@burdenoff/microfe-auth 2026.718.4 → 2026.731.1

package/dist/auth/AuthRoot.d.ts

@@ -0,0 +1,29 @@
+import { FC } from 'react';
+import { AuthRootProps } from './types';
+
+/**
+ * Root component for the Auth microfrontend.
+ *
+ * This is the main entry point that host applications import and render.
+ * It sets up the necessary providers and renders the internal routing.
+ * Automatically registers navigation items with the shell if registration functions are provided.
+ *
+ * @example
+ * ```tsx
+ * import { AuthRoot, type AuthRootProps } from '@burdenoff/microfe-auth';
+ *
+ * function App() {
+ *   const props: AuthRootProps = {
+ *     basePath: '/auth',
+ *     navigate: (path) => router.push(path),
+ *     apiGatewayUrl: 'http://localhost:4002',
+ *     authToken: 'token',
+ *     onAuthSuccess: (user) => shellLogin(user),
+ *     onLogout: () => shellLogout(),
+ *   };
+ *
+ *   return <AuthRoot {...props} />;
+ * }
+ * ```
+ */
+export declare const AuthRoot: FC<AuthRootProps>;

package/dist/auth/AuthRoutes.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Internal router for the Auth microfrontend.
+ * This component handles routing within the microfrontend using React Router v7.
+ *
+ * When used within a parent route (e.g., <Route path="/auth/*">), all paths are relative:
+ * - login → Login page (accessible at /auth/login)
+ * - register → Registration page (accessible at /auth/register)
+ * - reset-password → Password reset page (accessible at /auth/reset-password)
+ * - verify-email → Email verification page (accessible at /auth/verify-email)
+ * - mfa-verify → MFA verification page (accessible at /auth/mfa-verify)
+ * - magic-link → Magic link authentication page (accessible at /auth/magic-link)
+ * - sso/login → SSO login page (accessible at /auth/sso/login)
+ * - sso/callback → SSO callback handler (accessible at /auth/sso/callback)
+ * - oauth/callback → OAuth callback handler (accessible at /auth/oauth/callback)
+ * - security → Security settings (protected, accessible at /auth/security)
+ * - sessions → Active sessions (protected, accessible at /auth/sessions)
+ * - mfa → MFA setup (protected, accessible at /auth/mfa)
+ * - users → Users management (protected, admin only, accessible at /auth/users)
+ * - profile → User profile page (protected, accessible at /auth/profile)
+ * - audit-log → Security audit log (protected, accessible at /auth/audit-log)
+ * - sso → SSO configuration (protected, admin only, accessible at /auth/sso)
+ */
+export declare function AuthRoutes({ basePath: _basePath, enableAdminRoutes, bypassEnterprisePlanGate, }: {
+    basePath?: string;
+    enableAdminRoutes?: boolean;
+    bypassEnterprisePlanGate?: boolean;
+}): import("react").JSX.Element;

package/dist/auth/components/AuthIcons.d.ts

@@ -0,0 +1,16 @@
+import { SVGProps } from 'react';
+
+type IconProps = SVGProps<SVGSVGElement>;
+export declare function EmailIcon(props: IconProps): import("react").JSX.Element;
+export declare function LockIcon(props: IconProps): import("react").JSX.Element;
+export declare function UserIcon(props: IconProps): import("react").JSX.Element;
+export declare function EyeIcon(props: IconProps): import("react").JSX.Element;
+export declare function EyeOffIcon(props: IconProps): import("react").JSX.Element;
+export declare function CheckIcon(props: IconProps): import("react").JSX.Element;
+export declare function XIcon(props: IconProps): import("react").JSX.Element;
+export declare function AlertIcon(props: IconProps): import("react").JSX.Element;
+export declare function SpinnerIcon(props: IconProps): import("react").JSX.Element;
+export declare function GoogleIcon(props: IconProps): import("react").JSX.Element;
+export declare function GitHubIcon(props: IconProps): import("react").JSX.Element;
+export declare function MicrosoftIcon(props: IconProps): import("react").JSX.Element;
+export {};

