@easygov/web-components 0.4.0 → 0.6.0

package/dist/header.js

@@ -1,2 +1,2 @@
-import{e}from"./chunk-XA367GUU.js";import{a as o,b as r}from"./chunk-4YTFOHWE.js";import"./chunk-O3IXHDLE.js";var m=r(o(e,{shadow:"open"}));customElements.define("eg-easygov-header",m);
+import{e}from"./chunk-C75LXA3C.js";import{a as o,b as r}from"./chunk-6QWPHBPC.js";import"./chunk-KIC76O54.js";var m=r(o(e,{shadow:"open"}));customElements.define("eg-easygov-header",m);
 //# sourceMappingURL=header.js.map

package/dist/index.d.ts

@@ -1,6 +1,150 @@
+type ManagementRoleType = 'SUPER_AGENT' | 'AGENT';
+/** Verification level of a customer account's identity. */
+type AccountVerificationStatus = 'NOT_VERIFIED' | 'VERIFIED';
+/**
+ * Verification of a management-role grant. Same values as `AccountVerificationStatus` today, but
+ * a separate type deliberately: it verifies a different thing (the grant, not the identity) and
+ * the two are free to diverge on the wire.
+ */
+type ManagementRoleStatus = 'NOT_VERIFIED' | 'VERIFIED';
+type ProcessStatus = 'PRELIMINARY' | 'REQUEST_IN_PROGRESS' | 'REQUEST_COMPLETED' | 'SERVICE_PROVISION_PENDING' | 'FINISHED' | 'CANCELED';
+/** An Agent's permission level on one ServiceApp (Leistungsberechtigung). */
+type PermissionLevel = 'READ_ONLY' | 'EDIT' | 'AUTHORIZE';
+/**
+ * An Agent's ServicePermission for the current ServiceApp. Decoded from the context JWT, signature
+ * unverified: safe to render, never to authorize.
+ */
+interface ServicePermission {
+    /** Always the current ServiceApp's id (`HeaderContextClaims.serviceApp.id`). */
+    serviceAppId: string;
+    permissionLevel: PermissionLevel;
+}
+/**
+ * The caller's management role on the selected account: SUPER_AGENT (Kontoverwalter/in,
+ * unrestricted) or AGENT (Mitwirkende/r, restricted by per-service permissions).
+ * @see HeaderContextClaims for unverified-claims boundary; roleType and status must not drive authorization.
+ */
+interface ManagementRole {
+    roleType: ManagementRoleType;
+    /** Only present for SUPER_AGENT. */
+    status?: ManagementRoleStatus;
+    /**
+     * Only for an AGENT, and only for the current ServiceApp. Absent for a SUPER_AGENT, on a screen
+     * without a current ServiceApp, for an app with the individual permission model (the fach module
+     * manages those rights), and when the Agent holds no permission on the app. Absent never means
+     * "allowed".
+     */
+    servicePermission?: ServicePermission;
+}
+interface CustomerAccountBase {
+    id: string;
+    label: string;
+    status: AccountVerificationStatus;
+    managementRole: ManagementRole;
+}
+/**
+ * A customer account of type ORGANIZATION. Decoded from the context JWT, signature unverified: safe to render, never to authorize.
+ */
+interface OrganizationAccount extends CustomerAccountBase {
+    accountType: 'ORGANIZATION';
+    legalForm: string;
+    /** Absent while the organization has no UID register entry. */
+    uid?: string;
+}
+/**
+ * A customer account of type INDIVIDUAL. Decoded from the context JWT, signature unverified: safe to render, never to authorize.
+ */
+interface IndividualAccount extends CustomerAccountBase {
+    accountType: 'INDIVIDUAL';
+}
+/**
+ * Discriminated on `accountType` — narrow before reading organization-only fields.
+ * Decoded from the context JWT, signature unverified: safe to render, never to authorize.
+ */
+type SelectedCustomerAccount = OrganizationAccount | IndividualAccount;
+/**
+ * The ServiceApp the current screen belongs to, resolved by core from the screen URL.
