@acorex-platform/framework-client 0.0.18 → 0.0.20

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@acorex-platform/framework-client",
-  "version": "0.0.18",
+  "version": "0.0.20",
   "peerDependencies": {
-    "@acorex/cdk": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.0.0-next.0",
-    "@acorex/core": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.0.0-next.0",
-    "@acorex/charts": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.0.0-next.0",
-    "@acorex/styles": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.0.0-next.0",
-    "@acorex/components": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.0.0-next.0",
-    "@acorex-platform/framework-shared": "0.0.18",
+    "@acorex-platform/framework-shared": "0.0.20",
+    "@acorex/cdk": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.1.0-next.0 || ^22.1.0-next.0",
+    "@acorex/charts": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.1.0-next.0 || ^22.1.0-next.0",
+    "@acorex/components": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.1.0-next.0 || ^22.1.0-next.0",
+    "@acorex/core": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.1.0-next.0 || ^22.1.0-next.0",
+    "@acorex/styles": "^19.0.0 || ^20.0.0 || ^22.0.0-next.0 || ^22.1.0-next.0 || ^22.1.0-next.0",
     "@angular/animations": "^21.0.0",
     "@ngrx/signals": "^21.0.0",
-    "socket.io-client": "^4.0.0",
-    "tailwindcss-animate": "^1.0.0",
     "dom-to-image": "^2.6.0",
     "micromark": "^4.0.2",
-    "micromark-extension-gfm": "^3.0.0"
+    "micromark-extension-gfm": "^3.0.0",
+    "socket.io-client": "^4.0.0",
+    "tailwindcss-animate": "^1.0.0"
   },
   "dependencies": {
     "tslib": "^2.3.0"

package/realtime/README.md

@@ -0,0 +1,16 @@
+# Framework Client Realtime
+
+Always-on app signaling over the **built-in** Socket.IO connection. Topic handlers receive envelopes published by the server realtime module.
+
+## Built-in vs RTC
+
+- **This package:** inbox, chat messages, typing, entity mutations (lightweight, always on).
+- **`extensions/rtc`:** call ring plus voice/video media when an RTC provider (e.g. LiveKit) is configured. Not a replacement for this connection.
+
+```ts
+import { provideRealtime } from '@acorex-platform/framework-client/realtime';
+
+provideRealtime({ apiBaseUrl: environment.baseUrl, backend: 'builtin' });
+```
+
+Inject `AXPRealtimeConnectionPort` (or `AXPRealtimeConnectionService`) for connect/subscribe; register handlers on `AXPRealtimeDispatcherService`.

package/runtime/README.md

@@ -1,3 +1,17 @@
 # @acorex-platform/framework-client/runtime
 
 Secondary entry point of `@acorex-platform/framework-client/platform`. It can be used by importing from `@acorex-platform/framework-client/runtime`.
+
+## External bulk transport (other API stacks)
+
+When the host app uses only this client library and implements the API elsewhere, override bulk with:
+
+```typescript
+import { provideExternalRuntimeBulkTransport } from '@acorex-platform/framework-client/runtime';
+
+providers: [
+  ...provideExternalRuntimeBulkTransport((request) => myApi.bulk(request)),
+]
+```
+
+See [`src/lib/RUNTIME_REMOTE_BULK_TRANSPORT.md`](./src/lib/RUNTIME_REMOTE_BULK_TRANSPORT.md).

package/types/acorex-platform-framework-client-auth.d.ts

@@ -1,30 +1,29 @@
 import * as i0 from '@angular/core';
 import { InjectionToken, TemplateRef, ViewContainerRef, ModuleWithProviders, Injector, Type } from '@angular/core';
+import { AXPMultiLanguageString, AXPOptionsData, AXPExpressionEvaluatorScopeProvider, AXPExpressionEvaluatorScopeProviderContext } from '@acorex-platform/framework-shared/core';
 import { CanActivateFn } from '@angular/router';
-import { AXPDataSourceDefinitionProvider, AXPDataSourceDefinition } from '@acorex-platform/framework-client/core';
-import { AXPOptionsData, AXPExpressionEvaluatorScopeProvider, AXPExpressionEvaluatorScopeProviderContext } from '@acorex-platform/framework-shared/core';
 import { Observable } from 'rxjs';
 
