@acorex-platform/framework-client 0.0.18 → 0.0.21

package/fesm2022/acorex-platform-framework-client-auth.mjs

@@ -1,10 +1,11 @@
 import * as i0 from '@angular/core';
-import { InjectionToken, Injector, Injectable, signal, inject, Input, Directive, provideAppInitializer, Optional, Inject, NgModule, input, output, Component } from '@angular/core';
-import { map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, from, combineLatest, first } from 'rxjs';
-import { AXPBroadcastEventService, AXP_SESSION_SERVICE } from '@acorex-platform/framework-client/core';
+import { InjectionToken, Injector, Injectable, signal, inject, Input, Directive, Optional, Inject, NgModule, input, output, ChangeDetectionStrategy, Component } from '@angular/core';
+import { map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, distinctUntilChanged, of, from, combineLatest, first } from 'rxjs';
+import { AXPDebugService, AXPBroadcastEventService, AXP_SESSION_SERVICE, AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER, provideAppStartUpTask, AXP_APP_STARTUP_PRIORITY } from '@acorex-platform/framework-client/core';
 import { isEmpty } from 'lodash-es';
-import { AXPWidgetsCatalog } from '@acorex-platform/framework-shared/core';
-import { AXDataSource } from '@acorex/cdk/common';
+import { AXPCommandService, AXPQueryService } from '@acorex-platform/framework-client/runtime';
+import { AUTH_LOGOUT_DEFAULT, AUTH_REFRESH_DEFAULT, AUTH_UPDATE_SESSION_DEFAULT, AUTH_LIST_PROVIDERS_DEFAULT } from '@acorex-platform/framework-shared/runtime';
+import { runtimeQueryPayloadData, runtimeCommandPayloadData } from '@acorex-platform/framework-shared/core';
 
 const AXP_APPLICATION_LOADER = new InjectionToken('AXP_APPLICATION_LOADER', {
     providedIn: 'root',
@@ -39,13 +40,6 @@ class AXPApplicationDefaultLoader {
     }
 }
 
-//#region ---- Datasource keys ----
-/** Platform auth datasource registry names. */
-const AXPPlatformAuthDataSourceKeys = {
-    PermissionDefinitions: 'platform-permission-definitions',
-};
-//#endregion
-
 class AXPUnauthorizedError extends Error {
     constructor(message, data) {
         super(message);
@@ -111,6 +105,59 @@ class AXPTenantDefaultLoader {
     }
 }
 
+/** Debug namespace for auth session diagnostics. Filter console with `[AXP:AUTH-SESSION]`. */
+const AUTH_SESSION_TRACE_NS = 'AUTH-SESSION';
+//#region ----- Trace area titles -----
+const AUTH_SESSION_TRACE_TITLE = {
+    /** Sign-in / register / sign-out lifecycle. */
+    Lifecycle: 'Lifecycle',
+    /** Cookie session restore + refresh. */
+    Restore: 'Restore',
+    /** Tenant / application bind via UpdateSession. */
+    Workspace: 'Workspace',
+    /** Auth:GetAccessPolicy load (permissions + features). */
+    AccessPolicy: 'AccessPolicy',
+    /** ListTenants / ListApplications. */
+    Catalog: 'Catalog',
+    /** Route guards (login, tenant-chooser, app-chooser). */
+    Guard: 'Guard',
+};
+//#endregion
+
+//#region ----- Lifecycle -----
+function traceAuthLifecycle(message, data) {
+    AXPDebugService.instance?.trace(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Lifecycle, message, data);
+}
+function traceAuthLifecycleError(message, data) {
+    AXPDebugService.instance?.error(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Lifecycle, message, data);
+}
+//#endregion
+//#region ----- Restore -----
+function traceAuthRestore(message, data) {
+    AXPDebugService.instance?.trace(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Restore, message, data);
+}
+//#endregion
+//#region ----- Workspace -----
+function traceAuthWorkspace(message, data) {
+    AXPDebugService.instance?.trace(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Workspace, message, data);
+}
+//#endregion
+//#region ----- Access policy -----
+function traceAuthAccessPolicy(message, data) {
+    AXPDebugService.instance?.trace(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.AccessPolicy, message, data);
+}
+//#endregion
+//#region ----- Catalog -----
+function traceAuthCatalog(message, data) {
+    AXPDebugService.instance?.trace(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Catalog, message, data);
+}
+//#endregion
+//#region ----- Guards -----
+function traceAuthGuard(message, data) {
+    AXPDebugService.instance?.trace(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Guard, message, data);
+}
+//#endregion
+
 class AXPAuthStrategyRegistryService {
     constructor(injector) {
         this.strategies = new Map();
@@ -128,10 +175,10 @@ class AXPAuthStrategyRegistryService {
     get(strategyKey) {
         return this.strategies.get(strategyKey);
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPAuthStrategyRegistryService, deps: [{ token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
-    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPAuthStrategyRegistryService, providedIn: 'root' }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPAuthStrategyRegistryService, deps: [{ token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPAuthStrategyRegistryService, providedIn: 'root' }); }
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPAuthStrategyRegistryService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPAuthStrategyRegistryService, decorators: [{
             type: Injectable,
             args: [{
                     providedIn: 'root'
@@ -154,7 +201,8 @@ class AXPFeatureDirective {
     constructor(templateRef, viewContainer) {
         this.templateRef = templateRef;
         this.viewContainer = viewContainer;
-        this.hasView = signal(false, ...(ngDevMode ? [{ debugName: "hasView" }] : /* istanbul ignore next */ []));
+        this.hasView = signal(false, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "hasView" }] : /* istanbul ignore next */ []));
         this.sessionService = inject(AXPSessionService);
     }
     set feature(featureKeys) {
@@ -188,10 +236,10 @@ class AXPFeatureDirective {
     ngOnDestroy() {
         this.subscription?.unsubscribe();
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPFeatureDirective, deps: [{ token: i0.TemplateRef }, { token: i0.ViewContainerRef }], target: i0.ɵɵFactoryTarget.Directive }); }
-    static { this.ɵdir = i0.ɵɵngDeclareDirective({ minVersion: "14.0.0", version: "21.2.9", type: AXPFeatureDirective, isStandalone: false, selector: "[feature]", inputs: { feature: "feature", featureElse: "featureElse" }, ngImport: i0 }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPFeatureDirective, deps: [{ token: i0.TemplateRef }, { token: i0.ViewContainerRef }], target: i0.ɵɵFactoryTarget.Directive }); }
+    static { this.ɵdir = i0.ɵɵngDeclareDirective({ minVersion: "14.0.0", version: "22.0.8", type: AXPFeatureDirective, isStandalone: false, selector: "[feature]", inputs: { feature: "feature", featureElse: "featureElse" }, ngImport: i0 }); }
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPFeatureDirective, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPFeatureDirective, decorators: [{
             type: Directive,
             args: [{
                     selector: '[feature]',
@@ -225,6 +273,36 @@ const AXPFeatureGuard = (route, state) => {
  */
 const AXP_FEATURE_CHECKER = new InjectionToken('AXP_FEATURE_CHECKER');
 
+//#region ----- Imports -----
+//#endregion
+//#region ----- Feature Evaluator Scope Provider -----
+/**
+ * Exposes `feature.check(...)` / `feature.checkAny(...)` for entity expressions
+ * (e.g. `schema.visible: '{{ feature.check("Module:Feature:X") }}'`).
+ */
+class AXPFeatureEvaluatorScopeProvider {
+    constructor() {
+        this.sessionService = inject(AXPSessionService);
+    }
+    async provide(context) {
+        context.addScope('feature', {
+            /**
+             * True when every listed feature key is enabled for the session.
+             */
+            check: (...features) => {
+                return this.sessionService.isFeatureEnabled(...features);
+            },
+            /**
+             * True when any listed feature key is enabled for the session.
+             */
+            checkAny: (...features) => {
+                return features.some((f) => this.sessionService.isFeatureEnabled(f));
+            },
+        });
+    }
+}
+//#endregion
+
 const AXP_PERMISSION_LOADER = new InjectionToken('AXP_PERMISSION_LOADER', {
     providedIn: 'root',
     factory: () => {
@@ -247,6 +325,33 @@ const AXP_PERMISSION_CHECKER = new InjectionToken('AXP_PERMISSION_CHECKER');
 const AXP_ACCESS_POLICY_CACHE_PORT = new InjectionToken('AXP_ACCESS_POLICY_CACHE_PORT');
 //#endregion
 
