@astram/frontend-core 0.1.0

package/dist/auth/identityService.js

@@ -0,0 +1,374 @@
+export function createIdentityService(http) {
+    /**
+     * Build a `?page&limit&search&sortBy&sortOrder` query string from a DataTable
+     * options bag, omitting anything absent/empty so the server applies its defaults.
+     * Values are URL-encoded. Returns '' (no leading '?') when nothing is set.
+     *
+     * Built with plain `encodeURIComponent` (not `URLSearchParams`) — this package has
+     * no `lib.dom`/Node ambient types (it must run unchanged on web AND React Native,
+     * where `URLSearchParams` isn't guaranteed to exist), and every key here is set at
+     * most once, so a manual `key=value` join is byte-identical to the source's
+     * `URLSearchParams#toString()` output.
+     */
+    function listQueryString(opts) {
+        const o = opts ?? {};
+        const parts = [];
+        if (Number.isFinite(o.page) && o.page >= 1)
+            parts.push(`page=${encodeURIComponent(String(o.page))}`);
+        if (Number.isFinite(o.limit) && o.limit >= 1) {
+            parts.push(`limit=${encodeURIComponent(String(o.limit))}`);
+        }
+        const search = typeof o.search === 'string' ? o.search.trim() : '';
+        if (search.length > 0)
+            parts.push(`search=${encodeURIComponent(search)}`);
+        if (typeof o.sortBy === 'string' && o.sortBy.length > 0) {
+            parts.push(`sortBy=${encodeURIComponent(o.sortBy)}`);
+            parts.push(`sortOrder=${encodeURIComponent(o.sortOrder === 'desc' ? 'desc' : 'asc')}`);
+        }
+        return parts.length > 0 ? `?${parts.join('&')}` : '';
+    }
+    /**
+     * Shared translator for a failure response → a friendly result. Centralizes the
+     * 401/403/other mapping so every method reports consistently.
+     */
+    function fail(r, generic) {
+        if (r.status === 401) {
+            return { ok: false, status: 401, error: 'Not authenticated (no/invalid token).' };
+        }
+        if (r.status === 403) {
+            return { ok: false, status: 403, error: 'You need platform-admin access to do this.' };
+        }
+        return { ok: false, status: r.status, error: generic };
+    }
+    return {
+        // ── Companies ────────────────────────────────────────────────────────────
+        /**
+         * List companies visible to the authenticated caller (a @Classified route — the
+         * framework resolves the token → principal → decide() before the handler). Pass
+         * the access token; omit it to demonstrate the 401 wall.
+         *
+         * Server-side DataTable: pass `{ page, limit, search, sortBy, sortOrder }` — the
+         * server pages/searches (over name)/sorts (name, status) and returns the FILTERED
+         * total, so the client can page the true result count (no client-side 100-row cap).
+         *
+         * Resolves: { ok:true, total, rows, page, limit } | { ok:false, status, error }
+         */
+        async listCompanies(accessToken, opts) {
+            const r = await http.get(`/identity/companies${listQueryString(opts)}`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok) {
+                const data = r.data;
+                return {
+                    ok: true,
+                    total: data?.total ?? 0,
+                    rows: data?.rows ?? [],
+                    page: data?.page ?? 1,
+                    limit: data?.limit ?? data?.rows?.length ?? 0,
+                };
+            }
+            return fail(r, 'Could not load companies.');
+        },
+        /** Read one company → { ok:true, record } | { ok:false, ... }. */
+        async getCompany(accessToken, uuid) {
+            const r = await http.get(`/identity/companies/${encodeURIComponent(uuid)}`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok)
+                return { ok: true, record: r.data ?? null };
+            return fail(r, 'Could not load the company.');
+        },
+        /** Create a company → { ok:true, id } | { ok:false, ... }. */
+        async createCompany(accessToken, name) {
+            const r = await http.post('/identity/companies', { name }, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true, id: r.data?.id };
+            return fail(r, 'Could not create the company.');
+        },
+        /** Update a company (partial: name and/or status) → { ok:true } | { ok:false, ... }. */
+        async updateCompany(accessToken, uuid, patch) {
+            const r = await http.put(`/identity/companies/${encodeURIComponent(uuid)}`, patch ?? {}, {
+                bearerToken: accessToken,
+            });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not update the company.');
+        },
+        /** Delete a company → { ok:true } | { ok:false, ... }. */
+        async deleteCompany(accessToken, uuid) {
+            const r = await http.delete(`/identity/companies/${encodeURIComponent(uuid)}`, {}, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not delete the company.');
+        },
+        // ── Roles ────────────────────────────────────────────────────────────────
+        /**
+         * List roles with server-side DataTable paging/search (name)/sort (name).