 interface AXPEdition {
     id: string;
-    title: string;
-    description?: string;
+    title: AXPMultiLanguageString;
+    description?: AXPMultiLanguageString;
 }
 interface AXPApplication {
     id: string;
     name: string;
-    title?: string;
+    title?: AXPMultiLanguageString;
     version?: string;
     edition?: AXPEdition;
-    description?: string;
+    description?: AXPMultiLanguageString;
     logoUrl?: string;
 }
 
 interface AXPTenant {
     id: string;
     name: string;
-    title: string;
-    description?: string;
+    title: AXPMultiLanguageString;
+    description?: AXPMultiLanguageString;
     logo?: string;
 }
 
@@ -32,7 +31,8 @@ interface AXPUser {
     id: string;
     name: string;
     title: string;
-    avatar?: string;
+    /** File-storage id / ref; `null` when known empty (from SignIn/Refresh). */
+    avatar?: string | null;
 }
 
 declare class AXPSessionContext {
@@ -62,11 +62,6 @@ interface AXPApplicationLoader {
 }
 declare const AXP_APPLICATION_LOADER: InjectionToken<AXPApplicationLoader>;
 
-/** Platform auth datasource registry names. */
-declare const AXPPlatformAuthDataSourceKeys: {
-    readonly PermissionDefinitions: "platform-permission-definitions";
-};
-
 declare class AXPUnauthorizedError extends Error {
     data?: {
         redirectUrl?: string;
@@ -110,6 +105,13 @@ interface AXPPermissionGroupDefinition {
     name: string;
     title: string;
     description?: string;
+    /**
+     * Optional parent group name. When set, this group is a **section** under the parent
+     * in the Permissions Editor right panel (not a left-nav root).
+     */
+    parent?: string;
+    /** Optional sort order among sibling sections (lower first). */
+    order?: number;
     permissions: AXPPermissionDefinition[];
 }
 type AXPPermissionDefinition = {
@@ -123,6 +125,12 @@ type AXPPermissionDefinition = {
      * If any required feature is not enabled, this permission will be filtered out.
      */
     requiredFeatures?: string[];
+    /**
+     * Edition / Nx module names this permission belongs to.
+     * Session and role-editor filtering keep the permission when ANY listed module is enabled
+     * (Access/Setup typically list all domain contributors; unique caps list the owner module).
+     */
+    modules?: string[];
 };
 
 interface AXPPermissionLoader {
@@ -130,17 +138,24 @@ interface AXPPermissionLoader {
 }
 declare const AXP_PERMISSION_LOADER: InjectionToken<AXPPermissionLoader>;
 
