@robosystems/core 0.6.3 → 0.7.1

package/auth-components/AuthGuard.js

@@ -2,6 +2,7 @@
 import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
 import { useRouter } from 'next/navigation';
 import { useEffect } from 'react';
+import { isSafeRelativePath } from '../auth-core/login-home';
 import { BrandSpinner } from '../ui-components';
 import { useAuth } from './AuthProvider';
 export function AuthGuard({ children, redirectTo = '/login', loadingComponent, }) {
@@ -9,15 +10,28 @@ export function AuthGuard({ children, redirectTo = '/login', loadingComponent, }
     const router = useRouter();
     useEffect(() => {
         if (!isLoading && !isAuthenticated) {
+            // Carry the intended destination so the login flow can land the user
+            // back where they were headed instead of the default landing page.
+            // A bare "/" carries no information — the default landing already
+            // covers it — so it is not forwarded.
+            let target = redirectTo;
+            if (typeof window !== 'undefined') {
+                const destination = window.location.pathname + window.location.search;
+                if (destination !== '/' &&
+                    destination !== redirectTo &&
+                    isSafeRelativePath(destination)) {
+                    target = `${redirectTo}?return_to=${encodeURIComponent(destination)}`;
+                }
+            }
             try {
-                router.push(redirectTo);
+                router.push(target);
             }
             catch (error) {
                 if (process.env.NODE_ENV === 'development') {
                     // Fallback to window.location if router.push fails
                     console.error('Router push failed, using window.location fallback:', error);
                 }
-                window.location.href = redirectTo;
+                window.location.href = target;
             }
         }
     }, [isAuthenticated, isLoading, router, redirectTo]);

package/auth-components/AuthProvider.js

@@ -5,7 +5,9 @@ import { clearEntitySelection } from '../actions/entity-actions';
 import { clearGraphSelection } from '../actions/graph-actions';
 import { performLogoutCleanup } from '../auth-core/cleanup';
 import { RoboSystemsAuthClient } from '../auth-core/client';
+import { CURRENT_APP, isLoginHome } from '../auth-core/config';
 import { useTokenExpiryHandler } from '../auth-core/hooks';
+import { buildLoginHomeUrl, buildReturnTo } from '../auth-core/login-home';
 import { getTimeUntilExpiry, getTokenStatus } from '../auth-core/token-storage';
 // Configuration constants
 const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
@@ -108,7 +110,7 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
             setIsLoading(false);
         }
     }, [authClient]);
-    const logout = useCallback(async (reason) => {
+    const logout = useCallback(async (reason, options) => {
         try {
             await authClient.logout();
         }
@@ -129,23 +131,46 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
                 Promise.allSettled([clearGraphSelection(), clearEntitySelection()]),
                 new Promise((resolve) => setTimeout(resolve, 2000)),
             ]);
-            // Clear auth client cache and local user/session state
+            // Clear auth client cache and local storage state. Deliberately NO
+            // setUser(null) here: the hard navigation below tears the tree down
+            // anyway, and nulling the user first wakes AuthGuard, whose
+            // client-side redirect (→ /login → LoginRedirector → login home)
