@burdenoff/microfe-auth 2026.718.4 → 2026.725.1

package/dist/auth/hooks/useDelegationOperations.d.ts

@@ -0,0 +1,38 @@
+import { AppUserDelegation, GrantDelegationInput } from '../types';
+
+interface CurrentUserDelegationsResponse {
+    currentUserDelegations: {
+        delegations: AppUserDelegation[];
+        hasMore: boolean;
+        totalCount: number;
+    };
+}
+interface CurrentUserGrantedDelegationsResponse {
+    currentUserGrantedDelegations: {
+        delegations: AppUserDelegation[];
+        hasMore: boolean;
+        totalCount: number;
+    };
+}
+/**
+ * Hook for app-user delegation operations
+ */
+export declare function useDelegationOperations(): {
+    grantDelegation: (input: GrantDelegationInput) => Promise<AppUserDelegation>;
+    revokeDelegation: (id: string, reason?: string) => Promise<boolean>;
+    getDelegationsForApp: (appId: string) => AppUserDelegation[];
+    hasWorkspaceDelegation: (appId: string, workspaceId: string) => boolean;
+    refetchDelegations: (variables?: Partial<import('@apollo/client').OperationVariables> | undefined) => Promise<{
+        data: CurrentUserDelegationsResponse | undefined;
+        error?: import('@apollo/client').ErrorLike;
+    }>;
+    refetchGrantedDelegations: (variables?: Partial<import('@apollo/client').OperationVariables> | undefined) => Promise<{
+        data: CurrentUserGrantedDelegationsResponse | undefined;
+        error?: import('@apollo/client').ErrorLike;
+    }>;
+    delegations: AppUserDelegation[];
+    grantedDelegations: AppUserDelegation[];
+    isLoading: boolean;
+    error: string | null;
+};
+export {};

package/dist/auth/hooks/useMfaOperations.d.ts

@@ -0,0 +1,17 @@
+import { MFAMethod, MFASetupResult, MFAVerifyInput, AuthResult } from '../types';
+
+/**
+ * Hook for MFA operations
+ */
+export declare function useMfaOperations(): {
+    setupMFA: (method: MFAMethod) => Promise<MFASetupResult>;
+    enableMFA: (code: string) => Promise<boolean>;
+    verifyMFA: (input: MFAVerifyInput) => Promise<AuthResult>;
+    disableMFA: () => Promise<boolean>;
+    enableMfa: (code: string) => Promise<boolean>;
+    verifyMfa: (input: MFAVerifyInput) => Promise<AuthResult>;
+    disableMfa: () => Promise<boolean>;
+    mfaRequired: boolean;
+    mfaChallengeId: string | null;
+    isLoading: boolean;
+};

package/dist/auth/hooks/useMyWorkspaces.d.ts

@@ -0,0 +1,47 @@
+import { Workspace } from '../types';
+
+interface MyWorkspacesResponse {
+    myWorkspaces: {
+        total: number;
+        items: Workspace[];
+    };
+}
+/**
+ * Hook for fetching user's workspaces and issuing workspace tokens
+ *
+ * This hook provides:
+ * - Fetch workspaces: Query to get all workspaces the user has access to
+ * - Issue workspace token: Get a workspace-scoped token for API access
+ * - Complete auth flow: Fetch workspaces + auto-select + issue token
+ *
+ * Uses the shell's Apollo client (via GatewayRoute) for useQuery, and
+ * graphqlFetch from fe-libs for imperative calls that need explicit tokens.
+ */
+export declare function useMyWorkspaces(): {
+    workspaces: Workspace[];
+    totalWorkspaces: number;
+    currentWorkspaceId: string | null;
+    workspaceToken: string | null;
+    isLoading: boolean;
+    error: string | null;
+    fetchWorkspaces: (accessToken?: string) => Promise<Workspace[]>;
+    issueWorkspaceToken: (workspaceId: string, organizationId: string, accessToken?: string) => Promise<{
+        success: boolean;
+        token?: string;
+        error?: string;
+    }>;
+    selectWorkspace: (workspace: Workspace) => Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    completeAuthFlow: (accessToken?: string) => Promise<{
+        success: boolean;
+        workspace?: Workspace;
+        error?: string;
+    }>;
+    refetch: (variables?: Partial<import('@apollo/client').OperationVariables> | undefined) => Promise<{
+        data: MyWorkspacesResponse | undefined;
+        error?: import('@apollo/client').ErrorLike;
+    }>;
+};
+export {};