+ * Decoded from the context JWT, signature unverified: safe to render, never to authorize.
+ */
+interface ServiceApp {
+    id: string;
+    /** The fach module, not core, manages the Agents' rights for this ServiceApp. */
+    individualServicePermissionModel: boolean;
+}
+/**
+ * The selected Behördengang. Its ServiceApp is a reference only; on a screen of that ServiceApp
+ * it equals `HeaderContextClaims.serviceApp.id`.
+ * Decoded from the context JWT, signature unverified: safe to render, never to authorize.
+ */
+interface SelectedProcess {
+    id: string;
+    status: ProcessStatus;
+    serviceAppId: string;
+    /**
+     * Global identifier of this process's own parent. Absent for a top-level Behördengang. This
+     * reference is the only representation of a selected process's parent: the context carries no
+     * ancestor chain.
+     */
+    parentProcessId?: string;
+}
+/**
+ * The authenticated user's identity and profile information.
+ * Decoded from the context JWT, signature unverified: safe to render, never to authorize.
+ */
+interface UserProfile {
+    id: string;
+    eiamIdentity: string;
+    eiamSSOsessionID: string;
+    qoA: number;
+    emailAddress?: string;
+    firstName?: string;
+    lastName?: string;
+    roles?: string[];
+}
+/**
+ * Decoded payload of `contextJwt`. The signature is NOT verified by EasygovHeader — the
+ * authenticated HTTPS fetch to core-backend is the trust boundary. Safe for prefilling forms and
+ * rendering decisions; never for authorization. A backend receiving this JWT MUST verify it
+ * against core-backend's published JWKS.
+ */
+interface HeaderContextClaims {
+    currentUser: UserProfile;
+    customerAccount?: SelectedCustomerAccount;
+    /**
+     * The ServiceApp the current screen belongs to. Absent on core and info pages and on a URL that
+     * matches no registered ServiceApp.
+     */
+    serviceApp?: ServiceApp;
+    /**
+     * The Behördengang the URL selects (`/process/{id}`). Mutually exclusive with `parentProcessId`.
+     */
+    process?: SelectedProcess;
+    /**
+     * The Behördengang a sub-process is about to be created under (`/parentprocess/{id}`), by id
+     * only. Mutually exclusive with `process`. A selected process's own parent is
+     * `process.parentProcessId`.
+     */
+    parentProcessId?: string;
+}
+/**
+ * `detail` of the `contextchange` CustomEvent. The event fires for every new JWT, which includes
+ * the background refresh that renews it shortly before it expires; `contentChanged` says whether
+ * `claims` differs from what the previous event delivered.
+ */
+interface HeaderContextChangeDetail {
+    contextJwt: string;
+    claims: HeaderContextClaims;
+    /**
+     * `true` for the first context of a session and whenever `claims` differs from the previous
+     * event's. `false` for a refresh that only renewed the token: prefilling a form from `claims`
+     * on such an event would overwrite what the user has typed since.