-/**
- * Data source definition for leaf permissions from {@link AXPPermissionDefinitionService#getGroups}.
- */
-declare class AXPPermissionDefinitionsDataSourceDefinition implements AXPDataSourceDefinitionProvider {
-    private readonly permissionDefinitionService;
-    items(): Promise<AXPDataSourceDefinition[]>;
-}
-
+type AXPPermissionGroupAddOptions = {
+    /** Parent group name — makes this group a right-panel section under that root. */
+    parent?: string;
+    /** Sort order among sibling sections (lower first). */
+    order?: number;
+};
+type AXPPermissionAddOptions = {
+    /** Required feature flags for this permission to appear. */
+    requiredFeatures?: string[];
+    /**
+     * Edition module names this permission belongs to.
+     * Availability uses ANY-match against the tenant application edition modules.
+     */
+    modules?: string[];
+};
 declare class AXPPermissionDefinitionProviderContext {
     private builders;
-    addGroup(name: string, title: string, description?: string): AXPPermissionDefinitionGroupBuilder;
+    addGroup(name: string, title: string, description?: string, options?: AXPPermissionGroupAddOptions): AXPPermissionDefinitionGroupBuilder;
     getGroupDefinitions(): AXPPermissionGroupDefinition[];
     findGroup(name: string): AXPPermissionDefinitionGroupBuilder | undefined;
     isGroupDefined(name: string): boolean;
@@ -150,47 +165,59 @@ declare class AXPPermissionDefinitionGroupBuilder {
     private _group;
     get group(): AXPPermissionGroupDefinition;
     constructor(context: AXPPermissionDefinitionProviderContext, group: AXPPermissionGroupDefinition);
-    addPermission(name: string, title: string, description?: string, requiredFeatures?: string[]): AXPPermissionDefinitionBuilder;
+    addPermission(name: string, title: string, description?: string, options?: AXPPermissionAddOptions | string[]): AXPPermissionDefinitionBuilder;
     endGroup(): AXPPermissionDefinitionProviderContext;
-    findPermission(path: string): AXPPermissionDefinition | undefined;
-    findGroup(name: string): AXPPermissionDefinitionGroupBuilder | undefined;
+    findPermission(_path: string): AXPPermissionDefinition | undefined;
+    findGroup(_name: string): AXPPermissionDefinitionGroupBuilder | undefined;
 }
 declare class AXPPermissionDefinitionBuilder {
     private groupBuilder;
     private permission;
     constructor(groupBuilder: AXPPermissionDefinitionGroupBuilder, permission: AXPPermissionDefinition);
-    addChild(name: string, title: string, description?: string, requiredFeatures?: string[]): AXPPermissionDefinitionBuilder;
+    addChild(name: string, title: string, description?: string, options?: AXPPermissionAddOptions | string[]): AXPPermissionDefinitionBuilder;
     /**
      * Set required features for this permission.
      * @param features - Array of feature names (e.g., ['PlatformManagement.menu-customization'])
      */
     requireFeatures(...features: string[]): AXPPermissionDefinitionBuilder;
+    /**
+     * Set edition module ownership for this permission (ANY-match for availability).
+     */
+    modules(...moduleNames: string[]): AXPPermissionDefinitionBuilder;
     endPermission(): AXPPermissionDefinitionGroupBuilder;
 }
 
 interface AXPPermissionDefinitionProvider {
     define(context: AXPPermissionDefinitionProviderContext): Promise<void>;
 }
+/** Resolves edition module names for a permission key (product map). */