package/dist/auth/components/AuthLayout.d.ts

@@ -0,0 +1,16 @@
+import { ReactNode } from 'react';
+
+interface AuthLayoutProps {
+    children: ReactNode;
+    title: string;
+    subtitle: string;
+    productName?: string;
+    tagline?: string;
+}
+/**
+ * Professional auth layout with split-screen design
+ * Left side: Branding with gradient background
+ * Right side: Auth form
+ */
+export declare function AuthLayout({ children, title, subtitle, productName, tagline, }: AuthLayoutProps): import("react").JSX.Element;
+export {};

package/dist/auth/components/CaptchaV2.d.ts

@@ -0,0 +1,25 @@
+interface CaptchaV2Props {
+    onVerify: (token: string | null) => void;
+    onExpired?: () => void;
+    /**
+     * Host-driven enable flag. When provided it takes precedence over the
+     * build-time env switch (used so a per-product site key can turn the widget
+     * on/off without rebuilding). When omitted, falls back to env.
+     */
+    enabled?: boolean;
+    /**
+     * reCAPTCHA v2 site key to render with. Overrides the build-time env key.
+     * Resolved per-product by the caller (see `useSignupCaptcha`).
+     */
+    siteKey?: string;
+}
+/**
+ * reCAPTCHA v2 checkbox component.
+ *
+ * Enablement is host-driven via the `enabled` prop (resolved per-product from
+ * the platform catalog). When `enabled` is omitted it falls back to the
+ * build-time `VITE_CAPTCHA_ENABLED` env for local source-dev. Renders nothing
+ * when disabled and lazily loads the Google reCAPTCHA library only when enabled.
+ */
+export declare function CaptchaV2({ onVerify, onExpired, enabled, siteKey, }: CaptchaV2Props): import("react").JSX.Element | null;
+export {};

package/dist/auth/components/ConfirmActionDialog.d.ts

@@ -0,0 +1,15 @@
+type ConfirmActionDialogVariant = "default" | "warning" | "danger";
+interface ConfirmActionDialogProps {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    title: string;
+    description: string;
+    confirmText?: string;
+    cancelText?: string;
+    variant?: ConfirmActionDialogVariant;
+    isPending?: boolean;
+    disabled?: boolean;
+    onConfirm: () => void | Promise<void>;
+}
+export declare function ConfirmActionDialog({ open, onOpenChange, title, description, confirmText, cancelText, variant, isPending, disabled, onConfirm, }: ConfirmActionDialogProps): import("react").JSX.Element;
+export {};

package/dist/auth/components/index.d.ts

@@ -0,0 +1,3 @@
+export * from './AuthLayout';
+export * from './AuthIcons';
+export * from './ConfirmActionDialog';

package/dist/auth/components/profile/UserProfileMenu.d.ts

@@ -0,0 +1,41 @@
+export interface UserProfileMenuProps {
+    /**
+     * Callback when workspace switcher should be shown
+     */
+    onSwitchWorkspace?: () => void;
+    /**
+     * Logout handler (REQUIRED)
+     * Should clear auth state and redirect to login
+     */
+    onLogout: () => void;
+    /**
+     * Position of the dropdown menu
+     * @default 'right'
+     */
+    position?: "left" | "right";
+}
+/**
+ * User Profile Menu Component
+ *
+ * Displays user avatar/icon with dropdown menu containing:
+ * - User information
+ * - Switch Workspace option
+ * - Logout button
+ *
+ * @example
+ * ```tsx
+ * import { UserProfileMenu } from '@burdenoff/microfe-auth';
+ *
+ * function AppHeader() {
+ *   return (
+ *     <div className="header">
+ *       <UserProfileMenu
+ *         onSwitchWorkspace={() => setShowWorkspaceSwitcher(true)}
+ *         position="right"
+ *       />
+ *     </div>
+ *   );
+ * }
+ * ```
+ */
+export declare function UserProfileMenu({ onSwitchWorkspace, onLogout, position, }: UserProfileMenuProps): import("react").JSX.Element | null;