+     */
+    contentChanged: boolean;
+}
+
 declare function getDisplayLanguage(): string;
 declare function setDisplayLanguage(locale: string): void;
 declare function subscribeDisplayLanguage(listener: () => void): () => void;
 declare function setBusinessModuleVersion(version: string): void;
 
-export { getDisplayLanguage, setBusinessModuleVersion, setDisplayLanguage, subscribeDisplayLanguage };
+export { type HeaderContextChangeDetail, getDisplayLanguage, setBusinessModuleVersion, setDisplayLanguage, subscribeDisplayLanguage };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{a as e,b as a,c as i,d as g}from"./chunk-XA367GUU.js";import"./chunk-O3IXHDLE.js";function o(){return a()}function t(s){i(s)}function r(s){return g(s)}function u(s){e(s)}export{o as getDisplayLanguage,u as setBusinessModuleVersion,t as setDisplayLanguage,r as subscribeDisplayLanguage};
+import{a as s,b as a,c as t,d as o}from"./chunk-C75LXA3C.js";import"./chunk-KIC76O54.js";function i(){return a()}function g(e){t(e)}function r(e){return o(e)}function u(e){s(e)}export{i as getDisplayLanguage,u as setBusinessModuleVersion,g as setDisplayLanguage,r as subscribeDisplayLanguage};
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// No side-effecting element registration here. Consumers that need\n// <eg-easygov-header>/<eg-easygov-footer> registered import '@easygov/web-components/header'\n// and/or '@easygov/web-components/footer' directly, so an app using only one element doesn't\n// pull in the other.\n//\n// This entry exposes only the DisplayLanguage API (wrapped in local functions, not re-exported\n// directly) — deliberately not the raw React components (EasygovHeader/EasygovFooter) either.\n// @easygov/react-components' exports point at its JSX .tsx source (see CLAUDE.md), so any live\n// `from '@easygov/react-components'` type specifier here — a component re-export or a bare\n// `export { ... } from` for these functions — would force every consumer's compiler to resolve\n// that source, breaking non-React/non-JSX consumers like Angular. Wrapping locally keeps the\n// emitted .d.ts self-contained; `locale` is widened to `string` for the same reason, decoupling\n// our public types from react-components' internal `Locale` union. A React app that wants the\n// component directly should depend on @easygov/react-components itself.\n//\n// This bundle inlines its own copy of @easygov/react-components, so a web-component consumer\n// that separately npm-imported @easygov/react-components directly would be talking to a\n// *different* store instance — this package's own export is the supported surface here.\nimport {\n  getEasygovDisplayLanguage,\n  setEasygovDisplayLanguage,\n  setEasygovBusinessModuleVersion,\n  subscribeEasygovDisplayLanguage,\n} from '@easygov/react-components';\n\nexport function getDisplayLanguage(): string {\n  return getEasygovDisplayLanguage();\n}\n\n// No runtime validation here, matching setEasygovDisplayLanguage itself (it writes the cookie\n// unconditionally with no isSupportedLocale check) and this package's previous public contract\n// (the CDN global's setDisplayLanguage(locale: string) was equally unchecked). isSupportedLocale\n// is not part of @easygov/react-components' public exports, so this package has no way to guard\n// the value before the cast even if it wanted to; an invalid locale ends up handled the same way\n// t() already handles one — falling back to \"en\"/the raw key — not a new failure mode.\nexport function setDisplayLanguage(locale: string): void {\n  setEasygovDisplayLanguage(locale as Parameters<typeof setEasygovDisplayLanguage>[0]);\n}\n\nexport function subscribeDisplayLanguage(listener: () => void): () => void {\n  return subscribeEasygovDisplayLanguage(listener);\n}\n\nexport function setBusinessModuleVersion(version: string): void {\n  setEasygovBusinessModuleVersion(version);\n}\n"],"mappings":"yFAyBO,SAASA,GAA6B,CAC3C,OAAOC,EAA0B,CACnC,CAQO,SAASC,EAAmBC,EAAsB,CACvDC,EAA0BD,CAAyD,CACrF,CAEO,SAASE,EAAyBC,EAAkC,CACzE,OAAOC,EAAgCD,CAAQ,CACjD,CAEO,SAASE,EAAyBC,EAAuB,CAC9DC,EAAgCD,CAAO,CACzC","names":["getDisplayLanguage","getEasygovDisplayLanguage","setDisplayLanguage","locale","setEasygovDisplayLanguage","subscribeDisplayLanguage","listener","subscribeEasygovDisplayLanguage","setBusinessModuleVersion","version","setEasygovBusinessModuleVersion"]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// No side-effecting element registration here. Consumers that need\n// <eg-easygov-header>/<eg-easygov-footer> registered import '@easygov/web-components/header'\n// and/or '@easygov/web-components/footer' directly, so an app using only one element doesn't\n// pull in the other.