+type AXPPermissionModulesResolver = (permissionKey: string) => readonly string[];
 declare const AXP_PERMISSION_DEFINITION_PROVIDER: InjectionToken<AXPPermissionDefinitionProvider[]>;
+declare const AXP_PERMISSION_MODULES_RESOLVER: InjectionToken<AXPPermissionModulesResolver>;
 declare class AXPPermissionDefinitionService {
     private providers;
+    private modulesResolver;
     private sessionService;
     private cache;
+    /** Invalidates cache when the session edition modules/features change (e.g. app switch). */
+    private cacheAvailabilityKey;
+    private buildAvailabilityKey;
     private load;
+    /** Attach modules[] from the product resolver when providers omitted them. */
+    private enrichGroupModules;
+    private enrichPermissionModules;
     /**
-     * Filter permissions based on required features.
-     * Removes permissions that have required features that are not enabled.
-     */
-    private filterByFeatures;
-    /**
-     * Recursively filter permissions and their children based on required features.
+     * Filter permissions by edition modules (ANY-match) and required features.
+     * Keeps parent groups that still have at least one child section with permissions.
      */
+    private filterUnavailablePermissions;
     private filterPermissions;
     reload(): Promise<void>;
     getGroups(): Promise<AXPPermissionGroupDefinition[]>;
     getPermissions(): Promise<AXPPermissionDefinition[]>;
     getGroup(name: string): Promise<AXPPermissionGroupDefinition | null>;
     getPermission(name: string): Promise<AXPPermissionDefinition | null>;
+    private findPermissionRecursive;
     static ɵfac: i0.ɵɵFactoryDeclaration<AXPPermissionDefinitionService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<AXPPermissionDefinitionService>;
 }
@@ -200,7 +227,8 @@ interface AXPBaseCredentials {
     [key: string]: string;
 }
 interface AXPTokenResult {
-    accessToken: string;
+    /** Present only for non-browser clients; SPA uses HttpOnly cookies. */
+    accessToken?: string;
     expiresIn?: string | null;
     refreshToken?: string;
     idToken?: string;
@@ -210,10 +238,11 @@ interface AXPTokenResult {
 interface AXPSignInResult {
     succeed: boolean;
     data?: {
-        accessToken: string;
+        /** Present only for non-browser clients; SPA uses HttpOnly cookies. */
+        accessToken?: string;
         idToken?: string | null;
         expiresIn?: string | null;
-        refreshToken: string;
+        refreshToken?: string;
         user: AXPUser;
         tenant?: AXPTenant | null;
         application?: AXPApplication | null;
@@ -228,10 +257,10 @@ declare abstract class AXPAuthStrategy {
         [key: string]: any;
     }): Promise<AXPSignInResult | void>;
 }
+/**
+ * Client-persisted session metadata. Tokens are never stored here — they live in HttpOnly cookies.
+ */
 interface AXPSessionData {
-    accessToken: string;
-    refreshToken: string;
-    idToken: string | null;
     strategy: string;
     user?: AXPUser | null;
     tenant?: AXPTenant | null;
@@ -239,6 +268,8 @@ interface AXPSessionData {
     expiresIn?: string | null;
     /** When true, the client lock overlay stays active until PIN/password unlock or sign-out. */
     locked?: boolean;
+    /** True when the server issued HttpOnly auth cookies for this session. */
+    cookieSession?: boolean;
 }
 