+         * Resolves: { ok:true, total, rows, page, limit } | { ok:false, ... }.
+         */
+        async listRoles(accessToken, opts) {
+            const r = await http.get(`/identity/roles${listQueryString(opts)}`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok) {
+                const data = r.data;
+                return {
+                    ok: true,
+                    total: data?.total ?? 0,
+                    rows: data?.rows ?? [],
+                    page: data?.page ?? 1,
+                    limit: data?.limit ?? data?.rows?.length ?? 0,
+                };
+            }
+            return fail(r, 'Could not load roles.');
+        },
+        /** Read one role → { ok:true, record } | { ok:false, ... }. */
+        async getRole(accessToken, uuid) {
+            const r = await http.get(`/identity/roles/${encodeURIComponent(uuid)}`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok)
+                return { ok: true, record: r.data ?? null };
+            return fail(r, 'Could not load the role.');
+        },
+        /** Create a role → { ok:true, id } | { ok:false, ... }. */
+        async createRole(accessToken, name) {
+            const r = await http.post('/identity/roles', { name }, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true, id: r.data?.id };
+            return fail(r, 'Could not create the role.');
+        },
+        /** Update a role (name) → { ok:true } | { ok:false, ... }. */
+        async updateRole(accessToken, uuid, patch) {
+            const r = await http.put(`/identity/roles/${encodeURIComponent(uuid)}`, patch ?? {}, {
+                bearerToken: accessToken,
+            });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not update the role.');
+        },
+        /** Delete a role → { ok:true } | { ok:false, ... }. */
+        async deleteRole(accessToken, uuid) {
+            const r = await http.delete(`/identity/roles/${encodeURIComponent(uuid)}`, {}, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not delete the role.');
+        },
+        // ── Role permissions (grant admin) ────────────────────────────────────────
+        /** List grantable permission keys + wildcards → { ok:true, catalog, wildcards } | { ok:false, ... }. */
+        async listPermissionCatalog(accessToken) {
+            const r = await http.get('/identity/permission-catalog', { bearerToken: accessToken });
+            if (r.ok) {
+                const data = r.data;
+                return { ok: true, catalog: data?.catalog ?? [], wildcards: data?.wildcards ?? [] };
+            }
+            return fail(r, 'Could not load the permission catalog.');
+        },
+        /**
+         * Per-role access summary for the Access listing (server-paged/sorted/searched via
+         * `opts` = { page, limit, search, sortBy, sortOrder }) → { ok, rows, total, page,
+         * limit } | fail. Each row: { roleUuid, roleName, objectCount, permCount, chips[],
+         * preset, grantedAt, grantedByName } — grantor resolved to a NAME (never a uuid).
+         */
+        async listGrantsSummary(accessToken, opts) {
+            const r = await http.get(`/identity/access/role-grants${listQueryString(opts)}`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok) {
+                const data = r.data;
+                return {
+                    ok: true,
+                    rows: data?.rows ?? [],
+                    total: data?.total ?? 0,
+                    page: data?.page ?? 1,
+                    limit: data?.limit ?? data?.rows?.length ?? 0,
+                };
+            }
+            return fail(r, 'Could not load the roles summary.');
+        },
+        /** List a role's current grants → { ok:true, grants } | { ok:false, ... }. */
+        async listRolePermissions(accessToken, uuid) {
+            const r = await http.get(`/identity/roles/${encodeURIComponent(uuid)}/permissions`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok)
+                return { ok: true, grants: r.data?.grants ?? [] };
+            return fail(r, 'Could not load the role permissions.');
+        },
+        /** Grant one key to a role → { ok:true } | { ok:false, ... }. */
+        async grantPermission(accessToken, uuid, key) {
+            const r = await http.post(`/identity/roles/${encodeURIComponent(uuid)}/permissions`, { key }, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not grant the permission.');
+        },
+        /** Revoke one key from a role → { ok:true } | { ok:false, ... }. */
+        async revokePermission(accessToken, uuid, key) {
+            const r = await http.delete(`/identity/roles/${encodeURIComponent(uuid)}/permissions/${encodeURIComponent(key)}`, {}, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not revoke the permission.');
+        },
+        // ── Access bundles (named, grantable permission sets) ──────────────────────
+        /**
+         * List active access bundles → { ok:true, bundles } | { ok:false, ... }. Each
+         * bundle is `{ key, module, label, description?, permissionKeys[] }` — identified
+         * by `key`/`label`, never a uuid.
