@astram/frontend-core 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Astram
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/auth/accountService.d.ts

@@ -0,0 +1,112 @@
+/**
+ * createAccountService — platform-agnostic SELF-SCOPED account logic over an
+ * injected HTTP client (the authenticated user acting on their OWN credential/
+ * profile). Mirrors {@link createAuthService}: NO React / DOM / fetch / storage —
+ * the consuming app injects an {@link HttpClient} and the same service runs
+ * unchanged on web today and React Native next.
+ *
+ * Framework account routes (server-side, framework-owned, bearer-authenticated):
+ *   POST  /account/change-password           { currentPassword, newPassword } → 204 | 401 | 422 | 501
+ *   GET   /account/mfa/devices               → 200 { devices, mfaEnabled } | 401 | 501
+ *   POST  /account/mfa/devices/begin         { name? } → 200 { deviceId, otpauthUri, secret } | 401 | 501
+ *   POST  /account/mfa/devices/confirm       { deviceId, code } → 200 { recoveryCodes? } | 400 | 401 | 404 | 501
+ *   PATCH /account/mfa/devices/:id/rename    { name } → 200 { device } | 401 | 404 | 422 | 501
+ *   DELETE /account/mfa/devices/:id          { code } → 204 | 400 | 401 | 404 | 501
+ *   POST  /account/mfa/recovery-codes/regenerate { code } → 200 { recoveryCodes } | 400 | 401 | 501
+ *   PATCH /account/profile                   { name?, email? } → 200 { …profile } | 401 | 422 | 501
+ *
+ * Every method resolves to a plain result object (never throws), so views stay dumb.
+ * A device `secret` is only ever returned by `beginMfaDevice` (the caller's own, for a
+ * QR); the display list/rename shapes never carry a secret.
+ *
+ * Verbatim TS port of astram3/shared/src/auth/accountService.js — logic, routes, and
+ * every result branch are unchanged; only types were added.
+ */
+import type { HttpClient } from '../http/types.js';
+/** Display fields only — NEVER a secret or anything to render as a raw id. */
+export interface MfaDevice {
+    id: string;
+    name?: string;
+    confirmed?: boolean;
+    [key: string]: unknown;
+}
+export type ChangePasswordResult = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type ListMfaDevicesResult = {
+    ok: true;
+    devices: MfaDevice[];
+    mfaEnabled: boolean;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type BeginMfaDeviceResult = {
+    ok: true;
+    deviceId: string | undefined;
+    otpauthUri: string | undefined;
+    secret: string | undefined;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type ConfirmMfaDeviceResult = {
+    ok: true;
+    recoveryCodes: string[];
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type RenameMfaDeviceResult = {
+    ok: true;
+    device: MfaDevice | undefined;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type RemoveMfaDeviceResult = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type RegenerateRecoveryCodesResult = {
+    ok: true;
+    recoveryCodes: string[];
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type UpdateProfileResult = {
+    ok: true;
+    profile: unknown;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export interface AccountService {
+    changePassword(accessToken: string, currentPassword: string, newPassword: string): Promise<ChangePasswordResult>;
+    listMfaDevices(accessToken: string): Promise<ListMfaDevicesResult>;
+    beginMfaDevice(accessToken: string, name?: string): Promise<BeginMfaDeviceResult>;
+    confirmMfaDevice(accessToken: string, deviceId: string, code: string): Promise<ConfirmMfaDeviceResult>;
+    renameMfaDevice(accessToken: string, deviceId: string, name: string): Promise<RenameMfaDeviceResult>;
+    removeMfaDevice(accessToken: string, deviceId: string, code: string): Promise<RemoveMfaDeviceResult>;
+    regenerateRecoveryCodes(accessToken: string, code: string): Promise<RegenerateRecoveryCodesResult>;
+    updateProfile(accessToken: string, changes: {
+        name?: string;
+        email?: string;
+    }): Promise<UpdateProfileResult>;
+}
+export declare function createAccountService(http: HttpClient): AccountService;
+//# sourceMappingURL=accountService.d.ts.map

