@burdenoff/microfe-auth 2026.718.3 → 2026.725.1

package/dist/auth/utils/ssoOrigins.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared first-party SSO origin allow-list for the cross-domain auth pages
+ * (SSOClearPage, SSODepositPage, SSORelayPage, SessionBridgePage).
+ *
+ * These four pages each used to hand-roll an identical copy of this domain set
+ * plus its matching function, and they drifted independently — BOFF-4120 was
+ * exactly that drift (SSOClearPage's copy was missing admin./alphaadmin., so an
+ * admin logout returnTo was rejected on the bridge host and stranded the
+ * operator on app.burdenoff.com). Keep the list + matching logic HERE only so
+ * a new product domain or subdomain is added in one place. BOFF-4124.
+ */
+/**
+ * True when `url` is a first-party Burdenoff shell origin permitted to take
+ * part in the cross-domain SSO relay / clear / deposit / session-bridge flow:
+ *   - localhost / 127.0.0.1 (any port, local dev)
+ *   - *.local.burdenoff.com (local dev behind nginx)
+ *   - https://{"" | app. | alphaapp. | admin. | alphaadmin. | www.}<product-domain>
+ *     — note admin./alphaadmin. are included: the admin app shells
+ *     (admin.burdenoff.com / alphaadmin.burdenoff.com) are first-party origins
+ *     that relay through and return from the central bridge host.
+ */
+export declare function isAllowedSsoOrigin(url: URL): boolean;
+/**
+ * String-origin variant for postMessage origin checks (SessionBridgePage),
+ * which receives a raw origin string rather than a parsed URL. Returns false on
+ * an unparseable origin.
+ */
+export declare function isAllowedSsoOriginString(origin: string): boolean;

package/dist/auth/utils/validation.d.ts

@@ -0,0 +1,29 @@
+import { PasswordStrength } from '../types';
+
+/**
+ * Validate email format
+ */
+export declare function validateEmail(email: string): boolean;
+/**
+ * Validate password requirements
+ */
+export declare function validatePassword(password: string): {
+    valid: boolean;
+    errors: string[];
+};
+/**
+ * Calculate password strength using Zxcvbn-like algorithm
+ * Returns a score from 0-4 (0 = very weak, 4 = very strong)
+ */
+export declare function calculatePasswordStrength(password: string): PasswordStrength;
+/**
+ * Validate MFA code format (6 digits)
+ */
+export declare function validateMfaCode(code: string): boolean;
+/**
+ * Validate API key name
+ */
+export declare function validateApiKeyName(name: string): {
+    valid: boolean;
+    error?: string;
+};

package/dist/dev/main.d.ts

@@ -0,0 +1 @@
+