@flusys/ng-auth 1.1.0-beta → 2.0.0-rc.0

package/types/flusys-ng-auth.d.ts

@@ -1,8 +1,8 @@
-import { IMessageResponse, ApiResourceService, ISingleResponse, IUserProvider, IListResponse, IUserBasicInfo, ICompanyApiProvider, ICompanyBasicInfo, IUserPermissionProvider, IProfileRoleInfo, IProfileActionInfo, UploadFileFn } from '@flusys/ng-shared';
+import { IMessageResponse, ApiResourceService, ISingleResponse, ICompanyApiProvider, IListResponse, ICompanyBasicInfo, IAuthStateProvider, IUserPermissionProvider, IUserProvider, IUserBasicInfo, IProfileRoleInfo, IProfileActionInfo, UploadFileFn } from '@flusys/ng-shared';
 import * as rxjs from 'rxjs';
 import { Observable } from 'rxjs';
 import * as _angular_core from '@angular/core';
-import { Signal, Provider, OnInit } from '@angular/core';
+import { Signal, Provider } from '@angular/core';
 import { HttpClient, HttpRequest, HttpHandlerFn, HttpEvent } from '@angular/common/http';
 import { CanActivateFn, Routes } from '@angular/router';
 import { ILayoutAuthApi, ICompanyInfo as ICompanyInfo$1, IBranchInfo as IBranchInfo$1, ILayoutAuthState, IUserInfo as IUserInfo$1 } from '@flusys/ng-layout';
@@ -10,17 +10,10 @@ import * as _angular_forms_signals from '@angular/forms/signals';
 import * as _flusys_ng_auth from '@flusys/ng-auth';
 import * as _flusys_ng_core from '@flusys/ng-core';
 
-/**
- * Login Request Interface
- */
 interface ILoginRequest {
     email: string;
     password: string;
 }
-/**
- * Registration Request Interface
- * Supports both simple registration and company-based registration
- */
 interface IRegistrationRequest {
     name: string;
     email: string;
@@ -32,33 +25,19 @@ interface IRegistrationRequest {
     newCompanyPhone?: string;
     newCompanyAddress?: string;
 }
-/**
- * Select Company & Branch Request Interface
- * Used after login when user needs to select company and branch
- */
 interface ISelectRequest {
     sessionId: string;
     companyId: string;
     branchId: string;
 }
-/**
- * Switch Company Request Interface
- * Used to switch company/branch after login
- */
 interface ISwitchCompanyRequest {
     companyId: string;
     branchId: string;
 }
-/**
- * Change Password Request Interface
- */
 interface IChangePasswordRequest {
     currentPassword: string;
     newPassword: string;
 }
-/**
- * User Info Interface (used in responses)
- */
 interface IUserInfo {
     id: string;
     email: string;
@@ -70,84 +49,51 @@ interface IUserInfo {
     companyLogoId?: string;
     branchLogoId?: string;
 }
-/**
- * Company Info Interface (used in responses)
- */
 interface ICompanyInfo {
     id: string;
     name: string;
     slug?: string;
     logoId?: string | null;
 }
-/**
- * Branch Info Interface (used in responses)
- */
 interface IBranchInfo {
     id: string;
     name: string;
     slug?: string;
     logoId?: string | null;
 }
-/**
- * Branch Selection Info Interface (with additional fields)
- */
 interface IBranchSelectionInfo {
     id: string;
     name: string;
     slug: string;
-    isActive: boolean;
     logoId?: string | null;
 }
-/**
- * Company with Branches Interface (for selection response)
- */
 interface ICompanyWithBranches {
     id: string;
     name: string;
     slug: string;
-    isActive: boolean;
     logoId?: string | null;
     branches: IBranchSelectionInfo[];
 }
-/**
- * Login Response Interface
- * Returned on successful login with tokens
- */
 interface ILoginResponse {
     accessToken: string;
     refreshToken: string;
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
-    companyFeatureEnabled?: boolean;
 }
-/**
- * Me Response Interface
- * Returned by GET /auth/me endpoint
- * Contains only user data, no tokens
- */
 interface IMeResponse {
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
 }
-/**
- * Registration Response Interface
- * Returned on successful registration
- */
 interface IRegistrationResponse {
     accessToken?: string;
     refreshToken?: string;
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
-    companyFeatureEnabled?: boolean;
     requiresEmailVerification?: boolean;
 }
-/**
- * Company Selection Response Interface
- * Returned when user has multiple companies/branches to choose from
- */
 interface ICompanySelectionResponse {
     requiresSelection: true;
     sessionId: string;
@@ -155,41 +101,20 @@ interface ICompanySelectionResponse {
     user: IUserInfo;
     companies: ICompanyWithBranches[];
 }
-/**
- * Refresh Token Response Interface
- */
 interface IRefreshTokenResponse {
     accessToken: string;
     refreshToken?: string;
 }
-/**
- * Login Response when email verification required
- */
 interface ILoginRequiresEmailVerification {
     requiresEmailVerification: true;
     email: string;
     message: string;
 }
-/**
- * Auth Response Type - Can be login success, company selection, or email verification required
- */
 type AuthResponse = ILoginResponse | ICompanySelectionResponse | ILoginRequiresEmailVerification;
-/**
- * Type guard to check if response requires email verification
- */
 declare function isEmailVerificationRequired(response: AuthResponse): response is ILoginRequiresEmailVerification;
-/**
- * Type guard to check if response requires company selection
- */
 declare function isCompanySelectionResponse(response: AuthResponse): response is ICompanySelectionResponse;
-/**
- * Type guard to check if response is a successful login
- */
 declare function isLoginResponse(response: AuthResponse): response is ILoginResponse;
 
-/**
- * Create Company Branch Request Interface
- */
 interface ICreateBranchRequest {
     name: string;
     slug: string;
@@ -203,15 +128,9 @@ interface ICreateBranchRequest {
     isActive?: boolean;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * Update Company Branch Request Interface
- */
 interface IUpdateBranchRequest extends Partial<Omit<ICreateBranchRequest, 'companyId'>> {
     id: string;
 }
-/**
- * Company Branch Response Interface
- */
 interface IBranch {
     id: string;
     name: string;
@@ -230,9 +149,6 @@ interface IBranch {
     updatedAt: Date | string;
 }
 
-/**
- * Create Company Request Interface
- */
 interface ICreateCompanyRequest {
     name: string;
     slug: string;
@@ -246,15 +162,9 @@ interface ICreateCompanyRequest {
     settings?: Record<string, unknown>;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * Update Company Request Interface
- */
 interface IUpdateCompanyRequest extends Partial<ICreateCompanyRequest> {
     id: string;
 }
-/**
- * Company Response Interface
- */
 interface ICompany {
     id: string;
     name: string;
@@ -273,88 +183,48 @@ interface ICompany {
     updatedAt: Date | string;
 }
 
