@isi-ui7/bos7-shared 0.2.10 → 0.2.12

package/dist/bff/auth-logout.d.ts

@@ -0,0 +1,2 @@
+export declare function POST(request: Request): Promise<Response>;
+export declare function GET(request: Request): Promise<Response>;

package/dist/bff/auth-me.d.ts

@@ -0,0 +1,6 @@
+export interface AuthMeRouteOptions {
+    /** Error code returned in the 401 body when no access_token cookie is present. */
+    errorCode?: string;
+}
+export declare function makeAuthMeRoute(options?: AuthMeRouteOptions): (request: Request) => Promise<Response>;
+export declare const GET: (request: Request) => Promise<Response>;

package/dist/bff/auth-preferences.d.ts

@@ -0,0 +1,2 @@
+export declare function GET(request: Request): Promise<Response>;
+export declare function POST(request: Request): Promise<Response>;

package/dist/bff/auth-refresh.d.ts

@@ -0,0 +1,6 @@
+export interface AuthRefreshRouteOptions {
+    /** Fallback client_id used when AUTH7_CLIENT_ID env var is unset. */
+    clientIdFallback?: string;
+}
+export declare function makeAuthRefreshRoute(options?: AuthRefreshRouteOptions): (request: Request) => Promise<Response>;
+export declare const POST: (request: Request) => Promise<Response>;

package/dist/bff/health.d.ts

@@ -0,0 +1 @@
+export declare function GET(): Promise<Response>;

package/dist/index.js

@@ -20205,8 +20205,8 @@ function lx() {
   const e = (navigator.language || "").toLowerCase();
   return e.startsWith("en") ? "en" : e.startsWith("id") ? "id" : null;
 }
-function ux() {
-  return fx() ?? lx() ?? Ka;
+function ux(e) {
+  return fx() ?? e ?? lx() ?? Ka;
 }
 function As(e) {
   typeof document > "u" || (document.cookie = `${cc}=${e}; path=/; max-age=31536000; samesite=lax`);
@@ -20221,36 +20221,39 @@ const fc = bs({
 function hx({
   children: e,
   locale: t,
-  dictionaries: r
+  defaultLocale: r,
+  dictionaries: n
 }) {
-  const [n, a] = qt(t ?? ux()), i = ka(() => ({
-    id: { ...za.id, ...(r == null ? void 0 : r.id) ?? {} },
-    en: { ...za.en, ...(r == null ? void 0 : r.en) ?? {} }
-  }), [r]), s = ka(() => {
-    const o = i[n];
+  const [a, i] = qt(
+    t ?? ux(r)
+  ), s = ka(() => ({
+    id: { ...za.id, ...(n == null ? void 0 : n.id) ?? {} },
+    en: { ...za.en, ...(n == null ? void 0 : n.en) ?? {} }
+  }), [n]), o = ka(() => {
+    const l = s[a];
     return {
-      locale: n,
-      setLocale(l) {
-        a(l), As(l);
+      locale: a,
+      setLocale(f) {
+        i(f), As(f);
       },
-      t(l, f) {
-        return o[l] ?? f ?? l;
+      t(f, c) {
+        return l[f] ?? c ?? f;
       },
-      dictionary: o
+      dictionary: l
     };
-  }, [i, n]);
+  }, [s, a]);
   return Vt(() => {
     if (t) return;
-    let o = !1;
-    return fetch("/api/auth/preferences", { cache: "no-store" }).then(async (l) => l.ok ? await l.json() : null).then((l) => {
-      if (o) return;
-      const f = l == null ? void 0 : l.locale;
-      (f === "id" || f === "en") && (a(f), As(f));
+    let l = !1;
+    return fetch("/api/auth/preferences", { cache: "no-store" }).then(async (f) => f.ok ? await f.json() : null).then((f) => {
+      if (l) return;
+      const c = f == null ? void 0 : f.locale;
+      (c === "id" || c === "en") && (i(c), As(c));
     }).catch(() => {
     }), () => {
-      o = !0;
+      l = !0;
     };
-  }, [t]), /* @__PURE__ */ Ee(fc.Provider, { value: s, children: e });
+  }, [t]), /* @__PURE__ */ Ee(fc.Provider, { value: o, children: e });
 }
 function Ii() {
   return Cs(fc);
@@ -20301,10 +20304,10 @@ function dx() {
   };
 }
 function C_(e) {
-  const t = (e == null ? void 0 : e.withAuth) ?? !0, r = e == null ? void 0 : e.dictionaries;
-  return function({ children: a, Layout: i }) {
-    const s = /* @__PURE__ */ Ee(hx, { dictionaries: r, children: /* @__PURE__ */ Ee(i, { children: a }) });
-    return t ? /* @__PURE__ */ Ee(Mc, { children: s }) : s;
+  const t = (e == null ? void 0 : e.withAuth) ?? !0, r = e == null ? void 0 : e.dictionaries, n = (e == null ? void 0 : e.defaultLocale) ?? "en";
+  return function({ children: i, Layout: s }) {
+    const o = /* @__PURE__ */ Ee(hx, { defaultLocale: n, dictionaries: r, children: /* @__PURE__ */ Ee(s, { children: i }) });
+    return t ? /* @__PURE__ */ Ee(Mc, { children: o }) : o;
   };
 }
 function px(e, t, r) {