\n//\n// This entry exposes only the DisplayLanguage API (wrapped in local functions, not re-exported\n// directly) — deliberately not the raw React components (EasygovHeader/EasygovFooter) either.\n// @easygov/react-components' exports point at its JSX .tsx source (see CLAUDE.md), so any live\n// `from '@easygov/react-components'` type specifier here — a component re-export or a bare\n// `export { ... } from` for these functions — would force every consumer's compiler to resolve\n// that source, breaking non-React/non-JSX consumers like Angular. Wrapping locally keeps the\n// emitted .d.ts self-contained; `locale` is widened to `string` for the same reason, decoupling\n// our public types from react-components' internal `Locale` union. A React app that wants the\n// component directly should depend on @easygov/react-components itself.\n//\n// This bundle inlines its own copy of @easygov/react-components, so a web-component consumer\n// that separately npm-imported @easygov/react-components directly would be talking to a\n// *different* store instance — this package's own export is the supported surface here.\nimport {\n  getEasygovDisplayLanguage,\n  setEasygovDisplayLanguage,\n  setEasygovBusinessModuleVersion,\n  subscribeEasygovDisplayLanguage,\n} from '@easygov/react-components';\n\nexport function getDisplayLanguage(): string {\n  return getEasygovDisplayLanguage();\n}\n\n// No runtime validation here, matching setEasygovDisplayLanguage itself (it writes the cookie\n// unconditionally with no isSupportedLocale check) and this package's previous public contract\n// (the CDN global's setDisplayLanguage(locale: string) was equally unchecked). isSupportedLocale\n// is not part of @easygov/react-components' public exports, so this package has no way to guard\n// the value before the cast even if it wanted to; an invalid locale ends up handled the same way\n// t() already handles one — falling back to \"en\"/the raw key — not a new failure mode.\nexport function setDisplayLanguage(locale: string): void {\n  setEasygovDisplayLanguage(locale as Parameters<typeof setEasygovDisplayLanguage>[0]);\n}\n\nexport function subscribeDisplayLanguage(listener: () => void): () => void {\n  return subscribeEasygovDisplayLanguage(listener);\n}\n\nexport function setBusinessModuleVersion(version: string): void {\n  setEasygovBusinessModuleVersion(version);\n}\n\n// The `detail` of the header's `contextchange` event. A relative import of react-components'\n// types.ts rather than `from '@easygov/react-components'`, for the reason above: that file holds\n// only type declarations with no imports, so tsup's dts build inlines it and the emitted .d.ts\n// stays self-contained, without a second hand-kept copy of the claims schema to drift.\nexport type { HeaderContextChangeDetail } from '../../react-components/src/ui/EasygovHeader/types';\n"],"mappings":"yFAyBO,SAASA,GAA6B,CAC3C,OAAOC,EAA0B,CACnC,CAQO,SAASC,EAAmBC,EAAsB,CACvDC,EAA0BD,CAAyD,CACrF,CAEO,SAASE,EAAyBC,EAAkC,CACzE,OAAOC,EAAgCD,CAAQ,CACjD,CAEO,SAASE,EAAyBC,EAAuB,CAC9DC,EAAgCD,CAAO,CACzC","names":["getDisplayLanguage","getEasygovDisplayLanguage","setDisplayLanguage","locale","setEasygovDisplayLanguage","subscribeDisplayLanguage","listener","subscribeEasygovDisplayLanguage","setBusinessModuleVersion","version","setEasygovBusinessModuleVersion"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easygov/web-components",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "private": false,
   "description": "Framework-agnostic custom elements for EasyGov, wrapping @easygov/react-components as a self-contained browser bundle.",
   "license": "MIT",
@@ -43,14 +43,14 @@
   },
   "devDependencies": {
     "@easygov/eslint-config": "0.0.0",
-    "@easygov/react-components": "0.11.0",
+    "@easygov/react-components": "0.14.0",
     "@easygov/typescript-config": "0.0.0",
     "@types/node": "^24.0.0",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "eslint": "^9.39.1",
-    "react": "19.3.0",
-    "react-dom": "19.3.0",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
     "serve": "^14.2.6",
     "tsup": "^8.5.1",
     "typescript": "5.9.3"