package/dist/auth/hooks/useOAuthOperations.d.ts

@@ -0,0 +1,18 @@
+import { AuthResult } from '../types';
+
+/**
+ * Supported OAuth providers
+ */
+export type OAuthProvider = "google" | "github" | "microsoft";
+/**
+ * Hook for OAuth authentication operations
+ */
+export declare function useOAuthOperations(): {
+    initiateOAuth: (provider: OAuthProvider) => void;
+    completeOAuth: (code: string, state: string) => Promise<AuthResult>;
+    initiateGoogleOAuth: () => void;
+    initiateGitHubOAuth: () => void;
+    initiateMicrosoftOAuth: () => void;
+    isProviderConfigured: (provider: OAuthProvider) => boolean;
+    isLoading: boolean;
+};

package/dist/auth/hooks/usePasswordOperations.d.ts

@@ -0,0 +1,12 @@
+import { ChangePasswordInput, PasswordResetRequestResult } from '../types';
+
+/**
+ * Hook for password management operations
+ * Uses Zustand v5 pattern: selectors for state, getState() for actions
+ */
+export declare function usePasswordOperations(): {
+    changePassword: (input: ChangePasswordInput) => Promise<boolean>;
+    requestPasswordReset: (email: string, recaptchaToken?: string) => Promise<PasswordResetRequestResult>;
+    resetPassword: (token: string, newPassword: string) => Promise<boolean>;
+    isLoading: boolean;
+};

package/dist/auth/hooks/useSessionOperations.d.ts

@@ -0,0 +1,57 @@
+import { ActiveSessionsQuery } from '../../generated/global-operations';
+import { TokenValidationResponse, ValidateTokensInput } from '../types';
+
+interface TokenInfoQueryResponse {
+    tokenInfo: TokenValidationResponse;
+}
+interface UseSessionOperationsOptions {
+    disableTokenInfoQuery?: boolean;
+    /** Number of sessions to load per page (default: 10) */
+    pageSize?: number;
+}
+/**
+ * Hook for session/token management operations
+ */
+export declare function useSessionOperations(options?: UseSessionOperationsOptions): {
+    validateTokens: (input: ValidateTokensInput) => Promise<TokenValidationResponse>;
+    isTokenExpired: () => boolean;
+    getTokenRemainingTime: () => number;
+    tokenInfo: TokenValidationResponse | undefined;
+    revokeSession: (sessionId: string) => Promise<boolean>;
+    revokeAllSessions: () => Promise<{
+        success: boolean;
+        revokedCount: number;
+    }>;
+    activeSessions: {
+        __typename?: "Session";
+        id: string;
+        status: import('../../generated/global-types').SessionStatus;
+        ipAddress?: string | null;
+        userAgent?: string | null;
+        location?: string | null;
+        lastActivityAt: string;
+        expiresAt: string;
+        createdAt: string;
+        isCurrent: boolean;
+    }[];
+    sessionsLoading: boolean;
+    refetchSessions: (variables?: Partial<import('../../generated/global-types').Exact<{
+        pagination?: import('../../generated/global-types').InputMaybe<import('../../generated/global-types').PaginationInput>;
+    }>> | undefined) => Promise<{
+        data: ActiveSessionsQuery | undefined;
+        error?: import('@apollo/client').ErrorLike;
+    }>;
+    page: number;
+    pageSize: number;
+    totalCount: number;
+    totalPages: number;
+    hasMore: boolean;
+    goToNextPage: () => void;
+    goToPrevPage: () => void;
+    isLoading: boolean;
+    refetch: (variables?: Partial<import('@apollo/client').OperationVariables> | undefined) => Promise<{
+        data: TokenInfoQueryResponse | undefined;
+        error?: import('@apollo/client').ErrorLike;
+    }>;
+};
+export {};

