length >= 3) {\n      return false;\n    }\n\n    const nextRelayUrl = new URL(\"/auth/sso-relay\", relayUrl.origin);\n    nextRelayUrl.searchParams.set(\"returnTo\", returnTo);\n    nextRelayUrl.searchParams.set(\n      RELAY_CHAIN_PARAM,\n      Array.from(new Set([...relayChain, window.location.origin])).join(\"|\"),\n    );\n\n    window.location.replace(nextRelayUrl.href);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction readProfilesRaw(): string | null {\n  return localStorage.getItem(\"bf-profiles\");\n}\n\nfunction readProfileIds(): string[] {\n  try {\n    const profilesRaw = readProfilesRaw();\n    const profiles = profilesRaw\n      ? (JSON.parse(profilesRaw) as Array<{ id?: unknown }>)\n      : [];\n    return profiles\n      .map((profile) => profile.id)\n      .filter((id): id is string => typeof id === \"string\" && id.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction resolveRelayProfileId(): string | null {\n  const candidates = [\n    readSsoCookieProfileId(),\n    sessionStorage.getItem(\"bf-active-profile\"),\n    ...readProfileIds(),\n  ].filter((id): id is string => typeof id === \"string\" && id.length > 0);\n\n  for (const profileId of Array.from(new Set(candidates))) {\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    if (tokensRaw && userRaw) {\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      return profileId;\n    }\n  }\n\n  return null;\n}\n\nexport function SSORelayPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = searchParams.get(\"returnTo\");\n    if (!returnTo) {\n      // No relay target — there is nothing to relay to. Do NOT strand the user\n      // on a perpetual spinner (HM-016): send them to the app root, which routes\n      // to the dashboard when authenticated or the landing/login when not.\n      window.location.replace(\"/\");\n      return;\n    }\n\n    // Read tokens from localStorage (this origin has them). Prefer the shared\n    // SSO cookie profile because a relay often runs in a new tab with empty\n    // sessionStorage and stale historical profiles in localStorage.\n    const profileId = resolveRelayProfileId();\n    if (!profileId) {\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    const profilesRaw = readProfilesRaw();\n\n    if (!tokensRaw || !userRaw) {\n      // No tokens — redirect back without them\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    // Encode the auth state as a base64 URL fragment\n    const payload = {\n      profileId,\n      tokens: tokensRaw,\n      user: userRaw,\n      profiles: profilesRaw,\n    };\n    const encoded = btoa(JSON.stringify(payload));\n\n    // Build the callback URL on the target domain\n    // Parse returnTo to get the target origin\n    let callbackUrl: string;\n    try {\n      const targetUrl = new URL(returnTo);\n      if (!isAllowedRelayTarget(targetUrl)) {\n        window.location.replace(\"/\");\n        return;\n      }\n      const returnPath = targetUrl.pathname + targetUrl.search;\n      callbackUrl = `${targetUrl.origin}/auth/sso-callback?returnTo=${encodeURIComponent(returnPath)}#sso=${encoded}`;\n    } catch {\n      // returnTo is a relative path — can't do cross-domain relay\n      window.location.replace(returnTo);\n      return;\n    }\n\n    // Redirect to the callback\n    window.location.replace(callbackUrl);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;AAoBA,IAAM,IAAwB,IAAI,IAAI,8qBAwCrC,CAAC,EAEI,IAAoB,cACpB,IAAqB,cACrB,IAAkB,IAAI,IAAI,CAAC,aAAa,YAAY,CAAC,EAErD,IAAsB;CAC1B,UAAU;CACV,kBAAkB;CACnB;AAED,SAAS,EAAqB,GAAmB;AAI/C,KAHI,EAAI,aAAa,eAAe,EAAI,aAAa,eAGjD,EAAI,SAAS,SAAS,uBAAuB,CAC/C,QAAO;AAET,KAAI,EAAI,aAAa,SACnB,QAAO;AAET,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAK7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,IAA0B;AACjC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AACJ,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,CAKnD,CAJA,SAAS,SAAS,GAAG,EAAW,uBAC5B,MACF,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAO,eAEzD,KAAY,CAAC,EAAgB,IAAI,EAAS,KAC5C,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAS;SAG3D;;AAKV,SAAS,IAA0B;AACjC,KAAI;AACF,UACE,IAAI,gBAAgB,OAAO,SAAS,OAAO,CAAC,IAAI,EAAkB,IAAI,IAErE,MAAM,IAAI,CACV,QAAQ,MAAW,EAAO,SAAS,EAAE;SAClC;AACN,SAAO,EAAE;;;AAIb,SAAS,EAAkB,GAA0B;AACnD,KAAI;EACF,IAAM,IAAY,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAQ3D,SANE,EAAU,WAAW,OAAO,SAAS,UACrC,CAAC,EAAqB,EAAU,GAEzB,iBAET,EAAU,aAAa,IAAI,GAAoB,IAAI,EAC5C,EAAU;SACX;AACN,SAAO;;;AAIX,SAAS,IAAwC;AAC/C,QAAO,GAAmB,EAAE,MAAM;;AAGpC,SAAS,IAGA;AACP,KAAI;AACF,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,EAAW;GAC9D,IAAM,IAAQ,SAAS,OAAO,MAAM,EAAoB,GAAY;AACpE,OAAI,CAAC,EAAO;GAEZ,IAAM,IAAS,KAAK,MAAM,mBAAmB,EAAM,GAAG,CAAC;AAGvD,OAAI,OAAO,KAAW,SAAU,QAAO;IAAE,IAAI;IAAQ,QAAQ;IAAM;AACnE,OAAI,OAAO,EAAO,MAAO,YAAY,EAAO,GAAG,SAAS,EACtD,QAAO;IACL,IAAI,EAAO;IACX,QAAQ,OAAO,EAAO,UAAW,WAAW,EAAO,SAAS;IAC7D;;SAGC;AACN,SAAO;;AAET,QAAO;;AAGT,SAAS,EAA4B,GAA2B;AAC9D,KAAI;EACF,IAAM,IAAY,GAAmB;AACrC,MAAI,CAAC,GAAW,OAAQ,QAAO;EAE/B,IAAM,IAAW,IAAI,IAAI,EAAU,OAAO;AAE1C,MADI,CAAC,EAAqB,EAAS,IAC/B,EAAS,WAAW,OAAO,SAAS,OAAQ,QAAO;EAEvD,IAAM,IAAa,GAAe;AAClC,MAAI,EAAW,SAAS,EAAS,OAAO,IAAI,EAAW,UAAU,EAC/D,QAAO;EAGT,IAAM,IAAe,IAAI,IAAI,mBAAmB,EAAS,OAAO;AAQhE,SAPA,EAAa,aAAa,IAAI,YAAY,EAAS,EACnD,EAAa,aAAa,IACxB,GACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,GAAY,OAAO,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CACvE,EAED,OAAO,SAAS,QAAQ,EAAa,KAAK,EACnC;SACD;AACN,SAAO;;;AAIX,SAAS,IAAiC;AACxC,QAAO,aAAa,QAAQ,cAAc;;AAG5C,SAAS,IAA2B;AAClC,KAAI;EACF,IAAM,IAAc,GAAiB;AAIrC,UAHiB,IACZ,KAAK,MAAM,EAAY,GACxB,EAAE,EAEH,KAAK,MAAY,EAAQ,GAAG,CAC5B,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;SAClE;AACN,SAAO,EAAE;;;AAIb,SAAS,IAAuC;CAC9C,IAAM,IAAa;EACjB,GAAwB;EACxB,eAAe,QAAQ,oBAAoB;EAC3C,GAAG,GAAgB;EACpB,CAAC,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;AAEvE,MAAK,IAAM,KAAa,MAAM,KAAK,IAAI,IAAI,EAAW,CAAC,EAAE;EACvD,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO;AAC9D,MAAI,KAAa,EAEf,QADA,eAAe,QAAQ,qBAAqB,EAAU,EAC/C;;AAIX,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAiExC,QA/DA,QAAgB;EACd,IAAM,IAAW,EAAa,IAAI,WAAW;AAC7C,MAAI,CAAC,GAAU;AAIb,UAAO,SAAS,QAAQ,IAAI;AAC5B;;EAMF,IAAM,IAAY,GAAuB;AACzC,MAAI,CAAC,GAAW;AACd,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAGF,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO,EACxD,IAAc,GAAiB;AAErC,MAAI,CAAC,KAAa,CAAC,GAAS;AAE1B,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAUF,IAAM,IAAU,KAAK,KAAK,UANV;GACd;GACA,QAAQ;GACR,MAAM;GACN,UAAU;GACX,CAC2C,CAAC,EAIzC;AACJ,MAAI;GACF,IAAM,IAAY,IAAI,IAAI,EAAS;AACnC,OAAI,CAAC,EAAqB,EAAU,EAAE;AACpC,WAAO,SAAS,QAAQ,IAAI;AAC5B;;GAEF,IAAM,IAAa,EAAU,WAAW,EAAU;AAClD,OAAc,GAAG,EAAU,OAAO,8BAA8B,mBAAmB,EAAW,CAAC,OAAO;UAChG;AAEN,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAIF,SAAO,SAAS,QAAQ,EAAY;IACnC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}
+{"version":3,"file":"SSORelayPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayPage.tsx"],"sourcesContent":["/**\n * SSORelayPage — Cross-domain SSO token relay.\n *\n * This page is loaded on the ORIGIN where the user is logged in.\n * It reads tokens from localStorage and redirects to the TARGET domain's\n * /auth/sso-callback with the tokens in a URL fragment (not query param\n * for security — fragments are not sent to servers).\n *\n * Flow:\n * 1. User visits productA.com → not logged in → detects SSO cookie\n * 2. Redirect to productB.com/auth/sso-relay?returnTo=productA.com/dashboard\n *    (productB is where the user IS logged in — identified by cookie)\n * 3. This page reads tokens from productB's localStorage\n * 4. Redirects to productA.com/auth/sso-callback#token=<base64-encoded-tokens>\n * 5. SSORelayCallbackPage on productA decodes and stores tokens, redirects to /dashboard\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { isAllowedSsoOrigin } from \"../utils/ssoOrigins\";\n\nconst RELAY_CHAIN_PARAM = \"relayChain\";\nconst RELAY_FAILED_PARAM = \"sso_failed\";\nconst LOCAL_HOSTNAMES = new Set([\"localhost\", \"127.0.0.1\"]);\n\nconst SSO_COOKIE_PATTERNS = {\n  \"bf-sso\": /(?:^|;\\s*)bf-sso=([^;]*)/,\n  \"bf-sso-profile\": /(?:^|;\\s*)bf-sso-profile=([^;]*)/,\n} as const;\n\nfunction clearRelayCookies(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      document.cookie = `${cookieName}=; path=/; max-age=0`;\n      if (domain) {\n        document.cookie = `${cookieName}=; path=/; domain=${domain}; max-age=0`;\n      }\n      if (hostname && !LOCAL_HOSTNAMES.has(hostname)) {\n        document.cookie = `${cookieName}=; path=/; domain=${hostname}; max-age=0`;\n      }\n    }\n  } catch {\n    /* best effort */\n  }\n}\n\nfunction getRelayChain(): string[] {\n  try {\n    return (\n      new URLSearchParams(window.location.search).get(RELAY_CHAIN_PARAM) || \"\"\n    )\n      .split(\"|\")\n      .filter((origin) => origin.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction getFailedReturnTo(returnTo: string): string {\n  try {\n    const targetUrl = new URL(returnTo, window.location.origin);\n    if (\n      targetUrl.origin !