package/dist/auth/components/workspace/WorkspaceSelector.d.ts

@@ -0,0 +1,49 @@
+import { Workspace } from '../../types';
+
+/**
+ * Organization interface (grouped from workspaces)
+ */
+export interface Organization {
+    id: string;
+    name: string;
+    workspaceCount: number;
+}
+/**
+ * Project interface (optional, for future use)
+ */
+export interface Project {
+    id: string;
+    name: string;
+    workspaceId: string;
+}
+export interface WorkspaceSelectorProps {
+    /**
+     * Control modal visibility
+     */
+    isOpen: boolean;
+    /**
+     * Callback when modal is closed without selection
+     */
+    onClose: () => void;
+    /**
+     * List of workspaces to choose from
+     */
+    workspaces: Workspace[];
+    /**
+     * Optional list of projects (filtered by workspace)
+     */
+    projects?: Project[];
+    /**
+     * Callback when workspace is selected and confirmed
+     */
+    onSelect: (workspace: Workspace, project?: Project) => void;
+    /**
+     * Loading state while issuing workspace token
+     */
+    isLoading?: boolean;
+    /**
+     * Error message to display
+     */
+    error?: string | null;
+}
+export declare function WorkspaceSelector({ isOpen, onClose, workspaces, projects, onSelect, isLoading, error, }: WorkspaceSelectorProps): import("react").JSX.Element | null;

package/dist/auth/constants/permissions.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Auth Permission Constants
+ *
+ * Permission strings matching the @rbac directives on global-auth-svc.
+ * Only covers admin-facing operations — public auth flows (login, signup,
+ * password reset, MFA verify, OAuth, SSO) don't need RBAC.
+ * Self-service operations (own profile, sessions, API keys) are identity-scoped.
+ *
+ * Resource types and actions from global-rbac-svc seed:
+ *   user:       read, update, delete
+ *   app:        read, create, update
+ *   sso-config: manage, delete
+ *   oidc-config: manage, delete
+ *   auth-method: update
+ */
+export declare const AUTH_PERMISSIONS: {
+    readonly USER_READ: "user:read";
+    readonly USER_UPDATE: "user:update";
+    readonly USER_DELETE: "user:delete";
+    readonly APP_READ: "app:read";
+    readonly APP_CREATE: "app:create";
+    readonly APP_UPDATE: "app:update";
+    readonly SSO_CONFIG_MANAGE: "sso-config:manage";
+    readonly SSO_CONFIG_DELETE: "sso-config:delete";
+    readonly OIDC_CONFIG_MANAGE: "oidc-config:manage";
+    readonly OIDC_CONFIG_DELETE: "oidc-config:delete";
+    readonly AUTH_METHOD_UPDATE: "auth-method:update";
+};
+export type AuthPermission = (typeof AUTH_PERMISSIONS)[keyof typeof AUTH_PERMISSIONS];

package/dist/auth/constants/sessionKeys.d.ts

@@ -0,0 +1,17 @@
+/**
+ * sessionStorage key constants for auth flows.
+ * Centralizing these avoids silent key mismatches across files.
+ */
+export declare const MFA_CHALLENGE_ID = "mfa_challenge_id";
+export declare const MFA_PENDING_TOKEN = "mfa_pending_token";
+export declare const MFA_PENDING_REFRESH = "mfa_pending_refresh";
+export declare const MFA_REDIRECT = "mfa_redirect";
+export declare const OIDC_CODE_VERIFIER = "oidc_code_verifier";
+export declare const OIDC_STATE = "oidc_state";
+export declare const OIDC_NONCE = "oidc_nonce";
+export declare const OIDC_TENANT_ID = "oidc_tenant_id";
+export declare const OIDC_FLOW = "oidc_flow";
+export declare const OIDC_REDIRECT = "oidc_redirect";
+export declare const OIDC_CLIENT_ID = "oidc_client_id";
+export declare const MFA_SESSION_KEYS: readonly ["mfa_challenge_id", "mfa_pending_token", "mfa_pending_refresh", "mfa_redirect"];
+export declare const OIDC_SESSION_KEYS: readonly ["oidc_code_verifier", "oidc_state", "oidc_nonce", "oidc_tenant_id", "oidc_flow", "oidc_redirect"];