 interface AXPFeature {
@@ -296,6 +327,15 @@ interface AXPFeatureChecker {
  */
 declare const AXP_FEATURE_CHECKER: InjectionToken<AXPFeatureChecker>;
 
+/**
+ * Exposes `feature.check(...)` / `feature.checkAny(...)` for entity expressions
+ * (e.g. `schema.visible: '{{ feature.check("Module:Feature:X") }}'`).
+ */
+declare class AXPFeatureEvaluatorScopeProvider implements AXPExpressionEvaluatorScopeProvider {
+    protected sessionService: AXPSessionService;
+    provide(context: AXPExpressionEvaluatorScopeProviderContext): Promise<void>;
+}
+
 declare class AXPSessionService {
     private eventService;
     private authStrategyRegistry;
@@ -308,6 +348,9 @@ declare class AXPSessionService {
     private readonly permissionChecker;
     private readonly featureChecker;
     private readonly accessPolicyCache;
+    /** In-memory catalog caches — shared by guards and chooser UI (one List* per bind). */
+    private tenantsListCache;
+    private applicationsListCache;
     private status;
     readonly status$: Observable<AXPSessionStatus>;
     private isLoading;
@@ -318,11 +361,9 @@ declare class AXPSessionService {
     private currentTenantSubject;
     readonly tenant$: Observable<AXPTenant | null>;
     get tenant(): AXPTenant | null;
-    get tenants$(): Observable<AXPTenant[]>;
     private currentApplicationSubject;
     readonly application$: Observable<AXPApplication | null>;
     get application(): AXPApplication | null;
-    get applications$(): Observable<AXPApplication[]>;
     private permissionsSubject;
     readonly permissions$: Observable<never[] | string[]>;
     get permissions(): AXPPermission[];
@@ -330,21 +371,50 @@ declare class AXPSessionService {
     readonly features$: Observable<never[] | AXPFeature[]>;
     get features(): AXPFeature[];
     readonly isAuthenticated$: Observable<boolean>;
+    /** Synchronous counterpart to {@link isAuthenticated$}. */
+    get isAuthenticated(): boolean;
     readonly isAuthenticatedWithLoading$: Observable<boolean>;
     readonly isAuthorized$: Observable<boolean>;
+    /** Synchronous counterpart to {@link isAuthorized$}. */
+    get isAuthorized(): boolean;
+    /**
+     * Tenant and application are selected and permissions are loaded.
+     * Gate app-scoped runtime work (entity queries, inbox, activity).
+     */
+    get isReadyForAppScopedApi(): boolean;
+    readonly isReadyForAppScopedApi$: Observable<boolean>;
+    /** Tenant list for the signed-in user; skips the API when there is no cookie session. */
+    readonly tenants$: Observable<AXPTenant[]>;
+    /** Application list for the current tenant; skips the API when there is no cookie session. */
+    readonly applications$: Observable<AXPApplication[]>;
     /** Waits for session restore to finish, then emits whether the session is fully authorized. */
     readonly isAuthorizedWithLoading$: Observable<boolean>;
     restoreSession(): Promise<void>;
     signin(credentials: AXPBaseCredentials): Promise<void>;
     register(credentials: AXPBaseCredentials): Promise<void>;
     private applySignInResult;
+    /**
+     * Clears the selected application so the user must pick one (app chooser).
+     * Keeps tenant/user/token intact and demotes status to Authenticated.
+     */
+    clearApplicationSelection(): void;
     updateToken(params?: {
         [key: string]: any;
     }): Promise<void>;
     signout(): Promise<void>;
-    refreshToken(): Promise<any>;
+    refreshToken(): Promise<boolean>;
+    /**
+     * Auth:GetAccessPolicy is only meaningful with tenant + application bound.
+     * Skipping incomplete contexts cuts 2 redundant calls on the common login path.
+     */
+    private reloadAccessPolicyIfReady;
     private loadPermissions;