== window.location.origin &&\n      !isAllowedSsoOrigin(targetUrl)\n    ) {\n      return \"/auth/login\";\n    }\n    targetUrl.searchParams.set(RELAY_FAILED_PARAM, \"1\");\n    return targetUrl.href;\n  } catch {\n    return \"/auth/login?sso_failed=1\";\n  }\n}\n\nfunction readSsoCookieProfileId(): string | null {\n  return readSsoCookieData()?.id ?? null;\n}\n\nfunction readSsoCookieData(): {\n  id: string | null;\n  origin: string | null;\n} | null {\n  try {\n    for (const cookieName of [\"bf-sso\", \"bf-sso-profile\"] as const) {\n      const match = document.cookie.match(SSO_COOKIE_PATTERNS[cookieName]);\n      if (!match) continue;\n\n      const parsed = JSON.parse(decodeURIComponent(match[1])) as\n        string | { id?: unknown; origin?: unknown };\n      if (typeof parsed === \"string\") return { id: parsed, origin: null };\n      if (typeof parsed.id === \"string\" && parsed.id.length > 0) {\n        return {\n          id: parsed.id,\n          origin: typeof parsed.origin === \"string\" ? parsed.origin : null,\n        };\n      }\n    }\n  } catch {\n    return null;\n  }\n  return null;\n}\n\nfunction redirectToCookieRelayOrigin(returnTo: string): boolean {\n  try {\n    const ssoCookie = readSsoCookieData();\n    if (!ssoCookie?.origin) return false;\n\n    const relayUrl = new URL(ssoCookie.origin);\n    if (!isAllowedSsoOrigin(relayUrl)) return false;\n    if (relayUrl.origin === window.location.origin) return false;\n\n    const relayChain = getRelayChain();\n    if (relayChain.includes(relayUrl.origin) || relayChain.length >= 3) {\n      return false;\n    }\n\n    const nextRelayUrl = new URL(\"/auth/sso-relay\", relayUrl.origin);\n    nextRelayUrl.searchParams.set(\"returnTo\", returnTo);\n    nextRelayUrl.searchParams.set(\n      RELAY_CHAIN_PARAM,\n      Array.from(new Set([...relayChain, window.location.origin])).join(\"|\"),\n    );\n\n    window.location.replace(nextRelayUrl.href);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction readProfilesRaw(): string | null {\n  return localStorage.getItem(\"bf-profiles\");\n}\n\nfunction readProfileIds(): string[] {\n  try {\n    const profilesRaw = readProfilesRaw();\n    const profiles = profilesRaw\n      ? (JSON.parse(profilesRaw) as Array<{ id?: unknown }>)\n      : [];\n    return profiles\n      .map((profile) => profile.id)\n      .filter((id): id is string => typeof id === \"string\" && id.length > 0);\n  } catch {\n    return [];\n  }\n}\n\nfunction resolveRelayProfileId(): string | null {\n  const candidates = [\n    readSsoCookieProfileId(),\n    sessionStorage.getItem(\"bf-active-profile\"),\n    ...readProfileIds(),\n  ].filter((id): id is string => typeof id === \"string\" && id.length > 0);\n\n  for (const profileId of Array.from(new Set(candidates))) {\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    if (tokensRaw && userRaw) {\n      sessionStorage.setItem(\"bf-active-profile\", profileId);\n      return profileId;\n    }\n  }\n\n  return null;\n}\n\nexport function SSORelayPage() {\n  const [searchParams] = useSearchParams();\n\n  useEffect(() => {\n    const returnTo = searchParams.get(\"returnTo\");\n    if (!returnTo) {\n      // No relay target — there is nothing to relay to. Do NOT strand the user\n      // on a perpetual spinner (HM-016): send them to the app root, which routes\n      // to the dashboard when authenticated or the landing/login when not.\n      window.location.replace(\"/\");\n      return;\n    }\n\n    // Read tokens from localStorage (this origin has them). Prefer the shared\n    // SSO cookie profile because a relay often runs in a new tab with empty\n    // sessionStorage and stale historical profiles in localStorage.\n    const profileId = resolveRelayProfileId();\n    if (!profileId) {\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    const tokensRaw = localStorage.getItem(`bf-p-${profileId}-tokens`);\n    const userRaw = localStorage.getItem(`bf-p-${profileId}-user`);\n    const profilesRaw = readProfilesRaw();\n\n    if (!tokensRaw || !userRaw) {\n      // No tokens — redirect back without them\n      if (redirectToCookieRelayOrigin(returnTo)) return;\n      clearRelayCookies();\n      window.location.replace(getFailedReturnTo(returnTo));\n      return;\n    }\n\n    // Encode the auth state as a base64 URL fragment\n    const payload = {\n      profileId,\n      tokens: tokensRaw,\n      user: userRaw,\n      profiles: profilesRaw,\n    };\n    const encoded = btoa(JSON.stringify(payload));\n\n    // Build the callback URL on the target domain\n    // Parse returnTo to get the target origin\n    let callbackUrl: string;\n    try {\n      const targetUrl = new URL(returnTo);\n      if (!isAllowedSsoOrigin(targetUrl)) {\n        window.location.replace(\"/\");\n        return;\n      }\n      const returnPath = targetUrl.pathname + targetUrl.search;\n      callbackUrl = `${targetUrl.origin}/auth/sso-callback?returnTo=${encodeURIComponent(returnPath)}#sso=${encoded}`;\n    } catch {\n      // returnTo is a relative path — can't do cross-domain relay\n      window.location.replace(returnTo);\n      return;\n    }\n\n    // Redirect to the callback\n    window.location.replace(callbackUrl);\n  }, [searchParams]);\n\n  return (\n    <div className=\"flex items-center justify-center min-h-screen bg-bg-canvas\">\n      <div className=\"animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent\" />\n    </div>\n  );\n}\n"],"mappings":";;;;;AAqBA,IAAM,IAAoB,cACpB,IAAqB,cACrB,IAAkB,IAAI,IAAI,CAAC,aAAa,YAAY,CAAC,EAErD,IAAsB;CAC1B,UAAU;CACV,kBAAkB;CACnB;AAED,SAAS,IAA0B;AACjC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AACJ,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,CAKnD,CAJA,SAAS,SAAS,GAAG,EAAW,uBAC5B,MACF,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAO,eAEzD,KAAY,CAAC,EAAgB,IAAI,EAAS,KAC5C,SAAS,SAAS,GAAG,EAAW,oBAAoB,EAAS;SAG3D;;AAKV,SAAS,IAA0B;AACjC,KAAI;AACF,UACE,IAAI,gBAAgB,OAAO,SAAS,OAAO,CAAC,IAAI,EAAkB,IAAI,IAErE,MAAM,IAAI,CACV,QAAQ,MAAW,EAAO,SAAS,EAAE;SAClC;AACN,SAAO,EAAE;;;AAIb,SAAS,EAAkB,GAA0B;AACnD,KAAI;EACF,IAAM,IAAY,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAQ3D,SANE,EAAU,WAAW,OAAO,SAAS,UACrC,CAAC,EAAmB,EAAU,GAEvB,iBAET,EAAU,aAAa,IAAI,GAAoB,IAAI,EAC5C,EAAU;SACX;AACN,SAAO;;;AAIX,SAAS,IAAwC;AAC/C,QAAO,GAAmB,EAAE,MAAM;;AAGpC,SAAS,IAGA;AACP,KAAI;AACF,OAAK,IAAM,KAAc,CAAC,UAAU,iBAAiB,EAAW;GAC9D,IAAM,IAAQ,SAAS,OAAO,MAAM,EAAoB,GAAY;AACpE,OAAI,CAAC,EAAO;GAEZ,IAAM,IAAS,KAAK,MAAM,mBAAmB,EAAM,GAAG,CAAC;AAEvD,OAAI,OAAO,KAAW,SAAU,QAAO;IAAE,IAAI;IAAQ,QAAQ;IAAM;AACnE,OAAI,OAAO,EAAO,MAAO,YAAY,EAAO,GAAG,SAAS,EACtD,QAAO;IACL,IAAI,EAAO;IACX,QAAQ,OAAO,EAAO,UAAW,WAAW,EAAO,SAAS;IAC7D;;SAGC;AACN,SAAO;;AAET,QAAO;;AAGT,SAAS,EAA4B,GAA2B;AAC9D,KAAI;EACF,IAAM,IAAY,GAAmB;AACrC,MAAI,CAAC,GAAW,OAAQ,QAAO;EAE/B,IAAM,IAAW,IAAI,IAAI,EAAU,OAAO;AAE1C,MADI,CAAC,EAAmB,EAAS,IAC7B,EAAS,WAAW,OAAO,SAAS,OAAQ,QAAO;EAEvD,IAAM,IAAa,GAAe;AAClC,MAAI,EAAW,SAAS,EAAS,OAAO,IAAI,EAAW,UAAU,EAC/D,QAAO;EAGT,IAAM,IAAe,IAAI,IAAI,mBAAmB,EAAS,OAAO;AAQhE,SAPA,EAAa,aAAa,IAAI,YAAY,EAAS,EACnD,EAAa,aAAa,IACxB,GACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,GAAY,OAAO,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CACvE,EAED,OAAO,SAAS,QAAQ,EAAa,KAAK,EACnC;SACD;AACN,SAAO;;;AAIX,SAAS,IAAiC;AACxC,QAAO,aAAa,QAAQ,cAAc;;AAG5C,SAAS,IAA2B;AAClC,KAAI;EACF,IAAM,IAAc,GAAiB;AAIrC,UAHiB,IACZ,KAAK,MAAM,EAAY,GACxB,EAAE,EAEH,KAAK,MAAY,EAAQ,GAAG,CAC5B,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;SAClE;AACN,SAAO,EAAE;;;AAIb,SAAS,IAAuC;CAC9C,IAAM,IAAa;EACjB,GAAwB;EACxB,eAAe,QAAQ,oBAAoB;EAC3C,GAAG,GAAgB;EACpB,CAAC,QAAQ,MAAqB,OAAO,KAAO,YAAY,EAAG,SAAS,EAAE;AAEvE,MAAK,IAAM,KAAa,MAAM,KAAK,IAAI,IAAI,EAAW,CAAC,EAAE;EACvD,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO;AAC9D,MAAI,KAAa,EAEf,QADA,eAAe,QAAQ,qBAAqB,EAAU,EAC/C;;AAIX,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAiExC,QA/DA,QAAgB;EACd,IAAM,IAAW,EAAa,IAAI,WAAW;AAC7C,MAAI,CAAC,GAAU;AAIb,UAAO,SAAS,QAAQ,IAAI;AAC5B;;EAMF,IAAM,IAAY,GAAuB;AACzC,MAAI,CAAC,GAAW;AACd,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAGF,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAU,SAAS,EAC5D,IAAU,aAAa,QAAQ,QAAQ,EAAU,OAAO,EACxD,IAAc,GAAiB;AAErC,MAAI,CAAC,KAAa,CAAC,GAAS;AAE1B,OAAI,EAA4B,EAAS,CAAE;AAE3C,GADA,GAAmB,EACnB,OAAO,SAAS,QAAQ,EAAkB,EAAS,CAAC;AACpD;;EAUF,IAAM,IAAU,KAAK,KAAK,UANV;GACd;GACA,QAAQ;GACR,MAAM;GACN,UAAU;GACX,CAC2C,CAAC,EAIzC;AACJ,MAAI;GACF,IAAM,IAAY,IAAI,IAAI,EAAS;AACnC,OAAI,CAAC,EAAmB,EAAU,EAAE;AAClC,WAAO,SAAS,QAAQ,IAAI;AAC5B;;GAEF,IAAM,IAAa,EAAU,WAAW,EAAU;AAClD,OAAc,GAAG,EAAU,OAAO,8BAA8B,mBAAmB,EAAW,CAAC,OAAO;UAChG;AAEN,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAIF,SAAO,SAAS,QAAQ,EAAY;IACnC,CAAC,EAAa,CAAC,EAGhB,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,2FAA4F,CAAA;EACvG,CAAA"}

package/dist/auth/pages/SessionBridgePage.js

@@ -1,30 +1,20 @@
-import { useEffect as e, useRef as t } from "react";
-import { jsx as n } from "react/jsx-runtime";
+import { isAllowedSsoOriginString as e } from "../utils/ssoOrigins.js";
+import { useEffect as t, useRef as n } from "react";
+import { jsx as r } from "react/jsx-runtime";
 //#region src/auth/pages/SessionBridgePage.tsx
-var r = "burdenoff-auth-bridge", i = "burdenoff-auth-client", a = "bf-p", o = "bf-profiles", s = "bf-active-profile";
-function c(e) {
+var i = "burdenoff-auth-bridge", a = "burdenoff-auth-client", o = "bf-p", s = "bf-profiles", c = "bf-active-profile";
+function l(e) {
 	return e !== null && typeof e.postMessage == "function";
 }
-function l(e) {
+function u(e) {
 	return typeof e == "object" && !!e && typeof e.type == "string";
 }
-var u = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
-function d(e) {
+function d() {
 	try {
-		let t = new URL(e);
-		if (t.hostname === "localhost" || t.hostname === "127.0.0.1" || t.hostname.endsWith(".local.burdenoff.com")) return !0;
-		for (let e of u) if (t.hostname === e || t.hostname === `app.${e}` || t.hostname === `alphaapp.${e}` || t.hostname === `admin.${e}` || t.hostname === `alphaadmin.${e}` || t.hostname === `www.${e}`) return !0;
-		return !1;
-	} catch {
-		return !1;
-	}
-}
-function f() {
-	try {
-		let e = localStorage.getItem(o), t = sessionStorage.getItem(s);