package/dist/auth/hooks/index.d.ts

@@ -0,0 +1,19 @@
+export { useAuthOperations } from './useAuthOperations';
+export { useMfaOperations } from './useMfaOperations';
+export { usePasswordOperations } from './usePasswordOperations';
+export { useSessionOperations } from './useSessionOperations';
+export { useApiKeyOperations } from './useApiKeyOperations';
+export { useAppOperations } from './useAppOperations';
+export { useWorkspaceOperations } from './useWorkspaceOperations';
+export { useMyWorkspaces } from './useMyWorkspaces';
+export { useContextSwitcherData, useWorkspaceSyncEffect, useProjectSyncEffect, } from './useContextSwitcherData';
+export type { UseContextSwitcherDataOptions } from './useContextSwitcherData';
+export { useActiveContextBootstrapMirror } from './useActiveContextBootstrapMirror';
+export type { ActiveContextBootstrapMirrorArgs } from './useActiveContextBootstrapMirror';
+export { useDelegationOperations } from './useDelegationOperations';
+export { useUserOperations } from './useUserOperations';
+export { useSsoOperations } from './useSsoOperations';
+export { useOAuthOperations } from './useOAuthOperations';
+export { useAccountOperations } from './useAccountOperations';
+export { useAuthPermissions } from './useAuthPermissions';
+export { useAuthStore } from '../store/authStore';

package/dist/auth/hooks/useAccountOperations.d.ts

@@ -0,0 +1,18 @@
+import { AuthResult } from '../types';
+
+export interface AccountActionResult {
+    success: boolean;
+    message: string;
+}
+/**
+ * Hook for account management operations (deactivate, delete, reactivate)
+ */
+export declare function useAccountOperations(): {
+    deactivateAccount: (password: string) => Promise<AccountActionResult>;
+    deleteAccount: (password: string, confirmPhrase: string) => Promise<AccountActionResult>;
+    reactivateAccount: (email: string, password: string) => Promise<AuthResult>;
+    isDeactivating: boolean;
+    isDeleting: boolean;
+    isReactivating: boolean;
+    isLoading: boolean;
+};

package/dist/auth/hooks/useActiveContextBootstrapMirror.d.ts

@@ -0,0 +1,91 @@
+type ContextId = string | null | undefined;
+interface MirrorWorkspace {
+    id: string;
+    organizationId?: string | null;
+}
+interface MirrorProject {
+    id: string;
+    workspaceId?: string | null;
+}
+export interface ActiveContextBootstrapMirrorArgs {
+    /** Auth-store `currentOrganizationId` */
+    storeOrganizationId: ContextId;
+    /** Auth-store `currentWorkspaceId` */
+    storeWorkspaceId: ContextId;
+    /** Auth-store `currentProjectId` */
+    storeProjectId: ContextId;
+    /** ActiveContext `organizationId` */
+    activeOrganizationId: ContextId;
+    /** ActiveContext `workspaceId` */
+    activeWorkspaceId: ContextId;
+    /** ActiveContext `projectId` */
+    activeProjectId: ContextId;
+    /**
+     * The auth store's loaded `workspaces`. Used to verify that
+     * `storeWorkspaceId` actually belongs to the organization being mirrored
+     * before it is filled. If omitted, the workspace axis is never mirrored
+     * (safe default — better no workspace than one from the wrong org).
+     */
+    storeWorkspaces?: ReadonlyArray<MirrorWorkspace>;
+    /**
+     * The auth store's loaded `projects`. Used to verify that `storeProjectId`
+     * actually belongs to the workspace being mirrored before it is filled. If
+     * omitted, the project axis is never mirrored.
+     */
+    storeProjects?: ReadonlyArray<MirrorProject>;
+    /**
+     * ActiveContext setters. Must be **stable references** (they are, coming
+     * from `ActiveContextProvider`'s memoized value) — passing inline arrows
+     * makes this effect re-run every render. Likewise prefer stable references
+     * for `storeWorkspaces` / `storeProjects` (e.g. a shallow-equal Zustand
+     * selector or `useMemo`); a new array reference each render re-runs the
+     * effect. Re-runs are harmless (the fills are idempotent), just wasted work.
+     */
+    setOrganization: (organizationId: string | null) => void;
+    setWorkspace: (workspaceId: string | null) => void;
+    setProject: (projectId: string | null) => void;
+}
+/**
+ * One-way, **fill-only** mirror of the auth store's org / workspace / project
+ * ids into ActiveContext, for app-shell headers / context switchers.
+ *
+ * Some context ids are derived programmatically in the Zustand auth store
+ * without a paired ActiveContext write:
+ * - the bootstrap in `useContextSwitcherData` auto-selects an organization
+ *   (`setCurrentOrganizationId`) and, on the persisted-workspace path, a
+ *   workspace (`setCurrentWorkspaceId`) without calling `setActiveContext`;
+ * - `useProjectSyncEffect` / `selectWorkspace` auto-select a project.
+ *
+ * ActiveContext is the source of truth for the URL + storage + the props passed
+ * to workspace MFEs and the workspace-token context, so those store-only ids
+ * must reach it — otherwise e.g. a fresh `defaultWorkspaceId` login leaves
+ * `organizationId` undefined and the token / MFE context break until the user
+ * reselects.
+ *
+ * The rule is **fill, never override**: copy a store id into ActiveContext only
+ * when ActiveContext has no value for that axis yet. We must NOT overwrite a
+ * non-null ActiveContext value, because:
+ *  1. it would clobber an explicit selection — a switch handler's write, or a
+ *     deep-link / browser-back `?workspace=`/`?project=` that the router already
+ *     applied; and
+ *  2. overriding is exactly what turns this into a two-store ping-pong — the
+ *     store→AC and AC→store effects each read the other's pre-commit value and
+ *     swap the ids every commit until React throws "Maximum update depth
+ *     exceeded" (error #185). Filling only nulls is self-terminating: once the
+ *     axis is set the guard is false forever, so it can never alternate.
+ *
+ * Cross-context safety: a value is filled only when it provably belongs to the
+ * parent context being mirrored, validated against the loaded store metadata —
+ * the **workspace** must belong to the target organization (`storeWorkspaces`),
+ * and the **project** must belong to the target workspace (`storeProjects`).
+ * The store can transiently hold a stale child id after its parent advanced
+ * (e.g. `useContextSwitcherData` copies a new org into the store before the new
+ * org's — unpersisted — workspace list loads, leaving `currentWorkspaceId`
+ * pointing at the previous org; or the workspace advances to B while the
+ * project still points at A). Gating on loaded metadata means such a stale id
+ * isn't in the list yet, so it is not mirrored until it is genuinely valid.
+ *
+ * See BOFF-2805.
+ */
+export declare function useActiveContextBootstrapMirror({ storeOrganizationId, storeWorkspaceId, storeProjectId, activeOrganizationId, activeWorkspaceId, activeProjectId, storeWorkspaces, storeProjects, setOrganization, setWorkspace, setProject, }: ActiveContextBootstrapMirrorArgs): void;
+export {};