package/dist/shell/provider.d.ts

@@ -10,6 +10,7 @@ type SharedShellProviderProps = {
 type SharedShellProviderOptions = {
     withAuth?: boolean;
     dictionaries?: Partial<Record<"id" | "en", Record<string, string>>>;
+    defaultLocale?: "id" | "en";
 };
 export declare function createShellProvider(options?: SharedShellProviderOptions): ({ children, Layout }: SharedShellProviderProps) => import("react/jsx-runtime").JSX.Element;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isi-ui7/bos7-shared",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "Shared auth7 and layout primitives for bos7 applications.",
   "license": "MIT",
   "repository": {
@@ -9,11 +9,11 @@
     "directory": "packages/bos7-shared"
   },
   "type": "module",
-  "main": "dist/index.js",
-  "module": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "main": "src/index.ts",
+  "module": "src/index.ts",
+  "types": "src/index.ts",
   "exports": {
-    ".": "./dist/index.js",
+    ".": "./src/index.ts",
     "./auth7": "./src/auth7/index.ts",
     "./page-layout": "./src/page-layout.tsx",
     "./modal-layout": "./src/modal-layout.tsx",
@@ -42,25 +42,85 @@
     "./shell/provider": "./src/shell/provider.tsx",
     "./shell/app-shell-layout": "./src/shell/app-shell-layout.tsx",
     "./notifications-bff": "./src/notifications-bff.ts",
+    "./bff/auth-me": "./src/bff/auth-me.ts",
+    "./bff/auth-refresh": "./src/bff/auth-refresh.ts",
+    "./bff/auth-logout": "./src/bff/auth-logout.ts",
+    "./bff/auth-preferences": "./src/bff/auth-preferences.ts",
+    "./bff/health": "./src/bff/health.ts",
     "./observability/otel-init": "./src/observability/otel-init.ts",
     "./form-types": "./src/form-types.ts",
+    "./form-value-schema": "./src/form-value-schema.ts",
     "./form-numeric": "./src/form-numeric.ts",
     "./form-renderer": "./src/form-renderer.tsx",
     "./form-renderer-utils": "./src/form-renderer-utils.ts",
     "./form-rules": "./src/form-rules.ts",
     "./i18n": "./src/i18n.tsx",
     "./workflow/use-crud-form": "./src/workflow/use-crud-form.ts",
-    "./styles": "./src/form-contract.css",
-    "./form-value-schema": "./src/form-value-schema.ts"
+    "./styles": "./src/form-contract.css"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
-    "access": "public"
+    "access": "public",
+    "main": "dist/index.js",
+    "module": "dist/index.js",
+    "types": "dist/index.d.ts",
+    "exports": {
+      ".": "./dist/index.js",
+      "./auth7": "./src/auth7/index.ts",
+      "./page-layout": "./src/page-layout.tsx",
+      "./modal-layout": "./src/modal-layout.tsx",
+      "./form-layout": "./src/form-layout.tsx",
+      "./backend": "./src/backend.ts",
+      "./export": "./src/export.ts",
+      "./types/notification": "./src/types/notification.ts",
+      "./nats/client": "./src/nats/client.ts",
+      "./event-bus": "./src/event-bus/index.ts",
+      "./event-bus/useEventBus": "./src/event-bus/useEventBus.ts",
+      "./api": "./src/api.ts",
+      "./types/core": "./src/types/core.ts",
+      "./style-contract": "./src/style-contract.ts",
+      "./crud-components": "./src/crud-components.tsx",
+      "./workflow/backend": "./src/workflow/backend.ts",
+      "./workflow/notif7": "./src/workflow/notif7.ts",
+      "./workflow/api-client": "./src/workflow/api-client.ts",
+      "./workflow/starter": "./src/workflow/starter.ts",