     private loadFeatures;
+    /** Shared ListTenants — used by guards and {@link tenants$}. */
+    getTenantsList(): Promise<AXPTenant[]>;
+    /** Shared ListApplications — used by guards and {@link applications$}. */
+    getApplicationsList(): Promise<AXPApplication[]>;
+    private clearCatalogCaches;
     signInComplete(): Promise<void>;
     /** Tenant + application must be bound before menu, permissions, and features are fully valid. */
     private hasCompleteSessionContext;
@@ -353,12 +423,14 @@ declare class AXPSessionService {
      * Authorized only once tenant and application are selected and loaders have finished.
      */
     private syncSessionAuthorization;
-    setSession(tokens: Partial<AXPSessionData>): void;
+    setSession(partial: Partial<AXPSessionData>): void;
     /** Whether the client lock overlay should remain active after reload. */
     isLocked(): boolean;
     /** Persists client lock state inside {@link AXPSessionService.SESSION_KEY}. */
     setLocked(locked: boolean): void;
     setStrategy(strategy: string): void;
+    /** Session strategy, or pending OAuth strategy left for the callback page. */
+    private resolveStrategyName;
     getSessionData(): AXPSessionData | null;
     private clearSession;
     /** Keeps in-memory subjects aligned with persisted session (e.g. after user switch). */
@@ -371,9 +443,19 @@ declare class AXPSessionService {
      * Module names can be provided in PascalCase (e.g., 'SecurityManagement') or kebab-case (e.g., 'security-management').
      */
     isModuleEnabled(moduleName: string): boolean;
+    /**
+     * Access tokens are HttpOnly and not readable from JS.
+     * Use {@link hasSessionCredentials} for auth gating.
+     */
     getToken(): string | undefined;
+    /** True when the SPA has an active cookie-backed session. */
+    hasSessionCredentials(): boolean;
     getContext(): AXPSessionContext;
     private invalidateAccessPolicyCache;
+    private isApplicationContextUpdate;
+    private isTenantContextUpdate;
+    private resolveApplicationAfterUpdate;
+    private isAuthenticatedStatus;
     static ɵfac: i0.ɵɵFactoryDeclaration<AXPSessionService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<AXPSessionService>;
 }
@@ -411,7 +493,6 @@ declare const AXPAuthGuard: CanActivateFn;
 interface AXPAuthModuleConfigs {
     strategies: (new () => AXPAuthStrategy)[];
 }
-declare function initializeAppState(service: AXPSessionService): () => Promise<void>;
 declare class AXPAuthModule {
     static forRoot(configs?: AXPAuthModuleConfigs): ModuleWithProviders<AXPAuthModule>;
     static forChild(configs?: AXPAuthModuleConfigs): ModuleWithProviders<AXPAuthModule>;
@@ -483,12 +564,12 @@ interface PlatformAuthTokenResponseDto {
     tenant?: {
         id: string;
         name?: string;
-        title?: string;
+        title?: AXPMultiLanguageString;
     } | null;
     application?: {
         id: string;
         name?: string;
-        title?: string;
+        title?: AXPMultiLanguageString;
     } | null;
 }
 declare function platformOAuthSessionUpdateParams(params: {
@@ -499,14 +580,121 @@ declare function platformOAuthSessionUpdateParams(params: {
     tenantId?: string;
     applicationId?: string;
 };
-declare function shouldPlatformOAuthBindSession(accessToken: string | undefined, params: {
+declare function shouldPlatformOAuthBindSession(hasCredentials: boolean, params: {
     [key: string]: unknown;
 }): boolean;
-declare function postPlatformOAuthSessionUpdate(baseUrl: string, accessToken: string, params: {
-    [key: string]: unknown;
-}): Promise<AXPSignInResult>;
 declare function toPlatformOAuthSignInResult(result: PlatformAuthTokenResponseDto, context?: Partial<AXPSessionContext>): AXPSignInResult;
 