package/dist/auth/hooks/useApiKeyOperations.d.ts

@@ -0,0 +1,28 @@
+import { GenerateAPIKeyInput, APIKeyResult, APIKeyRotateResult, AuthResult, ApiKey } from '../types';
+
+interface MyApiKeysResponse {
+    myApiKeys: {
+        apiKeys: ApiKey[];
+        hasMore: boolean;
+        totalCount: number;
+    };
+}
+/**
+ * Hook for API key operations
+ */
+export declare function useApiKeyOperations(): {
+    generateAPIKey: (input: GenerateAPIKeyInput) => Promise<APIKeyResult>;
+    revokeAPIKey: (keyId: string) => Promise<boolean>;
+    rotateAPIKey: (keyId: string) => Promise<APIKeyRotateResult>;
+    authenticateAPIKey: (apiKey: string, apiSecret: string) => Promise<AuthResult>;
+    refetchApiKeys: () => Promise<void> | import("@apollo/client").ObservableQuery.ResultPromise<{
+        data: MyApiKeysResponse | undefined;
+        error?: import('@apollo/client').ErrorLike;
+    }>;
+    createApiKey: (input: GenerateAPIKeyInput) => Promise<APIKeyResult>;
+    revokeApiKey: (keyId: string) => Promise<boolean>;
+    apiKeys: ApiKey[];
+    isLoading: boolean;
+    error: import('@apollo/client').ErrorLike | undefined;
+};
+export {};