+      "./workflow/use-workflow-tracker": "./src/workflow/use-workflow-tracker.ts",
+      "./workflow/crud-client": "./src/workflow/crud-client.ts",
+      "./data-table/cursor-adapter": "./src/data-table/cursor-adapter.ts",
+      "./notification/routing": "./src/notification/routing.ts",
+      "./shell/interaction": "./src/shell/interaction.ts",
+      "./shell/branch": "./src/shell/branch.ts",
+      "./notif7": "./src/notif7.ts",
+      "./shell/provider": "./src/shell/provider.tsx",
+      "./shell/app-shell-layout": "./src/shell/app-shell-layout.tsx",
+      "./notifications-bff": "./src/notifications-bff.ts",
+      "./bff/auth-me": "./src/bff/auth-me.ts",
+      "./bff/auth-refresh": "./src/bff/auth-refresh.ts",
+      "./bff/auth-logout": "./src/bff/auth-logout.ts",
+      "./bff/auth-preferences": "./src/bff/auth-preferences.ts",
+      "./bff/health": "./src/bff/health.ts",
+      "./observability/otel-init": "./src/observability/otel-init.ts",
+      "./form-types": "./src/form-types.ts",
+      "./form-numeric": "./src/form-numeric.ts",
+      "./form-renderer": "./src/form-renderer.tsx",
+      "./form-renderer-utils": "./src/form-renderer-utils.ts",
+      "./form-rules": "./src/form-rules.ts",
+      "./i18n": "./src/i18n.tsx",
+      "./workflow/use-crud-form": "./src/workflow/use-crud-form.ts",
+      "./styles": "./src/form-contract.css",
+      "./form-value-schema": "./src/form-value-schema.ts"
+    }
   },
   "files": [
     "dist",
     "src"
   ],
+  "scripts": {
+    "build": "vite build",
+    "lint": "eslint \"src/**/*.{ts,tsx}\"",
+    "test": "vitest run --passWithNoTests",
+    "typecheck": "tsc --noEmit"
+  },
   "peerDependencies": {
     "react": ">=18",
     "react-dom": ">=18",
@@ -98,20 +158,23 @@
     "vite-plugin-dts": "^3.6.0",
     "vitest": "^1.0.0",
     "next": "16.1.1",
+    "@isi-ui7/corporate-themes": "workspace:*",
+    "@isi-ui7/i18n": "workspace:*",
+    "@isi-ui7/ui-shell": "workspace:*",
+    "@isi-ui7/modal-manager": "workspace:*",
+    "@isi-ui7/realtime": "workspace:*",
     "@carbon/react": "^1.97.0",
     "@carbon/icons-react": "^11.71.0",
-    "@isi-ui7/corporate-themes": "0.2.4",
-    "@isi-ui7/i18n": "0.2.1",
-    "@isi-ui7/ui-shell": "0.2.4",
-    "@isi-ui7/modal-manager": "0.2.2",
-    "@isi-ui7/realtime": "0.2.3",
-    "@isi-ui7/data-table": "0.2.3",
-    "@isi-ui7/lookup-input": "0.2.3",
-    "@isi-ui7/editable-table": "0.2.3"
+    "@isi-ui7/data-table": "workspace:*",
+    "@isi-ui7/lookup-input": "workspace:*",
+    "@isi-ui7/editable-table": "workspace:*"
   },
   "dependencies": {
     "@carbon/icons-react": "^11.71.0",
     "@carbon/react": "^1.97.0",
+    "@isi-ui7/data-table": "workspace:*",
+    "@isi-ui7/lookup-input": "workspace:*",
+    "@isi-ui7/editable-table": "workspace:*",
     "jose": "^5.9.6",
     "xlsx": "^0.18.5",
     "jspdf": "^4.2.1",
@@ -119,15 +182,6 @@
     "axios": "^1.7.7",
     "@opentelemetry/sdk-node": "^0.57.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.57.0",
-    "@opentelemetry/auto-instrumentations-node": "^0.57.0",
-    "@isi-ui7/data-table": "0.2.3",
-    "@isi-ui7/editable-table": "0.2.3",
-    "@isi-ui7/lookup-input": "0.2.3"
-  },
-  "scripts": {
-    "build": "vite build",
-    "lint": "eslint \"src/**/*.{ts,tsx}\"",
-    "test": "vitest run --passWithNoTests",
-    "typecheck": "tsc --noEmit"
+    "@opentelemetry/auto-instrumentations-node": "^0.57.0"
   }
-}
+}