+//#region ---- OAuth pending strategy (survives restoreSession) ----
+/**
+ * Persisted while an authorization-code redirect is in flight.
+ * `restoreSession` clears partial `AXP_SESSION` (no user / no cookies) — this key
+ * must survive so `/auth/oauth-callback` can resolve the strategy.
+ */
+const AXP_OAUTH_PENDING_STRATEGY_KEY = 'axp_oauth_pending_strategy';
+/** Set by platform OAuth strategies before redirect (PKCE). */
+const AXP_OAUTH_PKCE_VERIFIER_KEY = 'pkce_code_verifier';
+function setOAuthPendingStrategy(strategy) {
+    const trimmed = strategy?.trim();
+    if (!trimmed) {
+        return;
+    }
+    localStorage.setItem(AXP_OAUTH_PENDING_STRATEGY_KEY, trimmed);
+}
+function getOAuthPendingStrategy() {
+    return localStorage.getItem(AXP_OAUTH_PENDING_STRATEGY_KEY)?.trim() || null;
+}
+function clearOAuthPendingStrategy() {
+    localStorage.removeItem(AXP_OAUTH_PENDING_STRATEGY_KEY);
+}
+function isOAuthRedirectInFlight() {
+    return !!localStorage.getItem(AXP_OAUTH_PKCE_VERIFIER_KEY) || !!getOAuthPendingStrategy();
+}
+//#endregion
+
 class AXPSessionService {
     constructor() {
         this.eventService = inject(AXPBroadcastEventService);
@@ -259,6 +364,9 @@ class AXPSessionService {
         this.permissionChecker = inject(AXP_PERMISSION_CHECKER, { optional: true });
         this.featureChecker = inject(AXP_FEATURE_CHECKER, { optional: true });
         this.accessPolicyCache = inject(AXP_ACCESS_POLICY_CACHE_PORT, { optional: true });
+        /** In-memory catalog caches — shared by guards and chooser UI (one List* per bind). */
+        this.tenantsListCache = null;
+        this.applicationsListCache = null;
         this.status = new BehaviorSubject(AXPSessionStatus.Unauthenticated);
         this.status$ = this.status.asObservable().pipe(shareReplay(1));
         // Add loading state to prevent premature redirects
@@ -274,10 +382,7 @@ class AXPSessionService {
         this.permissions$ = this.permissionsSubject.asObservable().pipe(shareReplay(1), defaultIfEmpty([]));
         this.featuresSubject = new BehaviorSubject([]);
         this.features$ = this.featuresSubject.asObservable().pipe(shareReplay(1), defaultIfEmpty([]));
-        this.isAuthenticated$ = this.status$.pipe(map((status) => {
-            const isAuth = status === AXPSessionStatus.Authenticated || status === AXPSessionStatus.Authorized;
-            return isAuth;
-        }), shareReplay(1));
+        this.isAuthenticated$ = this.status$.pipe(map((status) => this.isAuthenticatedStatus(status)), shareReplay(1));
         // Add a new observable that considers loading state
         this.isAuthenticatedWithLoading$ = this.isLoading$.pipe(switchMap((loading) => {
             if (loading) {
@@ -288,6 +393,24 @@ class AXPSessionService {
             return this.isAuthenticated$;
         }), shareReplay(1));
         this.isAuthorized$ = this.status$.pipe(map((status) => status === AXPSessionStatus.Authorized), shareReplay(1));
+        this.isReadyForAppScopedApi$ = this.isAuthorized$.pipe(map((authorized) => authorized && this.hasSessionCredentials()), distinctUntilChanged(), shareReplay(1));
+        /** Tenant list for the signed-in user; skips the API when there is no cookie session. */
+        this.tenants$ = this.isAuthenticated$.pipe(distinctUntilChanged(), switchMap((authenticated) => {
+            if (!authenticated || !this.hasSessionCredentials()) {
+                return of([]);
+            }
+            return from(this.getTenantsList());
+        }), shareReplay({ bufferSize: 1, refCount: true }));
+        /** Application list for the current tenant; skips the API when there is no cookie session. */
+        this.applications$ = combineLatest([
+            this.isAuthenticated$,
+            this.tenant$,
+        ]).pipe(distinctUntilChanged(([authenticated, tenant], [previousAuthenticated, previousTenant]) => authenticated === previousAuthenticated && tenant?.id === previousTenant?.id), switchMap(([authenticated, tenant]) => {
+            if (!authenticated || !this.hasSessionCredentials() || !tenant?.id) {
+                return of([]);
+            }
+            return from(this.getApplicationsList());
+        }), shareReplay({ bufferSize: 1, refCount: true }));
         /** Waits for session restore to finish, then emits whether the session is fully authorized. */
         this.isAuthorizedWithLoading$ = this.isLoading$.pipe(switchMap((loading) => {
             if (loading) {
@@ -305,48 +428,109 @@ class AXPSessionService {
         this.syncContextSubjectsFromStorage();
         return this.currentTenantSubject.value;
     }
-    get tenants$() {
-        return from(this.tenantLoader.getList(this.getContext()));
-    }
     get application() {
         this.syncContextSubjectsFromStorage();
         return this.currentApplicationSubject.value;
     }
-    get applications$() {
-        return from(this.applicationLoader.getList(this.getContext()));
-    }
     get permissions() {
         return this.permissionsSubject.value ?? [];
     }
     get features() {
         return this.featuresSubject.value ?? [];
     }
+    /** Synchronous counterpart to {@link isAuthenticated$}. */
+    get isAuthenticated() {
+        return this.isAuthenticatedStatus(this.status.value);
+    }
+    /** Synchronous counterpart to {@link isAuthorized$}. */
+    get isAuthorized() {
+        return this.status.value === AXPSessionStatus.Authorized;
+    }
+    /**
+     * Tenant and application are selected and permissions are loaded.
+     * Gate app-scoped runtime work (entity queries, inbox, activity).
+     */
+    get isReadyForAppScopedApi() {
+        return this.isAuthorized && this.hasSessionCredentials();
+    }
     async restoreSession() {
         this.isLoading.next(true);
+        const startedAt = Date.now();
         try {
             const sessionData = this.getSessionData();
-            if (sessionData) {
-                if (sessionData.user) {
-                    this.currentUserSubject.next(sessionData.user);
-                    // Restore tenant and application from session data
-                    if (sessionData.tenant) {
-                        this.currentTenantSubject.next(sessionData.tenant);
-                    }
-                    if (sessionData.application) {
-                        this.currentApplicationSubject.next(sessionData.application);
+            if (!sessionData?.user || !sessionData.cookieSession) {
+                // OAuth code exchange needs `strategy` after redirect. Do not wipe the
+                // pre-login strategy / pending key while PKCE (or pending strategy) exists.
+                if (isOAuthRedirectInFlight()) {
+                    const strategy = sessionData?.strategy || getOAuthPendingStrategy();
+                    if (strategy && sessionData?.strategy !== strategy) {
+                        this.setSession({
+                            strategy,
+                            user: null,
+                            tenant: null,
+                            application: null,
+                            cookieSession: false,
+                        });
                     }
-                    this.status.next(AXPSessionStatus.Authenticated);
-                    await this.loadPermissions();
-                    await this.loadFeatures();
-                    await this.syncSessionAuthorization();
+                    this.status.next(AXPSessionStatus.Unauthorized);
+                    traceAuthRestore('OAuth redirect in flight — kept strategy', () => ({ strategy }));
+                    return;
                 }
+                this.clearSession();
+                this.status.next(AXPSessionStatus.Unauthorized);
+                traceAuthRestore('No cookie session metadata — cleared');
+                return;
             }
-            else {
+            // Validate HttpOnly cookies and rotate tokens before trusting local metadata.
+            const strategyName = sessionData.strategy;
+            const strategy = strategyName ? this.authStrategyRegistry.get(strategyName) : null;
+            if (!strategy) {
+                this.clearSession();
+                this.status.next(AXPSessionStatus.Unauthorized);
+                traceAuthRestore('Strategy missing — cleared', () => ({ strategyName }));
+                return;
+            }
+            // Keep subjects warm for refresh context, but do NOT mark Authenticated yet —
+            // that would trigger settings/chat side-effects while isLoading is still true.
+            this.currentUserSubject.next(sessionData.user);
+            this.currentTenantSubject.next(sessionData.tenant ?? null);
+            this.currentApplicationSubject.next(sessionData.application ?? null);
+            traceAuthRestore('Refreshing cookie session', () => ({
+                userId: sessionData.user?.id,
+                tenantId: sessionData.tenant?.id,
+                applicationId: sessionData.application?.id,
+                strategy: strategyName,
+            }));
+            const refreshResult = await strategy.refreshToken(this.getContext());
+            if (!refreshResult?.succeed || !refreshResult.data?.user) {
+                this.clearSession();
                 this.status.next(AXPSessionStatus.Unauthorized);
+                traceAuthRestore('Refresh failed — cleared');
+                return;
             }
+            // Preserve workspace binding from local metadata when refresh omits it.
+            const merged = {
+                succeed: true,
+                data: {
+                    ...refreshResult.data,
+                    tenant: refreshResult.data.tenant ?? sessionData.tenant ?? null,
+                    application: refreshResult.data.application ?? sessionData.application ?? null,
+                },
+            };
+            await this.applySignInResult(strategyName, merged);
+            traceAuthRestore('Restore complete', () => ({
+                ms: Date.now() - startedAt,
+                status: this.status.value,
+                tenantId: this.tenant?.id,
+                applicationId: this.application?.id,
+            }));
         }
         catch (error) {
+            this.clearSession();
             this.status.next(AXPSessionStatus.Unauthorized);
+            traceAuthRestore('Restore error — cleared', () => ({
+                error: error instanceof Error ? error.message : String(error),
+            }));
         }
         finally {
             this.isLoading.next(false);
@@ -354,33 +538,45 @@ class AXPSessionService {
     }
     async signin(credentials) {
         this.isLoading.next(true);
+        const startedAt = Date.now();
+        traceAuthLifecycle('Sign-in started', () => ({ strategy: credentials.strategy }));
         try {
-            //
-            // this.clearSession();
-            //
             const strategy = this.authStrategyRegistry.get(credentials.strategy);
             if (!strategy) {
                 throw new Error(`Authentication strategy '${credentials.strategy}' is not supported`);
             }
             const result = await strategy.signin(credentials);
-            if (!result)
+            if (!result) {
+                // Redirect / multi-step strategies return void — keep strategy + PKCE metadata.
+                this.status.next(AXPSessionStatus.Unauthenticated);
                 return;
+            }
             if (result?.succeed) {
                 await this.applySignInResult(credentials.strategy, result);
+                traceAuthLifecycle('Sign-in succeeded', () => ({
+                    ms: Date.now() - startedAt,
+                    userId: this.user?.id,
+                    tenantId: this.tenant?.id,
+                    applicationId: this.application?.id,
+                    status: this.status.value,
+                }));
             }
             else {
+                this.clearSession();
                 this.status.next(AXPSessionStatus.Unauthenticated);
                 throw new Error(`Invalid Username or Password`);
             }
         }
         catch (error) {
-            console.error('Signin error:', error);
+            traceAuthLifecycleError('Sign-in failed', () => ({
+                error: error instanceof Error ? error.message : String(error),
+            }));
+            this.clearSession();
             this.status.next(AXPSessionStatus.Unauthenticated);
             throw error;
         }
         finally {
             this.isLoading.next(false);
-            console.log('Signin process completed');
         }
     }
     async register(credentials) {
@@ -399,6 +595,7 @@ class AXPSessionService {
         }
         catch (error) {
             console.error('Register error:', error);
+            this.clearSession();
             this.status.next(AXPSessionStatus.Unauthenticated);
             throw error;
         }
@@ -407,38 +604,72 @@ class AXPSessionService {
         }
     }
     async applySignInResult(strategy, result) {
-        this.clearSession();
+        // Reset client metadata only — do not call clearSession() (that flips status to
+        // Unauthenticated and can trigger logout listeners mid-flow).
+        this.invalidateAccessPolicyCache();
+        this.clearCatalogCaches();
+        this.permissionsSubject.next([]);
+        this.featuresSubject.next([]);
         this.currentUserSubject.next(result.data.user);
         this.setSession({
-            accessToken: result.data.accessToken,
-            refreshToken: result.data.refreshToken,
             strategy,
             user: result.data.user,
             tenant: result.data?.tenant ?? null,
+            // Fresh sign-in tokens omit application; refresh/restore may include it.
             application: result.data?.application ?? null,
             expiresIn: result.data?.expiresIn,
-            idToken: result.data?.idToken ?? null,
             locked: false,
+            cookieSession: true,
         });
-        await this.loadPermissions();
-        await this.loadFeatures();
+        await this.reloadAccessPolicyIfReady('applySignInResult');
         await this.syncSessionAuthorization();
     }
+    /**
+     * Clears the selected application so the user must pick one (app chooser).
+     * Keeps tenant/user/token intact and demotes status to Authenticated.
+     */
+    clearApplicationSelection() {
+        if (!this.application?.id) {
+            return;
+        }
+        this.setSession({ application: null });
+        if (this.user) {
+            this.status.next(AXPSessionStatus.Authenticated);
+        }
+    }
     async updateToken(params) {
         this.isLoading.next(true);
+        const startedAt = Date.now();
+        const isApplicationUpdate = this.isApplicationContextUpdate(params);
+        const isTenantUpdate = this.isTenantContextUpdate(params);
+        traceAuthWorkspace('UpdateSession started', () => ({
+            isTenantUpdate,
+            isApplicationUpdate,
+            tenantId: params?.['tenant']?.id ?? params?.['tenantId'],
+            applicationId: params?.['application']?.id ?? params?.['applicationId'],
+        }));
+        // Pause app-scoped API work while token/context is rebound (avoids 401/403 races).
+        if (this.isAuthorized) {
+            this.status.next(AXPSessionStatus.Authenticated);
+        }
+        if (isTenantUpdate && !isApplicationUpdate) {
+            this.currentApplicationSubject.next(null);
+            this.applicationsListCache = null;
+        }
         try {
-            const strategyName = this.getSessionData()?.strategy;
+            const strategyName = this.resolveStrategyName();
             if (!strategyName) {
                 throw new Error('Strategy not found');
             }
             const strategy = this.authStrategyRegistry.get(strategyName);
             if (!strategy) {
-                throw new Error(`Authentication strategy '${this.getSessionData()?.strategy}' is not supported`);
+                throw new Error(`Authentication strategy '${strategyName}' is not supported`);
             }
             const result = await strategy.updateToken(params);
             if (result?.succeed) {
                 if (params?.['code']) {
                     this.clearSession();
+                    clearOAuthPendingStrategy();
                 }
                 else {
                     this.permissionsSubject.next([]);
@@ -447,19 +678,22 @@ class AXPSessionService {
                 }
                 this.currentUserSubject.next(result.data.user);
                 this.setSession({
-                    accessToken: result.data.accessToken,
-                    refreshToken: result.data.refreshToken,
                     strategy: strategyName,
                     user: result.data.user,
                     tenant: result.data?.tenant ?? null,
-                    application: result.data?.application ?? null,
+                    application: this.resolveApplicationAfterUpdate(result.data?.application ?? null, isApplicationUpdate, isTenantUpdate),
                     expiresIn: result.data?.expiresIn,
-                    idToken: result.data?.idToken ?? null,
                     locked: false,
+                    cookieSession: true,
                 });
-                await this.loadPermissions();
-                await this.loadFeatures();
+                await this.reloadAccessPolicyIfReady('updateToken');
                 await this.syncSessionAuthorization();
+                traceAuthWorkspace('UpdateSession complete', () => ({
+                    ms: Date.now() - startedAt,
+                    status: this.status.value,
+                    tenantId: this.tenant?.id,
+                    applicationId: this.application?.id,
+                }));
             }
             else {
                 this.status.next(AXPSessionStatus.Unauthenticated);
@@ -467,16 +701,23 @@ class AXPSessionService {
             }
         }
         catch (error) {
-            console.error('Update token error:', error);
+            traceAuthLifecycleError('UpdateSession failed', () => ({
+                error: error instanceof Error ? error.message : String(error),
+            }));
+            // Failed workspace bind must not leave a half-authenticated cookie session
+            // (that causes splash restore loops after refresh).
+            if (params?.['code']) {
+                clearOAuthPendingStrategy();
+            }
+            this.clearSession();
             throw error;
         }
         finally {
             this.isLoading.next(false);
-            console.log('Update token process completed');
         }
     }
     async signout() {
-        console.log('Signing out...');
+        traceAuthLifecycle('Sign-out started', () => ({ userId: this.user?.id }));
         this.isLoading.next(true);
         try {
             const sessionData = this.getSessionData();
@@ -489,53 +730,76 @@ class AXPSessionService {
                     catch (error) { }
                 }
             }
-            //
             const userId = this.user?.id;
             this.clearSession();
             this.eventService.publish(AXPSessionStatus.SignedOut, { id: userId });
             this.isLoading.next(false);
             this.status.next(AXPSessionStatus.SignedOut);
+            traceAuthLifecycle('Sign-out complete', () => ({ userId }));
         }
         finally {
             this.isLoading.next(false);
         }
     }
     async refreshToken() {
-        console.log('Refreshing token...');
-        return new Promise(async (resolve, reject) => {
-            const sessionData = this.getSessionData();
-            if (!sessionData || !sessionData?.refreshToken) {
-                console.log('No session data or refresh token found');
-                reject(new Error('No refresh token available'));
-                return;
-            }
-            const strategy = this.authStrategyRegistry.get(sessionData.strategy);
-            if (!strategy) {
-                console.error('Authentication strategy not found:', sessionData.strategy);
-                reject(new Error(`Authentication strategy '${sessionData.strategy}' is not found`));
-                return;
-            }
-            try {
-                const result = await strategy.refreshToken(this.getContext());
-                if (result.succeed) {
-                    console.log('Token refresh successful');
-                    this.setSession(result.data);
-                    resolve(result.data?.accessToken);
-                }
-                else {
-                    console.error('Token refresh failed');
-                    this.clearSession();
-                    this.status.next(AXPSessionStatus.Expired);
-                    reject(new Error('Token refresh failed'));
-                }
-            }
-            catch (error) {
-                console.error('Error during token refresh:', error);
+        const sessionData = this.getSessionData();
+        if (!sessionData?.strategy || !sessionData.cookieSession) {
+            throw new Error('No cookie session available');
+        }
+        const strategy = this.authStrategyRegistry.get(sessionData.strategy);
+        if (!strategy) {
+            throw new Error(`Authentication strategy '${sessionData.strategy}' is not found`);
+        }
+        try {
+            const result = await strategy.refreshToken(this.getContext());
+            if (!result.succeed || !result.data?.user) {
                 this.clearSession();
                 this.status.next(AXPSessionStatus.Expired);
-                reject(error);
+                throw new Error('Token refresh failed');
             }
-        });
+            this.setSession({
+                strategy: sessionData.strategy,
+                user: result.data.user,
+                tenant: result.data.tenant ?? sessionData.tenant ?? null,
+                application: result.data.application ?? sessionData.application ?? null,
+                expiresIn: result.data.expiresIn,
+                cookieSession: true,
+                locked: sessionData.locked === true,
+            });
+            return true;
+        }
+        catch (error) {
+            this.clearSession();
+            this.status.next(AXPSessionStatus.Expired);
+            throw error;
+        }
+    }
+    /**
+     * Auth:GetAccessPolicy is only meaningful with tenant + application bound.
+     * Skipping incomplete contexts cuts 2 redundant calls on the common login path.
+     */
+    async reloadAccessPolicyIfReady(reason) {
+        if (!this.hasCompleteSessionContext()) {
+            this.permissionsSubject.next([]);
+            this.featuresSubject.next([]);
+            traceAuthAccessPolicy('Skipped GetAccessPolicy (incomplete workspace)', () => ({
+                reason,
+                tenantId: this.tenant?.id ?? null,
+                applicationId: this.application?.id ?? null,
+            }));
+            return;
+        }
+        const startedAt = Date.now();
+        await this.loadPermissions();
+        await this.loadFeatures();
+        traceAuthAccessPolicy('GetAccessPolicy loaded', () => ({
+            reason,
+            ms: Date.now() - startedAt,
+            permissionCount: this.permissions.length,
+            featureCount: this.features.length,
+            tenantId: this.tenant?.id,
+            applicationId: this.application?.id,
+        }));
     }
     async loadPermissions() {
         try {
@@ -543,7 +807,9 @@ class AXPSessionService {
             this.permissionsSubject.next(permissions ?? []);
         }
         catch (error) {
-            console.error('Error loading permissions:', error);
+            traceAuthLifecycleError('Load permissions failed', () => ({
+                error: error instanceof Error ? error.message : String(error),
+            }));
             this.permissionsSubject.next([]);
         }
     }
@@ -553,10 +819,62 @@ class AXPSessionService {
             this.featuresSubject.next(features ?? []);
         }
         catch (error) {
-            console.error('Error loading features:', error);
+            traceAuthLifecycleError('Load features failed', () => ({
+                error: error instanceof Error ? error.message : String(error),
+            }));
             this.featuresSubject.next([]);
         }
     }
+    /** Shared ListTenants — used by guards and {@link tenants$}. */
+    async getTenantsList() {
+        if (!this.hasSessionCredentials()) {
+            return [];
+        }
+        const userId = this.user?.id ?? '';
+        if (this.tenantsListCache?.userId === userId) {
+            traceAuthCatalog('Tenants cache hit', () => ({
+                userId,
+                count: this.tenantsListCache.items.length,
+            }));
+            return this.tenantsListCache.items;
+        }
+        const startedAt = Date.now();
+        const items = await this.tenantLoader.getList(this.getContext());
+        this.tenantsListCache = { userId, items };
+        traceAuthCatalog('Tenants fetched', () => ({
+            userId,
+            count: items.length,
+            ms: Date.now() - startedAt,
+        }));
+        return items;
+    }
+    /** Shared ListApplications — used by guards and {@link applications$}. */
+    async getApplicationsList() {
+        if (!this.hasSessionCredentials() || !this.tenant?.id) {
+            return [];
+        }
+        const tenantId = this.tenant.id;
+        if (this.applicationsListCache?.tenantId === tenantId) {
+            traceAuthCatalog('Applications cache hit', () => ({
+                tenantId,
+                count: this.applicationsListCache.items.length,
+            }));
+            return this.applicationsListCache.items;
+        }
+        const startedAt = Date.now();
+        const items = await this.applicationLoader.getList(this.getContext());
+        this.applicationsListCache = { tenantId, items };
+        traceAuthCatalog('Applications fetched', () => ({
+            tenantId,
+            count: items.length,
+            ms: Date.now() - startedAt,
+        }));
+        return items;
+    }
+    clearCatalogCaches() {
+        this.tenantsListCache = null;
+        this.applicationsListCache = null;
+    }
     async signInComplete() {
         // Ensure we have the required data
         if (!this.user) {
@@ -585,21 +903,25 @@ class AXPSessionService {
         }
         this.status.next(AXPSessionStatus.Authenticated);
     }
-    setSession(tokens) {
-        const existing = this.getSessionData() ?? {};
+    setSession(partial) {
+        const existing = this.getSessionData() ?? { strategy: partial.strategy ?? 'user-pass' };
         const sessionData = {
             ...existing,
-            ...tokens,
+            ...partial,
+            strategy: partial.strategy ?? existing.strategy ?? 'user-pass',
         };
-        // Update subjects
-        if (tokens.user) {
-            this.currentUserSubject.next(tokens.user);
+        // Never persist tokens in browser storage — HttpOnly cookies are authoritative.
+        delete sessionData.accessToken;
+        delete sessionData.refreshToken;
+        delete sessionData.idToken;
+        if (partial.user) {
+            this.currentUserSubject.next(partial.user);
         }
-        if ('tenant' in tokens) {
-            this.currentTenantSubject.next(tokens.tenant ?? null);
+        if ('tenant' in partial) {
+            this.currentTenantSubject.next(partial.tenant ?? null);
         }
-        if ('application' in tokens) {
-            this.currentApplicationSubject.next(tokens.application ?? null);
+        if ('application' in partial) {
+            this.currentApplicationSubject.next(partial.application ?? null);
         }
         localStorage.setItem(AXPSessionService.SESSION_KEY, JSON.stringify(sessionData));
     }
@@ -616,9 +938,19 @@ class AXPSessionService {
         this.setSession({ locked });
     }
     setStrategy(strategy) {
+        setOAuthPendingStrategy(strategy);
         const sessionData = this.getSessionData();
-        const newSessionData = { ...sessionData, strategy };
-        this.setSession(newSessionData);
+        // Do not invent a persisted session from strategy alone (pre-login).
+        // That leaves a partial AXP_SESSION and can break splash restore after a failed sign-in.
+        if (!sessionData?.user && !sessionData?.cookieSession) {
+            this.setSession({ strategy, user: null, tenant: null, application: null, cookieSession: false });
+            return;
+        }
+        this.setSession({ ...sessionData, strategy });
+    }
+    /** Session strategy, or pending OAuth strategy left for the callback page. */
+    resolveStrategyName() {
+        return this.getSessionData()?.strategy?.trim() || getOAuthPendingStrategy();
     }
     getSessionData() {
         try {
@@ -638,13 +970,15 @@ class AXPSessionService {
     }
     clearSession() {
         this.invalidateAccessPolicyCache();
+        this.clearCatalogCaches();
+        this.status.next(AXPSessionStatus.Unauthenticated);
         this.currentUserSubject.next(null);
         this.currentTenantSubject.next(null);
         this.currentApplicationSubject.next(null);
         this.permissionsSubject.next([]);
         this.featuresSubject.next([]);
         localStorage.removeItem(AXPSessionService.SESSION_KEY);
-        this.status.next(AXPSessionStatus.Unauthenticated);
+        clearOAuthPendingStrategy();
     }
     /** Keeps in-memory subjects aligned with persisted session (e.g. after user switch). */
     syncContextSubjectsFromStorage() {
@@ -711,9 +1045,16 @@ class AXPSessionService {
         // Module names are stored as features with value: true when enabled
         return this.features.some(f => f.name === normalizedModuleName && f.value === true);
     }
+    /**
+     * Access tokens are HttpOnly and not readable from JS.
+     * Use {@link hasSessionCredentials} for auth gating.
+     */
     getToken() {
-        const sessionData = this.getSessionData();
-        return sessionData?.accessToken;
+        return undefined;
+    }
+    /** True when the SPA has an active cookie-backed session. */
+    hasSessionCredentials() {
+        return this.getSessionData()?.cookieSession === true && this.isAuthenticated;
     }
     getContext() {
         return new AXPSessionContext({
@@ -725,10 +1066,28 @@ class AXPSessionService {
     invalidateAccessPolicyCache() {
         this.accessPolicyCache?.invalidate();
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPSessionService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
-    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPSessionService, providedIn: 'root' }); }
+    isApplicationContextUpdate(params) {
+        return params?.['application'] != null || params?.['applicationId'] != null;
+    }
+    isTenantContextUpdate(params) {
+        return params?.['tenant'] != null || params?.['tenantId'] != null;
+    }
+    resolveApplicationAfterUpdate(fromToken, isApplicationUpdate, isTenantUpdate) {
+        if (isApplicationUpdate) {
+            return fromToken;
+        }
+        if (isTenantUpdate) {
+            return null;
+        }
+        return fromToken;
+    }
+    isAuthenticatedStatus(status) {
+        return status === AXPSessionStatus.Authenticated || status === AXPSessionStatus.Authorized;
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPSessionService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPSessionService, providedIn: 'root' }); }
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPSessionService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPSessionService, decorators: [{
             type: Injectable,
             args: [{
                     providedIn: 'root',
@@ -739,7 +1098,8 @@ class AXPPermissionDirective {
     constructor(templateRef, viewContainer) {
         this.templateRef = templateRef;
         this.viewContainer = viewContainer;
-        this.hasView = signal(false, ...(ngDevMode ? [{ debugName: "hasView" }] : /* istanbul ignore next */ []));
+        this.hasView = signal(false, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "hasView" }] : /* istanbul ignore next */ []));
         this.sessionService = inject(AXPSessionService);
     }
     set permission(permissionKeys) {
@@ -774,10 +1134,10 @@ class AXPPermissionDirective {
     ngOnDestroy() {
         this.subscription?.unsubscribe();
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPPermissionDirective, deps: [{ token: i0.TemplateRef }, { token: i0.ViewContainerRef }], target: i0.ɵɵFactoryTarget.Directive }); }
-    static { this.ɵdir = i0.ɵɵngDeclareDirective({ minVersion: "14.0.0", version: "21.2.9", type: AXPPermissionDirective, isStandalone: false, selector: "[permission]", inputs: { permission: "permission", permissionElse: "permissionElse" }, ngImport: i0 }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionDirective, deps: [{ token: i0.TemplateRef }, { token: i0.ViewContainerRef }], target: i0.ɵɵFactoryTarget.Directive }); }
+    static { this.ɵdir = i0.ɵɵngDeclareDirective({ minVersion: "14.0.0", version: "22.0.8", type: AXPPermissionDirective, isStandalone: false, selector: "[permission]", inputs: { permission: "permission", permissionElse: "permissionElse" }, ngImport: i0 }); }
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPPermissionDirective, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionDirective, decorators: [{
             type: Directive,
             args: [{
                     selector: '[permission]',
@@ -804,26 +1164,37 @@ const AXPPermissionGuard = (route, state) => {
     }));
 };
 