+         */
+        async listAccessBundles(accessToken) {
+            const r = await http.get('/identity/access-bundles', { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true, bundles: r.data?.bundles ?? [] };
+            return fail(r, 'Could not load the access bundles.');
+        },
+        /** Grant a bundle to a role (server expands it to atomic keys) → { ok } | fail. */
+        async grantAccessBundle(accessToken, uuid, key) {
+            const r = await http.post(`/identity/roles/${encodeURIComponent(uuid)}/access-bundles`, { key }, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not grant the bundle.');
+        },
+        /** Revoke a bundle from a role (removes its atomic keys) → { ok } | fail. */
+        async revokeAccessBundle(accessToken, uuid, key) {
+            const r = await http.delete(`/identity/roles/${encodeURIComponent(uuid)}/access-bundles/${encodeURIComponent(key)}`, {}, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not revoke the bundle.');
+        },
+        // ── Users ────────────────────────────────────────────────────────────────
+        /**
+         * List users with server-side DataTable paging/search (username, email)/sort
+         * (username, email, status).
+         * Resolves: { ok:true, total, rows, page, limit } | { ok:false, ... }.
+         */
+        async listUsers(accessToken, opts) {
+            const r = await http.get(`/identity/users${listQueryString(opts)}`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok) {
+                const data = r.data;
+                return {
+                    ok: true,
+                    total: data?.total ?? 0,
+                    rows: data?.rows ?? [],
+                    page: data?.page ?? 1,
+                    limit: data?.limit ?? data?.rows?.length ?? 0,
+                };
+            }
+            return fail(r, 'Could not load users.');
+        },
+        /** Read one user → { ok:true, record } | { ok:false, ... }. */
+        async getUser(accessToken, uuid) {
+            const r = await http.get(`/identity/users/${encodeURIComponent(uuid)}`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok)
+                return { ok: true, record: r.data ?? null };
+            return fail(r, 'Could not load the user.');
+        },
+        /**
+         * Create a user. The server currently accepts only `{ username }` (the global
+         * user record); an optional `email` is sent so a later server slice can pick it up
+         * without a client change. → { ok:true, id } | { ok:false, ... }.
+         */
+        async createUser(accessToken, { username, email } = {}) {
+            // `username` carries through as-is (including `undefined`, matching the source's
+            // `const body = { username }`); the property type allows `undefined` explicitly
+            // so this assignment is valid under `exactOptionalPropertyTypes`.
+            const body = { username };
+            if (typeof email === 'string' && email.length > 0)
+                body.email = email;
+            const r = await http.post('/identity/users', body, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true, id: r.data?.id };
+            return fail(r, 'Could not create the user.');
+        },
+        /** Update a user (partial: username / email / status) → { ok:true } | { ok:false, ... }. */
+        async updateUser(accessToken, uuid, patch) {
+            const r = await http.put(`/identity/users/${encodeURIComponent(uuid)}`, patch ?? {}, {
+                bearerToken: accessToken,
+            });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not update the user.');
+        },
+        /** Delete a user → { ok:true } | { ok:false, ... }. */
+        async deleteUser(accessToken, uuid) {
+            const r = await http.delete(`/identity/users/${encodeURIComponent(uuid)}`, {}, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not delete the user.');
+        },
+        // ── Memberships + postings (Phase 5's Assignments editor) ─────────────────
+        /**
+         * The user's membership cards + their postings, with EVERY uuid resolved to a
+         * display NAME server-side (companyName / roleName / departmentName / branchName).