package/src/bff/auth-logout.ts

@@ -0,0 +1,106 @@
+// bff/auth-logout.ts — Shared BFF handlers for /api/auth/logout
+// Logout endpoint for auth7. Canonical source: bos7-template.
+// Byte-identical across bos7-template, bos7-enterprise, bos7-portal.
+//
+// Config is fully env-driven (no per-app hardcoded values). Module-level env
+// assertions throw at import time, matching the original per-app behavior.
+
+import { NextRequest, NextResponse } from 'next/server';
+
+const AUTH7_API_URL = process.env.AUTH7_API_URL;
+if (!AUTH7_API_URL) throw new Error('[bos7] AUTH7_API_URL env var is required');
+const CLIENT_ID = process.env.AUTH7_CLIENT_ID || process.env.NEXT_PUBLIC_AUTH7_CLIENT_ID;
+if (!CLIENT_ID) throw new Error('[bos7] AUTH7_CLIENT_ID env var is required');
+const AUTH7_UI_URL = process.env.AUTH7_UI_URL || process.env.NEXT_PUBLIC_AUTH7_URL;
+const APP_URL = process.env.APP_URL || process.env.NEXT_PUBLIC_APP_URL || '';
+const LOGOUT_MARKER_COOKIE = 'bos7_logout_at';
+const LOGOUT_MARKER_DOMAIN = process.env.BOS7_COOKIE_DOMAIN || '.bos7.local';
+
+function getPostLogoutRedirectUri(request: NextRequest): string {
+  return new URL('/', APP_URL || request.url).toString();
+}
+
+function getAuth7LogoutUrl(request: NextRequest): string {
+  const url = new URL('/oauth2/logout', AUTH7_UI_URL);
+  url.searchParams.set('client_id', CLIENT_ID!);
+  url.searchParams.set('post_logout_redirect_uri', getPostLogoutRedirectUri(request));
+  return url.toString();
+}
+
+function clearAuthCookies(response: NextResponse): void {
+  const cookies = [
+    'access_token',
+    'refresh_token',
+    'id_token',
+    'token_expires_at',
+    'token_scope',
+    'auth7_pkce_verifier',
+    'auth7_oauth_state',
+    'auth7_return_url',
+  ];
+
+  cookies.forEach((name) => {
+    response.cookies.set(name, '', {
+      path: '/',
+      maxAge: 0,
+      sameSite: 'lax',
+    });
+  });
+}
+
+function setGlobalLogoutMarker(response: NextResponse): void {
+  response.cookies.set(LOGOUT_MARKER_COOKIE, Date.now().toString(), {
+    path: '/',
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    domain: LOGOUT_MARKER_DOMAIN,
+    maxAge: 60 * 60 * 24 * 30,
+  });
+}
+
+// Public signatures use Web `Request`/`Response` (see auth-me.ts for why); the
+// runtime object is always a real NextRequest.
+
+// POST: clear httpOnly cookies (called from JS before navigating to auth7 SSO logout)
+export async function POST(request: Request): Promise<Response> {
+  const req = request as unknown as NextRequest;
+  const accessToken = req.cookies.get('access_token')?.value;
+  if (accessToken) {
+    try {
+      await fetch(`${AUTH7_API_URL}/v1/auth/logout`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${accessToken}` },
+      });
+    } catch { /* best-effort */ }
+  }
+  const res = NextResponse.json({ ok: true });
+  clearAuthCookies(res);
+  setGlobalLogoutMarker(res);
+  return res;
+}
+
+export async function GET(request: Request): Promise<Response> {
+  const req = request as unknown as NextRequest;
+  const accessToken = req.cookies.get('access_token')?.value;
+
+  // Invalidate session on auth7 backend (best-effort)
+  if (accessToken) {
+    try {
+      await fetch(`${AUTH7_API_URL}/v1/auth/logout`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${accessToken}`,
+        },
+      });
+    } catch {
+      // Ignore backend errors — we still clear local cookies
+    }
+  }
+
+  const response = NextResponse.redirect(getAuth7LogoutUrl(req));
+  clearAuthCookies(response);
+  setGlobalLogoutMarker(response);
+
+  return response;
+}