-/**
- * Permission item for batch assignment/revocation
- */
 interface IPermissionItem {
-    /** Target ID (Company ID or Branch ID) */
     targetId: string;
-    /** Action: true to add permission, false to remove permission */
     isAdd: boolean;
 }
-/**
- * Batch assign/revoke user-company permissions request
- */
 interface IAssignUserCompanyRequest {
-    /** User ID to assign/revoke permissions for */
     userId: string;
-    /** List of company permissions to add or remove */
     items: IPermissionItem[];
 }
-/**
- * Batch assign/revoke user-branch permissions request
- */
 interface IAssignUserBranchRequest {
-    /** User ID to assign/revoke permissions for */
     userId: string;
-    /** List of branch permissions to add or remove */
     items: IPermissionItem[];
 }
-/**
- * User company permission with populated company details
- */
 interface IUserCompanyPermission {
-    /** Permission ID */
     id: string;
-    /** User ID */
     userId: string;
-    /** Company ID */
     companyId: string;
-    /** Company name */
     companyName: string;
-    /** Company slug */
     companySlug: string;
 }
-/**
- * User branch permission with populated branch details
- */
 interface IUserBranchPermission {
-    /** Permission ID */
     id: string;
-    /** User ID */
     userId: string;
-    /** Branch ID */
     branchId: string;
-    /** Branch name */
     branchName: string;
-    /** Branch slug */
     branchSlug: string;
-    /** Company ID this branch belongs to */
     companyId: string;
 }
-/**
- * Response for user companies
- */
 interface IUserCompaniesResponse {
+    success: boolean;
+    message: string;
     data: IUserCompanyPermission[];
 }
-/**
- * Response for user branches
- */
 interface IUserBranchesResponse {
+    success: boolean;
+    message: string;
     data: IUserBranchPermission[];
 }
-/**
- * Batch operation result response
- */
 interface IBatchOperationResponse {
     success: boolean;
     message: string;
 }
 
-/**
- * Create User Request Interface
- */
 interface ICreateUserRequest {
     name: string;
     email: string;
@@ -366,14 +236,12 @@ interface ICreateUserRequest {
     phoneVerified?: boolean;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * Update User Request Interface
- */
 interface IUpdateUserRequest {
     id: string;
     name?: string;
     email?: string;
     password?: string;
+    oldPassword?: string;
     phone?: string;
     profilePictureId?: string;
     isActive?: boolean;
@@ -381,9 +249,6 @@ interface IUpdateUserRequest {
     phoneVerified?: boolean;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * User Response Interface
- */
 interface IUser {
     id: string;
     name: string;
@@ -519,29 +384,54 @@ declare class AuthInitService {
 declare class AuthStateService {
     private readonly appConfig;
     private readonly router;
-    readonly user: _angular_core.WritableSignal<IUserInfo | null>;
-    readonly accessToken: _angular_core.WritableSignal<string>;
-    readonly company: _angular_core.WritableSignal<ICompanyInfo | null>;
-    readonly branch: _angular_core.WritableSignal<IBranchInfo | null>;
-    readonly selectionSessionId: _angular_core.WritableSignal<string | null>;
-    readonly availableCompanies: _angular_core.WritableSignal<ICompanyWithBranches[]>;
-    readonly selectionExpiresAt: _angular_core.WritableSignal<Date | null>;
+    private readonly platform;
+    private readonly _user;
+    private readonly _accessToken;
+    private readonly _tokenExpiresAt;
+    private readonly _company;
+    private readonly _branch;
+    readonly user: _angular_core.Signal<IUserInfo | null>;
+    readonly accessToken: _angular_core.Signal<string>;
+    readonly tokenExpiresAt: _angular_core.Signal<number | null>;
+    readonly company: _angular_core.Signal<ICompanyInfo | null>;
+    readonly branch: _angular_core.Signal<IBranchInfo | null>;
+    private readonly _selectionSessionId;
+    private readonly _availableCompanies;
+    private readonly _selectionExpiresAt;
+    readonly selectionSessionId: _angular_core.Signal<string | null>;
+    readonly availableCompanies: _angular_core.Signal<ICompanyWithBranches[]>;
     readonly isAuthenticated: _angular_core.Signal<boolean>;
     readonly requiresCompanySelection: _angular_core.Signal<boolean>;
     readonly userName: _angular_core.Signal<string>;
     readonly companyName: _angular_core.Signal<string>;
     readonly branchName: _angular_core.Signal<string>;
+    /**
+     * Check if token is expired or will expire soon (within 30 seconds).
+     * Used to proactively refresh token before requests fail.
+     */
+    readonly isTokenExpired: _angular_core.Signal<boolean>;
     readonly tenantId: _angular_core.Signal<string | null>;
     constructor();
     setLoginState(response: ILoginResponse): void;
     setSelectionState(response: ICompanySelectionResponse): void;
     clearSelectionState(): void;
     resetState(): void;
+    setUser(user: IUserInfo | null): void;
+    setAccessToken(token: string): void;
+    setCompany(company: ICompanyInfo | null): void;
+    setBranch(branch: IBranchInfo | null): void;
     navigateToLogin(returnUrl?: string): void;
     navigateAfterLogin(returnUrl?: string): void;
+    /** Validates a return URL to prevent open redirect attacks */
+    private isValidReturnUrl;
     getStoredCompanyId(): string | null;
     getStoredBranchId(): string | null;
     private loadFromStorage;
+    /**
+     * Decode JWT expiry without verification (client-side only).
+     * Returns expiry timestamp in milliseconds.
+     */
+    private decodeTokenExpiry;
     private store;
     private get;
     private remove;
@@ -552,45 +442,11 @@ declare class AuthStateService {
 /**
  * Branch API Service
  * Signal-based service for branch CRUD operations
- * Branches default to current company context
- *
- * @example
- * ```typescript
- * branchService = inject(BranchApiService);
- *
- * // Set current company context
- * branchService.setCurrentCompanyId('company-uuid');
- *
- * // Access data via signals
- * branches = this.branchService.data;
- * isLoading = this.branchService.isLoading;
- *
- * // Fetch branches (will filter by current company)
- * this.branchService.fetchList('search');
- *
- * // Create branch (companyId will be auto-set if not provided)
- * await this.branchService.insertBranch({ name: 'New Branch', slug: 'new-branch' });
- * ```
  */
 declare class BranchApiService extends ApiResourceService<ICreateBranchRequest | IUpdateBranchRequest, IBranch> {
-    /** Current company context for branch operations */
-    readonly currentCompanyId: _angular_core.WritableSignal<string | null>;
-    /** Branches filtered by current company */
-    readonly companyBranches: _angular_core.Signal<IBranch[]>;
+    private readonly _currentCompanyId;
     constructor(http: HttpClient);
-    /**
-     * Set the current company context for branch operations
-     */
     setCurrentCompanyId(companyId: string | null): void;
-    /**
-     * Insert a new branch, auto-setting companyId if not provided
-     */
-    insertBranch(data: Omit<ICreateBranchRequest, 'companyId'> & {
-        companyId?: string;
-    }): Promise<ReturnType<typeof this.insertAsync>>;
-    /**
-     * Fetch branches for a specific company
-     */
     fetchByCompany(companyId: string, search?: string): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<BranchApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<BranchApiService>;
@@ -599,21 +455,6 @@ declare class BranchApiService extends ApiResourceService<ICreateBranchRequest |
 /**
  * Company API Service
  * Signal-based service for company CRUD operations
- *
- * @example
- * ```typescript
- * companyService = inject(CompanyApiService);
- *
- * // Access data via signals
- * companies = this.companyService.data;
- * isLoading = this.companyService.isLoading;
- *
- * // Fetch companies
- * this.companyService.fetchList('search', { pagination: { currentPage: 0, pageSize: 10 } });
- *
- * // Create company
- * await this.companyService.insertAsync({ name: 'New Company', slug: 'new-company' });
- * ```
  */
 declare class CompanyApiService extends ApiResourceService<ICreateCompanyRequest | IUpdateCompanyRequest, ICompany> {
     constructor(http: HttpClient);
@@ -623,40 +464,16 @@ declare class CompanyApiService extends ApiResourceService<ICreateCompanyRequest
 