package/dist/auth/hooks/useAppOperations.d.ts

@@ -0,0 +1,32 @@
+import { App, AppCreateResponse, CreateAppInput, UpdateAppInput, AppTokenResponse, AppAsUserTokenResponse } from '../types';
+
+interface CurrentUserAppsResponse {
+    currentUserApps: {
+        apps: App[];
+        hasMore: boolean;
+        totalCount: number;
+    };
+}
+/**
+ * Hook for app management operations
+ */
+export declare function useAppOperations(): {
+    getApp: (id: string) => Promise<App | null>;
+    refetchApps: () => Promise<void> | import("@apollo/client").ObservableQuery.ResultPromise<{
+        data: CurrentUserAppsResponse | undefined;
+        error?: import('@apollo/client').ErrorLike;
+    }>;
+    createApp: (input: CreateAppInput) => Promise<AppCreateResponse>;
+    updateApp: (id: string, input: UpdateAppInput) => Promise<App>;
+    deactivateApp: (id: string) => Promise<boolean>;
+    rotateAppSecret: (id: string) => Promise<AppCreateResponse>;
+    authenticateApp: (clientId: string, clientSecret: string, scopes?: string[]) => Promise<AppTokenResponse>;
+    generateAppToken: (clientId: string, clientSecret: string, scopes?: string[]) => Promise<AppTokenResponse>;
+    generateAppAsUserToken: (targetUserId: string, scopes?: string[]) => Promise<AppAsUserTokenResponse>;
+    exchangeToken: (appId: string, userId: string, scopes?: string[]) => Promise<AppAsUserTokenResponse>;
+    apps: App[];
+    currentApp: App | null;
+    isLoading: boolean;
+    error: import('@apollo/client').ErrorLike | undefined;
+};
+export {};

package/dist/auth/hooks/useAuthOperations.d.ts

@@ -0,0 +1,59 @@
+import { SignInInput, SignUpInput, User, AuthPayload, AuthResult } from '../types';
+
+interface CurrentUserResponse {
+    currentUser: User | null;
+}
+interface UseAuthOperationsOptions {
+    disableCurrentUserQuery?: boolean;
+}
+/**
+ * Hook for authentication operations
+ * Uses Zustand v5 pattern: selectors for state, getState() for actions
+ */
+export declare function useAuthOperations(options?: UseAuthOperationsOptions): {
+    signIn: (input: SignInInput) => Promise<AuthResult>;
+    signUp: (input: SignUpInput) => Promise<AuthPayload | {
+        requiresEmailVerification: boolean;
+        user: User | null;
+        accessToken: string | null;
+        refreshToken: string | null;
+        expiresIn: number | null;
+        requiresMFA?: boolean;
+        mfaChallengeId?: string;
+        mfaMethod?: import('..').MFAMethod;
+    }>;
+    signOut: () => Promise<void>;
+    refreshToken: () => Promise<AuthPayload>;
+    verifyEmail: (token: string) => Promise<{
+        success: boolean;
+        message: string;
+        email?: string;
+    }>;
+    resendVerification: (email: string) => Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    refetchCurrentUser: (variables?: Partial<import('@apollo/client').OperationVariables> | undefined) => Promise<{
+        data: CurrentUserResponse | undefined;
+        error?: import('@apollo/client').ErrorLike;
+    }>;
+    login: (input: SignInInput) => Promise<AuthResult>;
+    register: (input: SignUpInput) => Promise<AuthPayload | {
+        requiresEmailVerification: boolean;
+        user: User | null;
+        accessToken: string | null;
+        refreshToken: string | null;
+        expiresIn: number | null;
+        requiresMFA?: boolean;
+        mfaChallengeId?: string;
+        mfaMethod?: import('..').MFAMethod;
+    }>;
+    logout: () => Promise<void>;
+    isLoading: boolean;
+    error: string | null;
+    errorCode: string | null;
+    isAuthenticated: boolean;
+    user: User | null;
+    accessToken: string | null;
+};
+export {};

package/dist/auth/hooks/useAuthPermissions.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Hook for auth admin RBAC permissions.
+ *
+ * Only covers admin-facing operations. Public auth flows and self-service
+ * operations don't need RBAC checks — they're either @rbac(public: true)
+ * or scoped to the current user's own data.
+ */
+export declare function useAuthPermissions(): {
+    canViewUsers: boolean;
+    canUpdateUsers: boolean;
+    canDeleteUsers: boolean;
+    canViewApps: boolean;
+    canCreateApps: boolean;
+    canUpdateApps: boolean;
+    canManageSsoConfig: boolean;
+    canManageOidcConfig: boolean;
+    canManageAuthMethods: boolean;
+    isLoading: boolean;
+};