package/dist/auth/accountService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountService.d.ts","sourceRoot":"","sources":["../../src/auth/accountService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAsBD,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GACvD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACtG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,MAAM,qBAAqB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG,MAAM,MAAM,6BAA6B,GACrC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjH,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnE,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClF,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACvG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACrG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACrG,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACnG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC9G;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAsOrE"}

package/dist/auth/accountService.js

@@ -0,0 +1,210 @@
+export function createAccountService(http) {
+    return {
+        /**
+         * Change the signed-in user's own password. The server verifies the current
+         * password, writes the new one, and revokes the user's OTHER sessions (the
+         * current session stays alive). Resolves to:
+         *   { ok: true }                      — changed (204)
+         *   { ok: false, status, error }      — 401 (current incorrect), 422 (weak new
+         *                                        password), 501 (not available), or other.
+         * @param accessToken  the caller's bearer access token
+         */
+        async changePassword(accessToken, currentPassword, newPassword) {
+            const r = await http.post('/account/change-password', { currentPassword, newPassword }, { bearerToken: accessToken });
+            if (r.status === 204)
+                return { ok: true };
+            if (r.status === 401)
+                return { ok: false, status: 401, error: 'Current password is incorrect.' };
+            if (r.status === 422) {
+                return { ok: false, status: 422, error: 'New password does not meet the requirements.' };
+            }
+            if (r.status === 501)
+                return { ok: false, status: 501, error: 'Password change is not available.' };
+            return { ok: false, status: r.status, error: 'Could not change password.' };
+        },
+        /**
+         * List the signed-in user's CONFIRMED authenticator devices (multi-device
+         * MFA). Each device carries display fields only (name, added/last-used timestamps,
+         * confirmed) — NEVER a secret or anything to render as a raw id to the user.
+         * Resolves to:
+         *   { ok: true, devices, mfaEnabled }  — 200
+         *   { ok: false, status, error }       — 401 (sign in again), 501 (not available), other
+         * @param accessToken  the caller's bearer access token
+         */
+        async listMfaDevices(accessToken) {
+            const r = await http.get('/account/mfa/devices', { bearerToken: accessToken });
+            if (r.status === 200) {
+                const data = r.data;
+                return {
+                    ok: true,
+                    devices: data?.devices ?? [],
+                    mfaEnabled: data?.mfaEnabled ?? false,
+                };
+            }
+            if (r.status === 401)
+                return { ok: false, status: 401, error: 'Please sign in again.' };
+            if (r.status === 501) {
+                return { ok: false, status: 501, error: 'Two-factor authentication is not available.' };
+            }
+            return { ok: false, status: r.status, error: 'Could not load your two-factor devices.' };
+        },
+        /**
+         * Begin enrolling a NEW authenticator device. The server mints a fresh secret and
+         * returns the provisioning material — the `otpauthUri` (for a QR) + the `secret`
+         * (for manual entry) — plus the `deviceId` to confirm. NOT yet active; the user must
+         * confirm a live code. An optional `name` labels the device (blank → the server
+         * defaults it). Resolves to:
+         *   { ok: true, deviceId, otpauthUri, secret }  — begun (200)
+         *   { ok: false, status, error }                — 401, 501, other
+         * @param accessToken  the caller's bearer access token
+         * @param name         an optional device label
+         */
+        async beginMfaDevice(accessToken, name) {
+            const r = await http.post('/account/mfa/devices/begin', typeof name === 'string' ? { name } : {}, { bearerToken: accessToken });
+            if (r.status === 200) {
+                const data = r.data;
+                return {
+                    ok: true,
+                    deviceId: data?.deviceId,
+                    otpauthUri: data?.otpauthUri,
+                    secret: data?.secret,
+                };
+            }
+            if (r.status === 401)
+                return { ok: false, status: 401, error: 'Please sign in again.' };
+            if (r.status === 501) {
+                return { ok: false, status: 501, error: 'Two-factor authentication is not available.' };
+            }
+            return { ok: false, status: r.status, error: 'Could not start two-factor setup.' };
+        },
+        /**
+         * Confirm a pending device by presenting a live code from it. On success the server
+         * activates the device; on the FIRST device it also returns the one-time recovery
+         * codes ONCE (show them prominently — they are never shown again). Subsequent devices
+         * return no recovery codes. Resolves to:
+         *   { ok: true, recoveryCodes }   — activated (200); recoveryCodes is [] for a
+         *                                    non-first device.
+         *   { ok: false, status, error }  — 400 (wrong/expired code), 404 (unknown device),
+         *                                    401, 501, other
+         * @param deviceId  the device from `beginMfaDevice`
+         * @param code      the 6-digit code from the authenticator app
+         */
+        async confirmMfaDevice(accessToken, deviceId, code) {
+            const r = await http.post('/account/mfa/devices/confirm', { deviceId, code }, { bearerToken: accessToken });
+            if (r.status === 200) {
+                const data = r.data;
+                return { ok: true, recoveryCodes: data?.recoveryCodes ?? [] };