package/dist/auth/hooks/useSignupCaptcha.d.ts

@@ -0,0 +1,22 @@
+export interface SignupCaptchaState {
+    /** Whether the reCAPTCHA v2 checkbox should be rendered + required on signup. */
+    enabled: boolean;
+    /** The reCAPTCHA v2 site key to render the widget with (undefined when disabled). */
+    siteKey: string | undefined;
+    /** True while the per-product config is still being fetched. */
+    loading: boolean;
+}
+/**
+ * Resolve whether the signup page should show the reCAPTCHA v2 checkbox, and
+ * with which site key, for the current host product.
+ *
+ * Source of truth is the platform product catalog: a product opts into signup
+ * captcha simply by having a `recaptchaSiteKey` configured (looked up here via
+ * the host-provided `productSlug`). This keeps enablement per-product and
+ * data-driven — no rebuild needed to turn it on/off for a product.
+ *
+ * Falls back to the build-time env (`VITE_CAPTCHA_ENABLED` +
+ * `VITE_RECAPTCHA_SITE_KEY`) only for local source-dev where no `productSlug`
+ * is provided, preserving the previous behavior.
+ */
+export declare function useSignupCaptcha(): SignupCaptchaState;

package/dist/auth/hooks/useSsoOperations.d.ts

@@ -0,0 +1,67 @@
+import { AuthResult, SSOConfig } from '../types';
+
+interface GetSSOConfigResponse {
+    getSSOConfig: SSOConfig | null;
+}
+interface GetSSOConfigVariables {
+    tenantId: string;
+}
+export interface SSOConfigInput {
+    entityId: string;
+    ssoUrl: string;
+    sloUrl?: string;
+    certificate: string;
+    enabled?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface SAMLRequestResult {
+    requestId: string;
+    ssoUrl: string;
+    samlRequest: string;
+}
+export interface ExternalOIDCAuthUrlResult {
+    authUrl: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    relayState?: string;
+}
+export interface OIDCConfig {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userinfoEndpoint: string;
+    jwksUri: string;
+    registrationEndpoint?: string;
+    scopesSupported: string[];
+    responseTypesSupported: string[];
+    grantTypesSupported: string[];
+}
+/**
+ * Hook for SSO/SAML operations
+ */
+export declare function useSsoOperations(tenantId?: string): {
+    initiateSsoLogin: (targetTenantId: string, relayState?: string) => Promise<void>;
+    handleSamlCallback: (samlResponse: string, relayState?: string) => Promise<AuthResult>;
+    saveSsoConfig: (configOrTenantId: SSOConfigInput | string, config?: SSOConfigInput) => Promise<SSOConfig>;
+    deleteSsoConfig: (targetTenantId?: string) => Promise<boolean>;
+    getOidcAuthUrl: (clientId: string, redirectUri: string, scopes?: string[]) => Promise<string>;
+    exchangeOidcCode: (code: string, clientId: string, redirectUri: string) => Promise<AuthResult>;
+    validateOidcState: (state: string) => boolean;
+    initiateExternalOidcLogin: (targetTenantId: string, redirectPath?: string) => Promise<void>;
+    handleExternalOidcCallback: (code: string, state: string) => Promise<AuthResult>;
+    isExternalOidcCallback: () => boolean;
+    ssoConfig: SSOConfig | undefined;
+    oidcConfig: OIDCConfig | undefined;
+    isLoading: boolean;
+    isGeneratingRequest: boolean;
+    isAuthenticating: boolean;
+    isSaving: boolean;
+    isDeleting: boolean;
+    isGeneratingOidcUrl: boolean;
+    refetchConfig: (variables?: Partial<GetSSOConfigVariables> | undefined) => Promise<{
+        data: GetSSOConfigResponse | undefined;
+        error?: import('@apollo/client').ErrorLike;
+    }>;
+};
+export {};