+         * → { ok:true, memberships } | { ok:false, ... }.
+         */
+        async getUserMemberships(accessToken, userUuid) {
+            const r = await http.get(`/identity/users/${encodeURIComponent(userUuid)}/memberships`, {
+                bearerToken: accessToken,
+            });
+            if (r.ok)
+                return { ok: true, memberships: r.data?.memberships ?? [] };
+            return fail(r, 'Could not load the user’s memberships.');
+        },
+        /** Add the user to a company (creates an inactive card) → { ok:true, id } | { ok:false, ... }. */
+        async addMembership(accessToken, userUuid, companyUuid) {
+            const r = await http.post(`/identity/users/${encodeURIComponent(userUuid)}/memberships`, { companyUuid }, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true, id: r.data?.id };
+            return fail(r, 'Could not add the membership.');
+        },
+        /**
+         * Mark a membership the active-login company (the one-active invariant — the server
+         * deactivates the user's other memberships). `userUuid` is required so the server can
+         * enforce it. → { ok:true } | { ok:false, ... }.
+         */
+        async setMembershipActive(accessToken, membershipUuid, userUuid) {
+            const r = await http.put(`/identity/memberships/${encodeURIComponent(membershipUuid)}`, { isActive: true, userUuid }, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not activate the membership.');
+        },
+        /** Remove a membership card (its postings cascade) → { ok:true } | { ok:false, ... }. */
+        async removeMembership(accessToken, membershipUuid) {
+            const r = await http.delete(`/identity/memberships/${encodeURIComponent(membershipUuid)}`, {}, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not remove the membership.');
+        },
+        /**
+         * Atomically replace a membership's FULL posting set (the multi-row editor submits the
+         * whole list; the server diffs → add/remove). `postings` is an array of
+         * `{ roleUuid, departmentUuid?, branchUuid?, effectiveFrom?, effectiveUntil? }`.
+         * → { ok:true } | { ok:false, ... }.
+         */
+        async replacePostings(accessToken, membershipUuid, postings) {
+            const r = await http.put(`/identity/memberships/${encodeURIComponent(membershipUuid)}/postings`, { postings }, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not save the postings.');
+        },
+        // ── Company-scoped catalogs (dept/branch option lists for the posting editor) ──
+        //
+        // These back the company-scoped dropdowns in Phase 5's Assignments editor. The
+        // server route lands with that phase; until then the call resolves { ok:false }
+        // gracefully (the editor treats an empty catalog as "no options yet").
+        /** List a company's departments → { ok:true, rows } | { ok:false, ... }. */
+        async listDepartments(accessToken, companyUuid) {
+            const r = await http.get(`/identity/companies/${encodeURIComponent(companyUuid)}/departments`, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true, rows: r.data?.rows ?? [] };
+            return fail(r, 'Could not load departments.');
+        },
+        /** List a company's branches → { ok:true, rows } | { ok:false, ... }. */
+        async listBranches(accessToken, companyUuid) {
+            const r = await http.get(`/identity/companies/${encodeURIComponent(companyUuid)}/branches`, { bearerToken: accessToken });
+            if (r.ok)
+                return { ok: true, rows: r.data?.rows ?? [] };
+            return fail(r, 'Could not load branches.');
+        },
+    };
+}
+//# sourceMappingURL=identityService.js.map

package/dist/auth/identityService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityService.js","sourceRoot":"","sources":["../../src/auth/identityService.ts"],"names":[],"mappings":"AAgMA,MAAM,UAAU,qBAAqB,CAAC,IAAgB;IACpD;;;;;;;;;;OAUG;IACH,SAAS,eAAe,CAAC,IAAe;QACtC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAK,CAAC,CAAC,IAAe,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACjH,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAK,CAAC,CAAC,KAAgB,IAAI,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,SAAS,IAAI,CACX,CAAqB,EACrB,OAAe;QAEf,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL,4EAA4E;QAE5E;;;;;;;;;;WAUG;QACH,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,IAAe;YACtD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE;gBACtE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAA4B,CAAC;gBAC5C,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;oBACvB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;oBACtB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;oBACrB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;iBAC9C,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAC9C,CAAC;QAED,kEAAkE;QAClE,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,IAAY;YAChD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE;gBAC1E,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAG,CAAC