+            // can outrace the queued /logout navigation — the anchor session
+            // then survives and silently signs the user back in, undoing the
+            // logout (observed E2E under centralized login).
             authClient.clearAuthCache();
-            setUser(null);
             setSessionWarning({ show: false, timeLeft: 0 });
             // Perform comprehensive cleanup of all user-specific data
             performLogoutCleanup();
             debugLog('Logout cleanup completed');
             // Always hard-redirect out of the authenticated area. A full-page
             // navigation (not a client-side router.push) guarantees the
-            // authenticated tree tears down instead of AuthGuard flashing a blank
-            // screen once user state clears. A forced logout (reason set, e.g.
+            // authenticated tree tears down without AuthGuard racing it (see
+            // above). A forced logout (reason set, e.g.
             // session_expired) goes to the login page so it can explain why the
-            // session ended and let the user sign back in; a manual logout goes to
-            // the public homepage, since the user likely isn't trying to sign in
-            // again right away.
+            // session ended and let the user sign back in. A manual logout on a
+            // product app chains through the login home's /logout so the anchor
+            // session dies too — otherwise the next visit silently re-bridges and
+            // "log out" appears not to work. On the login home itself (and in
+            // single-app deployments, where the app is its own login home) manual
+            // logout goes to the public homepage. `options.redirectTo` overrides
+            // the destination — used by the login home's /logout route to land the
+            // user back on the app they came from.
             if (typeof window !== 'undefined') {
-                window.location.href = reason ? `/login?reason=${reason}` : '/';
+                if (options === null || options === void 0 ? void 0 : options.redirectTo) {
+                    window.location.href = options.redirectTo;
+                }
+                else if (reason) {
+                    window.location.href = `/login?reason=${reason}`;
+                }
+                else if (!isLoginHome()) {
+                    window.location.href = buildLoginHomeUrl('logout', {
+                        returnTo: buildReturnTo(CURRENT_APP),
+                    });
+                }
+                else {
+                    window.location.href = '/';
+                }
             }
         }
     }, [authClient]);
@@ -494,8 +519,8 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
             throw new Error(response.message || 'Registration failed');
         }
     };
-    const forgotPassword = async (email) => {
-        return authClient.forgotPassword(email);
+    const forgotPassword = async (email, options) => {
+        return authClient.forgotPassword(email, options);
     };
     const resetPassword = async (token, newPassword) => {
         const result = await authClient.resetPassword(token, newPassword);
@@ -534,8 +559,8 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
         }
         return result;
     };
-    const resendVerificationEmail = async (email) => {
-        return authClient.resendVerificationEmail(email);
+    const resendVerificationEmail = async (email, options) => {
+        return authClient.resendVerificationEmail(email, options);
     };
     const value = {
         user,