package/dist/auth/hooks/useTokenRefresh.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Automatic workspace token refresh hook
+ *
+ * Monitors the workspace token and automatically refreshes it
+ * 5 minutes before expiry. This ensures uninterrupted access to
+ * workspace resources.
+ *
+ * Usage:
+ * ```tsx
+ * // In your root App component
+ * function App() {
+ *   useTokenRefresh({
+ *     workspaceAuthServiceUrl: 'http://localhost:3730/graphql',
+ *     refreshBeforeExpiry: 5 * 60 * 1000, // 5 minutes
+ *   });
+ *
+ *   return <AppContent />;
+ * }
+ * ```
+ */
+export interface UseTokenRefreshOptions {
+    /**
+     * URL of workspace auth service GraphQL endpoint
+     * Default: http://localhost:3730/graphql
+     */
+    workspaceAuthServiceUrl?: string;
+    /**
+     * Time before expiry to refresh token (in milliseconds)
+     * Default: 5 minutes (300000ms)
+     */
+    refreshBeforeExpiry?: number;
+    /**
+     * Enable/disable auto-refresh
+     * Default: true
+     */
+    enabled?: boolean;
+    /**
+     * Callback when token refresh succeeds
+     */
+    onRefreshSuccess?: (token: string) => void;
+    /**
+     * Callback when token refresh fails
+     */
+    onRefreshError?: (error: Error) => void;
+}
+export declare function useTokenRefresh(options?: UseTokenRefreshOptions): {
+    /**
+     * Manually trigger a token refresh
+     */
+    manualRefresh: () => Promise<string>;
+    /**
+     * Check if auto-refresh is currently scheduled
+     */
+    isScheduled: boolean;
+};

package/dist/auth/hooks/useUserOperations.d.ts

@@ -0,0 +1,32 @@
+import { User, UserConnection, UserFilterInput, PaginationInput, DeleteUserResult } from '../types';
+
+interface UpdateUserProfileInput {
+    avatar?: string;
+    username?: string;
+    firstName?: string;
+    lastName?: string;
+    name?: string;
+    phoneNumber?: string;
+    defaultWorkspaceId?: string;
+    language?: string;
+    timezone?: string;
+}
+interface AdminUpdateUserInput extends UpdateUserProfileInput {
+    role?: string;
+    status?: string;
+    emailVerified?: boolean;
+}
+/**
+ * Hook for user management operations
+ */
+export declare function useUserOperations(): {
+    getUser: (id: string) => Promise<User | null>;
+    listUsers: (filter?: UserFilterInput, pagination?: PaginationInput) => Promise<UserConnection>;
+    updateCurrentUserProfile: (input: UpdateUserProfileInput) => Promise<User>;
+    updateUser: (id: string, input: AdminUpdateUserInput) => Promise<User>;
+    deleteUser: (id: string) => Promise<DeleteUserResult>;
+    hardDeleteUser: (id: string) => Promise<DeleteUserResult>;
+    currentUser: User | null;
+    isLoading: boolean;
+};
+export {};

package/dist/auth/hooks/useWorkspaceOperations.d.ts

@@ -0,0 +1,34 @@
+import { useMutation } from '@apollo/client/react';
+import { WorkspaceTokenResponse, SecretRotationResponse, RotateWorkspaceSecretInput } from '../types';
+
+/**
+ * Hook for workspace token and secret operations
+ */
+export declare function useWorkspaceOperations(): {
+    generateWorkspaceToken: (_workspaceId: string) => Promise<WorkspaceTokenResponse>;
+    switchWorkspace: (workspaceId: string) => Promise<WorkspaceTokenResponse>;
+    createWorkspaceSecret: (_workspaceId: string) => Promise<boolean>;
+    rotateWorkspaceSecret: (_input: RotateWorkspaceSecretInput) => Promise<SecretRotationResponse>;
+    revokeWorkspaceSecret: (_workspaceId: string) => Promise<boolean>;
+    revokeWorkspaceToken: (_token: string, _reason?: string) => Promise<boolean>;
+    revokeAllMyWorkspaceTokens: (_reason?: string) => Promise<number>;
+    clearWorkspace: () => void;
+    createWorkspaceMutation: useMutation.MutationFunction<unknown, {
+        [x: string]: any;
+    }, import('@apollo/client').ApolloCache, undefined>;
+    updateWorkspaceMutation: useMutation.MutationFunction<unknown, {
+        [x: string]: any;
+    }, import('@apollo/client').ApolloCache, undefined>;
+    addWorkspaceMemberMutation: useMutation.MutationFunction<unknown, {
+        [x: string]: any;
+    }, import('@apollo/client').ApolloCache, undefined>;
+    updateWorkspaceMemberMutation: useMutation.MutationFunction<unknown, {
+        [x: string]: any;
+    }, import('@apollo/client').ApolloCache, undefined>;
+    removeWorkspaceMemberMutation: useMutation.MutationFunction<unknown, {
+        [x: string]: any;
+    }, import('@apollo/client').ApolloCache, undefined>;
+    currentWorkspaceId: string | null;
+    workspaceToken: string | null;
+    isLoading: boolean;
+};