package/src/bff/auth-me.ts

@@ -0,0 +1,74 @@
+// bff/auth-me.ts — Shared BFF handler for /api/auth/me
+// Proxy to auth7 /oauth2/userinfo, augmenting userinfo with JWT claims
+// (branch_id, roles) for shell display. Canonical source: bos7-template.
+//
+// Apps re-export the ready GET (default error code 'unauthorized'), or build a
+// variant via makeAuthMeRoute({ errorCode }) — e.g. bos7-enterprise uses
+// 'unauthenticated'.
+
+import { NextRequest, NextResponse } from 'next/server';
+
+const AUTH7_API_URL = process.env.AUTH7_API_URL || 'http://localhost:8090';
+
+export interface AuthMeRouteOptions {
+  /** Error code returned in the 401 body when no access_token cookie is present. */
+  errorCode?: string;
+}
+
+function decodeJWTPayload(token: string): Record<string, unknown> | null {
+  try {
+    const parts = token.split('.');
+    if (parts.length < 2) return null;
+    const payload = parts[1];
+    const decoded = Buffer.from(payload, 'base64url').toString('utf-8');
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+
+export function makeAuthMeRoute(options: AuthMeRouteOptions = {}) {
+  const errorCode = options.errorCode ?? 'unauthorized';
+
+  // NOTE: The public signature uses the Web `Request`/`Response` types (not
+  // NextRequest/NextResponse) so the exported route handler stays assignable to
+  // Next's RouteHandlerConfig regardless of which `next` install resolves the
+  // type. At runtime Next always passes a real NextRequest, so the internal
+  // cast is safe.
+  return async function GET(request: Request): Promise<Response> {
+    const req = request as unknown as NextRequest;
+    const accessToken = req.cookies.get('access_token')?.value;
+
+    if (!accessToken) {
+      return NextResponse.json({ error: errorCode }, { status: 401 });
+    }
+
+    try {
+      // Fetch userinfo from auth7 OAuth2 endpoint
+      const response = await fetch(`${AUTH7_API_URL}/oauth2/userinfo`, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+        },
+      });
+
+      if (!response.ok) {
+        return NextResponse.json({ error: 'userinfo_failed' }, { status: response.status });
+      }
+
+      const userInfo = await response.json();
+
+      // Augment with JWT claims for shell display
+      const jwtClaims = decodeJWTPayload(accessToken);
+      if (jwtClaims) {
+        userInfo.roles = jwtClaims.roles || userInfo.roles || [];
+        userInfo.branch_id = jwtClaims.branch_id || null;
+      }
+
+      return NextResponse.json(userInfo);
+    } catch {
+      return NextResponse.json({ error: 'server_error' }, { status: 500 });
+    }
+  };
+}
+
+export const GET = makeAuthMeRoute();