+//#endregion
+//#region ----- Context -----
 class AXPPermissionDefinitionProviderContext {
     constructor() {
         this.builders = new Map();
     }
-    addGroup(name, title, description) {
+    addGroup(name, title, description, options) {
         if (this.isGroupDefined(name)) {
-            return this.findGroup(name);
+            const existing = this.findGroup(name);
+            if (options?.parent && !existing.group.parent) {
+                existing.group.parent = options.parent;
+            }
+            if (options?.order != null && existing.group.order == null) {
+                existing.group.order = options.order;
+            }
+            return existing;
         }
         const group = {
             name,
             title,
             description,
-            permissions: []
+            parent: options?.parent,
+            order: options?.order,
+            permissions: [],
         };
         const builder = new AXPPermissionDefinitionGroupBuilder(this, group);
         this.builders.set(name, builder);
         return builder;
     }
     getGroupDefinitions() {
-        return Array.from(this.builders.values()).map(b => b.group);
+        return Array.from(this.builders.values()).map((b) => b.group);
     }
     findGroup(name) {
         return this.builders.get(name);
@@ -832,6 +1203,8 @@ class AXPPermissionDefinitionProviderContext {
         return this.builders.has(name);
     }
 }
+//#endregion
+//#region ----- Group Builder -----
 class AXPPermissionDefinitionGroupBuilder {
     get group() {
         return this._group;
@@ -840,13 +1213,20 @@ class AXPPermissionDefinitionGroupBuilder {
         this.context = context;
         this._group = group;
     }
-    addPermission(name, title, description, requiredFeatures) {
+    addPermission(name, title, description, options) {
+        const normalized = normalizePermissionAddOptions(options);
+        const existing = this._group.permissions.find((p) => p.name === name);
+        if (existing) {
+            mergePermissionOptions(existing, normalized);
+            return new AXPPermissionDefinitionBuilder(this, existing);
+        }
         const permission = {
             name,
             title,
             description,
             children: [],
-            requiredFeatures
+            requiredFeatures: normalized.requiredFeatures,
+            modules: normalized.modules,
         };
         this._group.permissions.push(permission);
         return new AXPPermissionDefinitionBuilder(this, permission);
@@ -854,25 +1234,34 @@ class AXPPermissionDefinitionGroupBuilder {
     endGroup() {
         return this.context;
     }
-    findPermission(path) {
+    findPermission(_path) {
         return undefined;
     }
-    findGroup(name) {
+    findGroup(_name) {
         return undefined;
     }
 }
+//#endregion
+//#region ----- Permission Builder -----
 class AXPPermissionDefinitionBuilder {
     constructor(groupBuilder, permission) {
         this.groupBuilder = groupBuilder;
         this.permission = permission;
     }
-    addChild(name, title, description, requiredFeatures) {
+    addChild(name, title, description, options) {
+        const normalized = normalizePermissionAddOptions(options);
+        const existing = this.permission.children.find((p) => p.name === name);
+        if (existing) {
+            mergePermissionOptions(existing, normalized);
+            return this;
+        }
         const permission = {
             name,
             title,
             description,
             children: [],
-            requiredFeatures
+            requiredFeatures: normalized.requiredFeatures,
+            modules: normalized.modules,
         };
         this.permission.children.push(permission);
         return this;
@@ -885,83 +1274,142 @@ class AXPPermissionDefinitionBuilder {
         this.permission.requiredFeatures = features;
         return this;
     }
+    /**
+     * Set edition module ownership for this permission (ANY-match for availability).
+     */
+    modules(...moduleNames) {
+        this.permission.modules = moduleNames;
+        return this;
+    }
     endPermission() {
         return this.groupBuilder;
     }
 }
+//#endregion
+//#region ----- Helpers -----
+function normalizePermissionAddOptions(options) {
+    if (!options) {
+        return {};
+    }
+    // Legacy: 4th argument was `requiredFeatures: string[]`
+    if (Array.isArray(options)) {
+        return { requiredFeatures: options };
+    }
+    return options;
+}
+function mergePermissionOptions(target, options) {
+    if (options.requiredFeatures?.length) {
+        const set = new Set([...(target.requiredFeatures ?? []), ...options.requiredFeatures]);
+        target.requiredFeatures = Array.from(set);
+    }
+    if (options.modules?.length) {
+        const set = new Set([...(target.modules ?? []), ...options.modules]);
+        target.modules = Array.from(set);
+    }
+}
+//#endregion
 