package/dist/auth/hooks/useWorkspaceToken.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Workspace token management hook
+ *
+ * Provides functions to issue, refresh, and verify workspace tokens.
+ * Automatically updates the auth store with new tokens.
+ *
+ * API Flow:
+ * - Calls workspace gateway (https://gw-wspace.local.burdenoff.com/workspaces/graphql)
+ * - Gateway federates wspace-auth-svc which handles token operations
+ * - Auth token (from global-auth-svc) goes in Authorization header
+ *
+ * Usage:
+ * ```tsx
+ * const { issueToken, refreshToken, verifyToken, isLoading, error } = useWorkspaceToken({
+ *   workspaceGatewayUrl: 'https://gw-wspace.local.burdenoff.com/workspaces/graphql'
+ * });
+ *
+ * // After login and organization/workspace selection
+ * await issueToken(organizationId, workspaceId);
+ *
+ * // Refresh token before expiry (uses stored org/workspace IDs)
+ * await refreshToken();
+ * ```
+ */
+export interface UseWorkspaceTokenOptions {
+    /**
+     * URL of workspace gateway GraphQL endpoint
+     * Default: https://gw-wspace.local.burdenoff.com/workspaces/graphql
+     *
+     * Note: This should point to the workspace gateway, NOT directly to wspace-auth-svc.
+     * The gateway federates wspace-auth-svc and handles routing.
+     */
+    workspaceGatewayUrl?: string;
+}
+export interface WorkspaceTokenPayload {
+    sub: string;
+    workspaceId: string;
+    tenantId?: string;
+    email?: string;
+    username?: string;
+    role?: string;
+    scopes: string[];
+    iat: number;
+    exp: number;
+}
+export declare function useWorkspaceToken(_options?: UseWorkspaceTokenOptions): {
+    issueToken: (organizationId: string, workspaceId?: string, projectId?: string, scopes?: string[]) => Promise<string>;
+    refreshToken: () => Promise<string>;
+    verifyToken: (token?: string) => Promise<WorkspaceTokenPayload>;
+    decodeToken: (token: string) => WorkspaceTokenPayload;
+    isTokenExpired: (token?: string) => boolean;
+    getTimeUntilExpiry: (token?: string) => number;
+    isLoading: boolean;
+    error: string | null;
+};