package/auth-components/LoginRedirector.d.ts

@@ -0,0 +1,20 @@
+export interface LoginRedirectorProps {
+    /** Which auth surface this page stands in for. */
+    mode?: 'login' | 'register';
+    apiUrl: string;
+    /** Where a completed bridge without a returnUrl lands. */
+    homePath?: string;
+}
+/**
+ * Product-app stand-in for the login/register pages under centralized login.
+ *
+ * Two jobs:
+ * - `?session_id=` present: consume the SSO bridge handoff exactly as the
+ *   full login page did. On failure it renders an error with a manual link
+ *   to the login home — never an automatic redirect, which with a live
+ *   anchor session would loop (login home re-bridges → fails → back again).
+ * - otherwise: redirect to the login home, upgrading a local `?return_to=`
+ *   path to app-qualified form and forwarding foreign query params
+ *   (e.g. `invite`) so mailed links keep working.
+ */
+export declare function LoginRedirector({ mode, apiUrl, homePath, }: LoginRedirectorProps): import("react").JSX.Element;

package/auth-components/LoginRedirector.js

@@ -0,0 +1,85 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useRef, useState } from 'react';
+import { CURRENT_APP, isLoginHome } from '../auth-core/config';
+import { buildLoginHomeUrl, buildReturnTo, isSafeRelativePath, } from '../auth-core/login-home';
+import { useSSO } from '../auth-core/sso';
+import { BrandSpinner } from '../ui-components';
+/**
+ * Product-app stand-in for the login/register pages under centralized login.
+ *
+ * Two jobs:
+ * - `?session_id=` present: consume the SSO bridge handoff exactly as the
+ *   full login page did. On failure it renders an error with a manual link
+ *   to the login home — never an automatic redirect, which with a live
+ *   anchor session would loop (login home re-bridges → fails → back again).
+ * - otherwise: redirect to the login home, upgrading a local `?return_to=`
+ *   path to app-qualified form and forwarding foreign query params
+ *   (e.g. `invite`) so mailed links keep working.
+ */
+export function LoginRedirector({ mode = 'login', apiUrl, homePath = '/home', }) {
+    const { handleSSOLogin } = useSSO(apiUrl);
+    const [bridgeFailed, setBridgeFailed] = useState(false);
+    const [misconfigured, setMisconfigured] = useState(false);
+    const startedRef = useRef(false);
+    useEffect(() => {
+        var _a;
+        // Guard against StrictMode double-mount: the first run consumes
+        // session_id and strips it from the URL, so a second run would
+        // misread the state as a failed bridge.
+        if (startedRef.current) {
+            return;
+        }
+        startedRef.current = true;
+        const params = new URLSearchParams(window.location.search);
+        const sessionId = params.get('session_id');
+        if (sessionId) {
+            const returnUrl = params.get('returnUrl');
+            void handleSSOLogin().then((user) => {
+                if (user) {
+                    // With a returnUrl, handleSSOLogin navigates there itself.
+                    if (!returnUrl) {
+                        window.location.href = homePath;
+                    }
+                }
+                else {
+                    setBridgeFailed(true);
+                }
+            });
+            return;
+        }
+        // Never self-redirect: mounted on the app that IS the login home
+        // (misconfiguration — the login home renders real auth forms, not this
+        // redirector), buildLoginHomeUrl() resolves to this same app and
+        // window.location.replace() would loop. Fail safe with a static state,
+        // mirroring AuthProvider.logout's isLoginHome() guard.
+        if (isLoginHome()) {
+            console.error('[LoginRedirector] rendered on the login home app — refusing to self-redirect. Check NEXT_PUBLIC_LOGIN_HOME_APP / the centralized-login flag.');
+            setMisconfigured(true);
+            return;
+        }
+        const localReturnTo = params.get('return_to');
+        const path = localReturnTo && isSafeRelativePath(localReturnTo)
+            ? localReturnTo
+            : undefined;
+        const reason = (_a = params.get('reason')) !== null && _a !== void 0 ? _a : undefined;
+        // replace() keeps the redirector page out of history so Back returns
+        // to the page the user actually came from.
+        window.location.replace(buildLoginHomeUrl(mode, {
+            returnTo: buildReturnTo(CURRENT_APP, path),
+            reason,
+            forwardParams: params,
+        }));
+    }, [handleSSOLogin, mode, homePath]);
+    if (misconfigured) {
+        return (_jsxs("div", { className: "flex min-h-screen flex-col items-center justify-center gap-4 px-6 text-center", children: [_jsx("p", { className: "text-lg font-semibold text-gray-900 dark:text-white", children: "Sign-in is temporarily unavailable" }), _jsx("p", { className: "max-w-md text-sm text-gray-600 dark:text-gray-400", children: "This page is misconfigured. Please contact support if the problem persists." })] }));
+    }
+    if (bridgeFailed) {
+        const retryUrl = buildLoginHomeUrl(mode, {
+            returnTo: buildReturnTo(CURRENT_APP),
+            reason: 'bridge_failed',
+        });
+        return (_jsxs("div", { className: "flex min-h-screen flex-col items-center justify-center gap-4 px-6 text-center", children: [_jsx("p", { className: "text-lg font-semibold text-gray-900 dark:text-white", children: "Sign-in could not be completed" }), _jsx("p", { className: "max-w-md text-sm text-gray-600 dark:text-gray-400", children: "The sign-in handoff expired or was invalid. This can happen when a sign-in link is reused or takes too long to load." }), _jsx("a", { href: retryUrl, className: "rounded-lg bg-blue-600 px-4 py-2 text-sm font-medium text-white hover:bg-blue-700", children: "Continue to sign in" })] }));
+    }
+    return _jsx(BrandSpinner, { size: "xl", fullScreen: true });
+}