package/dist/auth/hooks/useCaptchaV3.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Hook for reCAPTCHA v3 invisible verification.
+ * Returns a no-op when VITE_CAPTCHA_ENABLED is not "true".
+ *
+ * When enabled, dynamically imports `react-google-recaptcha-v3` and uses
+ * the `useGoogleReCaptcha` hook from the `GoogleReCaptchaProvider` context.
+ * The provider must be mounted above this hook in the component tree
+ * (handled by CaptchaProvider in AuthRoot).
+ */
+export declare function useCaptchaV3(): {
+    executeRecaptcha: (action: string) => Promise<string | undefined>;
+};

package/dist/auth/hooks/useContextSwitcherData.d.ts

@@ -0,0 +1,91 @@
+import { Organization, Workspace, Project } from '../types';
+
+export interface UseContextSwitcherDataOptions {
+    /**
+     * Optional Global API Gateway base URL override.
+     * If not provided, uses GATEWAYS config from fe-libs.
+     */
+    globalBaseUrl?: string;
+    /**
+     * Optional Workspaces API Gateway base URL override.
+     * If not provided, uses GATEWAYS config from fe-libs.
+     */
+    workspaceBaseUrl?: string;
+    /** Disable initial organization/workspace bootstrap fetches */
+    disableBootstrap?: boolean;
+    /** Disable the workspace sync effect */
+    disableWorkspaceSync?: boolean;
+    /** Disable the project sync effect */
+    disableProjectSync?: boolean;
+    /** Only hydrate the workspace token; do not eagerly fetch projects */
+    skipProjectFetch?: boolean;
+}
+export declare function useContextSwitcherData(options?: UseContextSwitcherDataOptions): {
+    organizations: Organization[];
+    workspaces: Workspace[];
+    projects: Project[];
+    currentOrganizationId: string | null;
+    currentWorkspaceId: string | null;
+    currentProjectId: string | null;
+    currentOrganization: Organization | undefined;
+    currentWorkspace: Workspace | undefined;
+    currentProject: Project | undefined;
+    workspaceToken: string | null;
+    isLoadingOrganizations: boolean;
+    isLoadingWorkspaces: boolean;
+    isLoadingProjects: boolean;
+    isLoading: boolean;
+    error: string | null;
+    fetchOrganizations: () => Promise<Organization[]>;
+    fetchWorkspacesForOrg: (organizationId: string) => Promise<Workspace[]>;
+    issueWorkspaceToken: (organizationId: string, workspaceId?: string, projectId?: string | null, tenantId?: string) => Promise<{
+        success: boolean;
+        token?: string;
+        resolvedWorkspaceId?: string;
+        error?: string;
+    }>;
+    fetchProjects: () => Promise<Project[]>;
+    selectOrganization: (org: Organization) => Promise<Workspace[]>;
+    selectWorkspace: (workspace: Workspace) => Promise<{
+        success: boolean;
+        projects?: Project[];
+        error?: string;
+    }>;
+    selectProject: (project: Project) => void;
+};
+/**
+ * Hook to reactively ensure workspaces are synced with the current organization.
+ *
+ * This handles edge cases where the organization changes but workspaces
+ * from a different org are still in the store (e.g., stale data, race conditions).
+ *
+ * Usage:
+ * ```tsx
+ * import { useWorkspaceSyncEffect } from '@burdenoff/microfe-auth';
+ *
+ * function MyComponent() {
+ *   useWorkspaceSyncEffect(); // Ensures workspaces stay in sync
+ *   // ...
+ * }
+ * ```
+ */
+export declare function useWorkspaceSyncEffect(options?: UseContextSwitcherDataOptions): void;
+/**
+ * Hook to reactively ensure projects are loaded when a workspace is selected.
+ *
+ * This handles the case where a workspace is auto-selected (from URL/localStorage)
+ * but projects haven't been fetched yet. It will:
+ * 1. Issue a workspace token if not present
+ * 2. Fetch projects for the selected workspace
+ *
+ * Usage:
+ * ```tsx
+ * import { useProjectSyncEffect } from '@burdenoff/microfe-auth';
+ *
+ * function MyComponent() {
+ *   useProjectSyncEffect(); // Ensures projects are loaded for selected workspace
+ *   // ...
+ * }
+ * ```
+ */
+export declare function useProjectSyncEffect(options?: UseContextSwitcherDataOptions): void;