+		let e = localStorage.getItem(s), t = sessionStorage.getItem(c);
 		if (!t && e) try {
 			let n = JSON.parse(e);
-			n.length > 0 && (t = n[0].id, sessionStorage.setItem(s, t));
+			n.length > 0 && (t = n[0].id, sessionStorage.setItem(c, t));
 		} catch {}
 		if (!t) return {
 			user: null,
@@ -32,7 +22,7 @@ function f() {
 			profiles: e ? JSON.parse(e) : [],
 			activeProfileId: null
 		};
-		let n = localStorage.getItem(`${a}-${t}-user`), r = localStorage.getItem(`${a}-${t}-tokens`), i = localStorage.getItem(`${a}-${t}-workspace-token`);
+		let n = localStorage.getItem(`${o}-${t}-user`), r = localStorage.getItem(`${o}-${t}-tokens`), i = localStorage.getItem(`${o}-${t}-workspace-token`);
 		return {
 			user: n ? JSON.parse(n) : null,
 			tokens: r ? {
@@ -51,64 +41,64 @@ function f() {
 		};
 	}
 }
-function p(e) {
-	let t = e.activeProfileId ?? e.user?.id ?? sessionStorage.getItem(s);
+function f(e) {
+	let t = e.activeProfileId ?? e.user?.id ?? sessionStorage.getItem(c);
 	if (t) {
-		if (e.user && localStorage.setItem(`${a}-${t}-user`, JSON.stringify(e.user)), e.tokens && typeof e.tokens == "object") {
+		if (e.user && localStorage.setItem(`${o}-${t}-user`, JSON.stringify(e.user)), e.tokens && typeof e.tokens == "object") {
 			let { workspaceToken: n, ...r } = e.tokens;
-			localStorage.setItem(`${a}-${t}-tokens`, JSON.stringify(r)), n && localStorage.setItem(`${a}-${t}-workspace-token`, String(n));
+			localStorage.setItem(`${o}-${t}-tokens`, JSON.stringify(r)), n && localStorage.setItem(`${o}-${t}-workspace-token`, String(n));
 		}
-		e.profiles && localStorage.setItem(o, JSON.stringify(e.profiles)), sessionStorage.setItem(s, t);
+		e.profiles && localStorage.setItem(s, JSON.stringify(e.profiles)), sessionStorage.setItem(c, t);
 	}
 }
-function m() {
-	let e = sessionStorage.getItem(s);
+function p() {
+	let e = sessionStorage.getItem(c);
 	if (e) {
-		localStorage.removeItem(`${a}-${e}-user`), localStorage.removeItem(`${a}-${e}-tokens`), localStorage.removeItem(`${a}-${e}-workspace-token`), localStorage.removeItem(`${a}-${e}-auth-storage`);
+		localStorage.removeItem(`${o}-${e}-user`), localStorage.removeItem(`${o}-${e}-tokens`), localStorage.removeItem(`${o}-${e}-workspace-token`), localStorage.removeItem(`${o}-${e}-auth-storage`);
 		try {
-			let t = localStorage.getItem(o), n = t ? JSON.parse(t) : [];
-			localStorage.setItem(o, JSON.stringify(n.filter((t) => t.id !== e)));
+			let t = localStorage.getItem(s), n = t ? JSON.parse(t) : [];
+			localStorage.setItem(s, JSON.stringify(n.filter((t) => t.id !== e)));
 		} catch {}
-		sessionStorage.removeItem(s);
+		sessionStorage.removeItem(c);
 	}
 	localStorage.removeItem("auth-storage");
 }
-function h() {
+function m() {
 	try {
-		let e = localStorage.getItem(o), t = e ? JSON.parse(e) : [];
-		for (let e of t) localStorage.removeItem(`${a}-${e.id}-user`), localStorage.removeItem(`${a}-${e.id}-tokens`), localStorage.removeItem(`${a}-${e.id}-workspace-token`), localStorage.removeItem(`${a}-${e.id}-auth-storage`), localStorage.removeItem(`${a}-${e.id}-context`);
+		let e = localStorage.getItem(s), t = e ? JSON.parse(e) : [];
+		for (let e of t) localStorage.removeItem(`${o}-${e.id}-user`), localStorage.removeItem(`${o}-${e.id}-tokens`), localStorage.removeItem(`${o}-${e.id}-workspace-token`), localStorage.removeItem(`${o}-${e.id}-auth-storage`), localStorage.removeItem(`${o}-${e.id}-context`);
 	} catch {}
-	for (let e of Object.keys(localStorage)) e.startsWith(`${a}-`) && e.endsWith("-auth-storage") && localStorage.removeItem(e);
-	localStorage.removeItem(o), localStorage.removeItem("auth-storage"), sessionStorage.removeItem(s);
+	for (let e of Object.keys(localStorage)) e.startsWith(`${o}-`) && e.endsWith("-auth-storage") && localStorage.removeItem(e);
+	localStorage.removeItem(s), localStorage.removeItem("auth-storage"), sessionStorage.removeItem(c);
 }
-var g = "bf-sso-profile", _ = "bf-sso";
-function v(e, t) {
+var h = "bf-sso-profile", g = "bf-sso";
+function _(e, t) {
 	try {
 		let n = window.location.hostname.endsWith(".local.burdenoff.com") ? ".local.burdenoff.com" : void 0, r = n ? `; domain=${n}` : "", i = window.location.protocol === "https:" ? "; secure" : "", a = JSON.stringify({
 			id: e,
 			origin: t
 		});
-		document.cookie = `${g}=${encodeURIComponent(a)}${r}; path=/; samesite=lax${i}; max-age=86400`;
+		document.cookie = `${h}=${encodeURIComponent(a)}${r}; path=/; samesite=lax${i}; max-age=86400`;
 	} catch {}
 }
-function y(e, t) {
+function v(e, t) {
 	try {
 		let n = window.location.hostname.endsWith(".local.burdenoff.com") ? ".local.burdenoff.com" : void 0, r = n ? `; domain=${n}` : "", i = window.location.protocol === "https:" ? "; secure" : "", a = JSON.stringify({
 			id: e,
 			origin: t
 		});
-		document.cookie = `${_}=${encodeURIComponent(a)}${r}; path=/; samesite=lax${i}; max-age=86400`;
+		document.cookie = `${g}=${encodeURIComponent(a)}${r}; path=/; samesite=lax${i}; max-age=86400`;
 	} catch {}
 }
-function b() {
+function y() {
 	try {
 		let e = window.location.hostname, t = e.endsWith(".local.burdenoff.com") ? ".local.burdenoff.com" : void 0;
-		document.cookie = `${g}=; path=/; max-age=0`, document.cookie = `${_}=; path=/; max-age=0`, t && (document.cookie = `${g}=; path=/; domain=${t}; max-age=0`, document.cookie = `${_}=; path=/; domain=${t}; max-age=0`), e && !["localhost", "127.0.0.1"].includes(e) && (document.cookie = `${g}=; path=/; domain=${e}; max-age=0`, document.cookie = `${_}=; path=/; domain=${e}; max-age=0`);
+		document.cookie = `${h}=; path=/; max-age=0`, document.cookie = `${g}=; path=/; max-age=0`, t && (document.cookie = `${h}=; path=/; domain=${t}; max-age=0`, document.cookie = `${g}=; path=/; domain=${t}; max-age=0`), e && !["localhost", "127.0.0.1"].includes(e) && (document.cookie = `${h}=; path=/; domain=${e}; max-age=0`, document.cookie = `${g}=; path=/; domain=${e}; max-age=0`);
 	} catch {}
 }
-function x() {
-	let s = t(/* @__PURE__ */ new Map()), u = t(/* @__PURE__ */ new Map()), g = t(!1);
-	return e(() => {
+function b() {
+	let c = n(/* @__PURE__ */ new Map()), h = n(/* @__PURE__ */ new Map()), g = n(!1);
+	return t(() => {
 		async function e() {
 			try {
 				if (!document.requestStorageAccess) {
@@ -125,95 +115,95 @@ function x() {
 			}
 		}
 		e();
-	}, []), e(() => {
-		function e(e) {
-			return d(e);
+	}, []), t(() => {
+		function t(t) {
+			return e(t);
 		}
-		function t(e, t) {
-			s.current.forEach((n, i) => {
-				i !== t && n.source.postMessage({
+		function n(e, t) {
+			c.current.forEach((n, r) => {
+				r !== t && n.source.postMessage({
 					...e,
-					source: r,
+					source: i,
 					nonce: n.nonce
 				}, n.origin);
 			});
 		}
-		function n(n) {
-			if (!e(n.origin) || !l(n.data) || n.data.source !== i) return;
-			let a = n.data, o = c(n.source) ? n.source : null;
+		function r(e) {
+			if (!t(e.origin) || !u(e.data) || e.data.source !== a) return;
+			let r = e.data, o = l(e.source) ? e.source : null;
 			if (!o) return;
-			let d = typeof a.nonce == "string" && a.nonce.length > 0 ? a.nonce : null, g = s.current.get(o);
-			if (a.type !== "AUTH_INIT") {
-				if (!d || g?.nonce !== d) return;
-			} else if (!d) return;
-			switch (a.type) {
+			let s = typeof r.nonce == "string" && r.nonce.length > 0 ? r.nonce : null, g = c.current.get(o);
+			if (r.type !== "AUTH_INIT") {
+				if (!s || g?.nonce !== s) return;
+			} else if (!s) return;
+			switch (r.type) {
 				case "AUTH_INIT": {
-					if (s.current.set(o, {
+					if (c.current.set(o, {
 						source: o,
-						origin: n.origin,
-						nonce: d
-					}), a.payload && typeof a.payload == "object") {
-						let e = a.payload;
-						e.user && e.tokens && p(e);
+						origin: e.origin,
+						nonce: s
+					}), r.payload && typeof r.payload == "object") {
+						let e = r.payload;
+						e.user && e.tokens && f(e);
 					}
-					let e = f(), t = s.current.get(o);
-					t && (t.source.postMessage({
+					let t = d(), n = c.current.get(o);
+					n && (n.source.postMessage({
 						type: "AUTH_STATE",
-						payload: e,
-						source: r,
-						nonce: t.nonce
-					}, n.origin), u.current.get(o) !== t.nonce && (u.current.set(o, t.nonce), t.source.postMessage({
+						payload: t,
+						source: i,
+						nonce: n.nonce
+					}, e.origin), h.current.get(o) !== n.nonce && (h.current.set(o, n.nonce), n.source.postMessage({
 						type: "AUTH_BRIDGE_READY",
-						source: r,
-						nonce: t.nonce
-					}, n.origin)));
+						source: i,
+						nonce: n.nonce
+					}, e.origin)));
 					break;
 				}
 				case "AUTH_LOGIN":
-					if (a.payload) {
-						p(a.payload);
-						let e = a.payload, r = e.activeProfileId ?? e.user?.id;
-						r && (b(), v(r, n.origin), y(r, n.origin)), t({
+					if (r.payload) {
+						f(r.payload);
+						let t = r.payload, i = t.activeProfileId ?? t.user?.id;
+						i && (y(), _(i, e.origin), v(i, e.origin)), n({
 							type: "AUTH_STATE_CHANGED",
 							payload: {
-								...f(),
+								...d(),
 								trigger: "login"
 							}
 						}, o);
 					}
 					break;
 				case "AUTH_LOGOUT":
-					m(), b(), t({
+					p(), y(), n({
 						type: "AUTH_STATE_CHANGED",
 						payload: {
-							...f(),
+							...d(),
 							trigger: "logout"
 						}
 					}, o);
 					break;
 				case "AUTH_LOGOUT_ALL":
-					h(), b(), t({
+					m(), y(), n({
 						type: "AUTH_STATE_CHANGED",
 						payload: {
-							...f(),
+							...d(),
 							trigger: "logout_all"
 						}
 					}, o);
 					break;
 				case "AUTH_TOKEN_REFRESH":
-					a.payload?.tokens && (p({ tokens: a.payload.tokens }), t({