package/auth-components/index.d.ts

@@ -1,6 +1,7 @@
 export { AppSwitcher } from './AppSwitcher';
 export { AuthGuard } from './AuthGuard';
 export { AuthProvider, useAuth, useOptionalAuth } from './AuthProvider';
+export { LoginRedirector } from './LoginRedirector';
 export { SignInForm } from './SignInForm';
 export { SignUpForm } from './SignUpForm';
 export { TurnstileWidget, useTurnstile } from './TurnstileWidget';

package/auth-components/index.js

@@ -1,6 +1,7 @@
 export { AppSwitcher } from './AppSwitcher';
 export { AuthGuard } from './AuthGuard';
 export { AuthProvider, useAuth, useOptionalAuth } from './AuthProvider';
+export { LoginRedirector } from './LoginRedirector';
 export { SignInForm } from './SignInForm';
 export { SignUpForm } from './SignUpForm';
 export { TurnstileWidget, useTurnstile } from './TurnstileWidget';

package/auth-core/client.d.ts

@@ -35,7 +35,9 @@ export declare class RoboSystemsAuthClient {
      */
     private syncClientConfigToken;
     login(email: string, password: string): Promise<AuthResponse>;
-    register(email: string, password: string, name?: string, captchaToken?: string, inviteToken?: string): Promise<AuthResponse>;
+    register(email: string, password: string, name?: string, captchaToken?: string, inviteToken?: string, options?: {
+        appSource?: string;
+    }): Promise<AuthResponse>;
     logout(): Promise<void>;
     getCurrentUser(): Promise<AuthUser>;
     private performAuthCheck;
@@ -57,7 +59,9 @@ export declare class RoboSystemsAuthClient {
     /**
      * Send password reset email
      */
-    forgotPassword(email: string): Promise<{
+    forgotPassword(email: string, options?: {
+        appSource?: string;
+    }): Promise<{
         success: boolean;
         message?: string;
     }>;
@@ -87,7 +91,9 @@ export declare class RoboSystemsAuthClient {
     /**
      * Resend verification email
      */
-    resendVerificationEmail(email: string): Promise<{
+    resendVerificationEmail(email: string, options?: {
+        appSource?: string;
+    }): Promise<{
         success: boolean;
         message?: string;
     }>;

package/auth-core/client.js

@@ -18,6 +18,15 @@ const setSDKClientConfig = (_a = sdkClientsModule.setSDKClientConfig) !== null &
 // Configuration constants
 const CACHE_TTL_MS = 30 * 1000; // 30 seconds - optimized for performance
 const ERROR_CACHE_TTL_MS = 5 * 1000; // 5 seconds - allow reasonable retry delay
+/**
+ * Identifies which product app an auth request originates from, for email
+ * branding. Under centralized login every interactive auth request comes
+ * from the login home, so Referer-based detection on the backend collapses
+ * to one app — the originating app (from `return_to`) rides this header
+ * instead.
+ */
+const APP_SOURCE_HEADER = 'X-App-Source';
+const appSourceHeaders = (appSource) => appSource ? { [APP_SOURCE_HEADER]: appSource } : undefined;
 // Custom error class for token expiry
 export class TokenExpiredError extends Error {
     constructor(message = 'Token expired') {
@@ -200,7 +209,7 @@ export class RoboSystemsAuthClient {
             refresh_threshold: sdkResponse.refresh_threshold,
         };
     }
-    async register(email, password, name, captchaToken, inviteToken) {
+    async register(email, password, name, captchaToken, inviteToken, options) {
         const response = await registerUser({
             client: this.client,
             body: {
@@ -210,6 +219,7 @@ export class RoboSystemsAuthClient {
                 captcha_token: captchaToken || undefined,
                 invite_token: inviteToken || undefined,
             },
+            headers: appSourceHeaders(options === null || options === void 0 ? void 0 : options.appSource),
         });
         // Check for error responses (4xx/5xx)
         if (response.error) {
@@ -490,11 +500,12 @@ export class RoboSystemsAuthClient {
     /**
      * Send password reset email
      */
-    async forgotPassword(email) {
+    async forgotPassword(email, options) {
         try {
             await forgotPassword({
                 client: this.client,
                 body: { email },
+                headers: appSourceHeaders(options === null || options === void 0 ? void 0 : options.appSource),
             });
             return {
                 success: true,
@@ -616,11 +627,12 @@ export class RoboSystemsAuthClient {
     /**
      * Resend verification email
      */
-    async resendVerificationEmail(email) {
+    async resendVerificationEmail(email, options) {
         try {
             await resendVerificationEmail({
                 client: this.client,
                 body: { email },
+                headers: appSourceHeaders(options === null || options === void 0 ? void 0 : options.appSource),
             });
             return {
                 success: true,