 /**
  * Token Refresh State Service
- *
- * Manages token refresh state in a request-safe manner for SSR environments.
- * Replaces module-level state that would be shared across requests in SSR.
- *
- * @example
- * ```typescript
- * const refreshState = inject(TokenRefreshStateService);
- *
- * if (refreshState.isRefreshing()) {
- *   // Queue request
- * } else {
- *   refreshState.startRefresh();
- *   // Perform refresh
- * }
- * ```
+ * Manages token refresh state for SSR-safe request queuing.
+ * Uses BehaviorSubject for RxJS interop (multi-subscriber async coordination).
  */
 declare class TokenRefreshStateService {
-    /** Flag to track if token refresh is in progress */
     private readonly _isRefreshing;
     readonly isRefreshing: _angular_core.Signal<boolean>;
-    /** Subject to queue requests while refreshing */
     private readonly _refreshTokenSubject;
     readonly refreshTokenSubject$: rxjs.Observable<string | null>;
-    /**
-     * Mark refresh as started
-     */
     startRefresh(): void;
-    /**
-     * Mark refresh as completed and broadcast new token
-     */
     completeRefresh(newToken: string): void;
-    /**
-     * Mark refresh as failed
-     */
     failRefresh(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<TokenRefreshStateService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<TokenRefreshStateService>;
@@ -665,43 +482,9 @@ declare class TokenRefreshStateService {
 /**
  * User API Service
  * Signal-based service for user CRUD operations
- *
- * @example
- * ```typescript
- * userService = inject(UserApiService);
- *
- * // Access data via signals
- * users = this.userService.data;
- * isLoading = this.userService.isLoading;
- *
- * // Fetch users
- * this.userService.fetchList('search', { pagination: { currentPage: 0, pageSize: 10 } });
- *
- * // Create user
- * await this.userService.insertAsync({
- *   name: 'John Doe',
- *   email: 'john@example.com',
- *   password: 'password123'
- * });
- * ```
  */
 declare class UserApiService extends ApiResourceService<ICreateUserRequest | IUpdateUserRequest, IUser> {
     constructor(http: HttpClient);
-    /**
-     * Verify user's email
-     */
-    verifyEmail(userId: string): Observable<IMessageResponse>;
-    /**
-     * Verify user's phone
-     */
-    verifyPhone(userId: string): Observable<IMessageResponse>;
-    /**
-     * Update user status (active/inactive)
-     */
-    updateStatus(userId: string, isActive: boolean): Observable<IMessageResponse>;
-    /**
-     * Update current user's profile
-     */
     updateProfile(data: IUpdateUserRequest): Observable<ISingleResponse<IUser>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<UserApiService>;
@@ -709,167 +492,29 @@ declare class UserApiService extends ApiResourceService<ICreateUserRequest | IUp
 
 /**
  * User Permission API Service
- *
  * Handles user-company and user-branch permission assignments.
- * Uses batch operations for efficient permission management.
- *
- * Backend Endpoints:
- * - POST /administration/permissions/user-company/assign - Batch assign/revoke company permissions
- * - GET /administration/permissions/user-company?userId=xxx - Get user's companies
- * - POST /administration/permissions/user-branch/assign - Batch assign/revoke branch permissions
- * - GET /administration/permissions/user-branch?userId=xxx - Get user's branches
  */
 declare class UserPermissionApiService {
     private readonly appConfig;
     private readonly http;
     private readonly baseUrl;
-    constructor();
-    /**
-     * Batch assign/revoke user-company permissions
-     *
-     * @example
-     * // Add company permissions
-     * service.assignUserCompanies({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'company-1', isAdd: true },
-     *     { targetId: 'company-2', isAdd: true }
-     *   ]
-     * });
-     *
-     * @example
-     * // Remove company permissions
-     * service.assignUserCompanies({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'company-1', isAdd: false }
-     *   ]
-     * });
-     */
     assignUserCompanies(data: IAssignUserCompanyRequest): Observable<IBatchOperationResponse>;
-    /**
-     * Assign single company to user (convenience method)
-     */
     assignUserToCompany(userId: string, companyId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Revoke single company from user (convenience method)
-     */
     revokeUserFromCompany(userId: string, companyId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Get user's company permissions
-     *
-     * @param userId - User ID to get companies for
-     * @returns Observable with user's company permissions
-     */
     getUserCompanies(userId: string): Observable<IUserCompaniesResponse>;
-    /**
-     * Batch assign/revoke user-branch permissions
-     *
-     * @example
-     * // Add branch permissions
-     * service.assignUserBranches({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'branch-1', isAdd: true },
-     *     { targetId: 'branch-2', isAdd: true }
-     *   ]
-     * });
-     *
-     * @example
-     * // Remove branch permissions
-     * service.assignUserBranches({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'branch-1', isAdd: false }
-     *   ]
-     * });
-     */
     assignUserBranches(data: IAssignUserBranchRequest): Observable<IBatchOperationResponse>;
-    /**
-     * Assign single branch to user (convenience method)
-     */
     assignUserToBranch(userId: string, branchId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Revoke single branch from user (convenience method)
-     */
     revokeUserFromBranch(userId: string, branchId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Get user's branch permissions
-     *
-     * @param userId - User ID to get branches for
-     * @returns Observable with user's branch permissions
-     */
-    getUserBranches(userId: string): Observable<IUserBranchesResponse>;
+    getUserBranches(userId: string, companyId?: string): Observable<IUserBranchesResponse>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserPermissionApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<UserPermissionApiService>;
 }
 