,CAAC,IAA8B,IAAI,IAAI,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;QAChD,CAAC;QAED,8DAA8D;QAC9D,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,IAAY;YACnD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAG,CAAC,CAAC,IAA0B,EAAE,EAAE,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAClD,CAAC;QAED,wFAAwF;QACxF,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,IAAY,EACZ,KAA+B;YAE/B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,EAAE;gBACvF,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAClD,CAAC;QAED,0DAA0D;QAC1D,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,IAAY;YACnD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CACzB,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EACjD,EAAE,EACF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAClD,CAAC;QAED,4EAA4E;QAE5E;;;WAGG;QACH,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,IAAe;YAClD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAA4B,CAAC;gBAC5C,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;oBACvB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;oBACtB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;oBACrB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;iBAC9C,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC1C,CAAC;QAED,+DAA+D;QAC/D,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,IAAY;YAC7C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE;gBACtE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAG,CAAC,CAAC,IAA8B,IAAI,IAAI,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAC7C,CAAC;QAED,2DAA2D;QAC3D,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,IAAY;YAChD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACrF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAG,CAAC,CAAC,IAA0B,EAAE,EAAE,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QAED,8DAA8D;QAC9D,KAAK,CAAC,UAAU,CACd,WAAmB,EACnB,IAAY,EACZ,KAA+B;YAE/B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,EAAE;gBACnF,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QAED,uDAAuD;QACvD,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,IAAY;YAChD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CACzB,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAC7C,EAAE,EACF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QAED,6EAA6E;QAE7E,wGAAwG;QACxG,KAAK,CAAC,qBAAqB,CAAC,WAAmB;YAC7C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAAoC,CAAC;gBACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;YACtF,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAC3D,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,IAAe;YAC1D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,+BAA+B,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE;gBAC/E,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAA4B,CAAC;gBAC5C,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;oBACtB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;oBACvB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;oBACrB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;iBAC9C,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;QACtD,CAAC;QAED,8EAA8E;QAC9E,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,IAAY;YACzD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE;gBAClF,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAG,CAAC,CAAC,IAAmC,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC;QACzD,CAAC;QAED,iEAAiE;QACjE,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,IAAY,EAAE,GAAW;YAClE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,cAAc,EACzD,EAAE,GAAG,EAAE,EACP,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;QACpD,CAAC;QAED,oEAAoE;QACpE,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,IAAY,EAAE,GAAW;YACnE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CACzB,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,EACpF,EAAE,EACF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;QACrD,CAAC;QAED,8EAA8E;QAE9E;;;;WAIG;QACH,KAAK,CAAC,iBAAiB,CAAC,WAAmB;YACzC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAG,CAAC,CAAC,IAAiC,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC;QACvD,CAAC;QAED,mFAAmF;QACnF,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,IAAY,EAAE,GAAW;YACpE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,iBAAiB,EAC5D,EAAE,GAAG,EAAE,EACP,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;QAChD,CAAC;QAED,6EAA6E;QAC7E,KAAK,CAAC,kBAAkB,CAAC,WAAmB,EAAE,IAAY,EAAE,GAAW;YACrE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CACzB,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,kBAAkB,CAAC,GAAG,CAAC,EAAE,EACvF,EAAE,EACF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;QACjD,CAAC;QAED,4EAA4E;QAE5E;;;;WAIG;QACH,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,IAAe;YAClD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAA4B,CAAC;gBAC5C,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;oBACvB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;oBACtB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;oBACrB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;iBAC9C,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAC1C,CAAC;QAED,+DAA+D;QAC/D,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,IAAY;YAC7C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE;gBACtE,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAG,CAAC,CAAC,IAA8B,IAAI,IAAI,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAC7C,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,UAAU,CACd,WAAmB,EACnB,EAAE,QAAQ,EAAE,KAAK,KAA4C,EAAE;YAE/D,iFAAiF;YACjF,gFAAgF;YAChF,kEAAkE;YAClE,MAAM,IAAI,GAAsD,EAAE,QAAQ,EAAE,CAAC;YAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACtE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAG,CAAC,CAAC,IAA0B,EAAE,EAAE,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QAED,4FAA4F;QAC5F,KAAK,CAAC,UAAU,CACd,WAAmB,EACnB,IAAY,EACZ,KAA+B;YAE/B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,EAAE;gBACnF,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QAED,uDAAuD;QACvD,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,IAAY;YAChD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CACzB,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAC7C,EAAE,EACF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QAED,6EAA6E;QAE7E;;;;WAIG;QACH,KAAK,CAAC,kBAAkB,CAAC,WAAmB,EAAE,QAAgB;YAC5D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,cAAc,EAAE;gBACtF,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAG,CAAC,CAAC,IAA+B,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;YAClG,OAAO,IAAI,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAC3D,CAAC;QAED,kGAAkG;QAClG,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,QAAgB,EAChB,WAAmB;YAEnB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,cAAc,EAC7D,EAAE,WAAW,EAAE,EACf,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAG,CAAC,CAAC,IAA0B,EAAE,EAAE,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAClD,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,mBAAmB,CACvB,WAAmB,EACnB,cAAsB,EACtB,QAAgB;YAEhB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CACtB,yBAAyB,kBAAkB,CAAC,cAAc,CAAC,EAAE,EAC7D,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC5B,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC;QACvD,CAAC;QAED,yFAAyF;QACzF,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,cAAsB;YAChE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CACzB,yBAAyB,kBAAkB,CAAC,cAAc,CAAC,EAAE,EAC7D,EAAE,EACF,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;QACrD,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,eAAe,CACnB,WAAmB,EACnB,cAAsB,EACtB,QAAmB;YAEnB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CACtB,yBAAyB,kBAAkB,CAAC,cAAc,CAAC,WAAW,EACtE,EAAE,QAAQ,EAAE,EACZ,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;QACjD,CAAC;QAED,kFAAkF;QAClF,EAAE;QACF,+EAA+E;QAC/E,gFAAgF;QAChF,uEAAuE;QAEvE,4EAA4E;QAC5E,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,WAAmB;YAC5D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CACtB,uBAAuB,kBAAkB,CAAC,WAAW,CAAC,cAAc,EACpE,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAG,CAAC,CAAC,IAA+B,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;QAChD,CAAC;QAED,yEAAyE;QACzE,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,WAAmB;YACzD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CACtB,uBAAuB,kBAAkB,CAAC,WAAW,CAAC,WAAW,EACjE,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAG,CAAC,CAAC,IAA+B,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Public barrel for the framework's identity surface. Mirrors
+ * astram3/shared/src/auth/index.js MINUS the excluded cross-tenant/demo services —
+ * `createNotesService`, `createShareService`, and `createGrantService` are NOT ported
+ * and MUST NOT be re-exported here.
+ */
+export { createAuthService } from './authService.js';
+export { createAccountService } from './accountService.js';
+export { createIdentityService } from './identityService.js';
+export { createAuditService } from './auditService.js';
+export { isAuthenticated, accessTokenOf, tenantOf, principalOf } from './session.js';
+export { isRestorablePath, encodeReturnPath, decodeReturnPath } from './returnPath.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,13 @@
+/**
+ * Public barrel for the framework's identity surface. Mirrors
+ * astram3/shared/src/auth/index.js MINUS the excluded cross-tenant/demo services —
+ * `createNotesService`, `createShareService`, and `createGrantService` are NOT ported
+ * and MUST NOT be re-exported here.
+ */
+export { createAuthService } from './authService.js';
+export { createAccountService } from './accountService.js';
+export { createIdentityService } from './identityService.js';
+export { createAuditService } from './auditService.js';
+export { isAuthenticated, accessTokenOf, tenantOf, principalOf } from './session.js';
+export { isRestorablePath, encodeReturnPath, decodeReturnPath } from './returnPath.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/auth/returnPath.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Return-path logic — PURE + platform-agnostic (no storage). Lets the next successful
+ * login return the user to the page they were on when they left (logout OR session
+ * expiry), instead of always landing on /dashboard.