+            }
+            if (r.status === 400) {
+                return { ok: false, status: 400, error: 'That code is incorrect or has expired. Try again.' };
+            }
+            if (r.status === 404)
+                return { ok: false, status: 404, error: 'That device was not found.' };
+            if (r.status === 401)
+                return { ok: false, status: 401, error: 'Please sign in again.' };
+            if (r.status === 501) {
+                return { ok: false, status: 501, error: 'Two-factor authentication is not available.' };
+            }
+            return { ok: false, status: r.status, error: 'Could not confirm two-factor setup.' };
+        },
+        /**
+         * Rename one of the signed-in user's devices (cosmetic — no code required). On
+         * success the server returns the refreshed device (display fields only). Resolves to:
+         *   { ok: true, device }          — renamed (200)
+         *   { ok: false, status, error }  — 422 (blank name), 404 (unknown/not owned), 401,
+         *                                    501, other
+         * @param name  the new label (must be non-empty after trim)
+         */
+        async renameMfaDevice(accessToken, deviceId, name) {
+            const r = await http.patch(`/account/mfa/devices/${encodeURIComponent(deviceId)}/rename`, { name }, { bearerToken: accessToken });
+            if (r.status === 200) {
+                const data = r.data;
+                return { ok: true, device: data?.device };
+            }
+            if (r.status === 422)
+                return { ok: false, status: 422, error: 'Please enter a device name.' };
+            if (r.status === 404)
+                return { ok: false, status: 404, error: 'That device was not found.' };
+            if (r.status === 401)
+                return { ok: false, status: 401, error: 'Please sign in again.' };
+            if (r.status === 501) {
+                return { ok: false, status: 501, error: 'Two-factor authentication is not available.' };
+            }
+            return { ok: false, status: r.status, error: 'Could not rename the device.' };
+        },
+        /**
+         * Remove one of the signed-in user's devices. Requires proof — a current TOTP code
+         * from ANY remaining device OR one of the saved recovery codes. Removing the LAST
+         * device turns MFA off (and wipes recovery codes). Resolves to:
+         *   { ok: true }                  — removed (204)
+         *   { ok: false, status, error }  — 400 (wrong code), 404 (unknown/not owned), 401,
+         *                                    501, other
+         * @param code  a TOTP or recovery code (proof)
+         */
+        async removeMfaDevice(accessToken, deviceId, code) {
+            const r = await http.delete(`/account/mfa/devices/${encodeURIComponent(deviceId)}`, { code }, { bearerToken: accessToken });
+            if (r.status === 204)
+                return { ok: true };
+            if (r.status === 400) {
+                return { ok: false, status: 400, error: 'That code is incorrect. Enter a current or recovery code.' };
+            }
+            if (r.status === 404)
+                return { ok: false, status: 404, error: 'That device was not found.' };
+            if (r.status === 401)
+                return { ok: false, status: 401, error: 'Please sign in again.' };
+            if (r.status === 501) {
+                return { ok: false, status: 501, error: 'Two-factor authentication is not available.' };
+            }
+            return { ok: false, status: r.status, error: 'Could not remove the device.' };
+        },
+        /**
+         * Regenerate the account's recovery codes (replacing the old set). Requires MFA to be
+         * enabled and proof — a current TOTP from any device OR an existing recovery code. The
+         * fresh codes are returned ONCE. Resolves to:
+         *   { ok: true, recoveryCodes }   — regenerated (200)
+         *   { ok: false, status, error }  — 400 (MFA off / wrong code), 401, 501, other
+         * @param code  a TOTP or recovery code (proof)
+         */
+        async regenerateRecoveryCodes(accessToken, code) {
+            const r = await http.post('/account/mfa/recovery-codes/regenerate', { code }, { bearerToken: accessToken });
+            if (r.status === 200) {
+                const data = r.data;
+                return { ok: true, recoveryCodes: data?.recoveryCodes ?? [] };
+            }
+            if (r.status === 400) {
+                return { ok: false, status: 400, error: 'That code is incorrect, or two-factor is not enabled.' };
+            }
+            if (r.status === 401)
+                return { ok: false, status: 401, error: 'Please sign in again.' };
+            if (r.status === 501) {
+                return { ok: false, status: 501, error: 'Two-factor authentication is not available.' };
+            }
+            return { ok: false, status: r.status, error: 'Could not regenerate recovery codes.' };
+        },
+        /**
+         * Edit the signed-in user's own display profile (name and/or email). Only the
+         * supplied fields are written (partial edit). On success the server returns the
+         * REFRESHED display profile (names, never UUIDs) — hand it straight to the UI so
+         * the header/user card updates in place. Resolves to:
+         *   { ok: true, profile }         — updated (200)
+         *   { ok: false, status, error }  — 401 (sign in again), 422 (nothing to change /
+         *                                    invalid email), 501 (not available), or other.
+         * @param accessToken  the caller's bearer access token
+         */
+        async updateProfile(accessToken, changes) {
+            const r = await http.patch('/account/profile', changes, { bearerToken: accessToken });
+            if (r.status === 200)
+                return { ok: true, profile: r.data };
+            if (r.status === 401)
+                return { ok: false, status: 401, error: 'Please sign in again.' };
+            if (r.status === 422) {
+                return { ok: false, status: 422, error: 'Please enter a valid name and email.' };
+            }
+            if (r.status === 501) {
+                return { ok: false, status: 501, error: 'Profile editing is not available.' };
+            }
+            return { ok: false, status: r.status, error: 'Could not update your profile.' };
+        },
+    };
+}
+//# sourceMappingURL=accountService.js.map