-/**
- * Auth Guard
- * Protects routes that require authentication.
- *
- * Session restoration is handled by guestGuard. This guard assumes
- * the session has already been restored if user accessed login page first.
- *
- * Handles company feature:
- * - If company feature enabled and no company selected, redirects to login
- *   (login page handles company selection as step 2)
- * - If not authenticated, redirects to login
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'dashboard',
- *   loadComponent: () => import('./dashboard.component'),
- *   canActivate: [authGuard]
- * }
- * ```
- */
+/** Protects routes requiring authentication */
 declare const authGuard: CanActivateFn;
-/**
- * Guest Guard
- * Protects auth routes (login, register) from authenticated users.
- * Redirects authenticated users to home page.
- *
- * CRITICAL: Unlike old implementation, this guard RESTORES the session first
- * before checking authentication. This handles the case when users directly
- * navigate to /auth/login via browser URL while having valid refresh token.
- *
- * Flow:
- * 1. Restore session (if needed) via AuthInitService.initialize()
- * 2. Check if user is authenticated
- * 3. If authenticated -> redirect to dashboard
- * 4. If not authenticated -> allow access to login page
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'auth/login',
- *   loadComponent: () => import('./login.component'),
- *   canActivate: [guestGuard]
- * }
- * ```
- */
+/** Protects auth routes from authenticated users, restores session first */
 declare const guestGuard: CanActivateFn;
-/**
- * Company Feature Guard
- * Protects routes that require company feature to be enabled.
- * Redirects to home if company feature is disabled.
- *
- * Use this guard on company/branch management routes.
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'administration/company',
- *   loadComponent: () => import('./company-list.component'),
- *   canActivate: [authGuard, companyFeatureGuard]
- * }
- * ```
- */
+/** Protects routes requiring company feature to be enabled */
 declare const companyFeatureGuard: CanActivateFn;
 
 /**
@@ -877,26 +522,7 @@ declare const companyFeatureGuard: CanActivateFn;
  */
 declare function authInterceptor(req: HttpRequest<unknown>, next: HttpHandlerFn): Observable<HttpEvent<unknown>>;
 
-/**
- * Token Refresh Interceptor
- * Handles 401 errors by refreshing the access token.
- *
- * - Intercepts 401 Unauthorized responses
- * - Calls refresh token endpoint
- * - Retries failed request with new token
- * - Queues concurrent requests during refresh
- * - Redirects to login on refresh failure
- * - SSR-safe: Uses injectable service instead of module-level state
- *
- * @example
- * ```typescript
- * // In app.config.ts
- * provideHttpClient(
- *   withFetch(),
- *   withInterceptors([authInterceptor, tokenRefreshInterceptor])
- * )
- * ```
- */
+/** Token Refresh Interceptor - Proactive and reactive token refresh with request queuing */
 declare function tokenRefreshInterceptor(req: HttpRequest<unknown>, next: HttpHandlerFn): Observable<HttpEvent<unknown>>;
 
 /**
@@ -919,86 +545,49 @@ declare const ADMINISTRATION_ROUTES: Routes;
 declare const PROFILE_ROUTES: Routes;
 
 /**
- * Auth Layout State Adapter
- * Bridges AuthStateService signals to ILayoutAuthState interface.
- * Provides ready-to-use integration between ng-auth, ng-layout, and ng-shared provider tokens.
+ * Auth Layout Provider Adapters
+ *
+ * Implements provider interfaces from ng-layout using ng-auth services.
+ * Bridges auth state and API to layout components.
+ *
+ * @example
+ * // In app.config.ts
+ * import { provideAuthLayoutIntegration } from '@flusys/ng-auth';
+ * providers: [...provideAuthLayoutIntegration()]
  */
 declare class AuthLayoutStateAdapter implements ILayoutAuthState {
     private readonly authState;
-    /**
-     * Maps company info to company info for layout.
-     * Falls back to app name from config when no company is selected.
-     */
     readonly currentCompanyInfo: Signal<ICompanyInfo$1 | null>;
-    /**
-     * Maps branch info to branch info for layout.
-     * Returns null when no branch is selected.
-     */
     readonly currentBranchInfo: Signal<IBranchInfo$1 | null>;
-    /**
-     * Maps user info from auth state to layout user info.
-     * Profile picture URL is managed separately by AuthLayoutSyncService via FileUrlService.
-     */
     readonly loginUserData: Signal<IUserInfo$1 | null>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthLayoutStateAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthLayoutStateAdapter>;
 }
-/**
- * Auth Layout API Adapter
- * Bridges AuthApiService to ILayoutAuthApi interface.
- * Handles logout and navigation for layout components.
- */
 declare class AuthLayoutApiAdapter implements ILayoutAuthApi {
     private readonly authApi;
     private readonly authState;
     private readonly permissionApi;
     private readonly router;
-    /**
-     * Logout the current user.
-     * Calls backend logout endpoint and resets local auth state.
-     * Auth state reset handles clearing all localStorage including company/branch.
-     */
     logOut(): Observable<any>;
-    /**
-     * Navigate to login page.
-     * Optionally preserves current URL as return URL.
-     */
     navigateLogin(withUrl?: boolean): void;
-    /**
-     * Switch to a different company and branch.
-     * Calls backend switch endpoint, then triggers full page reload to
-     * refresh permissions, reset component state, and re-filter all data.
-     */
     switchCompany(companyId: string, branchId: string): Observable<any>;
-    /**
-     * Get list of companies the logged-in user has permissions for.
-     * Uses permission API to filter by user's actual company-level permissions.
-     */
     getUserCompanies(): Observable<ICompanyInfo$1[]>;
-    /**
-     * Get branches for a specific company that the logged-in user has access to.
-     * Fetches all user branches and filters by companyId.
-     */
     getCompanyBranches(companyId: string): Observable<IBranchInfo$1[]>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthLayoutApiAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthLayoutApiAdapter>;
 }
 