+ *
+ * Storage is the APP's concern (web: localStorage via platform/returnPathStore.js;
+ * mobile: AsyncStorage) — this module only decides WHICH paths are restorable and
+ * obfuscates/deobfuscates the value so a readable route isn't sitting in plain text.
+ * Obfuscation, not secrecy: the user owns their storage; the goal is "not human-readable".
+ */
+/**
+ * True for real in-app routes; false for empty, root, and auth/transient pages.
+ */
+export declare function isRestorablePath(path: string | null | undefined): boolean;
+/**
+ * Obfuscate `path` to an opaque blob, or null if non-restorable / btoa unavailable.
+ */
+export declare function encodeReturnPath(path: string | null | undefined): string | null;
+/**
+ * De-obfuscate a blob back to a path, or null if missing / corrupt / non-restorable.
+ */
+export declare function decodeReturnPath(blob: string | null | undefined): string | null;
+//# sourceMappingURL=returnPath.d.ts.map

package/dist/auth/returnPath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"returnPath.d.ts","sourceRoot":"","sources":["../../src/auth/returnPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA2CH;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAQzE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAS/E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAa/E"}

package/dist/auth/returnPath.js

@@ -0,0 +1,95 @@
+/**
+ * Return-path logic — PURE + platform-agnostic (no storage). Lets the next successful
+ * login return the user to the page they were on when they left (logout OR session
+ * expiry), instead of always landing on /dashboard.
+ *
+ * Storage is the APP's concern (web: localStorage via platform/returnPathStore.js;
+ * mobile: AsyncStorage) — this module only decides WHICH paths are restorable and
+ * obfuscates/deobfuscates the value so a readable route isn't sitting in plain text.
+ * Obfuscation, not secrecy: the user owns their storage; the goal is "not human-readable".
+ */
+// Fixed obfuscation key. Not a secret — see file header.
+const XOR_KEY = 'astram.return.v1';
+// Routes we must never restore to (auth / transient pages + root).
+const NON_RESTORABLE_PREFIXES = [
+    '/login',
+    '/forgot-password',
+    '/reset-password',
+    '/account/reenroll',
+];
+function getBtoa() {
+    const g = globalThis;
+    return typeof g.btoa === 'function' ? g.btoa : null;
+}
+function getAtob() {
+    const g = globalThis;
+    return typeof g.atob === 'function' ? g.atob : null;
+}
+// XOR each char code with the repeating key → a Latin-1 string btoa can encode.
+// Symmetric: applying twice returns the original.
+function xor(input) {
+    let out = '';
+    for (let i = 0; i < input.length; i++) {
+        out += String.fromCharCode(input.charCodeAt(i) ^ XOR_KEY.charCodeAt(i % XOR_KEY.length));
+    }
+    return out;
+}
+function toBase64Url(b64) {
+    return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function fromBase64Url(s) {
+    let b64 = s.replace(/-/g, '+').replace(/_/g, '/');
+    while (b64.length % 4 !== 0)
+        b64 += '=';
+    return b64;
+}
+/**
+ * True for real in-app routes; false for empty, root, and auth/transient pages.
+ */
+export function isRestorablePath(path) {
+    if (!path || path === '/')
+        return false;
+    // Strip any hash fragment before matching so /login#x is also rejected.
+    const bare = path.split('#')[0];
+    if (!bare || bare === '/')
+        return false;
+    return !NON_RESTORABLE_PREFIXES.some((p) => bare === p || bare.startsWith(p + '/') || bare.startsWith(p + '?'));
+}
+/**
+ * Obfuscate `path` to an opaque blob, or null if non-restorable / btoa unavailable.
+ */
+export function encodeReturnPath(path) {
+    if (!isRestorablePath(path))
+        return null;
+    const btoa = getBtoa();
+    if (!btoa)
+        return null;
+    try {
+        return toBase64Url(btoa(xor(path)));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * De-obfuscate a blob back to a path, or null if missing / corrupt / non-restorable.
+ */
+export function decodeReturnPath(blob) {
+    if (!blob)
+        return null;
+    const atob = getAtob();
+    if (!atob)
+        return null;
+    try {
+        const path = xor(atob(fromBase64Url(blob)));
+        // A tampered/corrupt blob can decode to arbitrary bytes; only accept a value that
+        // looks like a real path (leading slash, printable ASCII).