package/dist/auth/accountService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountService.js","sourceRoot":"","sources":["../../src/auth/accountService.ts"],"names":[],"mappings":"AA2FA,MAAM,UAAU,oBAAoB,CAAC,IAAgB;IACnD,OAAO;QACL;;;;;;;;WAQG;QACH,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,eAAuB,EACvB,WAAmB;YAEnB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,0BAA0B,EAC1B,EAAE,eAAe,EAAE,WAAW,EAAE,EAChC,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YACjG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YAC3F,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC9E,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,cAAc,CAAC,WAAmB;YACtC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,CAAC,CAAC,IAA6B,CAAC;gBAC7C,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;oBAC5B,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,KAAK;iBACtC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YACxF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;QAC3F,CAAC;QAED;;;;;;;;;;WAUG;QACH,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,IAAa;YACrD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,4BAA4B,EAC5B,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EACxC,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAiC,CAAC;gBACjD,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,QAAQ,EAAE,IAAI,EAAE,QAAQ;oBACxB,UAAU,EAAE,IAAI,EAAE,UAAU;oBAC5B,MAAM,EAAE,IAAI,EAAE,MAAM;iBACrB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YACxF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACrF,CAAC;QAED;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,QAAgB,EAAE,IAAY;YACxE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,8BAA8B,EAC9B,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAgC,CAAC;gBAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;YAChG,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC7F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YACxF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QACvF,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,QAAgB,EAAE,IAAY;YACvE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CACxB,wBAAwB,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAC7D,EAAE,IAAI,EAAE,EACR,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAkC,CAAC;gBAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;YAC9F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC7F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YACxF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QAChF,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,QAAgB,EAAE,IAAY;YACvE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CACzB,wBAAwB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EACtD,EAAE,IAAI,EAAE,EACR,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;YACxG,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC7F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YACxF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QAChF,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,uBAAuB,CAAC,WAAmB,EAAE,IAAY;YAC7D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,wCAAwC,EACxC,EAAE,IAAI,EAAE,EACR,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAgC,CAAC;gBAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC;YACpG,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YACxF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;QACxF,CAAC;QAED;;;;;;;;;WASG;QACH,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,OAA0C;YAE1C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YACxF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;YACnF,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YAChF,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QAClF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/auditService.d.ts