 /**
- * Auth User Provider Adapter
+ * Auth Shared Provider Adapters
  *
- * Implements IUserProvider interface from ng-shared using UserApiService from ng-auth.
- * This allows IAM and other packages to access user data without depending on ng-auth directly.
+ * Implements provider interfaces from ng-shared using ng-auth services.
+ * Allows IAM, Storage, and Form-Builder packages to access auth data
+ * without depending on ng-auth directly.
  *
  * @example
  * // In app.config.ts
- * providers: [
- *   { provide: USER_PROVIDER, useClass: AuthUserProviderAdapter }
- * ]
- *
- * // In IAM component
- * private readonly userProvider = inject(USER_PROVIDER);
- * this.userProvider.getUsers({ page: 0, pageSize: 50 }).subscribe(...);
+ * import { provideAuthProviders } from '@flusys/ng-auth';
+ * providers: [...provideAuthProviders()]
  */
 declare class AuthUserProviderAdapter implements IUserProvider {
     private readonly userApi;
@@ -1014,19 +603,6 @@ declare class AuthUserProviderAdapter implements IUserProvider {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthUserProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthUserProviderAdapter>;
 }
-
-/**
- * Auth Company API Provider Adapter
- *
- * Implements ICompanyApiProvider interface from ng-shared using CompanyApiService.
- * Allows IAM package to access company data without depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: COMPANY_API_PROVIDER, useClass: AuthCompanyApiProviderAdapter }
- * ]
- */
 declare class AuthCompanyApiProviderAdapter implements ICompanyApiProvider {
     private readonly companyApi;
     getCompanies(filter?: {
@@ -1037,64 +613,25 @@ declare class AuthCompanyApiProviderAdapter implements ICompanyApiProvider {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthCompanyApiProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthCompanyApiProviderAdapter>;
 }
-
-/**
- * Auth User Permission Provider Adapter
- *
- * Implements IUserPermissionProvider interface from ng-shared using UserPermissionApiService.
- * Allows IAM package to query user permissions without depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: USER_PERMISSION_PROVIDER, useClass: AuthUserPermissionProviderAdapter }
- * ]
- */
 declare class AuthUserPermissionProviderAdapter implements IUserPermissionProvider {
     private readonly userPermissionApi;
-    getUserBranchPermissions(userId: string): Observable<ISingleResponse<any>>;
+    getUserBranchPermissions(userId: string, companyId?: string): Observable<ISingleResponse<any>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthUserPermissionProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthUserPermissionProviderAdapter>;
 }
+declare class AuthStateProviderAdapter implements IAuthStateProvider {
+    private readonly authState;
+    private readonly authInit;
+    get isAuthenticated(): Signal<boolean>;
+    initialize(): Observable<void>;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthStateProviderAdapter, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthStateProviderAdapter>;
+}
 
-/**
- * Provides auth layout integration for ng-layout.
- * Call this in your app.config.ts to integrate ng-auth with ng-layout.
- *
- * Also registers LAYOUT_AUTH_STATE since AuthLayoutStateAdapter
- * implements both ILayoutAuthState and ICompanyContextProvider.
- *
- * @example
- * ```typescript
- * // In app.config.ts
- * export const appConfig: ApplicationConfig = {
- *   providers: [
- *     ...provideAuthLayoutIntegration(),
- *   ],
- * };
- * ```
- */
+/** Provides auth integration for ng-layout */
 declare function provideAuthLayoutIntegration(): Provider[];
 
-/**
- * Provide Auth Provider Adapters
- *
- * Registers auth implementations for provider interfaces from ng-shared.
- * This allows IAM and Storage packages to use auth services without direct dependencies.
- *
- * @example
- * // In app.config.ts
- * import { provideAuthProviders } from '@flusys/ng-auth';
- *
- * export const appConfig: ApplicationConfig = {
- *   providers: [
- *     provideAuthProviders(),
- *     // ... other providers
- *   ]
- * };
- *
- * @returns Array of Angular providers
- */
+/** Provides auth implementations for ng-shared provider interfaces */
 declare function provideAuthProviders(): Provider[];
 
 /**
@@ -1102,33 +639,22 @@ declare function provideAuthProviders(): Provider[];
  *
  * Centralized endpoint definitions to prevent inconsistencies across interceptors
  * and services. All auth-related endpoints should be referenced from here.
- *
- * @example
- * ```typescript
- * if (isAuthEndpoint(req.url)) {
- *   // Skip interceptor logic
- * }
- * ```
  */
 declare const AUTH_ENDPOINTS: {
     readonly LOGIN: "/auth/login";
     readonly LOGOUT: "/auth/logout";
     readonly REFRESH: "/auth/refresh";
     readonly REGISTER: "/auth/register";
+    readonly ME: "/auth/me";
     readonly SELECT: "/auth/select";
     readonly SWITCH_COMPANY: "/auth/switch-company";
+    readonly CHANGE_PASSWORD: "/auth/change-password";
     readonly VERIFY_EMAIL: "/auth/verify-email";
     readonly FORGOT_PASSWORD: "/auth/forgot-password";
     readonly RESET_PASSWORD: "/auth/reset-password";
     readonly RESEND_VERIFICATION: "/auth/resend-verification";
 };
-/**
- * Check if a URL is an auth-related endpoint
- */
-declare function isAuthEndpoint(url: string): boolean;
-/**
- * Check if a URL is a specific auth endpoint
- */
+/** Check if a URL matches a specific endpoint */
 declare function isEndpoint(url: string, endpoint: string): boolean;
 
