@choubo/kerthus-web-core

Framework-neutral browser contracts shared by Kerthus and independent applications. The package does not import Vue, Pinia, Axios, or any Go module.

The public exports are deliberately small so application code does not depend on the shared package's internal file layout.

Current exports include authenticated fetch construction, platform response envelope parsing, authentication header construction, and build-time application registry contracts. Authentication exports also include canonical token, user profile, authorization snapshot, and tenant/application context types.

createSharedAuthSessionStorage implements the versioned encrypted browser session and token-free cross-tab event contract. Host-owned legacy readers migrate existing sessions without importing platform code into applications. See the integration and rollback guide.

Navigation helpers

normalizeAuthNavigation removes malformed authorization records while preserving valid absolute child routes. externalUrl validates explicit HTTP(S) destinations without relying on a browser origin, and isExternalDestination distinguishes external paths from in-app routes.

AppContext also carries the platform's frontend_entry, frontend_base_path, and frontend_home fields. buildFrontendLaunchUrl accepts application catalog metadata or an app context and returns a same-origin path for an independent frontend. It rejects external URLs, encoded or traversing paths, and reserved platform base paths. A bundled frontend or invalid metadata returns undefined; the host decides what to do in that case and remains responsible for authorization before switching apps.

import { buildFrontendLaunchUrl } from '@choubo/kerthus-web-core';

const target = buildFrontendLaunchUrl({
  code: 'fablex', frontend_entry: 'independent',
  frontend_base_path: '/fablex', frontend_home: '/projects',
}); // /fablex/projects