@@ -0,0 +1,45 @@
+/**
+ * createAuditService — platform-agnostic calls to the identity feature's audit-log
+ * API. Like identityService, it takes an injected HTTP client and carries no platform
+ * code, so web + mobile share it. The bearer token is passed per call (the UI holds
+ * the session; the shared logic stays stateless).
+ *
+ * Every method resolves to a plain result object (never throws): `{ ok:true, ... }`
+ * on success, `{ ok:false, status, error }` on any non-2xx (401 = not authenticated,
+ * 403 = denied by policy, anything else = a generic failure). Views stay dumb: they
+ * branch on `ok`/`status` and render the message.
+ *
+ * The server route this hits: GET /identity/audit — resolved audit rows, no raw
+ * uuid ever a display value (actor/tenant are resolved to names server-side).
+ *
+ * Verbatim TS port of astram3/shared/src/auth/auditService.js — logic, routes, and
+ * every result branch are unchanged; only types were added.
+ */
+import type { HttpClient } from '../http/types.js';
+/** Filter/cursor bag for {@link AuditService.list}. All fields optional. */
+export interface AuditQuery {
+    type?: string;
+    actor?: string;
+    tenant?: string;
+    before?: string;
+    limit?: number;
+}
+/** A single resolved audit row. Concrete shape is server-defined. */
+export interface AuditRecord {
+    id?: string;
+    [key: string]: unknown;
+}
+export type ListAuditResult = {
+    ok: true;
+    data: AuditRecord[];
+    nextCursor: string | null;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export interface AuditService {
+    list(accessToken: string, query?: AuditQuery): Promise<ListAuditResult>;
+}
+export declare function createAuditService(http: HttpClient): AuditService;
+//# sourceMappingURL=auditService.d.ts.map

package/dist/auth/auditService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditService.d.ts","sourceRoot":"","sources":["../../src/auth/auditService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CA0DjE"}

package/dist/auth/auditService.js

@@ -0,0 +1,58 @@
+export function createAuditService(http) {
+    /**
+     * Build a `?type&actor&tenant&before&limit` query string from a filter/cursor bag,
+     * omitting anything absent/empty so the server applies its defaults. Values are
+     * URL-encoded. Returns '' (no leading '?') when nothing is set.
+     *
+     * Built with plain `encodeURIComponent` (not `URLSearchParams`) — this package has
+     * no `lib.dom`/Node ambient types (it must run unchanged on web AND React Native,
+     * where `URLSearchParams` isn't guaranteed to exist), and every key here is set at
+     * most once, so a manual `key=value` join is byte-identical to the source's
+     * `URLSearchParams#toString()` output.
+     */
+    function listQueryString(query) {
+        const q = query ?? {};
+        const parts = [];
+        for (const [key, value] of Object.entries(q)) {
+            if (value !== undefined && value !== null && value !== '') {
+                parts.push(`${key}=${encodeURIComponent(String(value))}`);
+            }
+        }
+        return parts.length > 0 ? `?${parts.join('&')}` : '';
+    }
+    /**
+     * Shared translator for a failure response → a friendly result. Centralizes the
+     * 401/403/other mapping so every method reports consistently (mirrors identityService).
+     */
+    function fail(r, generic) {
+        if (r.status === 401) {
+            return { ok: false, status: 401, error: 'Not authenticated (no/invalid token).' };
+        }
+        if (r.status === 403) {
+            return { ok: false, status: 403, error: 'You need platform-admin access to do this.' };
+        }
+        return { ok: false, status: r.status, error: generic };
+    }
+    return {
+        /**
+         * Page of resolved audit rows + a cursor for the next page.
+         * @param accessToken  the caller's bearer access token
+         * Resolves: { ok:true, data, nextCursor } | { ok:false, status, error }
+         */
+        async list(accessToken, query) {
+            const r = await http.get(`/identity/audit${listQueryString(query)}`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok) {
+                const body = (r.data ?? {});
+                return {
+                    ok: true,
+                    data: body.data ?? [],
+                    nextCursor: body.nextCursor ?? null,
+                };
+            }
+            return fail(r, 'Could not load the audit log.');
+        },
+    };
+}
+//# sourceMappingURL=auditService.js.map