 interface ITab {
@@ -1136,6 +662,7 @@ interface ITab {
     label: string;
     icon: string;
     route: string;
+    permission: string;
     requiresCompanyFeature?: boolean;
 }
 /**
@@ -1147,14 +674,15 @@ interface ITab {
  */
 declare class AdministrationPageComponent {
     private readonly appConfig;
+    private readonly permissionValidator;
     /** All available tabs */
     private readonly allTabs;
     /** Check if company feature is enabled */
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
-    /** Visible tabs based on config */
+    /** Visible tabs based on config and permissions */
     readonly visibleTabs: _angular_core.Signal<ITab[]>;
-    /** Dynamic subtitle based on visible features */
-    readonly subtitle: _angular_core.Signal<"Manage users, companies, and branches" | "Manage users">;
+    /** Dynamic subtitle based on visible tabs */
+    readonly subtitle: _angular_core.Signal<string>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AdministrationPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AdministrationPageComponent, "lib-administration-page", never, {}, {}, never, never, true, never>;
 }
@@ -1174,13 +702,15 @@ interface IBranchFormModel {
  * Handles creating and editing branches.
  * Defaults to current company context.
  */
-declare class BranchFormComponent implements OnInit {
+declare class BranchFormComponent {
     private readonly router;
     private readonly route;
     private readonly messageService;
     private readonly branchService;
     private readonly companyService;
     private readonly authState;
+    private readonly routeParams;
+    private readonly queryParams;
     /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     /** Existing branch data when editing */
@@ -1195,10 +725,17 @@ declare class BranchFormComponent implements OnInit {
     readonly branchForm: _angular_forms_signals.FieldTree<IBranchFormModel, string | number>;
     /** Check if form is valid */
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     loadBranch(id: string): Promise<void>;
+    private toFormModel;
     generateSlug(): void;
     onSubmit(): Promise<void>;
+    private updateBranch;
+    private createBranch;
+    private buildOptionalFields;
+    private onSaveSuccess;
+    private getTargetCompanyId;
+    private navigateToList;
     onCancel(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<BranchFormComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<BranchFormComponent, "lib-branch-form", never, {}, {}, never, never, true, never>;
@@ -1209,7 +746,13 @@ declare class BranchFormComponent implements OnInit {
  * Displays a list of branches for a company with CRUD operations.
  * Defaults to current company context.
  */
-declare class BranchListComponent implements OnInit {
+declare class BranchListComponent {
+    readonly BRANCH_PERMISSIONS: {
+        readonly CREATE: "branch.create";
+        readonly READ: "branch.read";
+        readonly UPDATE: "branch.update";
+        readonly DELETE: "branch.delete";
+    };
     private readonly router;
     private readonly route;
     private readonly messageService;
@@ -1217,8 +760,10 @@ declare class BranchListComponent implements OnInit {
     private readonly branchService;
     private readonly companyService;
     private readonly authState;
-    /** Selected company ID */
-    selectedCompanyId: string | null;
+    private readonly queryParamMap;
+    private initialized;
+    /** Selected company ID (signal for zoneless change detection) */
+    readonly selectedCompanyId: _angular_core.WritableSignal<string | null>;
     /** Companies list for dropdown */
     readonly companies: _angular_core.Signal<_flusys_ng_auth.ICompany[]>;
     /** Branches from service */
@@ -1227,7 +772,7 @@ declare class BranchListComponent implements OnInit {
     readonly isLoading: _angular_core.Signal<boolean>;
     /** Total count from service */
     readonly total: _angular_core.Signal<number>;
-    ngOnInit(): void;
+    constructor();
     loadBranches(): void;
     onCompanyChange(): void;
     onLazyLoad(event: {
@@ -1255,11 +800,12 @@ interface ICompanyFormModel$1 {
  * Company Form Component
  * Handles creating and editing companies.
  */
-declare class CompanyFormComponent implements OnInit {
+declare class CompanyFormComponent {
     private readonly router;
     private readonly route;
     private readonly messageService;
     private readonly companyService;
+    private readonly routeParams;
     /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     /** Existing company data when editing */
@@ -1272,11 +818,13 @@ declare class CompanyFormComponent implements OnInit {
     readonly companyForm: _angular_forms_signals.FieldTree<ICompanyFormModel$1, string | number>;
     /** Check if form is valid */
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
-    loadCompany(id: string): Promise<void>;
+    constructor();
+    private loadCompany;
     generateSlug(): void;
     onSubmit(): Promise<void>;
     onCancel(): void;
+    /** Build company data from form model */
+    private buildCompanyData;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<CompanyFormComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<CompanyFormComponent, "lib-company-form", never, {}, {}, never, never, true, never>;
 }
@@ -1286,7 +834,19 @@ declare class CompanyFormComponent implements OnInit {
  * Displays a list of companies with CRUD operations.
  * Only visible when company feature is enabled.
  */
-declare class CompanyListComponent implements OnInit {
+declare class CompanyListComponent {
+    readonly COMPANY_PERMISSIONS: {
+        readonly CREATE: "company.create";
+        readonly READ: "company.read";
+        readonly UPDATE: "company.update";
+        readonly DELETE: "company.delete";
+    };
+    readonly BRANCH_PERMISSIONS: {
+        readonly CREATE: "branch.create";
+        readonly READ: "branch.read";
+        readonly UPDATE: "branch.update";
+        readonly DELETE: "branch.delete";
+    };
     private readonly router;
     private readonly messageService;
     private readonly confirmationService;
@@ -1297,8 +857,6 @@ declare class CompanyListComponent implements OnInit {
     readonly isLoading: _angular_core.Signal<boolean>;
     /** Total count from service */
     readonly total: _angular_core.Signal<number>;
-    ngOnInit(): void;
-    loadCompanies(): void;
     onLazyLoad(event: {
         first?: number | null;
         rows?: number | null;
@@ -1325,31 +883,24 @@ declare class ForgotPasswordPageComponent {
     readonly forgotForm: _angular_forms_signals.FieldTree<IForgotPasswordFormModel, string | number>;
     readonly isFormValid: _angular_core.Signal<boolean>;
     onSubmit(): void;
+    private showEmailSent;
     resetForm(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<ForgotPasswordPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<ForgotPasswordPageComponent, "lib-forgot-password-page", never, {}, {}, never, never, true, never>;
 }
 