 const AXP_PERMISSION_DEFINITION_PROVIDER = new InjectionToken('AXP_PERMISSION_DEFINITION_PROVIDER', {
     providedIn: 'root',
     factory: () => {
         return [];
-    }
+    },
 });
+const AXP_PERMISSION_MODULES_RESOLVER = new InjectionToken('AXP_PERMISSION_MODULES_RESOLVER');
 class AXPPermissionDefinitionService {
     constructor() {
         this.providers = inject(AXP_PERMISSION_DEFINITION_PROVIDER, { optional: true });
+        this.modulesResolver = inject(AXP_PERMISSION_MODULES_RESOLVER, { optional: true });
         this.sessionService = inject(AXPSessionService);
         this.cache = null;
+        /** Invalidates cache when the session edition modules/features change (e.g. app switch). */
+        this.cacheAvailabilityKey = null;
+    }
+    buildAvailabilityKey() {
+        const enabled = this.sessionService.features
+            .filter((feature) => feature.value === true && !!feature.name)
+            .map((feature) => feature.name)
+            .sort();
+        const applicationId = this.sessionService.application?.id ?? '';
+        const tenantId = this.sessionService.tenant?.id ?? '';
+        return `${tenantId}|${applicationId}|${enabled.join(',')}`;
     }
     async load() {
-        if (this.cache) {
+        const availabilityKey = this.buildAvailabilityKey();
+        if (this.cache && this.cacheAvailabilityKey === availabilityKey) {
             return;
         }
+        this.cacheAvailabilityKey = availabilityKey;
         const context = new AXPPermissionDefinitionProviderContext();
-        // Load providers from DI tokens
         if (Array.isArray(this.providers)) {
             for (const provider of this.providers) {
                 if (provider instanceof Promise) {
-                    // If provider is a promise, resolve it
                     const resolvedProvider = await provider;
                     await resolvedProvider.define(context);
                 }
                 else {
-                    // If provider is a direct instance, use it directly
                     await provider.define(context);
                 }
             }
         }
-        // Filter permissions based on required features
-        const allGroups = context.getGroupDefinitions();
-        this.cache = this.filterByFeatures(allGroups);
+        const allGroups = context.getGroupDefinitions().map((group) => this.enrichGroupModules(group));
+        this.cache = this.filterUnavailablePermissions(allGroups);
     }
-    /**
-     * Filter permissions based on required features.
-     * Removes permissions that have required features that are not enabled.
-     */
-    filterByFeatures(groups) {
-        return groups.map(group => ({
+    /** Attach modules[] from the product resolver when providers omitted them. */
+    enrichGroupModules(group) {
+        return {
             ...group,
-            permissions: this.filterPermissions(group.permissions)
-        })).filter(group => group.permissions.length > 0);
+            permissions: group.permissions.map((permission) => this.enrichPermissionModules(permission)),
+        };
+    }
+    enrichPermissionModules(permission) {
+        const resolved = permission.modules?.length || !this.modulesResolver
+            ? permission.modules
+            : [...this.modulesResolver(permission.name)];
+        return {
+            ...permission,
+            modules: resolved,
+            children: (permission.children ?? []).map((child) => this.enrichPermissionModules(child)),
+        };
     }
     /**
-     * Recursively filter permissions and their children based on required features.
+     * Filter permissions by edition modules (ANY-match) and required features.
+     * Keeps parent groups that still have at least one child section with permissions.
      */
+    filterUnavailablePermissions(groups) {
+        const filtered = groups.map((group) => ({
+            ...group,
+            permissions: this.filterPermissions(group.permissions),
+        }));
+        const withPermissions = new Set(filtered.filter((g) => g.permissions.length > 0).map((g) => g.name));
+        const parentsOfKept = new Set(filtered.filter((g) => withPermissions.has(g.name) && g.parent).map((g) => g.parent));
+        return filtered.filter((g) => withPermissions.has(g.name) || parentsOfKept.has(g.name));
+    }
     filterPermissions(permissions) {
         return permissions
-            .filter(permission => {
-            // Check if required features are enabled
+            .filter((permission) => {
+            if (permission.modules?.length) {
+                const anyModuleEnabled = permission.modules.some((moduleName) => this.sessionService.isModuleEnabled(moduleName));
+                if (!anyModuleEnabled) {
+                    return false;
+                }
+            }
             if (permission.requiredFeatures && permission.requiredFeatures.length > 0) {
-                const allFeaturesEnabled = permission.requiredFeatures.every(featureName => this.sessionService.isFeatureEnabled(featureName));
+                const allFeaturesEnabled = permission.requiredFeatures.every((featureName) => this.sessionService.isFeatureEnabled(featureName));
                 if (!allFeaturesEnabled) {
-                    return false; // Filter out this permission
+                    return false;
                 }
             }
             return true;
         })
-            .map(permission => ({
+            .map((permission) => ({
             ...permission,
-            children: this.filterPermissions(permission.children)
-        }))
-            .filter(permission => {
-            // Remove permissions that have no children if they were only containers
-            // (This is optional - you might want to keep parent permissions even without children)
-            return true;
-        });
+            children: this.filterPermissions(permission.children),
+        }));
     }
     async reload() {
         this.cache = null;
+        this.cacheAvailabilityKey = null;
         await this.load();
     }
     async getGroups() {
@@ -970,112 +1418,42 @@ class AXPPermissionDefinitionService {
     }
     async getPermissions() {
         await this.load();
-        return this.cache?.flatMap(g => g.permissions) ?? [];
+        return this.cache?.flatMap((g) => g.permissions) ?? [];
     }
     async getGroup(name) {
         await this.load();
-        return this.cache?.find(g => g.name === name) ?? null;
+        return this.cache?.find((g) => g.name === name) ?? null;
     }
     async getPermission(name) {
         await this.load();
-        return this.cache?.find(g => g.permissions.find(p => p.name === name))?.permissions.find(p => p.name === name) ?? null;
+        for (const group of this.cache ?? []) {
+            const found = this.findPermissionRecursive(group.permissions, name);
+            if (found) {
+                return found;
+            }
+        }
+        return null;
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPPermissionDefinitionService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
-    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPPermissionDefinitionService, providedIn: 'root' }); }
+    findPermissionRecursive(permissions, name) {
+        for (const permission of permissions) {
+            if (permission.name === name) {
+                return permission;
+            }
+            const child = this.findPermissionRecursive(permission.children ?? [], name);
+            if (child) {
+                return child;
+            }
+        }
+        return null;
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionDefinitionService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionDefinitionService, providedIn: 'root' }); }
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPPermissionDefinitionService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPermissionDefinitionService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
 