+					r.payload?.tokens && (f({ tokens: r.payload.tokens }), n({
 						type: "AUTH_STATE_CHANGED",
 						payload: {
-							...f(),
+							...d(),
 							trigger: "refresh"
 						}
 					}, o));
 					break;
 				case "AUTH_ACCOUNT_SWITCH":
-					a.payload && (p(a.payload), t({
+					r.payload && (f(r.payload), n({
 						type: "AUTH_STATE_CHANGED",
 						payload: {
-							...f(),
+							...d(),
 							trigger: "account_switch"
 						}
 					}, o));
@@ -221,24 +211,24 @@ function x() {
 			}
 		}
 		function g(e) {
-			(e.key?.startsWith(a) || e.key === o) && t({
+			(e.key?.startsWith(o) || e.key === s) && n({
 				type: "AUTH_STATE_CHANGED",
 				payload: {
-					...f(),
+					...d(),
 					trigger: "storage_sync"
 				}
 			});
 		}
-		return window.addEventListener("message", n), window.addEventListener("storage", g), () => {
-			window.removeEventListener("message", n), window.removeEventListener("storage", g);
+		return window.addEventListener("message", r), window.addEventListener("storage", g), () => {
+			window.removeEventListener("message", r), window.removeEventListener("storage", g);
 		};
-	}, []), /* @__PURE__ */ n("div", {
+	}, []), /* @__PURE__ */ r("div", {
 		id: "auth-session-bridge-root",
 		"data-bridge": "active",
 		style: { display: "none" }
 	});
 }
 //#endregion
-export { x as SessionBridgePage };
+export { b as SessionBridgePage };
 
 //# sourceMappingURL=SessionBridgePage.js.map

package/dist/auth/pages/SessionBridgePage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionBridgePage.js","names":[],"sources":["../../../src/auth/pages/SessionBridgePage.tsx"],"sourcesContent":["/**\n * SessionBridgePage — Cross-Domain Auth Session Bridge (Profile-Scoped)\n *\n * Embedded as hidden iframe by other app shells. Manages profile-scoped\n * auth tokens in localStorage and relays state via postMessage.\n *\n * Storage uses ProfileStorageManager keys:\n *   bf-profiles, bf-p-{id}-user, bf-p-{id}-tokens, bf-p-{id}-workspace-token\n *   bf-active-profile (sessionStorage, per-tab)\n *\n * URL: /auth/session-bridge\n */\n\nimport { useEffect, useRef } from \"react\";\n\nconst BRIDGE_SOURCE = \"burdenoff-auth-bridge\";\nconst PARENT_SOURCE = \"burdenoff-auth-client\";\nconst BF_PREFIX = \"bf-p\";\nconst BF_PROFILES = \"bf-profiles\";\nconst BF_ACTIVE = \"bf-active-profile\";\n\ninterface BridgeMessage {\n  type: string;\n  payload?: Record<string, unknown>;\n  nonce?: string;\n  source?: string;\n}\n\ninterface ConnectedParent {\n  source: Window;\n  origin: string;\n  nonce: string;\n}\n\nfunction isWindowMessageSource(\n  source: MessageEventSource | null,\n): source is Window {\n  return (\n    source !== null &&\n    typeof (source as { postMessage?: unknown }).postMessage === \"function\"\n  );\n}\n\nfunction isBridgeMessage(value: unknown): value is BridgeMessage {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    typeof (value as { type?: unknown }).type === \"string\"\n  );\n}\n\n/**\n * Dynamically validates allowed origins for the auth bridge.\n * Accepts all Burdenoff product domains (prod + alpha + local dev).\n */\nconst ALLOWED_PRODUCT_DOMAINS = new Set([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\nfunction isAllowedOrigin(origin: string): boolean {\n  try {\n    const url = new URL(origin);\n    // Allow all localhost ports (local dev)\n    if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") {\n      return true;\n    }\n    // Allow *.local.burdenoff.com (local dev with nginx)\n    if (url.hostname.endsWith(\".local.burdenoff.com\")) {\n      return true;\n    }\n    // Allow app.{domain} and alphaapp.{domain} for all known product domains\n    for (const domain of ALLOWED_PRODUCT_DOMAINS) {\n      if (\n        url.hostname === domain ||\n        url.hostname === `app.${domain}` ||\n        url.hostname === `alphaapp.${domain}` ||\n        // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com)\n        // embed this bridge iframe too. Without trusting their origin, the\n        // bridge ignores their postMessages and the admin shell never receives\n        // the shared session.\n        url.hostname === `admin.${domain}` ||\n        url.hostname === `alphaadmin.${domain}` ||\n        url.hostname === `www.${domain}`\n      ) {\n        return true;\n      }\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\nfunction readAuthState(): Record<string, unknown> {\n  try {\n    const profiles = localStorage.getItem(BF_PROFILES);\n    let activeId = sessionStorage.getItem(BF_ACTIVE);\n\n    // Fall back: if sessionStorage is empty but localStorage has profiles,\n    // pick the first profile (same logic as resolveActiveProfileId)\n    if (!activeId && profiles) {\n      try {\n        const profileList = JSON.parse(profiles) as Array<{ id: string }>;\n        if (profileList.length > 0) {\n          activeId = profileList[0].id;\n          sessionStorage.setItem(BF_ACTIVE, activeId);\n        }\n      } catch {\n        // ignore\n      }\n    }\n\n    if (!activeId) {\n      return {\n        user: null,\n        tokens: null,\n        profiles: profiles ? JSON.parse(profiles) : [],\n        activeProfileId: null,\n      };\n    }\n    const user = localStorage.getItem(`${BF_PREFIX}-${activeId}-user`);\n    const tokens = localStorage.getItem(`${BF_PREFIX}-${activeId}-tokens`);\n    const wsToken = localStorage.getItem(\n      `${BF_PREFIX}-${activeId}-workspace-token`,\n    );\n\n    return {\n      user: user ? JSON.parse(user) : null,\n      tokens: tokens\n        ? { ...JSON.parse(tokens), workspaceToken: wsToken ?? undefined }\n        : null,\n      profiles: profiles ? JSON.parse(profiles) : [],\n      activeProfileId: activeId,\n    };\n  } catch {\n    return { user: null, tokens: null, profiles: [], activeProfileId: null };\n  }\n}\n\nfunction writeAuthState(payload: Record<string, unknown>): void {\n  const profileId =\n    (payload.activeProfileId as string) ??\n    ((payload.user as Record<string, unknown>)?.id as string) ??\n    sessionStorage.getItem(BF_ACTIVE);\n  if (!profileId) return;\n\n  if (payload.user) {\n    localStorage.setItem(\n      `${BF_PREFIX}-${profileId}-user`,\n      JSON.stringify(payload.user),\n    );\n  }\n  if (payload.tokens && typeof payload.tokens === \"object\") {\n    const t = payload.tokens as Record<string, unknown>;\n    const { workspaceToken, ...rest } = t;\n    localStorage.setItem(\n      `${BF_PREFIX}-${profileId}-tokens`,\n      JSON.stringify(rest),\n    );\n    if (workspaceToken) {\n      localStorage.setItem(\n        `${BF_PREFIX}-${profileId}-workspace-token`,\n        String(workspaceToken),\n      );\n    }\n  }\n  if (payload.profiles) {\n    localStorage.setItem(BF_PROFILES, JSON.stringify(payload.profiles));\n  }\n  sessionStorage.setItem(BF_ACTIVE, profileId);\n}\n\nfunction clearAuthState(): void {\n  const activeId = sessionStorage.getItem(BF_ACTIVE);\n  if (activeId) {\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-user`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-tokens`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-workspace-token`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-auth-storage`);\n    // Remove from profiles list\n    try {\n      const raw = localStorage.getItem(BF_PROFILES);\n      const profiles = raw ? JSON.parse(raw) : [];\n      localStorage.setItem(\n        BF_PROFILES,\n        JSON.stringify(\n          profiles.filter((p: { id: string }) => p.id !== activeId),\n        ),\n      );\n    } catch {\n      /* ignore */\n    }\n    sessionStorage.removeItem(BF_ACTIVE);\n  }\n  localStorage.removeItem(\"auth-storage\");\n}\n\nfunction clearAllAuthState(): void {\n  // Get all profiles and remove their data\n  try {\n    const raw = localStorage.getItem(BF_PROFILES);\n    const profiles: Array<{ id: string }> = raw ? JSON.parse(raw) : [];\n    for (const p of profiles) {\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-user`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-tokens`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-workspace-token`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-auth-storage`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-context`);\n    }\n  } catch {\n    /* ignore */\n  }\n  for (const key of Object.keys(localStorage)) {\n    if (key.startsWith(`${BF_PREFIX}-`) && key.endsWith(\"-auth-storage\")) {\n      localStorage.removeItem(key);\n    }\n  }\n  localStorage.removeItem(BF_PROFILES);\n  localStorage.removeItem(\"auth-storage\");\n  sessionStorage.removeItem(BF_ACTIVE);\n}\n\n// SSO cookie helpers (shared domain cookie for local dev fast-path)\nconst SSO_COOKIE_NAME = \"bf-sso-profile\";\nconst SHELL_SSO_COOKIE_NAME = \"bf-sso\";\nfunction setSSoCookieBridge(profileId: string, origin: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const cookieValue = JSON.stringify({ id: profileId, origin });\n    document.cookie = `${SSO_COOKIE_NAME}=${encodeURIComponent(cookieValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction setShellSsoCookieBridge(profileId: string, origin: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const ssoValue = JSON.stringify({ id: profileId, origin });\n    document.cookie = `${SHELL_SSO_COOKIE_NAME}=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction clearSSoCookieBridge(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    document.cookie = `${SSO_COOKIE_NAME}=; path=/; max-age=0`;\n    document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; max-age=0`;\n    if (domain) {\n      document.cookie = `${SSO_COOKIE_NAME}=; path=/; domain=${domain}; max-age=0`;\n      document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; domain=${domain}; max-age=0`;\n    }\n    if (hostname && ![\"localhost\", \"127.0.0.1\"].includes(hostname)) {\n      document.cookie = `${SSO_COOKIE_NAME}=; path=/; domain=${hostname}; max-age=0`;\n      document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; domain=${hostname}; max-age=0`;\n    }\n  } catch {\n    /* ignore */\n  }\n}\n\nexport function SessionBridgePage() {\n  const connectedParents = useRef<Map<Window, ConnectedParent>>(new Map());\n  const readySentTo = useRef<Map<Window, string>>(new Map());\n  const storageAccessGranted = useRef(false);\n\n  // Request unpartitioned storage access (Storage Access API).