+interface AXPPlatformOAuthDiscoveryDocument {
+    issuer?: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    jwks_uri?: string;
+}
+interface AXPPlatformOAuthClientConfig {
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+}
+declare const AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID = "acorex";
+declare const AXP_DEFAULT_PLATFORM_OAUTH_SCOPE = "openid profile email offline_access";
+declare function resolvePlatformOAuthIssuer(baseUrl?: string): string;
+declare function resolvePlatformOAuthRedirectUri(): string;
+declare function resolvePlatformOAuthClientConfig(authConfig?: {
+    clientId?: string;
+    client_id?: string;
+    redirectUri?: string;
+    scope?: string;
+} | null): AXPPlatformOAuthClientConfig;
+declare function fetchPlatformOAuthDiscoveryDocument(issuer: string): Promise<AXPPlatformOAuthDiscoveryDocument>;
+declare function resolvePlatformOAuthAuthorizeEndpoint(issuer: string, discovery?: AXPPlatformOAuthDiscoveryDocument | null): string;
+declare function resolvePlatformOAuthTokenEndpoint(issuer: string, discovery?: AXPPlatformOAuthDiscoveryDocument | null): string;
+
+interface AXPAuthLocalSignInMethod {
+    id: string;
+    title: string;
+    protocol: 'password' | 'otp' | 'custom';
+    enabled: boolean;
+}
+/** Public IdP row — never includes secrets. `id` is used as OAuth `acr_values`. */
+interface AXPAuthIdentityProvider {
+    id: string;
+    title: string;
+    icon?: string;
+    priority: number;
+}
+interface AXPAuthListProvidersResponse {
+    localMethods: AXPAuthLocalSignInMethod[];
+    identityProviders: AXPAuthIdentityProvider[];
+}
+declare function asAuthListProvidersResponse(payload: unknown): AXPAuthListProvidersResponse;
+declare function findIdentityProvider(payload: unknown, id: string): AXPAuthIdentityProvider | undefined;
+
+interface PlatformAuthUpdateSessionInput {
+    tenantId?: string;
+    applicationId?: string;
+    tenant?: AXPTenant;
+    application?: AXPApplication;
+}
+declare class AXPPlatformAuthRuntimeService {
+    private readonly commandService;
+    private readonly queryService;
+    private readonly sessionService;
+    private listProvidersCache;
+    private listProvidersInFlight;
+    logout(_refreshToken?: string | null): Promise<void>;
+    refresh(_refreshToken?: string): Promise<PlatformAuthTokenResponseDto>;
+    updateSession(input: PlatformAuthUpdateSessionInput): Promise<PlatformAuthTokenResponseDto>;
+    listProviders(): Promise<AXPAuthListProvidersResponse>;
+    clearListProvidersCache(): void;
+    private executeCommand;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AXPPlatformAuthRuntimeService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AXPPlatformAuthRuntimeService>;
+}
+
+/**
+ * Best-effort plain string for thrown {@link Error} messages from command results (no i18n lookup).
+ */
+declare function commandMessageTextForError(value: AXPMultiLanguageString | undefined | null): string;
+
+/**
+ * Persisted while an authorization-code redirect is in flight.
+ * `restoreSession` clears partial `AXP_SESSION` (no user / no cookies) — this key
+ * must survive so `/auth/oauth-callback` can resolve the strategy.
+ */
+declare const AXP_OAUTH_PENDING_STRATEGY_KEY = "axp_oauth_pending_strategy";
+/** Set by platform OAuth strategies before redirect (PKCE). */
+declare const AXP_OAUTH_PKCE_VERIFIER_KEY = "pkce_code_verifier";
+declare function setOAuthPendingStrategy(strategy: string): void;
+declare function getOAuthPendingStrategy(): string | null;
+declare function clearOAuthPendingStrategy(): void;
+declare function isOAuthRedirectInFlight(): boolean;
+
+/** Debug namespace for auth session diagnostics. Filter console with `[AXP:AUTH-SESSION]`. */
+declare const AUTH_SESSION_TRACE_NS = "AUTH-SESSION";
+declare const AUTH_SESSION_TRACE_TITLE: {
+    /** Sign-in / register / sign-out lifecycle. */
+    readonly Lifecycle: "Lifecycle";
+    /** Cookie session restore + refresh. */
+    readonly Restore: "Restore";
+    /** Tenant / application bind via UpdateSession. */
+    readonly Workspace: "Workspace";
+    /** Auth:GetAccessPolicy load (permissions + features). */
+    readonly AccessPolicy: "AccessPolicy";
+    /** ListTenants / ListApplications. */
+    readonly Catalog: "Catalog";
+    /** Route guards (login, tenant-chooser, app-chooser). */
+    readonly Guard: "Guard";
+};
+
+declare function traceAuthLifecycle(message: string, data?: () => Record<string, unknown>): void;
+declare function traceAuthLifecycleError(message: string, data?: () => Record<string, unknown>): void;
+declare function traceAuthRestore(message: string, data?: () => Record<string, unknown>): void;
+declare function traceAuthWorkspace(message: string, data?: () => Record<string, unknown>): void;
+declare function traceAuthAccessPolicy(message: string, data?: () => Record<string, unknown>): void;
+declare function traceAuthCatalog(message: string, data?: () => Record<string, unknown>): void;
+declare function traceAuthGuard(message: string, data?: () => Record<string, unknown>): void;
+
 /**
  * Narrow API for refreshing cached user avatar display data.
  * Implemented via auth-gateway; keeps auth free of layout/components imports (avoids circular deps).
@@ -757,5 +945,56 @@ declare abstract class AXPLoginChallengeProvider {
  */
 declare const AXP_LOGIN_CHALLENGE_PROVIDER: InjectionToken<AXPLoginChallengeProvider>;
 