-//#region ---- Imports ----
-//#endregion
-//#region ---- Helpers ----
-function flattenPermissionDefinitions(nodes, groupPrefix) {
-    const rows = [];
-    for (const node of nodes) {
-        const displayTitle = groupPrefix ? `${groupPrefix} / ${node.title}` : node.title;
-        if (node.children?.length) {
-            rows.push(...flattenPermissionDefinitions(node.children, displayTitle));
-        }
-        else {
-            rows.push({
-                id: String(node.name),
-                title: displayTitle,
-            });
-        }
-    }
-    return rows;
-}
-//#endregion
-//#region ---- Permission definitions data source ----
-/**
- * Data source definition for leaf permissions from {@link AXPPermissionDefinitionService#getGroups}.
- */
-class AXPPermissionDefinitionsDataSourceDefinition {
-    constructor() {
-        //#region ---- Services & Dependencies ----
-        this.permissionDefinitionService = inject(AXPPermissionDefinitionService);
-        //#endregion
-    }
-    //#endregion
-    //#region ---- Public API ----
-    async items() {
-        return [
-            {
-                name: AXPPlatformAuthDataSourceKeys.PermissionDefinitions,
-                title: 'Permissions',
-                source: () => new AXDataSource({
-                    key: 'id',
-                    load: async () => {
-                        const groups = await this.permissionDefinitionService.getGroups();
-                        const list = [];
-                        for (const g of groups) {
-                            list.push(...flattenPermissionDefinitions(g.permissions, g.title));
-                        }
-                        return { items: list, total: list.length };
-                    },
-                    byKey: async (key) => {
-                        const groups = await this.permissionDefinitionService.getGroups();
-                        const list = [];
-                        for (const g of groups) {
-                            list.push(...flattenPermissionDefinitions(g.permissions, g.title));
-                        }
-                        return list.find((item) => item.id === key);
-                    },
-                    pageSize: 1000,
-                }),
-                columns: [
-                    {
-                        name: 'id',
-                        title: 'ID',
-                        datatype: 'string',
-                        type: AXPWidgetsCatalog.text,
-                    },
-                    {
-                        name: 'title',
-                        title: 'Title',
-                        datatype: 'string',
-                        type: AXPWidgetsCatalog.text,
-                    },
-                ],
-                filters: [
-                    {
-                        field: 'title',
-                        title: 'Title',
-                        operator: { type: 'equal' },
-                        widget: { type: AXPWidgetsCatalog.text },
-                        filterType: { advance: true, inline: true },
-                    },
-                ],
-                textField: { name: 'title', title: 'Title' },
-                valueField: { name: 'id', title: 'ID' },
-            },
-        ];
-    }
-}
-//#endregion
-
 class AXPPermissionEvaluatorScopeProvider {
     constructor() {
         this.sessionService = inject(AXPSessionService);
@@ -1114,16 +1492,6 @@ const AXPAuthGuard = (route, state) => {
     }));
 };
 