\n  // This is critical for cross-domain SSO in modern browsers that\n  // partition third-party iframe localStorage.\n  useEffect(() => {\n    async function requestAccess() {\n      try {\n        // Check if Storage Access API is available\n        if (!document.requestStorageAccess) {\n          storageAccessGranted.current = true;\n          return;\n        }\n        // Check if we already have access\n        const hasAccess = await document.hasStorageAccess();\n        if (hasAccess) {\n          storageAccessGranted.current = true;\n          return;\n        }\n        // Request unpartitioned storage access\n        await document.requestStorageAccess();\n        storageAccessGranted.current = true;\n      } catch {\n        // Storage Access API not available or denied — fall through\n        // to cookie-based fallback. localStorage will be partitioned.\n        storageAccessGranted.current = false;\n      }\n    }\n    void requestAccess();\n  }, []);\n\n  useEffect(() => {\n    function isOriginAllowed(origin: string): boolean {\n      return isAllowedOrigin(origin);\n    }\n\n    function broadcastToAll(\n      message: BridgeMessage,\n      excludeSource?: Window | null,\n    ): void {\n      connectedParents.current.forEach((connection, parent) => {\n        if (parent !== excludeSource) {\n          connection.source.postMessage(\n            { ...message, source: BRIDGE_SOURCE, nonce: connection.nonce },\n            connection.origin,\n          );\n        }\n      });\n    }\n\n    function handleMessage(event: MessageEvent): void {\n      if (!isOriginAllowed(event.origin)) return;\n      if (!isBridgeMessage(event.data) || event.data.source !== PARENT_SOURCE) {\n        return;\n      }\n      const message = event.data;\n      const parentSource = isWindowMessageSource(event.source)\n        ? event.source\n        : null;\n      if (!parentSource) return;\n\n      const incomingNonce =\n        typeof message.nonce === \"string\" && message.nonce.length > 0\n          ? message.nonce\n          : null;\n      const existingConnection = connectedParents.current.get(parentSource);\n\n      if (message.type !== \"AUTH_INIT\") {\n        if (!incomingNonce || existingConnection?.nonce !== incomingNonce) {\n          return;\n        }\n      } else if (!incomingNonce) {\n        return;\n      }\n\n      switch (message.type) {\n        case \"AUTH_INIT\": {\n          connectedParents.current.set(parentSource, {\n            source: parentSource,\n            origin: event.origin,\n            nonce: incomingNonce,\n          });\n\n          // If the parent sends its current auth state in AUTH_INIT,\n          // store it so other cross-domain shells can pick it up.\n          if (message.payload && typeof message.payload === \"object\") {\n            const initPayload = message.payload as Record<string, unknown>;\n            if (initPayload.user && initPayload.tokens) {\n              writeAuthState(initPayload);\n            }\n          }\n\n          const state = readAuthState();\n          const connection = connectedParents.current.get(parentSource);\n          if (connection) {\n            connection.source.postMessage(\n              {\n                type: \"AUTH_STATE\",\n                payload: state,\n                source: BRIDGE_SOURCE,\n                nonce: connection.nonce,\n              },\n              event.origin,\n            );\n            if (readySentTo.current.get(parentSource) !== connection.nonce) {\n              readySentTo.current.set(parentSource, connection.nonce);\n              connection.source.postMessage(\n                {\n                  type: \"AUTH_BRIDGE_READY\",\n                  source: BRIDGE_SOURCE,\n                  nonce: connection.nonce,\n                },\n                event.origin,\n              );\n            }\n          }\n          break;\n        }\n        case \"AUTH_LOGIN\": {\n          if (message.payload) {\n            writeAuthState(message.payload);\n            // Set SSO cookie for cross-domain fast-path detection\n            const loginPayload = message.payload as Record<string, unknown>;\n            const loginProfileId =\n              (loginPayload.activeProfileId as string) ??\n              ((loginPayload.user as Record<string, unknown>)?.id as string);\n            if (loginProfileId) {\n              clearSSoCookieBridge();\n              setSSoCookieBridge(loginProfileId, event.origin);\n              setShellSsoCookieBridge(loginProfileId, event.origin);\n            }\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"login\" },\n              },\n              parentSource,\n            );\n          }\n          break;\n        }\n        case \"AUTH_LOGOUT\": {\n          clearAuthState();\n          clearSSoCookieBridge();\n          broadcastToAll(\n            {\n              type: \"AUTH_STATE_CHANGED\",\n              payload: { ...readAuthState(), trigger: \"logout\" },\n            },\n            parentSource,\n          );\n          break;\n        }\n        case \"AUTH_LOGOUT_ALL\": {\n          clearAllAuthState();\n          clearSSoCookieBridge();\n          broadcastToAll(\n            {\n              type: \"AUTH_STATE_CHANGED\",\n              payload: { ...readAuthState(), trigger: \"logout_all\" },\n            },\n            parentSource,\n          );\n          break;\n        }\n        case \"AUTH_TOKEN_REFRESH\": {\n          if (message.payload?.tokens) {\n            writeAuthState({ tokens: message.payload.tokens });\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"refresh\" },\n              },\n              parentSource,\n            );\n          }\n          break;\n        }\n        case \"AUTH_ACCOUNT_SWITCH\": {\n          if (message.payload) {\n            writeAuthState(message.payload);\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"account_switch\" },\n              },\n              parentSource,\n            );\n          }\n          break;\n        }\n      }\n    }\n\n    function handleStorageChange(event: StorageEvent): void {\n      if (event.key?.startsWith(BF_PREFIX) || event.key === BF_PROFILES) {\n        broadcastToAll({\n          type: \"AUTH_STATE_CHANGED\",\n          payload: { ...readAuthState(), trigger: \"storage_sync\" },\n        });\n      }\n    }\n\n    window.addEventListener(\"message\", handleMessage);\n    window.addEventListener(\"storage\", handleStorageChange);\n\n    return () => {\n      window.removeEventListener(\"message\", handleMessage);\n      window.removeEventListener(\"storage\", handleStorageChange);\n      // Don't clear connectedParents or readySentTo on cleanup to maintain state across StrictMode remounts\n    };\n  }, []);\n\n  return (\n    <div\n      id=\"auth-session-bridge-root\"\n      data-bridge=\"active\"\n      style={{ display: \"none\" }}\n    />\n  );\n}\n"],"mappings":";;;AAeA,IAAM,IAAgB,yBAChB,IAAgB,yBAChB,IAAY,QACZ,IAAc,eACd,IAAY;AAelB,SAAS,EACP,GACkB;AAClB,QACE,MAAW,QACX,OAAQ,EAAqC,eAAgB;;AAIjE,SAAS,EAAgB,GAAwC;AAC/D,QACE,OAAO,KAAU,cACjB,KACA,OAAQ,EAA6B,QAAS;;AAQlD,IAAM,IAA0B,IAAI,IAAI,8qBAwCvC,CAAC;AAEF,SAAS,EAAgB,GAAyB;AAChD,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,EAAO;AAM3B,MAJI,EAAI,aAAa,eAAe,EAAI,aAAa,eAIjD,EAAI,SAAS,SAAS,uBAAuB,CAC/C,QAAO;AAGT,OAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAK7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,SAAO;SACD;AACN,SAAO;;;AAIX,SAAS,IAAyC;AAChD,KAAI;EACF,IAAM,IAAW,aAAa,QAAQ,EAAY,EAC9C,IAAW,eAAe,QAAQ,EAAU;AAIhD,MAAI,CAAC,KAAY,EACf,KAAI;GACF,IAAM,IAAc,KAAK,MAAM,EAAS;AACxC,GAAI,EAAY,SAAS,MACvB,IAAW,EAAY,GAAG,IAC1B,eAAe,QAAQ,GAAW,EAAS;UAEvC;AAKV,MAAI,CAAC,EACH,QAAO;GACL,MAAM;GACN,QAAQ;GACR,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;GAC9C,iBAAiB;GAClB;EAEH,IAAM,IAAO,aAAa,QAAQ,GAAG,EAAU,GAAG,EAAS,OAAO,EAC5D,IAAS,aAAa,QAAQ,GAAG,EAAU,GAAG,EAAS,SAAS,EAChE,IAAU,aAAa,QAC3B,GAAG,EAAU,GAAG,EAAS,kBAC1B;AAED,SAAO;GACL,MAAM,IAAO,KAAK,MAAM,EAAK,GAAG;GAChC,QAAQ,IACJ;IAAE,GAAG,KAAK,MAAM,EAAO;IAAE,gBAAgB,KAAW,KAAA;IAAW,GAC/D;GACJ,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;GAC9C,iBAAiB;GAClB;SACK;AACN,SAAO;GAAE,MAAM;GAAM,QAAQ;GAAM,UAAU,EAAE;GAAE,iBAAiB;GAAM;;;AAI5E,SAAS,EAAe,GAAwC;CAC9D,IAAM,IACH,EAAQ,mBACP,EAAQ,MAAkC,MAC5C,eAAe,QAAQ,EAAU;AAC9B,QAQL;MANI,EAAQ,QACV,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,QAC1B,KAAK,UAAU,EAAQ,KAAK,CAC7B,EAEC,EAAQ,UAAU,OAAO,EAAQ,UAAW,UAAU;GAExD,IAAM,EAAE,mBAAgB,GAAG,MADjB,EAAQ;AAMlB,GAJA,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,UAC1B,KAAK,UAAU,EAAK,CACrB,EACG,KACF,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,mBAC1B,OAAO,EAAe,CACvB;;AAML,EAHI,EAAQ,YACV,aAAa,QAAQ,GAAa,KAAK,UAAU,EAAQ,SAAS,CAAC,EAErE,eAAe,QAAQ,GAAW,EAAU;;;AAG9C,SAAS,IAAuB;CAC9B,IAAM,IAAW,eAAe,QAAQ,EAAU;AAClD,KAAI,GAAU;AAIZ,EAHA,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,OAAO,EACxD