-export { AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDefinitionsDataSourceDefinition, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthDataSourceKeys, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, PkceUtil, TimeUtil, initializeAppState, platformOAuthSessionUpdateParams, postPlatformOAuthSessionUpdate, shouldPlatformOAuthBindSession, toPlatformOAuthSignInResult };
-export type { AXPAccessPolicyCachePort, AXPApplication, AXPApplicationLoader, AXPAuthModuleConfigs, AXPBaseCredentials, AXPChallengeCheckResult, AXPChallengeContentType, AXPEdition, AXPFeature, AXPFeatureChecker, AXPFeatureLoader, AXPLoginChallengeData, AXPPermission, AXPPermissionChecker, AXPPermissionDefinition, AXPPermissionDefinitionProvider, AXPPermissionGroupDefinition, AXPPermissionLoader, AXPSessionData, AXPSignInResult, AXPTenant, AXPTenantLoader, AXPTokenResult, AXPUser, AXPUserAvatarCachePort, PlatformAuthTokenResponseDto };
+/** Protocol family for a sign-in method. */
+type AXPSignInMethodProtocol = 'password' | 'otp' | 'oidc' | 'saml' | 'ldap' | 'custom';
+/** One interactive step in a multi-factor / challenge flow. */
+type AXPSignInMethodStepKind = 'credentials' | 'otp' | 'captcha' | 'external-redirect' | 'complete';
+interface AXPSignInMethodDescriptor {
+    /** Stable id, e.g. `password`, `oidc:google`, `saml:okta-hr`. */
+    readonly id: string;
+    readonly title: string;
+    readonly protocol: AXPSignInMethodProtocol;
+    readonly enabled: boolean;
+    /** Lower = higher on the login page. */
+    readonly priority?: number;
+    readonly icon?: string;
+}
+interface AXPSignInMethodStep {
+    readonly kind: AXPSignInMethodStepKind;
+    readonly challengeId?: string;
+    readonly message?: string;
+    readonly redirectUrl?: string;
+}
+interface AXPSignInMethodStartResult {
+    readonly status: 'completed' | 'continue' | 'redirect';
+    readonly step?: AXPSignInMethodStep;
+    /** When status is completed, session cookies are already set by the server. */
+    readonly userId?: string;
+}
+/**
+ * Pluggable sign-in method. Multiple methods can be registered and offered at once.
+ * Session remember/refresh live in {@link AXPSessionService}; methods only prove identity.
+ */
+declare abstract class AXPSignInMethod {
+    abstract get descriptor(): AXPSignInMethodDescriptor;
+    /** Begin or continue the method flow. */
+    abstract start(input: Record<string, unknown>): Promise<AXPSignInMethodStartResult>;
+    /** Submit a challenge / OTP / captcha step. */
+    abstract continue(step: AXPSignInMethodStep, input: Record<string, unknown>): Promise<AXPSignInMethodStartResult>;
+}
+
+/**
+ * Registry of enabled sign-in methods for the login UI.
+ * Methods are independent of session refresh/remember (owned by session service).
+ */
+declare class AXPSignInMethodRegistry {
+    private readonly methods;
+    register(...methods: AXPSignInMethod[]): void;
+    get(id: string): AXPSignInMethod | undefined;
+    listEnabled(): AXPSignInMethodDescriptor[];
+    static ɵfac: i0.ɵɵFactoryDeclaration<AXPSignInMethodRegistry, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AXPSignInMethodRegistry>;
+}
+
+export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PENDING_STRATEGY_KEY, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, commandMessageTextForError, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace };
+export type { AXPAccessPolicyCachePort, AXPApplication, AXPApplicationLoader, AXPAuthIdentityProvider, AXPAuthListProvidersResponse, AXPAuthLocalSignInMethod, AXPAuthModuleConfigs, AXPBaseCredentials, AXPChallengeCheckResult, AXPChallengeContentType, AXPEdition, AXPFeature, AXPFeatureChecker, AXPFeatureLoader, AXPLoginChallengeData, AXPPermission, AXPPermissionAddOptions, AXPPermissionChecker, AXPPermissionDefinition, AXPPermissionDefinitionProvider, AXPPermissionGroupAddOptions, AXPPermissionGroupDefinition, AXPPermissionLoader, AXPPermissionModulesResolver, AXPPlatformOAuthClientConfig, AXPPlatformOAuthDiscoveryDocument, AXPSessionData, AXPSignInMethodDescriptor, AXPSignInMethodProtocol, AXPSignInMethodStartResult, AXPSignInMethodStep, AXPSignInMethodStepKind, AXPSignInResult, AXPTenant, AXPTenantLoader, AXPTokenResult, AXPUser, AXPUserAvatarCachePort, PlatformAuthTokenResponseDto, PlatformAuthUpdateSessionInput };