package/auth-core/config.d.ts

@@ -17,3 +17,11 @@ export declare const BRAND_COLORS: Record<AppName, string>;
 export declare const BRAND_GRADIENTS: Record<AppName, string>;
 export declare const APP_CONFIGS: Record<string, AppConfig>;
 export declare const getAppConfig: (appName: string) => AppConfig;
+/**
+ * The app hosting the interactive auth surface ("login home"). Product apps
+ * redirect login/register there; single-app deployments designate their own
+ * app key so the architecture degrades to local auth by config.
+ */
+export declare const LOGIN_HOME_APP: AppName;
+export declare const getLoginHomeUrl: () => string;
+export declare const isLoginHome: () => boolean;

package/auth-core/config.js

@@ -54,3 +54,11 @@ export const APP_CONFIGS = {
 export const getAppConfig = (appName) => {
     return APP_CONFIGS[appName] || APP_CONFIGS.robosystems;
 };
+/**
+ * The app hosting the interactive auth surface ("login home"). Product apps
+ * redirect login/register there; single-app deployments designate their own
+ * app key so the architecture degrades to local auth by config.
+ */
+export const LOGIN_HOME_APP = process.env.NEXT_PUBLIC_LOGIN_HOME_APP || 'robosystems';
+export const getLoginHomeUrl = () => getAppConfig(LOGIN_HOME_APP).url;
+export const isLoginHome = () => CURRENT_APP === LOGIN_HOME_APP;

package/auth-core/index.d.ts

@@ -2,5 +2,6 @@ export * from './cleanup';
 export * from './client';
 export * from './config';
 export * from './hooks';
+export * from './login-home';
 export * from './sso';
 export * from './types';

package/auth-core/index.js

@@ -2,5 +2,6 @@ export * from './cleanup';
 export * from './client';
 export * from './config';
 export * from './hooks';
+export * from './login-home';
 export * from './sso';
 export * from './types';

package/auth-core/login-home.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Helpers for the centralized login home.
+ *
+ * Interactive auth (login/register/verify/reset) renders on one designated
+ * app — the "login home" — and product apps redirect to it carrying a
+ * `return_to` value so the user is bridged back after authenticating.
+ *
+ * `return_to` grammar: `app` or `app:/path`. The app segment is validated
+ * against APP_CONFIGS; the path must be a same-app relative path. Never a
+ * free-form URL — an open redirect on a login surface is a phishing
+ * amplifier.
+ */
+export interface ParsedReturnTo {
+    app: string;
+    /** Relative path on the target app, or null for its default landing. */
+    path: string | null;
+}
+/**
+ * True when `path` is a same-app relative path. Rejects scheme-relative
+ * URLs ("//host"), absolute URLs, backslashes (browsers normalize
+ * "/\host" to "//host"), and ASCII tab/newline characters (browsers
+ * strip those before URL parsing, so "/<TAB>/host" would normalize
+ * to "//host").
+ */
+export declare function isSafeRelativePath(path: string): boolean;
+/** Build a `return_to` value. An unsafe path degrades to app-only. */
+export declare function buildReturnTo(app: string, path?: string | null): string;
+/**
+ * Parse a raw `return_to` query value (already URL-decoded by
+ * URLSearchParams — do not decode again). Unknown apps return null;
+ * an unsafe path degrades to the app's default landing.
+ */
+export declare function parseReturnTo(raw: string | null | undefined): ParsedReturnTo | null;
+export interface LoginHomeUrlOptions {
+    /** `return_to` value (build with buildReturnTo). */
+    returnTo?: string;
+    /** Sign-in notice key (e.g. session_expired) rendered by the login home. */
+    reason?: string;
+    /**
+     * Query params to carry through to the login home (e.g. `invite`).
+     * Params owned by the redirect/bridge flow are dropped.
+     */
+    forwardParams?: URLSearchParams;
+}
+/** Build an absolute URL on the login home for the given auth surface. */
+export declare function buildLoginHomeUrl(mode: 'login' | 'register' | 'logout', options?: LoginHomeUrlOptions): string;