-function initializeAppState(service) {
-    return async () => {
-        try {
-            await service.restoreSession();
-        }
-        catch (error) {
-            console.error(error);
-        }
-    };
-}
 class AXPAuthModule {
     static forRoot(configs) {
         return {
@@ -1165,34 +1533,76 @@ class AXPAuthModule {
             f();
         });
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPAuthModule, deps: [{ token: 'AXPAuthModuleFactory', optional: true }], target: i0.ɵɵFactoryTarget.NgModule }); }
-    static { this.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "21.2.9", ngImport: i0, type: AXPAuthModule, declarations: [AXPPermissionDirective, AXPFeatureDirective], exports: [AXPPermissionDirective, AXPFeatureDirective] }); }
-    static { this.ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPAuthModule, providers: [
-            provideAppInitializer(() => {
-                const initializerFn = initializeAppState(inject(AXPSessionService));
-                return initializerFn();
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPAuthModule, deps: [{ token: 'AXPAuthModuleFactory', optional: true }], target: i0.ɵɵFactoryTarget.NgModule }); }
+    static { this.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "22.0.8", ngImport: i0, type: AXPAuthModule, declarations: [AXPPermissionDirective, AXPFeatureDirective], exports: [AXPPermissionDirective, AXPFeatureDirective] }); }
+    static { this.ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPAuthModule, providers: [
+            provideAppStartUpTask(() => {
+                const service = inject(AXPSessionService);
+                return {
+                    name: 'session-restore',
+                    priority: AXP_APP_STARTUP_PRIORITY.sessionRestore,
+                    run: async () => {
+                        try {
+                            await service.restoreSession();
+                        }
+                        catch (error) {
+                            console.error(error);
+                        }
+                    },
+                };
             }),
             {
                 provide: AXP_SESSION_SERVICE,
                 useExisting: AXPSessionService,
             },
+            {
+                provide: AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER,
+                useClass: AXPFeatureEvaluatorScopeProvider,
+                multi: true,
+            },
+            {
+                provide: AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER,
+                useClass: AXPPermissionEvaluatorScopeProvider,
+                multi: true,
+            },
         ] }); }
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPAuthModule, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPAuthModule, decorators: [{
             type: NgModule,
             args: [{
                     imports: [],
                     exports: [AXPPermissionDirective, AXPFeatureDirective],
                     declarations: [AXPPermissionDirective, AXPFeatureDirective],
                     providers: [
-                        provideAppInitializer(() => {
-                            const initializerFn = initializeAppState(inject(AXPSessionService));
-                            return initializerFn();
+                        provideAppStartUpTask(() => {
+                            const service = inject(AXPSessionService);
+                            return {
+                                name: 'session-restore',
+                                priority: AXP_APP_STARTUP_PRIORITY.sessionRestore,
+                                run: async () => {
+                                    try {
+                                        await service.restoreSession();
+                                    }
+                                    catch (error) {
+                                        console.error(error);
+                                    }
+                                },
+                            };
                         }),
                         {
                             provide: AXP_SESSION_SERVICE,
                             useExisting: AXPSessionService,
                         },
+                        {
+                            provide: AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER,
+                            useClass: AXPFeatureEvaluatorScopeProvider,
+                            multi: true,
+                        },
+                        {
+                            provide: AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER,
+                            useClass: AXPPermissionEvaluatorScopeProvider,
+                            multi: true,
+                        },
                     ],
                 }]
         }], ctorParameters: () => [{ type: undefined, decorators: [{
@@ -1204,6 +1614,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImpor
 