-/** Login form model interface */
 interface ILoginFormModel {
     email: string;
     password: string;
     rememberMe: boolean;
 }
-/** Company selection form model interface */
 interface ISelectionFormModel {
     companyId: string;
     branchId: string;
     rememberSelection: boolean;
 }
 type LoginStep = 'credentials' | 'company-selection' | 'email-verification';
-/**
- * Login Page Component
- * Multi-step authentication flow:
- * - Step 1: Email/Password credentials
- * - Step 2: Company/Branch selection (when company feature enabled and user has multiple)
- */
-declare class LoginPageComponent implements OnInit {
+declare class LoginPageComponent {
     private readonly destroyRef;
     private readonly appConfig;
     private readonly messageService;
@@ -1359,31 +910,20 @@ declare class LoginPageComponent implements OnInit {
     readonly currentStep: _angular_core.WritableSignal<LoginStep>;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly unverifiedEmail: _angular_core.WritableSignal<string>;
-    /** Login form model */
     readonly loginFormModel: _angular_core.WritableSignal<ILoginFormModel>;
-    /** Login form with validation schema */
     readonly loginForm: _angular_forms_signals.FieldTree<ILoginFormModel, string | number>;
-    /** Check if login form is valid */
     readonly isLoginFormValid: _angular_core.Signal<boolean>;
-    /** Selection form model */
     readonly selectionFormModel: _angular_core.WritableSignal<ISelectionFormModel>;
-    /** Selection form with validation schema */
     readonly selectionForm: _angular_forms_signals.FieldTree<ISelectionFormModel, string | number>;
-    /** Check if selection form is valid */
     readonly isSelectionFormValid: _angular_core.Signal<boolean>;
-    /** Whether company feature is enabled */
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
-    /** Session ID for company selection */
     private sessionId;
-    /** Available companies */
     readonly companies: _angular_core.WritableSignal<ICompanyWithBranches[]>;
-    /** User's name */
     readonly userName: _angular_core.WritableSignal<string>;
-    /** Branches for selected company */
     readonly branches: _angular_core.Signal<IBranchSelectionInfo[]>;
-    ngOnInit(): void;
+    constructor();
+    private restorePendingSelectionState;
     onSubmit(): void;
-    /** Handle company selection change */
     onCompanyChange(): void;
     onSelectCompany(): void;
     goBackToCredentials(): void;
@@ -1418,7 +958,7 @@ interface IPasswordFormModel {
  * - Uses PROFILE_PERMISSION_PROVIDER (optional) for IAM functionality
  * - No direct imports from ng-storage or ng-iam
  */
-declare class ProfilePageComponent implements OnInit {
+declare class ProfilePageComponent {
     private readonly destroyRef;
     private readonly appConfig;
     private readonly messageService;
@@ -1448,9 +988,11 @@ declare class ProfilePageComponent implements OnInit {
     readonly showRoles: _angular_core.Signal<boolean>;
     readonly showActions: _angular_core.Signal<boolean>;
     readonly showBottomRow: _angular_core.Signal<boolean>;
+    private readonly originalFormModel;
     readonly formModel: _angular_core.WritableSignal<IProfileFormModel>;
     readonly formTree: _angular_forms_signals.FieldTree<IProfileFormModel, string | number>;
     readonly isFormValid: _angular_core.Signal<boolean>;
+    readonly isFormDirty: _angular_core.Signal<boolean>;
     readonly passwordModel: _angular_core.WritableSignal<IPasswordFormModel>;
     readonly isPasswordLoading: _angular_core.WritableSignal<boolean>;
     readonly isPasswordFormValid: _angular_core.Signal<boolean>;
@@ -1458,7 +1000,7 @@ declare class ProfilePageComponent implements OnInit {
     readonly uploadFileFn: UploadFileFn;
     /** Map upload result to IUploadedFile format */
     private mapUploadResultToUploadedFile;
-    ngOnInit(): void;
+    constructor();
     private loadUserData;
     private loadPermissions;
     onProfilePictureUploaded(file: {
@@ -1490,7 +1032,7 @@ interface ICompanyFormModel {
     newCompanyPhone: string;
     newCompanyAddress: string;
 }
-declare class RegisterPageComponent implements OnInit {
+declare class RegisterPageComponent {
     private readonly destroyRef;
     private readonly appConfig;
     private readonly messageService;
@@ -1498,6 +1040,8 @@ declare class RegisterPageComponent implements OnInit {
     private readonly authState;
     private readonly route;
     private readonly router;
+    private readonly queryParamMap;
+    private companySlugInitialized;
     readonly returnUrl: _angular_core.InputSignal<string>;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
@@ -1507,7 +1051,7 @@ declare class RegisterPageComponent implements OnInit {
     readonly companyForm: _angular_forms_signals.FieldTree<ICompanyFormModel, string | number>;
     readonly passwordsMatch: _angular_core.Signal<boolean>;
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     onCreateCompanyToggle(): void;
     onSubmit(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<RegisterPageComponent, never>;
@@ -1519,11 +1063,13 @@ interface IResetPasswordFormModel {
     confirmPassword: string;
 }
 type PageState$1 = 'form' | 'success' | 'invalid-token';
-declare class ResetPasswordPageComponent implements OnInit {
+declare class ResetPasswordPageComponent {
     private readonly destroyRef;
     private readonly route;
     private readonly messageService;
     private readonly authApi;
+    private readonly queryParams;
+    private tokenInitialized;
     private token;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly pageState: _angular_core.WritableSignal<PageState$1>;
@@ -1531,7 +1077,7 @@ declare class ResetPasswordPageComponent implements OnInit {
     readonly resetForm: _angular_forms_signals.FieldTree<IResetPasswordFormModel, string | number>;
     readonly passwordMismatch: _angular_core.Signal<boolean>;
     readonly canSubmit: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     onSubmit(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<ResetPasswordPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<ResetPasswordPageComponent, "lib-reset-password-page", never, {}, {}, never, never, true, never>;
@@ -1551,7 +1097,7 @@ interface IUserFormModel {
  * Handles creating and editing users.
  * When company feature is enabled, automatically assigns new users to current company/branch.
  */
-declare class UserFormComponent implements OnInit {
+declare class UserFormComponent {
     private readonly destroyRef;
     private readonly router;
     private readonly route;
@@ -1560,6 +1106,8 @@ declare class UserFormComponent implements OnInit {
     private readonly userService;
     private readonly permissionService;
     private readonly authState;
+    private readonly routeParams;
+    private userLoadTriggered;
     /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     /** Existing user data when editing */
@@ -1578,9 +1126,13 @@ declare class UserFormComponent implements OnInit {
     readonly formTree: _angular_forms_signals.FieldTree<IUserFormModel, string | number>;
     /** Check if form is valid */
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     loadUser(id: string): void;
+    private toFormModel;
     onSubmit(): void;
+    private updateUser;
+    private createUser;
+    private onSaveSuccess;
     /**
      * Assign user to current company and branch
      */
@@ -1594,7 +1146,13 @@ declare class UserFormComponent implements OnInit {
  * User List Component
  * Displays a list of users with CRUD operations.
  */
-declare class UserListComponent implements OnInit {
+declare class UserListComponent {
+    readonly USER_PERMISSIONS: {
+        readonly CREATE: "user.create";
+        readonly READ: "user.read";
+        readonly UPDATE: "user.update";
+        readonly DELETE: "user.delete";
+    };
     private readonly router;
     private readonly appConfig;
     private readonly messageService;
@@ -1613,7 +1171,6 @@ declare class UserListComponent implements OnInit {
     readonly showBranchDialog: _angular_core.WritableSignal<boolean>;
     /** Selected user for permission management */
     readonly selectedUser: _angular_core.WritableSignal<IUser | null>;
-    ngOnInit(): void;
     loadUsers(): void;
     onLazyLoad(event: {
         first?: number | null;
@@ -1623,6 +1180,7 @@ declare class UserListComponent implements OnInit {
     onEdit(user: IUser): void;
     onManageCompanyPermissions(user: IUser): void;
     onManageBranchPermissions(user: IUser): void;
+    private openPermissionDialog;
     onDelete(user: IUser): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserListComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserListComponent, "lib-user-list", never, {}, {}, never, never, true, never>;
@@ -1632,13 +1190,15 @@ interface IResendFormModel {
     email: string;
 }
 type PageState = 'verifying' | 'success' | 'invalid-token' | 'resend';
-declare class VerifyEmailPageComponent implements OnInit {
+declare class VerifyEmailPageComponent {
     private readonly platformId;
     private readonly transferState;
     private readonly destroyRef;
     private readonly route;
     private readonly messageService;
     private readonly authApi;
+    private readonly queryParams;
+    private verificationTriggered;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly pageState: _angular_core.WritableSignal<PageState>;
     readonly resendSuccess: _angular_core.WritableSignal<boolean>;
@@ -1646,7 +1206,7 @@ declare class VerifyEmailPageComponent implements OnInit {
     readonly resendFormModel: _angular_core.WritableSignal<IResendFormModel>;
     readonly resendForm: _angular_forms_signals.FieldTree<IResendFormModel, string | number>;
     readonly isResendFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     private verifyEmail;
     private handleVerificationResult;
     showResendForm(): void;
@@ -1656,52 +1216,27 @@ declare class VerifyEmailPageComponent implements OnInit {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<VerifyEmailPageComponent, "lib-verify-email-page", never, {}, {}, never, never, true, never>;
 }
 