package/dist/auth/auditService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditService.js","sourceRoot":"","sources":["../../src/auth/auditService.ts"],"names":[],"mappings":"AA0CA,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD;;;;;;;;;;OAUG;IACH,SAAS,eAAe,CAAC,KAAkB;QACzC,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,SAAS,IAAI,CAAC,CAAqB,EAAE,OAAe;QAClD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL;;;;WAIG;QACH,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,KAAkB;YAChD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE;gBACnE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAyD,CAAC;gBACpF,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;oBACrB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;iBACpC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/authService.d.ts

@@ -0,0 +1,96 @@
+/**
+ * createAuthService — platform-agnostic auth logic over an injected HTTP client.
+ *
+ * This is the SINGLE source of truth for how a UI talks to the framework auth
+ * surface. It has NO React / DOM / fetch / storage — the consuming app injects a
+ * {@link HttpClient} (web: fetch-based; mobile: RN's). The same service therefore
+ * runs unchanged on web today and React Native next.
+ *
+ * Framework auth routes (server-side, framework-owned):
+ *   POST /auth/login   { identityHint, password } → { session, tokens } | { mfaRequired, challengeToken }
+ *   POST /auth/mfa     { challengeToken, factor, code } → { session, tokens }
+ *   POST /auth/refresh { refreshToken }           → { session, tokens }
+ *   POST /auth/logout  { sessionId }              → 204
+ *
+ * Every method resolves to a plain result object (never throws), so views stay dumb.
+ *
+ * Verbatim TS port of astram3/shared/src/auth/authService.js — logic, routes, and
+ * every result branch are unchanged; only types were added.
+ */
+import type { HttpClient } from '../http/types.js';
+import type { Session, SessionTokens } from './session.js';
+/** Shape of a display profile returned by GET /auth/me. */
+export interface AuthProfile {
+    id: string;
+    name: string;
+    email?: string;
+    company?: {
+        id: string;
+        name: string;
+    };
+    roles?: Array<{
+        id: string;
+        name: string;
+    }>;
+    [key: string]: unknown;
+}
+export type LoginResult = {
+    ok: true;
+    session: Session;
+    tokens: SessionTokens;
+} | {
+    ok: 'mfa';
+    challengeToken: string;
+} | {
+    ok: false;
+    error: string;
+};
+export type CompleteMfaResult = {
+    ok: true;
+    session: Session;
+    tokens: SessionTokens;
+    mfaRecoveryUsed: boolean;
+} | {
+    ok: false;
+    error: string;
+};
+export type RefreshResult = {
+    ok: true;
+    session: Session;
+    tokens: SessionTokens;
+} | {
+    ok: false;
+    error: string;
+};
+export type LogoutResult = {
+    ok: true;
+};
+export type MeResult = {
+    ok: true;
+    profile: AuthProfile;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type RequestResetResult = {
+    ok: true;
+};
+export type ResetPasswordResult = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export interface AuthService {
+    login(identityHint: string, password: string): Promise<LoginResult>;
+    completeMfa(challengeToken: string, code: string, factor?: string): Promise<CompleteMfaResult>;
+    refresh(refreshToken: string): Promise<RefreshResult>;
+    logout(sessionId: string | undefined): Promise<LogoutResult>;
+    me(accessToken: string): Promise<MeResult>;
+    requestReset(identityHint: string): Promise<RequestResetResult>;
+    resetPassword(token: string, newPassword: string): Promise<ResetPasswordResult>;
+}
+export declare function createAuthService(http: HttpClient): AuthService;
+//# sourceMappingURL=authService.d.ts.map

package/dist/auth/authService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authService.d.ts","sourceRoot":"","sources":["../../src/auth/authService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE3D,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAWD,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GAC/E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjH,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAExC,MAAM,MAAM,QAAQ,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpE,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/F,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAmH/D"}