package/auth-core/login-home.js

@@ -0,0 +1,61 @@
+import { APP_CONFIGS, getLoginHomeUrl } from './config';
+/**
+ * True when `path` is a same-app relative path. Rejects scheme-relative
+ * URLs ("//host"), absolute URLs, backslashes (browsers normalize
+ * "/\host" to "//host"), and ASCII tab/newline characters (browsers
+ * strip those before URL parsing, so "/<TAB>/host" would normalize
+ * to "//host").
+ */
+export function isSafeRelativePath(path) {
+    if (!path.startsWith('/') || path.startsWith('//')) {
+        return false;
+    }
+    return !/[\\\t\n\r]/.test(path);
+}
+/** Build a `return_to` value. An unsafe path degrades to app-only. */
+export function buildReturnTo(app, path) {
+    if (path && isSafeRelativePath(path)) {
+        return `${app}:${path}`;
+    }
+    return app;
+}
+/**
+ * Parse a raw `return_to` query value (already URL-decoded by
+ * URLSearchParams — do not decode again). Unknown apps return null;
+ * an unsafe path degrades to the app's default landing.
+ */
+export function parseReturnTo(raw) {
+    if (!raw) {
+        return null;
+    }
+    const separator = raw.indexOf(':');
+    const app = separator === -1 ? raw : raw.slice(0, separator);
+    const path = separator === -1 ? null : raw.slice(separator + 1);
+    if (!APP_CONFIGS[app]) {
+        return null;
+    }
+    if (path !== null && !isSafeRelativePath(path)) {
+        return { app, path: null };
+    }
+    return { app, path };
+}
+/** Params the redirect/bridge flow owns; never forwarded verbatim. */
+const OWNED_PARAMS = new Set(['session_id', 'returnUrl', 'return_to', 'reason']);
+/** Build an absolute URL on the login home for the given auth surface. */
+export function buildLoginHomeUrl(mode, options = {}) {
+    const url = new URL(`/${mode}`, getLoginHomeUrl());
+    if (options.forwardParams) {
+        options.forwardParams.forEach((value, key) => {
+            if (!OWNED_PARAMS.has(key)) {
+                url.searchParams.append(key, value);
+            }
+        });
+    }
+    if (options.returnTo) {
+        url.searchParams.set('return_to', options.returnTo);
+    }
+    if (options.reason) {
+        url.searchParams.set('reason', options.reason);
+    }
+    return url.toString();
+}

package/auth-core/types.d.ts

@@ -71,10 +71,14 @@ export interface AuthContextType {
     };
     login: (email: string, password: string) => Promise<AuthUser>;
     register: (email: string, password: string, name?: string) => Promise<AuthUser>;
-    logout: (reason?: string) => Promise<void>;
+    logout: (reason?: string, options?: {
+        redirectTo?: string;
+    }) => Promise<void>;
     refreshUser: () => Promise<AuthUser | null>;
     refreshSession: (force?: boolean) => Promise<void>;
-    forgotPassword: (email: string) => Promise<{
+    forgotPassword: (email: string, options?: {
+        appSource?: string;
+    }) => Promise<{
         success: boolean;
         message?: string;
     }>;
@@ -92,7 +96,9 @@ export interface AuthContextType {
         message?: string;
         user?: AuthUser;
     }>;
-    resendVerificationEmail: (email: string) => Promise<{
+    resendVerificationEmail: (email: string, options?: {
+        appSource?: string;
+    }) => Promise<{
         success: boolean;
         message?: string;
     }>;