package/src/bff/auth-preferences.ts

@@ -0,0 +1,80 @@
+// bff/auth-preferences.ts — Shared BFF handlers for /api/auth/preferences
+// Locale preference (GET/POST) backed by auth7 profile + core7_locale cookie.
+// Canonical source: bos7-template. Byte-identical across bos7-template,
+// bos7-portal, bos7-workflow, auth7-ui.
+
+import { NextRequest, NextResponse } from "next/server";
+
+const COOKIE_KEY = "core7_locale";
+const VALID = new Set(["id", "en"]);
+const AUTH7_API_URL = process.env.AUTH7_API_URL || "http://localhost:8090";
+
+// Public signatures use Web `Request`/`Response` (see bff/auth-me.ts for why);
+// the runtime object is always a real NextRequest.
+export async function GET(request: Request): Promise<Response> {
+  const req = request as unknown as NextRequest;
+  const cookieLocale = req.cookies.get(COOKIE_KEY)?.value ?? "id";
+  const accessToken = req.cookies.get("access_token")?.value;
+  if (!accessToken) {
+    return NextResponse.json({ locale: VALID.has(cookieLocale) ? cookieLocale : "id" });
+  }
+
+  try {
+    const res = await fetch(`${AUTH7_API_URL}/v1/auth/me`, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      cache: "no-store",
+    });
+    if (!res.ok) {
+      return NextResponse.json({ locale: VALID.has(cookieLocale) ? cookieLocale : "id" });
+    }
+    const data = (await res.json()) as { preferred_locale?: string };
+    const locale = data?.preferred_locale && VALID.has(data.preferred_locale) ? data.preferred_locale : (VALID.has(cookieLocale) ? cookieLocale : "id");
+    const response = NextResponse.json({ locale });
+    response.cookies.set(COOKIE_KEY, locale, {
+      httpOnly: false,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      maxAge: 31536000,
+      path: "/",
+    });
+    return response;
+  } catch {
+    return NextResponse.json({ locale: VALID.has(cookieLocale) ? cookieLocale : "id" });
+  }
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const req = request as unknown as NextRequest;
+  const accessToken = req.cookies.get("access_token")?.value;
+  let locale = "id";
+  try {
+    const body = (await req.json()) as { locale?: string };
+    if (body?.locale && VALID.has(body.locale)) locale = body.locale;
+  } catch {
+    return NextResponse.json({ error: "invalid_request" }, { status: 400 });
+  }
+
+  const res = NextResponse.json({ locale });
+  if (accessToken) {
+    try {
+      await fetch(`${AUTH7_API_URL}/v1/auth/profile`, {
+        method: "PUT",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${accessToken}`,
+        },
+        body: JSON.stringify({ preferred_locale: locale }),
+      });
+    } catch {
+      // keep local cookie fallback even if backend sync fails
+    }
+  }
+  res.cookies.set(COOKIE_KEY, locale, {
+    httpOnly: false,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    maxAge: 31536000,
+    path: "/",
+  });
+  return res;
+}