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,SAAS,EAC1D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,kBAAkB,EACnE,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,eAAe;AAEhE,MAAI;GACF,IAAM,IAAM,aAAa,QAAQ,EAAY,EACvC,IAAW,IAAM,KAAK,MAAM,EAAI,GAAG,EAAE;AAC3C,gBAAa,QACX,GACA,KAAK,UACH,EAAS,QAAQ,MAAsB,EAAE,OAAO,EAAS,CAC1D,CACF;UACK;AAGR,iBAAe,WAAW,EAAU;;AAEtC,cAAa,WAAW,eAAe;;AAGzC,SAAS,IAA0B;AAEjC,KAAI;EACF,IAAM,IAAM,aAAa,QAAQ,EAAY,EACvC,IAAkC,IAAM,KAAK,MAAM,EAAI,GAAG,EAAE;AAClE,OAAK,IAAM,KAAK,EAKd,CAJA,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,OAAO,EACpD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,SAAS,EACtD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,kBAAkB,EAC/D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,eAAe,EAC5D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,UAAU;SAEnD;AAGR,MAAK,IAAM,KAAO,OAAO,KAAK,aAAa,CACzC,CAAI,EAAI,WAAW,GAAG,EAAU,GAAG,IAAI,EAAI,SAAS,gBAAgB,IAClE,aAAa,WAAW,EAAI;AAKhC,CAFA,aAAa,WAAW,EAAY,EACpC,aAAa,WAAW,eAAe,EACvC,eAAe,WAAW,EAAU;;AAItC,IAAM,IAAkB,kBAClB,IAAwB;AAC9B,SAAS,EAAmB,GAAmB,GAAsB;AACnE,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAc,KAAK,UAAU;GAAE,IAAI;GAAW;GAAQ,CAAC;AAC7D,WAAS,SAAS,GAAG,EAAgB,GAAG,mBAAmB,EAAY,GAAG,EAAW,wBAAwB,EAAW;SAClH;;AAKV,SAAS,EAAwB,GAAmB,GAAsB;AACxE,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAAE,IAAI;GAAW;GAAQ,CAAC;AAC1D,WAAS,SAAS,GAAG,EAAsB,GAAG,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;SACrH;;AAKV,SAAS,IAA6B;AACpC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AAOJ,EANA,SAAS,SAAS,GAAG,EAAgB,uBACrC,SAAS,SAAS,GAAG,EAAsB,uBACvC,MACF,SAAS,SAAS,GAAG,EAAgB,oBAAoB,EAAO,cAChE,SAAS,SAAS,GAAG,EAAsB,oBAAoB,EAAO,eAEpE,KAAY,CAAC,CAAC,aAAa,YAAY,CAAC,SAAS,EAAS,KAC5D,SAAS,SAAS,GAAG,EAAgB,oBAAoB,EAAS,cAClE,SAAS,SAAS,GAAG,EAAsB,oBAAoB,EAAS;SAEpE;;AAKV,SAAgB,IAAoB;CAClC,IAAM,IAAmB,kBAAqC,IAAI,KAAK,CAAC,EAClE,IAAc,kBAA4B,IAAI,KAAK,CAAC,EACpD,IAAuB,EAAO,GAAM;AAqN1C,QAhNA,QAAgB;EACd,eAAe,IAAgB;AAC7B,OAAI;AAEF,QAAI,CAAC,SAAS,sBAAsB;AAClC,OAAqB,UAAU;AAC/B;;AAIF,QADkB,MAAM,SAAS,kBAAkB,EACpC;AACb,OAAqB,UAAU;AAC/B;;AAIF,IADA,MAAM,SAAS,sBAAsB,EACrC,EAAqB,UAAU;WACzB;AAGN,MAAqB,UAAU;;;AAG9B,KAAe;IACnB,EAAE,CAAC,EAEN,QAAgB;EACd,SAAS,EAAgB,GAAyB;AAChD,UAAO,EAAgB,EAAO;;EAGhC,SAAS,EACP,GACA,GACM;AACN,KAAiB,QAAQ,SAAS,GAAY,MAAW;AACvD,IAAI,MAAW,KACb,EAAW,OAAO,YAChB;KAAE,GAAG;KAAS,QAAQ;KAAe,OAAO,EAAW;KAAO,EAC9D,EAAW,OACZ;KAEH;;EAGJ,SAAS,EAAc,GAA2B;AAEhD,OADI,CAAC,EAAgB,EAAM,OAAO,IAC9B,CAAC,EAAgB,EAAM,KAAK,IAAI,EAAM,KAAK,WAAW,EACxD;GAEF,IAAM,IAAU,EAAM,MAChB,IAAe,EAAsB,EAAM,OAAO,GACpD,EAAM,SACN;AACJ,OAAI,CAAC,EAAc;GAEnB,IAAM,IACJ,OAAO,EAAQ,SAAU,YAAY,EAAQ,MAAM,SAAS,IACxD,EAAQ,QACR,MACA,IAAqB,EAAiB,QAAQ,IAAI,EAAa;AAErE,OAAI,EAAQ,SAAS;QACf,CAAC,KAAiB,GAAoB,UAAU,EAClD;cAEO,CAAC,EACV;AAGF,WAAQ,EAAQ,MAAhB;IACE,KAAK,aAAa;AAShB,SARA,EAAiB,QAAQ,IAAI,GAAc;MACzC,QAAQ;MACR,QAAQ,EAAM;MACd,OAAO;MACR,CAAC,EAIE,EAAQ,WAAW,OAAO,EAAQ,WAAY,UAAU;MAC1D,IAAM,IAAc,EAAQ;AAC5B,MAAI,EAAY,QAAQ,EAAY,UAClC,EAAe,EAAY;;KAI/B,IAAM,IAAQ,GAAe,EACvB,IAAa,EAAiB,QAAQ,IAAI,EAAa;AAC7D,KAAI,MACF,EAAW,OAAO,YAChB;MACE,MAAM;MACN,SAAS;MACT,QAAQ;MACR,OAAO,EAAW;MACnB,EACD,EAAM,OACP,EACG,EAAY,QAAQ,IAAI,EAAa,KAAK,EAAW,UACvD,EAAY,QAAQ,IAAI,GAAc,EAAW,MAAM,EACvD,EAAW,OAAO,YAChB;MACE,MAAM;MACN,QAAQ;MACR,OAAO,EAAW;MACnB,EACD,EAAM,OACP;AAGL;;IAEF,KAAK;AACH,SAAI,EAAQ,SAAS;AACnB,QAAe,EAAQ,QAAQ;MAE/B,IAAM,IAAe,EAAQ,SACvB,IACH,EAAa,mBACZ,EAAa,MAAkC;AAMnD,MALI,MACF,GAAsB,EACtB,EAAmB,GAAgB,EAAM,OAAO,EAChD,EAAwB,GAAgB,EAAM,OAAO,GAEvD,EACE;OACE,MAAM;OACN,SAAS;QAAE,GAAG,GAAe;QAAE,SAAS;QAAS;OAClD,EACD,EACD;;AAEH;IAEF,KAAK;AAGH,KAFA,GAAgB,EAChB,GAAsB,EACtB,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAU;MACnD,EACD,EACD;AACD;IAEF,KAAK;AAGH,KAFA,GAAmB,EACnB,GAAsB,EACtB,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAc;MACvD,EACD,EACD;AACD;IAEF,KAAK;AACH,KAAI,EAAQ,SAAS,WACnB,EAAe,EAAE,QAAQ,EAAQ,QAAQ,QAAQ,CAAC,EAClD,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAW;MACpD,EACD,EACD;AAEH;IAEF,KAAK;AACH,KAAI,EAAQ,YACV,EAAe,EAAQ,QAAQ,EAC/B,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAkB;MAC3D,EACD,EACD;AAEH;;;EAKN,SAAS,EAAoB,GAA2B;AACtD,IAAI,EAAM,KAAK,WAAW,EAAU,IAAI,EAAM,QAAQ,MACpD,EAAe;IACb,MAAM;IACN,SAAS;KAAE,GAAG,GAAe;KAAE,SAAS;KAAgB;IACzD,CAAC;;AAON,SAHA,OAAO,iBAAiB,WAAW,EAAc,EACjD,OAAO,iBAAiB,WAAW,EAAoB,QAE1C;AAEX,GADA,OAAO,oBAAoB,WAAW,EAAc,EACpD,OAAO,oBAAoB,WAAW,EAAoB;;IAG3D,EAAE,CAAC,EAGJ,kBAAC,OAAD;EACE,IAAG;EACH,eAAY;EACZ,OAAO,EAAE,SAAS,QAAQ;EAC1B,CAAA"}
+{"version":3,"file":"SessionBridgePage.js","names":[],"sources":["../../../src/auth/pages/SessionBridgePage.tsx"],"sourcesContent":["/**\n * SessionBridgePage — Cross-Domain Auth Session Bridge (Profile-Scoped)\n *\n * Embedded as hidden iframe by other app shells. Manages profile-scoped\n * auth tokens in localStorage and relays state via postMessage.\n *\n * Storage uses ProfileStorageManager keys:\n *   bf-profiles, bf-p-{id}-user, bf-p-{id}-tokens, bf-p-{id}-workspace-token\n *   bf-active-profile (sessionStorage, per-tab)\n *\n * URL: /auth/session-bridge\n */\n\nimport { useEffect, useRef } from \"react\";\nimport { isAllowedSsoOriginString } from \"../utils/ssoOrigins\";\n\nconst BRIDGE_SOURCE = \"burdenoff-auth-bridge\";\nconst PARENT_SOURCE = \"burdenoff-auth-client\";\nconst BF_PREFIX = \"bf-p\";\nconst BF_PROFILES = \"bf-profiles\";\nconst BF_ACTIVE = \"bf-active-profile\";\n\ninterface BridgeMessage {\n  type: string;\n  payload?: Record<string, unknown>;\n  nonce?: string;\n  source?: string;\n}\n\ninterface ConnectedParent {\n  source: Window;\n  origin: string;\n  nonce: string;\n}\n\nfunction isWindowMessageSource(\n  source: MessageEventSource | null,\n): source is Window {\n  return (\n    source !== null &&\n    typeof (source as { postMessage?: unknown }).postMessage === \"function\"\n  );\n}\n\nfunction isBridgeMessage(value: unknown): value is BridgeMessage {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    typeof (value as { type?: unknown }).type === \"string\"\n  );\n}\n\nfunction readAuthState(): Record<string, unknown> {\n  try {\n    const profiles = localStorage.getItem(BF_PROFILES);\n    let activeId = sessionStorage.getItem(BF_ACTIVE);\n\n    // Fall back: if sessionStorage is empty but localStorage has profiles,\n    // pick the first profile (same logic as resolveActiveProfileId)\n    if (!activeId && profiles) {\n      try {\n        const profileList = JSON.parse(profiles) as Array<{ id: string }>;\n        if (profileList.length > 0) {\n          activeId = profileList[0].id;\n          sessionStorage.setItem(BF_ACTIVE, activeId);\n        }\n      } catch {\n        // ignore\n      }\n    }\n\n    if (!activeId) {\n      return {\n        user: null,\n        tokens: null,\n        profiles: profiles ? JSON.parse(profiles) : [],\n        activeProfileId: null,\n      };\n    }\n    const user = localStorage.getItem(`${BF_PREFIX}-${activeId}-user`);\n    const tokens = localStorage.getItem(`${BF_PREFIX}-${activeId}-tokens`);\n    const wsToken = localStorage.getItem(\n      `${BF_PREFIX}-${activeId}-workspace-token`,\n    );\n\n    return {\n      user: user ? JSON.parse(user) : null,\n      tokens: tokens\n        ? { ...JSON.parse(tokens), workspaceToken: wsToken ?? undefined }\n        : null,\n      profiles: profiles ? JSON.parse(profiles) : [],\n      activeProfileId: activeId,\n    };\n  } catch {\n    return { user: null, tokens: null, profiles: [], activeProfileId: null };\n  }\n}\n\nfunction writeAuthState(payload: Record<string, unknown>): void {\n  const profileId =\n    (payload.activeProfileId as string) ??\n    ((payload.user as Record<string, unknown>)?.id as string) ??\n    sessionStorage.getItem(BF_ACTIVE);\n  if (!profileId) return;\n\n  if (payload.user) {\n    localStorage.setItem(\n      `${BF_PREFIX}-${profileId}-user`,\n      JSON.stringify(payload.user),\n    );\n  }\n  if (payload.tokens && typeof payload.tokens === \"object\") {\n    const t = payload.tokens as Record<string, unknown>;\n    const { workspaceToken, ...rest } = t;\n    localStorage.setItem(\n      `${BF_PREFIX}-${profileId}-tokens`,\n      JSON.stringify(rest),\n    );\n    if (workspaceToken) {\n      localStorage.setItem(\n        `${BF_PREFIX}-${profileId}-workspace-token`,\n        String(workspaceToken),\n      );\n    }\n  }\n  if (payload.profiles) {\n    localStorage.setItem(BF_PROFILES, JSON.stringify(payload.profiles));\n  }\n  sessionStorage.setItem(BF_ACTIVE, profileId);\n}\n\nfunction clearAuthState(): void {\n  const activeId = sessionStorage.getItem(BF_ACTIVE);\n  if (activeId) {\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-user`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-tokens`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-workspace-token`);\n    localStorage.removeItem(`${BF_PREFIX}-${activeId}-auth-storage`);\n    // Remove from profiles list\n    try {\n      const raw = localStorage.getItem(BF_PROFILES);\n      const profiles = raw ? JSON.parse(raw) : [];\n      localStorage.setItem(\n        BF_PROFILES,\n        JSON.stringify(\n          profiles.filter((p: { id: string }) => p.id !