package/dist/auth/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Auth Microfrontend
+ *
+ * Provides authentication, security settings, and account management interface
+ * for the Burdenoff multi-tenant platform.
+ *
+ * Features:
+ * - User authentication (signIn, signUp, signOut, refreshToken)
+ * - MFA (TOTP, SMS, Email, WebAuthn)
+ * - OAuth and SAML SSO
+ * - Magic Link authentication
+ * - Workspace token management
+ * - User management (admin)
+ *
+ * Note: API Key management, App management, and App-user delegations
+ * have been consolidated into microfe-devportal.
+ *
+ * @example
+ * ```tsx
+ * import { AuthRoot, type AuthRootProps } from '@burdenoff/microfe-auth';
+ *
+ * function App() {
+ *   const props: AuthRootProps = {
+ *     basePath: '/auth',
+ *     navigate: (path) => router.push(path),
+ *     apiGatewayUrl: 'https://gw-global.local.burdenoff.com',
+ *     authToken: 'token',
+ *     onAuthSuccess: (user) => shellLogin(user),
+ *     onLogout: () => shellLogout(),
+ *   };
+ *
+ *   return <AuthRoot {...props} />;
+ * }
+ * ```
+ */
+export { AuthRoot } from './AuthRoot';
+export type { AuthRootProps, User, UserRole, UserStatus, UserConnection, UserFilterInput, PaginationInput, } from './types';
+export type { AuthType, AuthMethod, AuthMethodConfig, AuthStrategyHealth, AuthPayload, AuthResult, SignInInput, SignUpInput, ChangePasswordInput, } from './types';
+export type { MFAMethod, MFASetupResult, MFAVerifyInput } from './types';
+export type { OAuthInput, SAMLInput, SAMLRequestResult } from './types';
+export type { AuthContext, MagicLinkSendResult } from './types';
+export type { Organization, OrganizationConnection } from './types';
+export type { Project, ProjectStatus, ProjectConnection } from './types';
+export type { Workspace, WorkspaceSecretStatus, WorkspaceSecretInfo, WorkspaceTokenResponse, GenerateWorkspaceTokenInput, RotateWorkspaceSecretInput, SecretRotationResponse, } from './types';
+export type { TokenValidationError, TokenValidationResponse, ValidateTokensInput, } from './types';
+export type { EmailVerificationResult, ResendVerificationResult, PasswordResetRequestResult, DeleteUserResult, } from './types';
+export type { Session, MfaDevice, OAuthAccount, SecurityAudit, OAuthProvider, SecurityEventType, TrustedDevice, SSOConfig, PasswordStrength, } from './types';
+export { useAuth } from './providers/AuthProvider';
+export { useAuthOperations, useMfaOperations, useSessionOperations, usePasswordOperations, useAuthStore, } from './hooks';
+export { useWorkspaceOperations } from './hooks';
+export { useUserOperations } from './hooks';
+export { useWorkspaceToken } from './hooks/useWorkspaceToken';
+export { useTokenRefresh } from './hooks/useTokenRefresh';
+export { useContextSwitcherData, useWorkspaceSyncEffect, useProjectSyncEffect, useActiveContextBootstrapMirror, } from './hooks';
+export { useMyWorkspaces } from './hooks';
+export type { UseContextSwitcherDataOptions } from './hooks';
+export type { ActiveContextBootstrapMirrorArgs } from './hooks';
+export { WorkspaceSelector } from './components/workspace/WorkspaceSelector';
+export type { WorkspaceSelectorProps } from './components/workspace/WorkspaceSelector';
+export { UserProfileMenu } from './components/profile/UserProfileMenu';
+export type { UserProfileMenuProps } from './components/profile/UserProfileMenu';
+export { SSORelayPage } from './pages/SSORelayPage';
+export { SSORelayCallbackPage } from './pages/SSORelayCallbackPage';

package/dist/auth/pages/AuditLogPage.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Security audit log page with pagination and export
+ *
+ * Fragment: AuditLogEntry_AuthAuditLog (graphql/operations/global/fragments/AuditLogEntry.fragment.graphql)
+ * Query: AuthAuditLogs (graphql/operations/global/queries/auditLog.graphql)
+ *
+ * TODO: When authAuditLogs backend migrates to AuthAuditLogConnection type,
+ *   update this query to use: authAuditLogs { auditLogs: [...], totalCount, hasMore }
+ *   and remove the client-side hasMore approximation below.
+ */
+export declare function AuditLogPage(): import("react").JSX.Element;

package/dist/auth/pages/EmailVerifyPage.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Email verification page with professional design
+ */
+export declare function EmailVerifyPage(): import("react").JSX.Element;

package/dist/auth/pages/LoginPage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Login page with professional design
+ * Provides email/password login and social OAuth options
+ */
+export declare function LoginPage(): import("react").JSX.Element;