package/src/bff/auth-refresh.ts

@@ -0,0 +1,106 @@
+// bff/auth-refresh.ts — Shared BFF handler for /api/auth/refresh
+// Silent token refresh endpoint. Canonical source: bos7-template.
+//
+// The only per-app difference is the CLIENT_ID fallback used when
+// AUTH7_CLIENT_ID is unset. Apps re-export the ready POST (fallback
+// 'bos7-template') when byte-identical, or build a variant via
+// makeAuthRefreshRoute({ clientIdFallback }).
+
+import { NextRequest, NextResponse } from 'next/server';
+
+const AUTH7_API_URL = process.env.AUTH7_API_URL || 'http://localhost:8090';
+
+export interface AuthRefreshRouteOptions {
+  /** Fallback client_id used when AUTH7_CLIENT_ID env var is unset. */
+  clientIdFallback?: string;
+}
+
+function getRefreshToken(request: NextRequest): string | null {
+  return request.cookies.get('refresh_token')?.value ?? null;
+}
+
+export function makeAuthRefreshRoute(options: AuthRefreshRouteOptions = {}) {
+  const CLIENT_ID = process.env.AUTH7_CLIENT_ID || options.clientIdFallback || 'bos7-template';
+
+  // Public signature uses Web `Request`/`Response` (see auth-me.ts for why); the
+  // runtime object is always a real NextRequest.
+  return async function POST(request: Request): Promise<Response> {
+    const refreshToken = getRefreshToken(request as unknown as NextRequest);
+
+    if (!refreshToken) {
+      return NextResponse.json({ error: 'No refresh token' }, { status: 401 });
+    }
+
+    try {
+      const body = new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+        client_id: CLIENT_ID,
+      });
+
+      const response = await fetch(`${AUTH7_API_URL}/oauth2/token`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: body.toString(),
+      });
+
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => ({}));
+        throw new Error(errorData.error_description || errorData.error || 'Token refresh failed');
+      }
+
+      const tokens = await response.json();
+      const expiresAt = Date.now() + tokens.expires_in * 1000;
+
+      const jsonResponse = NextResponse.json({ success: true });
+
+      jsonResponse.cookies.set('access_token', tokens.access_token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: tokens.expires_in,
+        path: '/',
+      });
+
+      jsonResponse.cookies.set('token_expires_at', expiresAt.toString(), {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: tokens.expires_in,
+        path: '/',
+      });
+
+      jsonResponse.cookies.set('token_scope', tokens.scope, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: tokens.expires_in,
+        path: '/',
+      });
+
+      if (tokens.refresh_token) {
+        jsonResponse.cookies.set('refresh_token', tokens.refresh_token, {
+          httpOnly: true,
+          secure: process.env.NODE_ENV === 'production',
+          sameSite: 'lax',
+          maxAge: 8 * 3600,
+          path: '/',
+        });
+      }
+
+      return jsonResponse;
+    } catch (err) {
+      const response = NextResponse.json({ error: (err as Error).message }, { status: 401 });
+      response.cookies.set('access_token', '', { path: '/', maxAge: 0, sameSite: 'lax' });
+      response.cookies.set('refresh_token', '', { path: '/', maxAge: 0, sameSite: 'lax' });
+      response.cookies.set('id_token', '', { path: '/', maxAge: 0, sameSite: 'lax' });
+      response.cookies.set('token_expires_at', '', { path: '/', maxAge: 0, sameSite: 'lax' });
+      response.cookies.set('token_scope', '', { path: '/', maxAge: 0, sameSite: 'lax' });
+      return response;
+    }
+  };
+}
+
+export const POST = makeAuthRefreshRoute();

package/src/bff/health.ts

@@ -0,0 +1,12 @@
+// bff/health.ts — Shared BFF handler for /api/health
+// Liveness probe. Canonical source: bos7-template.
+// Byte-identical across bos7-template and bos7-enterprise.
+
+export async function GET(): Promise<Response> {
+  return Response.json({
+    status: 'ok',
+    version: process.env.APP_VERSION ?? 'unknown',
+    timestamp: new Date().toISOString(),
+    env: process.env.NODE_ENV ?? 'unknown',
+  });
+}

package/src/shell/provider.tsx

@@ -16,15 +16,19 @@ type SharedShellProviderProps = {
 type SharedShellProviderOptions = {
   withAuth?: boolean;
   dictionaries?: Partial<Record<"id" | "en", Record<string, string>>>;
+  // Default bahasa untuk pengunjung baru; pilihan user (cookie) tetap menang.
+  // Standar platform: English.
+  defaultLocale?: "id" | "en";
 };
 
 export function createShellProvider(options?: SharedShellProviderOptions) {
   const withAuth = options?.withAuth ?? true;
   const dictionaries = options?.dictionaries;
+  const defaultLocale = options?.defaultLocale ?? "en";
 
   return function SharedShellProvider({ children, Layout }: SharedShellProviderProps) {
     const content = (
-      <I18nProvider dictionaries={dictionaries}>
+      <I18nProvider defaultLocale={defaultLocale} dictionaries={dictionaries}>
         <Layout>{children}</Layout>
       </I18nProvider>
     );