-/**
- * User Branch Permission Dialog
- *
- * Workflow:
- * 1. Dialog opens → Shows company dropdown with user's permitted companies
- * 2. User selects a company → Branches load for that company
- * 3. Branches show with checkboxes (checked = already assigned)
- * 4. Check to assign, uncheck to revoke
- *
- * Company dropdown only shows companies the user has company-level permissions for.
- * Branch permissions can only be assigned within user's permitted companies.
- */
+interface BranchWithAssignment extends IBranch {
+    isAssigned: boolean;
+}
 declare class UserBranchPermissionDialogComponent {
     private readonly branchApi;
     private readonly permissionApi;
-    private readonly authState;
     private readonly messageService;
-    /** Dialog visibility */
     readonly visible: _angular_core.InputSignal<boolean>;
-    /** User to manage permissions for */
     readonly user: _angular_core.InputSignal<IUser | null>;
-    /** Close event */
     readonly closed: _angular_core.OutputEmitterRef<void>;
-    /** Refresh event after changes */
     readonly permissionsChanged: _angular_core.OutputEmitterRef<void>;
-    /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
-    /** Saving state */
     readonly isSaving: _angular_core.WritableSignal<boolean>;
-    /** Branches with assignment status */
     readonly branches: _angular_core.WritableSignal<BranchWithAssignment[]>;
-    /** Available companies (filtered by user's company permissions) */
     readonly companies: _angular_core.WritableSignal<{
         id: string;
         name: string;
     }[]>;
-    /** Selected company ID */
     selectedCompanyId: string | null;
-    /** Current company from auth state */
-    readonly currentCompany: _angular_core.Signal<_flusys_ng_auth.ICompanyInfo | null>;
-    /** Currently assigned branch IDs */
     private assignedBranchIds;
     constructor();
-    /**
-     * Load user's assigned companies (does not auto-select or load branches)
-     */
     private loadUserCompaniesAndData;
     private loadData;
     onCompanyChange(): void;
@@ -1710,35 +1245,21 @@ declare class UserBranchPermissionDialogComponent {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserBranchPermissionDialogComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserBranchPermissionDialogComponent, "lib-user-branch-permission-dialog", never, { "visible": { "alias": "visible"; "required": true; "isSignal": true; }; "user": { "alias": "user"; "required": true; "isSignal": true; }; }, { "closed": "closed"; "permissionsChanged": "permissionsChanged"; }, never, never, true, never>;
 }
-interface BranchWithAssignment extends IBranch {
+
+interface CompanyWithAssignment extends ICompany {
     isAssigned: boolean;
 }
-
-/**
- * User Company Permission Dialog
- * Shows all companies with checkboxes
- * Initially assigned companies are checked
- * Check to assign, uncheck to revoke
- */
 declare class UserCompanyPermissionDialogComponent {
     private readonly companyApi;
     private readonly permissionApi;
     private readonly messageService;
-    /** Dialog visibility */
     readonly visible: _angular_core.InputSignal<boolean>;
-    /** User to manage permissions for */
     readonly user: _angular_core.InputSignal<IUser | null>;
-    /** Close event */
     readonly closed: _angular_core.OutputEmitterRef<void>;
-    /** Refresh event after changes */
     readonly permissionsChanged: _angular_core.OutputEmitterRef<void>;
-    /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
-    /** Saving state */
     readonly isSaving: _angular_core.WritableSignal<boolean>;
-    /** Companies with assignment status */
     readonly companies: _angular_core.WritableSignal<CompanyWithAssignment[]>;
-    /** Currently assigned company IDs */
     private assignedCompanyIds;
     constructor();
     private loadData;
@@ -1747,9 +1268,6 @@ declare class UserCompanyPermissionDialogComponent {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserCompanyPermissionDialogComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserCompanyPermissionDialogComponent, "lib-user-company-permission-dialog", never, { "visible": { "alias": "visible"; "required": true; "isSignal": true; }; "user": { "alias": "user"; "required": true; "isSignal": true; }; }, { "closed": "closed"; "permissionsChanged": "permissionsChanged"; }, never, never, true, never>;
 }
-interface CompanyWithAssignment extends ICompany {
-    isAssigned: boolean;
-}
 
-export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_ROUTES, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, ForgotPasswordPageComponent, LoginPageComponent, PROFILE_ROUTES, ProfilePageComponent, RegisterPageComponent, ResetPasswordPageComponent, TokenRefreshStateService, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, VerifyEmailPageComponent, authGuard, authInterceptor, companyFeatureGuard, guestGuard, isAuthEndpoint, isCompanySelectionResponse, isEmailVerificationRequired, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, tokenRefreshInterceptor };
+export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_ROUTES, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateProviderAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, ForgotPasswordPageComponent, LoginPageComponent, PROFILE_ROUTES, ProfilePageComponent, RegisterPageComponent, ResetPasswordPageComponent, TokenRefreshStateService, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, VerifyEmailPageComponent, authGuard, authInterceptor, companyFeatureGuard, guestGuard, isCompanySelectionResponse, isEmailVerificationRequired, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, tokenRefreshInterceptor };
 export type { AuthResponse, IAssignUserBranchRequest, IAssignUserCompanyRequest, IBatchOperationResponse, IBranch, IBranchInfo, IBranchSelectionInfo, IChangePasswordRequest, ICompany, ICompanyInfo, ICompanySelectionResponse, ICompanyWithBranches, ICreateBranchRequest, ICreateCompanyRequest, ICreateUserRequest, ILoginRequest, ILoginRequiresEmailVerification, ILoginResponse, IMeResponse, IPermissionItem, IRefreshTokenResponse, IRegistrationRequest, IRegistrationResponse, ISelectRequest, ISwitchCompanyRequest, IUpdateBranchRequest, IUpdateCompanyRequest, IUpdateUserRequest, IUser, IUserBranchPermission, IUserBranchesResponse, IUserCompaniesResponse, IUserCompanyPermission, IUserInfo };