package/dist/auth/pages/MagicLinkPage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Magic Link authentication page
+ * Supports both sending magic links and verifying them via token
+ */
+export declare function MagicLinkPage(): import("react").JSX.Element;

package/dist/auth/pages/MfaSetupPage.d.ts

@@ -0,0 +1,4 @@
+/**
+ * MFA setup and management page with professional UI
+ */
+export declare function MfaSetupPage(): import("react").JSX.Element;

package/dist/auth/pages/MfaVerifyPage.d.ts

@@ -0,0 +1,6 @@
+/**
+ * MFA verification page with professional design
+ * Shown when user needs to verify MFA code during login
+ * Handles both regular login MFA and SSO MFA flows
+ */
+export declare function MfaVerifyPage(): import("react").JSX.Element;

package/dist/auth/pages/OAuthCallbackPage.d.ts

@@ -0,0 +1,6 @@
+/**
+ * OAuth Callback Page
+ * Handles the redirect from OAuth providers (Google, GitHub, Microsoft)
+ * Extracts the authorization code and completes the authentication flow
+ */
+export declare function OAuthCallbackPage(): import("react").JSX.Element;

package/dist/auth/pages/PasswordResetPage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Password reset page with professional design
+ * Handles both requesting reset and completing reset with token
+ */
+export declare function PasswordResetPage(): import("react").JSX.Element;

package/dist/auth/pages/ReactivatePage.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Account Reactivation Page
+ * Allows users to reactivate their deactivated accounts
+ */
+export declare function ReactivatePage(): import("react").JSX.Element;

package/dist/auth/pages/RegisterPage.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Registration page with professional design
+ */
+export declare function RegisterPage(): import("react").JSX.Element;

package/dist/auth/pages/SSOClearPage.d.ts

@@ -0,0 +1,21 @@
+/**
+ * SSOClearPage — Cross-Domain Logout at the Central Bridge Host
+ *
+ * Companion to SSODepositPage. When a user signs out on a product origin,
+ * the product app cleared its own localStorage / cookies but the bridge
+ * host (alphaapp/app.burdenoff.com) still held the deposited session in
+ * first-party (unpartitioned) localStorage. A later visit to any product
+ * would then bridge-host-relay that stale session back, effectively
+ * undoing the logout.
+ *
+ * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect
+ * here via a top-level navigation:
+ *
+ *   product.com (logout)
+ *     → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>
+ *         — wipes bridge-host localStorage + bf-sso cookie
+ *     → <returnTo>
+ *
+ * URL: /auth/sso-clear
+ */
+export declare function SSOClearPage(): import("react").JSX.Element;

package/dist/auth/pages/SSODepositPage.d.ts

@@ -0,0 +1,23 @@
+/**
+ * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host
+ *
+ * Loaded as a top-level navigation (NOT an iframe) on the bridge host
+ * (alphaapp/app.burdenoff.com) right after a user signs in on any other
+ * product origin. It receives the freshly-issued tokens in the URL fragment
+ * (`#sso=<base64>` — fragments are never sent to servers) and stores them
+ * in this origin's first-party (unpartitioned) localStorage so that:
+ *
+ *   1. A later top-level visit to the bridge host renders authenticated.
+ *   2. Other product origins can discover the session via
+ *      `/auth/sso-relay?returnTo=...` against this host.
+ *
+ * Flow:
+ *   product.com/auth/login    → user signs in
+ *   product.com               → POST-success redirect to:
+ *   app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>
+ *                             → writes tokens here, sets bf-sso cookie
+ *   <returnTo>                → user lands back at intended dashboard
+ *
+ * URL: /auth/sso-deposit
+ */
+export declare function SSODepositPage(): import("react").JSX.Element;

package/dist/auth/pages/SSORelayCallbackPage.d.ts

@@ -0,0 +1,7 @@
+/**
+ * SSORelayCallbackPage — Receives tokens from the SSO relay and stores them locally.
+ *
+ * Tokens arrive in the URL fragment (#sso=<base64>) which is never sent to servers.
+ * After storing in localStorage, redirects to the returnTo path.
+ */
+export declare function SSORelayCallbackPage(): import("react").JSX.Element;