+        if (!/^\/[\x20-\x7E]*$/.test(path))
+            return null;
+        return isRestorablePath(path) ? path : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=returnPath.js.map

package/dist/auth/returnPath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"returnPath.js","sourceRoot":"","sources":["../../src/auth/returnPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yDAAyD;AACzD,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC,mEAAmE;AACnE,MAAM,uBAAuB,GAAG;IAC9B,QAAQ;IACR,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;CACpB,CAAC;AAEF,SAAS,OAAO;IACd,MAAM,CAAC,GAAG,UAAqE,CAAC;IAChF,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,OAAO;IACd,MAAM,CAAC,GAAG,UAAqE,CAAC;IAChF,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,gFAAgF;AAChF,kDAAkD;AAClD,SAAS,GAAG,CAAC,KAAa;IACxB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,GAAG,IAAI,GAAG,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA+B;IAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACxC,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA+B;IAC9D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA+B;IAC9D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,kFAAkF;QAClF,2DAA2D;QAC3D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Session helpers — pure, platform-agnostic. Storage is INJECTED (web: localStorage;
+ * mobile: AsyncStorage), so the shared logic never touches a platform storage API.
+ *
+ * A {@link SessionStore} is the tiny contract a platform provides.
+ */
+/** The framework session view. */
+export interface Session {
+    sessionId?: string;
+    principalId?: string;
+    tenantId?: string;
+    [key: string]: unknown;
+}
+/** The bearer + refresh tokens. */
+export interface SessionTokens {
+    accessToken?: string;
+    refreshToken?: string;
+}
+export interface SessionState {
+    /** the framework session view ({ sessionId, principalId, tenantId, ... }) */
+    session?: Session;
+    /** { accessToken, refreshToken } */
+    tokens?: SessionTokens;
+}
+/** The tiny contract a platform provides for loading/saving session state. */
+export interface SessionStore {
+    load: () => SessionState | null;
+    save: (state: SessionState | null) => void;
+}
+/** True if the state carries a usable access token. */
+export declare function isAuthenticated(state: SessionState | null | undefined): boolean;
+/** The bearer access token, or undefined. */
+export declare function accessTokenOf(state: SessionState | null | undefined): string | undefined;
+/** The current tenant id, or null. */
+export declare function tenantOf(state: SessionState | null | undefined): string | null;
+/** The principal id (who you're acting as), or null. */
+export declare function principalOf(state: SessionState | null | undefined): string | null;
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,kCAAkC;AAClC,MAAM,WAAW,OAAO;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,mCAAmC;AACnC,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,YAAY,GAAG,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,KAAK,IAAI,CAAC;CAC5C;AAED,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE/E;AAED,6CAA6C;AAC7C,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAExF;AAED,sCAAsC;AACtC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAE9E;AAED,wDAAwD;AACxD,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAEjF"}

package/dist/auth/session.js

@@ -0,0 +1,23 @@
+/**
+ * Session helpers — pure, platform-agnostic. Storage is INJECTED (web: localStorage;
+ * mobile: AsyncStorage), so the shared logic never touches a platform storage API.
+ *
+ * A {@link SessionStore} is the tiny contract a platform provides.
+ */
+/** True if the state carries a usable access token. */
+export function isAuthenticated(state) {
+    return Boolean(state?.tokens?.accessToken);
+}
+/** The bearer access token, or undefined. */
+export function accessTokenOf(state) {
+    return state?.tokens?.accessToken ?? undefined;
+}
+/** The current tenant id, or null. */
+export function tenantOf(state) {
+    return state?.session?.tenantId ?? null;
+}
+/** The principal id (who you're acting as), or null. */
+export function principalOf(state) {
+    return state?.session?.principalId ?? null;
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA6BH,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,KAAsC;IACpE,OAAO,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,aAAa,CAAC,KAAsC;IAClE,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;AACjD,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,QAAQ,CAAC,KAAsC;IAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,WAAW,CAAC,KAAsC;IAChE,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC;AAC7C,CAAC"}