 class AXPAuthStrategy {
 }
+//#endregion
 
 //#region ----   JWT Utility   ----
 /**
@@ -1292,40 +1703,13 @@ function platformOAuthSessionUpdateParams(params) {
         applicationId: params['applicationId'] ?? application?.id,
     };
 }
-function shouldPlatformOAuthBindSession(accessToken, params) {
-    if (!accessToken) {
+function shouldPlatformOAuthBindSession(hasCredentials, params) {
+    if (!hasCredentials) {
         return false;
     }
     const { tenant, application, tenantId, applicationId } = platformOAuthSessionUpdateParams(params);
     return Boolean(tenantId || applicationId || tenant || application);
 }
-async function postPlatformOAuthSessionUpdate(baseUrl, accessToken, params) {
-    const { tenant, application, tenantId, applicationId } = platformOAuthSessionUpdateParams(params);
-    const response = await fetch(`${baseUrl.replace(/\/$/, '')}/v1/auth/session`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${accessToken}`,
-        },
-        credentials: 'include',
-        body: JSON.stringify({
-            tenantId,
-            applicationId,
-            tenant,
-            application,
-        }),
-    });
-    if (!response.ok) {
-        const detail = await response.text().catch(() => '');
-        throw new Error(`Session update failed: ${response.status} ${response.statusText}${detail ? ` — ${detail}` : ''}`);
-    }
-    const result = (await response.json());
-    return toPlatformOAuthSignInResult(result, {
-        user: params['user'] ?? null,
-        tenant: tenant ?? null,
-        application: application ?? null,
-    });
-}
 function toPlatformOAuthSignInResult(result, context) {
     const tenant = mergeTenant(mapPlatformTenant(result.tenant), context?.tenant ?? null);
     const application = mergeApplication(mapPlatformApplication(result.application), context?.application ?? null);
@@ -1408,6 +1792,137 @@ function parsePlatformExpiresIn(expiresIn) {
 }
 //#endregion
 