== activeId),\n        ),\n      );\n    } catch {\n      /* ignore */\n    }\n    sessionStorage.removeItem(BF_ACTIVE);\n  }\n  localStorage.removeItem(\"auth-storage\");\n}\n\nfunction clearAllAuthState(): void {\n  // Get all profiles and remove their data\n  try {\n    const raw = localStorage.getItem(BF_PROFILES);\n    const profiles: Array<{ id: string }> = raw ? JSON.parse(raw) : [];\n    for (const p of profiles) {\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-user`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-tokens`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-workspace-token`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-auth-storage`);\n      localStorage.removeItem(`${BF_PREFIX}-${p.id}-context`);\n    }\n  } catch {\n    /* ignore */\n  }\n  for (const key of Object.keys(localStorage)) {\n    if (key.startsWith(`${BF_PREFIX}-`) && key.endsWith(\"-auth-storage\")) {\n      localStorage.removeItem(key);\n    }\n  }\n  localStorage.removeItem(BF_PROFILES);\n  localStorage.removeItem(\"auth-storage\");\n  sessionStorage.removeItem(BF_ACTIVE);\n}\n\n// SSO cookie helpers (shared domain cookie for local dev fast-path)\nconst SSO_COOKIE_NAME = \"bf-sso-profile\";\nconst SHELL_SSO_COOKIE_NAME = \"bf-sso\";\nfunction setSSoCookieBridge(profileId: string, origin: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const cookieValue = JSON.stringify({ id: profileId, origin });\n    document.cookie = `${SSO_COOKIE_NAME}=${encodeURIComponent(cookieValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction setShellSsoCookieBridge(profileId: string, origin: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const ssoValue = JSON.stringify({ id: profileId, origin });\n    document.cookie = `${SHELL_SSO_COOKIE_NAME}=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction clearSSoCookieBridge(): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    document.cookie = `${SSO_COOKIE_NAME}=; path=/; max-age=0`;\n    document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; max-age=0`;\n    if (domain) {\n      document.cookie = `${SSO_COOKIE_NAME}=; path=/; domain=${domain}; max-age=0`;\n      document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; domain=${domain}; max-age=0`;\n    }\n    if (hostname && ![\"localhost\", \"127.0.0.1\"].includes(hostname)) {\n      document.cookie = `${SSO_COOKIE_NAME}=; path=/; domain=${hostname}; max-age=0`;\n      document.cookie = `${SHELL_SSO_COOKIE_NAME}=; path=/; domain=${hostname}; max-age=0`;\n    }\n  } catch {\n    /* ignore */\n  }\n}\n\nexport function SessionBridgePage() {\n  const connectedParents = useRef<Map<Window, ConnectedParent>>(new Map());\n  const readySentTo = useRef<Map<Window, string>>(new Map());\n  const storageAccessGranted = useRef(false);\n\n  // Request unpartitioned storage access (Storage Access API).\n  // This is critical for cross-domain SSO in modern browsers that\n  // partition third-party iframe localStorage.\n  useEffect(() => {\n    async function requestAccess() {\n      try {\n        // Check if Storage Access API is available\n        if (!document.requestStorageAccess) {\n          storageAccessGranted.current = true;\n          return;\n        }\n        // Check if we already have access\n        const hasAccess = await document.hasStorageAccess();\n        if (hasAccess) {\n          storageAccessGranted.current = true;\n          return;\n        }\n        // Request unpartitioned storage access\n        await document.requestStorageAccess();\n        storageAccessGranted.current = true;\n      } catch {\n        // Storage Access API not available or denied — fall through\n        // to cookie-based fallback. localStorage will be partitioned.\n        storageAccessGranted.current = false;\n      }\n    }\n    void requestAccess();\n  }, []);\n\n  useEffect(() => {\n    function isOriginAllowed(origin: string): boolean {\n      return isAllowedSsoOriginString(origin);\n    }\n\n    function broadcastToAll(\n      message: BridgeMessage,\n      excludeSource?: Window | null,\n    ): void {\n      connectedParents.current.forEach((connection, parent) => {\n        if (parent !== excludeSource) {\n          connection.source.postMessage(\n            { ...message, source: BRIDGE_SOURCE, nonce: connection.nonce },\n            connection.origin,\n          );\n        }\n      });\n    }\n\n    function handleMessage(event: MessageEvent): void {\n      if (!isOriginAllowed(event.origin)) return;\n      if (!isBridgeMessage(event.data) || event.data.source !== PARENT_SOURCE) {\n        return;\n      }\n      const message = event.data;\n      const parentSource = isWindowMessageSource(event.source)\n        ? event.source\n        : null;\n      if (!parentSource) return;\n\n      const incomingNonce =\n        typeof message.nonce === \"string\" && message.nonce.length > 0\n          ? message.nonce\n          : null;\n      const existingConnection = connectedParents.current.get(parentSource);\n\n      if (message.type !== \"AUTH_INIT\") {\n        if (!incomingNonce || existingConnection?.nonce !== incomingNonce) {\n          return;\n        }\n      } else if (!incomingNonce) {\n        return;\n      }\n\n      switch (message.type) {\n        case \"AUTH_INIT\": {\n          connectedParents.current.set(parentSource, {\n            source: parentSource,\n            origin: event.origin,\n            nonce: incomingNonce,\n          });\n\n          // If the parent sends its current auth state in AUTH_INIT,\n          // store it so other cross-domain shells can pick it up.\n          if (message.payload && typeof message.payload === \"object\") {\n            const initPayload = message.payload as Record<string, unknown>;\n            if (initPayload.user && initPayload.tokens) {\n              writeAuthState(initPayload);\n            }\n          }\n\n          const state = readAuthState();\n          const connection = connectedParents.current.get(parentSource);\n          if (connection) {\n            connection.source.postMessage(\n              {\n                type: \"AUTH_STATE\",\n                payload: state,\n                source: BRIDGE_SOURCE,\n                nonce: connection.nonce,\n              },\n              event.origin,\n            );\n            if (readySentTo.current.get(parentSource) !== connection.nonce) {\n              readySentTo.current.set(parentSource, connection.nonce);\n              connection.source.postMessage(\n                {\n                  type: \"AUTH_BRIDGE_READY\",\n                  source: BRIDGE_SOURCE,\n                  nonce: connection.nonce,\n                },\n                event.origin,\n              );\n            }\n          }\n          break;\n        }\n        case \"AUTH_LOGIN\": {\n          if (message.payload) {\n            writeAuthState(message.payload);\n            // Set SSO cookie for cross-domain fast-path detection\n            const loginPayload = message.payload as Record<string, unknown>;\n            const loginProfileId =\n              (loginPayload.activeProfileId as string) ??\n              ((loginPayload.user as Record<string, unknown>)?.id as string);\n            if (loginProfileId) {\n              clearSSoCookieBridge();\n              setSSoCookieBridge(loginProfileId, event.origin);\n              setShellSsoCookieBridge(loginProfileId, event.origin);\n            }\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"login\" },\n              },\n              parentSource,\n            );\n          }\n          break;\n        }\n        case \"AUTH_LOGOUT\": {\n          clearAuthState();\n          clearSSoCookieBridge();\n          broadcastToAll(\n            {\n              type: \"AUTH_STATE_CHANGED\",\n              payload: { ...readAuthState(), trigger: \"logout\" },\n            },\n            parentSource,\n          );\n          break;\n        }\n        case \"AUTH_LOGOUT_ALL\": {\n          clearAllAuthState();\n          clearSSoCookieBridge();\n          broadcastToAll(\n            {\n              type: \"AUTH_STATE_CHANGED\",\n              payload: { ...readAuthState(), trigger: \"logout_all\" },\n            },\n            parentSource,\n          );\n          break;\n        }\n        case \"AUTH_TOKEN_REFRESH\": {\n          if (message.payload?.tokens) {\n            writeAuthState({ tokens: message.payload.tokens });\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"refresh\" },\n              },\n              parentSource,\n            );\n          }\n          break;\n        }\n        case \"AUTH_ACCOUNT_SWITCH\": {\n          if (message.payload) {\n            writeAuthState(message.payload);\n            broadcastToAll(\n              {\n                type: \"AUTH_STATE_CHANGED\",\n                payload: { ...readAuthState(), trigger: \"account_switch\" },\n              },\n              parentSource,\n            );\n          }\n          break;\n        }\n      }\n    }\n\n    function handleStorageChange(event: StorageEvent): void {\n      if (event.key?.startsWith(BF_PREFIX) || event.key === BF_PROFILES) {\n        broadcastToAll({\n          type: \"AUTH_STATE_CHANGED\",\n          payload: { ...readAuthState(), trigger: \"storage_sync\" },\n        });\n      }\n    }\n\n    window.addEventListener(\"message\", handleMessage);\n    window.addEventListener(\"storage\", handleStorageChange);\n\n    return () => {\n      window.removeEventListener(\"message\", handleMessage);\n      window.removeEventListener(\"storage\", handleStorageChange);\n      // Don't clear connectedParents or readySentTo on cleanup to maintain state across StrictMode remounts\n    };\n  }, []);\n\n  return (\n    <div\n      id=\"auth-session-bridge-root\"\n      data-bridge=\"active\"\n      style={{ display: \"none\" }}\n    />\n  );\n}\n"],"mappings":";;;;AAgBA,IAAM,IAAgB,yBAChB,IAAgB,yBAChB,IAAY,QACZ,IAAc,eACd,IAAY;AAelB,SAAS,EACP,GACkB;AAClB,QACE,MAAW,QACX,OAAQ,EAAqC,eAAgB;;AAIjE,SAAS,EAAgB,GAAwC;AAC/D,QACE,OAAO,KAAU,cACjB,KACA,OAAQ,EAA6B,QAAS;;AAIlD,SAAS,IAAyC;AAChD,KAAI;EACF,IAAM,IAAW,aAAa,QAAQ,EAAY,EAC9C,IAAW,eAAe,QAAQ,EAAU;AAIhD,MAAI,CAAC,KAAY,EACf,KAAI;GACF,IAAM,IAAc,KAAK,MAAM,EAAS;AACxC,GAAI,EAAY,SAAS,MACvB,IAAW,EAAY,GAAG,IAC1B,eAAe,QAAQ,GAAW,EAAS;UAEvC;AAKV,MAAI,CAAC,EACH,QAAO;GACL,MAAM;GACN,QAAQ;GACR,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;GAC9C,iBAAiB;GAClB;EAEH,IAAM,IAAO,aAAa,QAAQ,GAAG,EAAU,GAAG,EAAS,OAAO,EAC5D,IAAS,aAAa,QAAQ,GAAG,EAAU,GAAG,EAAS,SAAS,EAChE,IAAU,aAAa,QAC3B,GAAG,EAAU,GAAG,EAAS,kBAC1B;AAED,SAAO;GACL,MAAM,IAAO,KAAK,MAAM,EAAK,GAAG;GAChC,QAAQ,IACJ;IAAE,GAAG,KAAK,MAAM,EAAO;IAAE,gBAAgB,KAAW,KAAA;IAAW,GAC/D;GACJ,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;GAC9C,iBAAiB;GAClB;SACK;AACN,SAAO;GAAE,MAAM;GAAM,QAAQ;GAAM,UAAU,EAAE;GAAE,iBAAiB;GAAM;;;AAI5E,SAAS,EAAe,GAAwC;CAC9D,IAAM,IACH,EAAQ,mBACP,EAAQ,MAAkC,MAC5C,eAAe,QAAQ,EAAU;AAC9B,QAQL;MANI,EAAQ,QACV,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,QAC1B,KAAK,UAAU,EAAQ,KAAK,CAC7B,EAEC,EAAQ,UAAU,OAAO,EAAQ,UAAW,UAAU;GAExD,IAAM,EAAE,mBAAgB,GAAG,MADjB,EAAQ;AAMlB,GAJA,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,UAC1B,KAAK,UAAU,EAAK,CACrB,EACG,KACF,aAAa,QACX,GAAG,EAAU,GAAG,EAAU,mBAC1B,OAAO,EAAe,CACvB;;AAML,EAHI,EAAQ,YACV,aAAa,QAAQ,GAAa,KAAK,UAAU,EAAQ,SAAS,CAAC,EAErE,eAAe,QAAQ,GAAW,EAAU;;;AAG9C,SAAS,IAAuB;CAC9B,IAAM,IAAW,eAAe,QAAQ,EAAU;AAClD,KAAI,GAAU;AAIZ,EAHA,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,OAAO,EACxD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,SAAS,EAC1D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,kBAAkB,EACnE,aAAa,WAAW,GAAG,EAAU,GAAG,EAAS,eAAe;AAEhE,MAAI;GACF,IAAM,IAAM,aAAa,QAAQ,EAAY,EACvC,IAAW,IAAM,KAAK,MAAM,EAAI,GAAG,EAAE;AAC3C,gBAAa,QACX,GACA,KAAK,UACH,EAAS,QAAQ,MAAsB,EAAE,OAAO,EAAS,CAC1D,CACF;UACK;AAGR,iBAAe,WAAW,EAAU;;AAEtC,cAAa,WAAW,eAAe;;AAGzC,SAAS,IAA0B;AAEjC,KAAI;EACF,IAAM,IAAM,aAAa,QAAQ,EAAY,EACvC,IAAkC,IAAM,KAAK,MAAM,EAAI,GAAG,EAAE;AAClE,OAAK,IAAM,KAAK,EAKd,CAJA,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,OAAO,EACpD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,SAAS,EACtD,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,kBAAkB,EAC/D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,eAAe,EAC5D,aAAa,WAAW,GAAG,EAAU,GAAG,EAAE,GAAG,UAAU;SAEnD;AAGR,MAAK,IAAM,KAAO,OAAO,KAAK,aAAa,CACzC,CAAI,EAAI,WAAW,GAAG,EAAU,GAAG,IAAI,EAAI,SAAS,gBAAgB,IAClE,aAAa,WAAW,EAAI;AAKhC,CAFA,aAAa,WAAW,EAAY,EACpC,aAAa,WAAW,eAAe,EACvC,eAAe,WAAW,EAAU;;AAItC,IAAM,IAAkB,kBAClB,IAAwB;AAC9B,SAAS,EAAmB,GAAmB,GAAsB;AACnE,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAc,KAAK,UAAU;GAAE,IAAI;GAAW;GAAQ,CAAC;AAC7D,WAAS,SAAS,GAAG,EAAgB,GAAG,mBAAmB,EAAY,GAAG,EAAW,wBAAwB,EAAW;SAClH;;AAKV,SAAS,EAAwB,GAAmB,GAAsB;AACxE,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAAE,IAAI;GAAW;GAAQ,CAAC;AAC1D,WAAS,SAAS,GAAG,EAAsB,GAAG,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;SACrH;;AAKV,SAAS,IAA6B;AACpC,KAAI;EACF,IAAM,IAAW,OAAO,SAAS,UAC3B,IAAS,EAAS,SAAS,uBAAuB,GACpD,yBACA,KAAA;AAOJ,EANA,SAAS,SAAS,GAAG,EAAgB,uBACrC,SAAS,SAAS,GAAG,EAAsB,uBACvC,MACF,SAAS,SAAS,GAAG,EAAgB,oBAAoB,EAAO,cAChE,SAAS,SAAS,GAAG,EAAsB,oBAAoB,EAAO,eAEpE,KAAY,CAAC,CAAC,aAAa,YAAY,CAAC,SAAS,EAAS,KAC5D,SAAS,SAAS,GAAG,EAAgB,oBAAoB,EAAS,cAClE,SAAS,SAAS,GAAG,EAAsB,oBAAoB,EAAS;SAEpE;;AAKV,SAAgB,IAAoB;CAClC,IAAM,IAAmB,kBAAqC,IAAI,KAAK,CAAC,EAClE,IAAc,kBAA4B,IAAI,KAAK,CAAC,EACpD,IAAuB,EAAO,GAAM;AAqN1C,QAhNA,QAAgB;EACd,eAAe,IAAgB;AAC7B,OAAI;AAEF,QAAI,CAAC,SAAS,sBAAsB;AAClC,OAAqB,UAAU;AAC/B;;AAIF,QADkB,MAAM,SAAS,kBAAkB,EACpC;AACb,OAAqB,UAAU;AAC/B;;AAIF,IADA,MAAM,SAAS,sBAAsB,EACrC,EAAqB,UAAU;WACzB;AAGN,MAAqB,UAAU;;;AAG9B,KAAe;IACnB,EAAE,CAAC,EAEN,QAAgB;EACd,SAAS,EAAgB,GAAyB;AAChD,UAAO,EAAyB,EAAO;;EAGzC,SAAS,EACP,GACA,GACM;AACN,KAAiB,QAAQ,SAAS,GAAY,MAAW;AACvD,IAAI,MAAW,KACb,EAAW,OAAO,YAChB;KAAE,GAAG;KAAS,QAAQ;KAAe,OAAO,EAAW;KAAO,EAC9D,EAAW,OACZ;KAEH;;EAGJ,SAAS,EAAc,GAA2B;AAEhD,OADI,CAAC,EAAgB,EAAM,OAAO,IAC9B,CAAC,EAAgB,EAAM,KAAK,IAAI,EAAM,KAAK,WAAW,EACxD;GAEF,IAAM,IAAU,EAAM,MAChB,IAAe,EAAsB,EAAM,OAAO,GACpD,EAAM,SACN;AACJ,OAAI,CAAC,EAAc;GAEnB,IAAM,IACJ,OAAO,EAAQ,SAAU,YAAY,EAAQ,MAAM,SAAS,IACxD,EAAQ,QACR,MACA,IAAqB,EAAiB,QAAQ,IAAI,EAAa;AAErE,OAAI,EAAQ,SAAS;QACf,CAAC,KAAiB,GAAoB,UAAU,EAClD;cAEO,CAAC,EACV;AAGF,WAAQ,EAAQ,MAAhB;IACE,KAAK,aAAa;AAShB,SARA,EAAiB,QAAQ,IAAI,GAAc;MACzC,QAAQ;MACR,QAAQ,EAAM;MACd,OAAO;MACR,CAAC,EAIE,EAAQ,WAAW,OAAO,EAAQ,WAAY,UAAU;MAC1D,IAAM,IAAc,EAAQ;AAC5B,MAAI,EAAY,QAAQ,EAAY,UAClC,EAAe,EAAY;;KAI/B,IAAM,IAAQ,GAAe,EACvB,IAAa,EAAiB,QAAQ,IAAI,EAAa;AAC7D,KAAI,MACF,EAAW,OAAO,YAChB;MACE,MAAM;MACN,SAAS;MACT,QAAQ;MACR,OAAO,EAAW;MACnB,EACD,EAAM,OACP,EACG,EAAY,QAAQ,IAAI,EAAa,KAAK,EAAW,UACvD,EAAY,QAAQ,IAAI,GAAc,EAAW,MAAM,EACvD,EAAW,OAAO,YAChB;MACE,MAAM;MACN,QAAQ;MACR,OAAO,EAAW;MACnB,EACD,EAAM,OACP;AAGL;;IAEF,KAAK;AACH,SAAI,EAAQ,SAAS;AACnB,QAAe,EAAQ,QAAQ;MAE/B,IAAM,IAAe,EAAQ,SACvB,IACH,EAAa,mBACZ,EAAa,MAAkC;AAMnD,MALI,MACF,GAAsB,EACtB,EAAmB,GAAgB,EAAM,OAAO,EAChD,EAAwB,GAAgB,EAAM,OAAO,GAEvD,EACE;OACE,MAAM;OACN,SAAS;QAAE,GAAG,GAAe;QAAE,SAAS;QAAS;OAClD,EACD,EACD;;AAEH;IAEF,KAAK;AAGH,KAFA,GAAgB,EAChB,GAAsB,EACtB,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAU;MACnD,EACD,EACD;AACD;IAEF,KAAK;AAGH,KAFA,GAAmB,EACnB,GAAsB,EACtB,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAc;MACvD,EACD,EACD;AACD;IAEF,KAAK;AACH,KAAI,EAAQ,SAAS,WACnB,EAAe,EAAE,QAAQ,EAAQ,QAAQ,QAAQ,CAAC,EAClD,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAW;MACpD,EACD,EACD;AAEH;IAEF,KAAK;AACH,KAAI,EAAQ,YACV,EAAe,EAAQ,QAAQ,EAC/B,EACE;MACE,MAAM;MACN,SAAS;OAAE,GAAG,GAAe;OAAE,SAAS;OAAkB;MAC3D,EACD,EACD;AAEH;;;EAKN,SAAS,EAAoB,GAA2B;AACtD,IAAI,EAAM,KAAK,WAAW,EAAU,IAAI,EAAM,QAAQ,MACpD,EAAe;IACb,MAAM;IACN,SAAS;KAAE,GAAG,GAAe;KAAE,SAAS;KAAgB;IACzD,CAAC;;AAON,SAHA,OAAO,iBAAiB,WAAW,EAAc,EACjD,OAAO,iBAAiB,WAAW,EAAoB,QAE1C;AAEX,GADA,OAAO,oBAAoB,WAAW,EAAc,EACpD,OAAO,oBAAoB,WAAW,EAAoB;;IAG3D,EAAE,CAAC,EAGJ,kBAAC,OAAD;EACE,IAAG;EACH,eAAY;EACZ,OAAO,EAAE,SAAS,QAAQ;EAC1B,CAAA"}

package/dist/auth/utils/ssoOrigins.js

@@ -0,0 +1,19 @@
+//#region src/auth/utils/ssoOrigins.ts
+var e = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
+function t(t) {
+	if (t.hostname === "localhost" || t.hostname === "127.0.0.1" || t.hostname.endsWith(".local.burdenoff.com")) return !0;
+	if (t.protocol !== "https:") return !1;
+	for (let n of e) if (t.hostname === n || t.hostname === `app.${n}` || t.hostname === `alphaapp.${n}` || t.hostname === `admin.${n}` || t.hostname === `alphaadmin.${n}` || t.hostname === `www.${n}`) return !0;
+	return !1;
+}
+function n(e) {
+	try {
+		return t(new URL(e));
+	} catch {
+		return !1;
+	}
+}
+//#endregion
+export { t as isAllowedSsoOrigin, n as isAllowedSsoOriginString };
+
+//# sourceMappingURL=ssoOrigins.js.map

package/dist/auth/utils/ssoOrigins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoOrigins.js","names":[],"sources":["../../../src/auth/utils/ssoOrigins.ts"],"sourcesContent":["/**\n * Shared first-party SSO origin allow-list for the cross-domain auth pages\n * (SSOClearPage, SSODepositPage, SSORelayPage, SessionBridgePage).\n *\n * These four pages each used to hand-roll an identical copy of this domain set\n * plus its matching function, and they drifted independently — BOFF-4120 was\n * exactly that drift (SSOClearPage's copy was missing admin./alphaadmin., so an\n * admin logout returnTo was rejected on the bridge host and stranded the\n * operator on app.burdenoff.com). Keep the list + matching logic HERE only so\n * a new product domain or subdomain is added in one place. BOFF-4124.\n */\n\nconst ALLOWED_SSO_DOMAINS = new Set<string>([\n  \"burdenoff.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botlit.ai\",\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n  \"atheletebridge.com\",\n  \"adaptercloud.com\",\n  \"coolandlovely.com\",\n  \"subscriberbot.com\",\n  \"labsofscience.com\",\n  \"hookmovies.com\",\n]);\n\n/**\n * True when `url` is a first-party Burdenoff shell origin permitted to take\n * part in the cross-domain SSO relay / clear / deposit / session-bridge flow:\n *   - localhost / 127.0.0.1 (any port, local dev)\n *   - *.local.burdenoff.com (local dev behind nginx)\n *   - https://{\"\" | app. | alphaapp. | admin. | alphaadmin. | www.}<product-domain>\n *     — note admin./alphaadmin. are included: the admin app shells\n *     (admin.burdenoff.com / alphaadmin.burdenoff.com) are first-party origins\n *     that relay through and return from the central bridge host.\n */\nexport function isAllowedSsoOrigin(url: URL): boolean {\n  if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n  if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n  if (url.protocol !== \"https:\") return false;\n  for (const domain of ALLOWED_SSO_DOMAINS) {\n    if (\n      url.hostname === domain ||\n      url.hostname === `app.${domain}` ||\n      url.hostname === `alphaapp.${domain}` ||\n      url.hostname === `admin.${domain}` ||\n      url.hostname === `alphaadmin.${domain}` ||\n      url.hostname === `www.${domain}`\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * String-origin variant for postMessage origin checks (SessionBridgePage),\n * which receives a raw origin string rather than a parsed URL. Returns false on\n * an unparseable origin.\n */\nexport function isAllowedSsoOriginString(origin: string): boolean {\n  try {\n    return isAllowedSsoOrigin(new URL(origin));\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";AAYA,IAAM,IAAsB,IAAI,IAAY,8qBAwC3C,CAAC;AAYF,SAAgB,EAAmB,GAAmB;AAEpD,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAQT,SAAgB,EAAyB,GAAyB;AAChE,KAAI;AACF,SAAO,EAAmB,IAAI,IAAI,EAAO,CAAC;SACpC;AACN,SAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/microfe-auth",
-  "version": "2026.718.1",
+  "version": "2026.718.2",
   "description": "Auth microfrontend for Burdenoff products",
   "type": "module",
   "imports": {