package/index.d.ts

@@ -1,7 +1,7 @@
 export * as AuthCore from './auth-core';
 export { clearToken, getAuthHeader, getToken, getValidToken, handleAuthResponse, hasValidToken, storeToken, } from './auth-core/token-storage';
 export { clearUserCookies, clearUserLocalStorage, clearUserSessionStorage, listUserData, performLogoutCleanup, resetUIState, } from './auth-core/cleanup';
-export { AppSwitcher, AuthGuard, AuthProvider, SignInForm, SignUpForm, useAuth, } from './auth-components';
+export { AppSwitcher, AuthGuard, AuthProvider, LoginRedirector, SignInForm, SignUpForm, useAuth, } from './auth-components';
 export { useApiError, useMediaQuery, useToast, useUser, useUserLimits, type ToastMessage, } from './hooks';
 export { createGraphContext, createGraphProvider, createUseGraphContext, EntityProvider, GraphContext, GraphProvider, OrgProvider, ServiceOfferingsProvider, SidebarProvider, useEntity, useGraphContext, useOrg, useServiceOfferings, useSidebarContext, type EntityContextValue, type EntityProviderProps, type GraphContextValue, type GraphProviderProps, type GraphState, type OrgContextState, type OrgContextValue, type OrgProviderProps, type ServiceOfferings, } from './contexts';
 export { clientGraphCookie, clientSidebarCookie, createMcpConnectorUrl, entityCookie, graphCookie, sidebarCookie, type EntityCookie, type GraphCookie, type McpConnectorUrl, type SidebarCookie, } from './lib';
@@ -28,3 +28,6 @@ import { client } from '@robosystems/client';
 export { client };
 export type { APIKey, AppName, AuthContextType, AuthUser } from './auth-core';
 export { CURRENT_APP } from './auth-core/config';
+export { getLoginHomeUrl, isLoginHome, LOGIN_HOME_APP, } from './auth-core/config';
+export { buildLoginHomeUrl, buildReturnTo, isSafeRelativePath, parseReturnTo, } from './auth-core/login-home';
+export type { LoginHomeUrlOptions, ParsedReturnTo, } from './auth-core/login-home';

package/index.js

@@ -6,7 +6,7 @@ export { clearToken, getAuthHeader, getToken, getValidToken, handleAuthResponse,
 // Export auth cleanup utilities
 export { clearUserCookies, clearUserLocalStorage, clearUserSessionStorage, listUserData, performLogoutCleanup, resetUIState, } from './auth-core/cleanup';
 // Export auth-components
-export { AppSwitcher, AuthGuard, AuthProvider, SignInForm, SignUpForm, useAuth, } from './auth-components';
+export { AppSwitcher, AuthGuard, AuthProvider, LoginRedirector, SignInForm, SignUpForm, useAuth, } from './auth-components';
 // Export hooks
 export { useApiError, useMediaQuery, useToast, useUser, useUserLimits, } from './hooks';
 // Export contexts
@@ -75,3 +75,6 @@ if (process.env.NODE_ENV !== 'test') {
 export { client };
 // App identity
 export { CURRENT_APP } from './auth-core/config';
+// Centralized login home
+export { getLoginHomeUrl, isLoginHome, LOGIN_HOME_APP, } from './auth-core/config';
+export { buildLoginHomeUrl, buildReturnTo, isSafeRelativePath, parseReturnTo, } from './auth-core/login-home';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.6.3",
+  "version": "0.7.1",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,