+//#region ---- Platform OAuth helpers (PKCE + /connect/*) ----
+const AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID = 'acorex';
+const AXP_DEFAULT_PLATFORM_OAUTH_SCOPE = 'openid profile email offline_access';
+function resolvePlatformOAuthIssuer(baseUrl) {
+    const issuer = baseUrl?.replace(/\/$/, '');
+    if (!issuer) {
+        throw new Error('API baseUrl is not configured');
+    }
+    return issuer;
+}
+function resolvePlatformOAuthRedirectUri() {
+    return `${window.location.origin}/auth/oauth-callback`;
+}
+function resolvePlatformOAuthClientConfig(authConfig) {
+    return {
+        clientId: authConfig?.clientId ?? authConfig?.client_id ?? AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID,
+        redirectUri: authConfig?.redirectUri ?? resolvePlatformOAuthRedirectUri(),
+        scope: authConfig?.scope ?? AXP_DEFAULT_PLATFORM_OAUTH_SCOPE,
+    };
+}
+async function fetchPlatformOAuthDiscoveryDocument(issuer) {
+    const response = await fetch(`${issuer}/.well-known/openid-configuration`);
+    if (!response.ok) {
+        throw new Error(`Failed to load OpenID discovery document: ${response.status} ${response.statusText}`);
+    }
+    return (await response.json());
+}
+function resolvePlatformOAuthAuthorizeEndpoint(issuer, discovery) {
+    return discovery?.authorization_endpoint ?? `${issuer}/connect/authorize`;
+}
+function resolvePlatformOAuthTokenEndpoint(issuer, discovery) {
+    return discovery?.token_endpoint ?? `${issuer}/connect/token`;
+}
+//#endregion
+
+//#region ---- Auth:ListProviders public DTOs ----
+function asAuthListProvidersResponse(payload) {
+    const data = (payload ?? {});
+    return {
+        localMethods: Array.isArray(data.localMethods) ? data.localMethods : [],
+        identityProviders: Array.isArray(data.identityProviders) ? data.identityProviders : [],
+    };
+}
+function findIdentityProvider(payload, id) {
+    const { identityProviders } = asAuthListProvidersResponse(payload);
+    return identityProviders.find((p) => p.id === id);
+}
+//#endregion
+
+/**
+ * Best-effort plain string for thrown {@link Error} messages from command results (no i18n lookup).
+ */
+function commandMessageTextForError(value) {
+    if (value == null) {
+        return '';
+    }
+    if (typeof value === 'string') {
+        return value;
+    }
+    if (typeof value === 'object' && !Array.isArray(value)) {
+        const values = Object.values(value);
+        const first = values.find((v) => typeof v === 'string' && v.length > 0);
+        return first ?? '';
+    }
+    return String(value);
+}
+
+class AXPPlatformAuthRuntimeService {
+    constructor() {
+        this.commandService = inject(AXPCommandService);
+        this.queryService = inject(AXPQueryService);
+        this.sessionService = inject(AXPSessionService);
+        this.listProvidersCache = null;
+        this.listProvidersInFlight = null;
+    }
+    async logout(_refreshToken) {
+        try {
+            // Refresh token is read from HttpOnly cookie on the server.
+            await this.commandService.execute(AUTH_LOGOUT_DEFAULT, {});
+        }
+        catch {
+            // Ignore logout network errors; client session is cleared regardless.
+        }
+        finally {
+            this.clearListProvidersCache();
+        }
+    }
+    async refresh(_refreshToken) {
+        return this.executeCommand(AUTH_REFRESH_DEFAULT, {});
+    }
+    async updateSession(input) {
+        return this.executeCommand(AUTH_UPDATE_SESSION_DEFAULT, input);
+    }
+    async listProviders() {
+        if (this.listProvidersCache) {
+            return this.listProvidersCache;
+        }
+        if (this.listProvidersInFlight) {
+            return this.listProvidersInFlight;
+        }
+        this.listProvidersInFlight = this.queryService
+            .fetch(AUTH_LIST_PROVIDERS_DEFAULT, {})
+            .then((result) => {
+            this.listProvidersCache = asAuthListProvidersResponse(runtimeQueryPayloadData(result));
+            return this.listProvidersCache;
+        })
+            .finally(() => {
+            this.listProvidersInFlight = null;
+        });
+        return this.listProvidersInFlight;
+    }
+    clearListProvidersCache() {
+        this.listProvidersCache = null;
+        this.listProvidersInFlight = null;
+    }
+    async executeCommand(key, input) {
+        const result = await this.commandService.execute(key, input);
+        const data = runtimeCommandPayloadData(result);
+        if (data == null) {
+            throw new Error(commandMessageTextForError(result?.message?.text) || `Auth command failed: ${key}`);
+        }
+        return data;
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPlatformAuthRuntimeService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPlatformAuthRuntimeService, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPPlatformAuthRuntimeService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
 const AXP_USER_AVATAR_CACHE_PORT = new InjectionToken('AXP_USER_AVATAR_CACHE_PORT');
 
 //#region ---- User profile identity service ----
@@ -1442,10 +1957,10 @@ class AXPUserProfileIdentityService {
         }
         await this.avatarCachePort?.refreshUserInfo(id);
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPUserProfileIdentityService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
-    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPUserProfileIdentityService, providedIn: 'root' }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPUserProfileIdentityService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPUserProfileIdentityService, providedIn: 'root' }); }
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPUserProfileIdentityService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPUserProfileIdentityService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });
@@ -1581,11 +2096,13 @@ class AXPLoginChallengeComponentBase {
          * Challenge data to display
          * Contains the image/content and metadata from the server
          */
-        this.challengeData = input.required(...(ngDevMode ? [{ debugName: "challengeData" }] : /* istanbul ignore next */ []));
+        this.challengeData = input.required(/* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "challengeData" }] : /* istanbul ignore next */ []));
         /**
          * Whether the challenge is currently loading (e.g., refreshing)
          */
-        this.isLoading = input(false, ...(ngDevMode ? [{ debugName: "isLoading" }] : /* istanbul ignore next */ []));
+        this.isLoading = input(false, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "isLoading" }] : /* istanbul ignore next */ []));
         //#endregion
         //#region ----   Outputs   ----
         /**
@@ -1599,20 +2116,61 @@ class AXPLoginChallengeComponentBase {
          */
         this.refreshRequest = output();
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPLoginChallengeComponentBase, deps: [], target: i0.ɵɵFactoryTarget.Component }); }
-    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.1.0", version: "21.2.9", type: AXPLoginChallengeComponentBase, isStandalone: true, selector: "ng-component", inputs: { challengeData: { classPropertyName: "challengeData", publicName: "challengeData", isSignal: true, isRequired: true, transformFunction: null }, isLoading: { classPropertyName: "isLoading", publicName: "isLoading", isSignal: true, isRequired: false, transformFunction: null } }, outputs: { responseChange: "responseChange", refreshRequest: "refreshRequest" }, ngImport: i0, template: '', isInline: true }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPLoginChallengeComponentBase, deps: [], target: i0.ɵɵFactoryTarget.Component }); }
+    static { this.ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.1.0", version: "22.0.8", type: AXPLoginChallengeComponentBase, isStandalone: true, selector: "ng-component", inputs: { challengeData: { classPropertyName: "challengeData", publicName: "challengeData", isSignal: true, isRequired: true, transformFunction: null }, isLoading: { classPropertyName: "isLoading", publicName: "isLoading", isSignal: true, isRequired: false, transformFunction: null } }, outputs: { responseChange: "responseChange", refreshRequest: "refreshRequest" }, ngImport: i0, template: '', isInline: true, changeDetection: i0.ChangeDetectionStrategy.Eager }); }
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.9", ngImport: i0, type: AXPLoginChallengeComponentBase, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPLoginChallengeComponentBase, decorators: [{
             type: Component,
             args: [{
                     template: '',
+                    changeDetection: ChangeDetectionStrategy.Eager,
                     standalone: true,
                 }]
         }], propDecorators: { challengeData: [{ type: i0.Input, args: [{ isSignal: true, alias: "challengeData", required: true }] }], isLoading: [{ type: i0.Input, args: [{ isSignal: true, alias: "isLoading", required: false }] }], responseChange: [{ type: i0.Output, args: ["responseChange"] }], refreshRequest: [{ type: i0.Output, args: ["refreshRequest"] }] } });
 
+//#region ----- Sign-in method types -----
+/**
+ * Pluggable sign-in method. Multiple methods can be registered and offered at once.
+ * Session remember/refresh live in {@link AXPSessionService}; methods only prove identity.
+ */
+class AXPSignInMethod {
+}
+//#endregion
+
+//#region ----- Sign-in method registry -----
+/**
+ * Registry of enabled sign-in methods for the login UI.
+ * Methods are independent of session refresh/remember (owned by session service).
+ */
+class AXPSignInMethodRegistry {
+    constructor() {
+        this.methods = new Map();
+    }
+    register(...methods) {
+        for (const method of methods) {
+            this.methods.set(method.descriptor.id, method);
+        }
+    }
+    get(id) {
+        return this.methods.get(id);
+    }
+    listEnabled() {
+        return [...this.methods.values()]
+            .map((m) => m.descriptor)
+            .filter((d) => d.enabled)
+            .sort((a, b) => (a.priority ?? 100) - (b.priority ?? 100));
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPSignInMethodRegistry, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPSignInMethodRegistry, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: AXPSignInMethodRegistry, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
 /**
  * Generated bundle index. Do not edit.
  */
 
-export { AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDefinitionsDataSourceDefinition, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthDataSourceKeys, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, PkceUtil, TimeUtil, initializeAppState, platformOAuthSessionUpdateParams, postPlatformOAuthSessionUpdate, shouldPlatformOAuthBindSession, toPlatformOAuthSignInResult };
+export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PENDING_STRATEGY_KEY, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, commandMessageTextForError, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace };
 //# sourceMappingURL=acorex-platform-framework-client-auth.mjs.map