@flusys/ng-auth 1.1.1-beta → 1.2.0-rc.1

package/types/flusys-ng-auth.d.ts

@@ -1,26 +1,19 @@
-import { IMessageResponse, ApiResourceService, ISingleResponse, IUserProvider, IListResponse, IUserBasicInfo, ICompanyApiProvider, ICompanyBasicInfo, IUserPermissionProvider, IProfileRoleInfo, IProfileActionInfo, UploadFileFn } from '@flusys/ng-shared';
+import { ISingleResponse, IMessageResponse, ApiResourceService, ICompanyApiProvider, IListResponse, ICompanyBasicInfo, IAuthStateProvider, IUserPermissionProvider, IUserBranchPermission as IUserBranchPermission$1, IUserProvider, IUserBasicInfo, ILogicNode, RouterTabItem, BaseFormComponent, IFormField, ITableAction, ITableColumn, IProfileRoleInfo, IProfileActionInfo } from '@flusys/ng-shared';
 import * as rxjs from 'rxjs';
 import { Observable } from 'rxjs';
 import * as _angular_core from '@angular/core';
-import { Signal, Provider, OnInit } from '@angular/core';
-import { HttpClient, HttpRequest, HttpHandlerFn, HttpEvent } from '@angular/common/http';
+import { Signal, Provider, InjectionToken, Type, TemplateRef, Injector } from '@angular/core';
 import { CanActivateFn, Routes } from '@angular/router';
+import { HttpRequest, HttpHandlerFn, HttpEvent } from '@angular/common/http';
 import { ILayoutAuthApi, ICompanyInfo as ICompanyInfo$1, IBranchInfo as IBranchInfo$1, ILayoutAuthState, IUserInfo as IUserInfo$1 } from '@flusys/ng-layout';
 import * as _angular_forms_signals from '@angular/forms/signals';
 import * as _flusys_ng_auth from '@flusys/ng-auth';
 import * as _flusys_ng_core from '@flusys/ng-core';
 
-/**
- * Login Request Interface
- */
 interface ILoginRequest {
     email: string;
     password: string;
 }
-/**
- * Registration Request Interface
- * Supports both simple registration and company-based registration
- */
 interface IRegistrationRequest {
     name: string;
     email: string;
@@ -31,34 +24,21 @@ interface IRegistrationRequest {
     newCompanyName?: string;
     newCompanyPhone?: string;
     newCompanyAddress?: string;
+    additionalFields?: Record<string, unknown>;
 }
-/**
- * Select Company & Branch Request Interface
- * Used after login when user needs to select company and branch
- */
 interface ISelectRequest {
     sessionId: string;
     companyId: string;
     branchId: string;
 }
-/**
- * Switch Company Request Interface
- * Used to switch company/branch after login
- */
 interface ISwitchCompanyRequest {
     companyId: string;
     branchId: string;
 }
-/**
- * Change Password Request Interface
- */
 interface IChangePasswordRequest {
     currentPassword: string;
     newPassword: string;
 }
-/**
- * User Info Interface (used in responses)
- */
 interface IUserInfo {
     id: string;
     email: string;
@@ -70,126 +50,76 @@ interface IUserInfo {
     companyLogoId?: string;
     branchLogoId?: string;
 }
-/**
- * Company Info Interface (used in responses)
- */
 interface ICompanyInfo {
     id: string;
     name: string;
     slug?: string;
     logoId?: string | null;
 }
-/**
- * Branch Info Interface (used in responses)
- */
 interface IBranchInfo {
     id: string;
     name: string;
     slug?: string;
     logoId?: string | null;
 }
-/**
- * Branch Selection Info Interface (with additional fields)
- */
 interface IBranchSelectionInfo {
     id: string;
     name: string;
     slug: string;
-    isActive: boolean;
     logoId?: string | null;
 }
-/**
- * Company with Branches Interface (for selection response)
- */
 interface ICompanyWithBranches {
     id: string;
     name: string;
     slug: string;
-    isActive: boolean;
     logoId?: string | null;
     branches: IBranchSelectionInfo[];
 }
-/**
- * Login Response Interface
- * Returned on successful login with tokens
- */
-interface ILoginResponse {
+interface ILoginData {
     accessToken: string;
-    refreshToken: string;
+    refreshToken?: string;
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
-    companyFeatureEnabled?: boolean;
 }
-/**
- * Me Response Interface
- * Returned by GET /auth/me endpoint
- * Contains only user data, no tokens
- */
-interface IMeResponse {
+interface IMeData {
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
 }
-/**
- * Registration Response Interface
- * Returned on successful registration
- */
-interface IRegistrationResponse {
+interface IRegistrationData {
     accessToken?: string;
     refreshToken?: string;
     user: IUserInfo;
     company?: ICompanyInfo;
     branch?: IBranchInfo;
-    companyFeatureEnabled?: boolean;
     requiresEmailVerification?: boolean;
 }
-/**
- * Company Selection Response Interface
- * Returned when user has multiple companies/branches to choose from
- */
-interface ICompanySelectionResponse {
+interface ICompanySelectionData {
     requiresSelection: true;
     sessionId: string;
     expiresAt: Date | string;
     user: IUserInfo;
     companies: ICompanyWithBranches[];
 }
-/**
- * Refresh Token Response Interface
- */
-interface IRefreshTokenResponse {
-    accessToken: string;
-    refreshToken?: string;
-}
-/**
- * Login Response when email verification required
- */
-interface ILoginRequiresEmailVerification {
+interface IEmailVerificationData {
     requiresEmailVerification: true;
     email: string;
-    message: string;
 }
-/**
- * Auth Response Type - Can be login success, company selection, or email verification required
- */
-type AuthResponse = ILoginResponse | ICompanySelectionResponse | ILoginRequiresEmailVerification;
-/**
- * Type guard to check if response requires email verification
- */
+type ILoginResponse = ISingleResponse<ILoginData>;
+type IMeResponse = ISingleResponse<IMeData>;
+type IRegistrationResponse = ISingleResponse<IRegistrationData>;
+type ICompanySelectionResponse = ISingleResponse<ICompanySelectionData>;
+type ILoginRequiresEmailVerification = ISingleResponse<IEmailVerificationData>;
+type IRefreshTokenResponse = ISingleResponse<{
+    accessToken: string;
+    refreshToken?: string;
+}>;
+type AuthResponse = ISingleResponse<ILoginData | ICompanySelectionData | IEmailVerificationData>;
 declare function isEmailVerificationRequired(response: AuthResponse): response is ILoginRequiresEmailVerification;
-/**
- * Type guard to check if response requires company selection
- */
 declare function isCompanySelectionResponse(response: AuthResponse): response is ICompanySelectionResponse;
-/**
- * Type guard to check if response is a successful login
- */
 declare function isLoginResponse(response: AuthResponse): response is ILoginResponse;
 
-/**
- * Create Company Branch Request Interface
- */
 interface ICreateBranchRequest {
     name: string;
     slug: string;
@@ -203,15 +133,9 @@ interface ICreateBranchRequest {
     isActive?: boolean;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * Update Company Branch Request Interface
- */
 interface IUpdateBranchRequest extends Partial<Omit<ICreateBranchRequest, 'companyId'>> {
     id: string;
 }
-/**
- * Company Branch Response Interface
- */
 interface IBranch {
     id: string;
     name: string;
@@ -230,9 +154,6 @@ interface IBranch {
     updatedAt: Date | string;
 }
 
-/**
- * Create Company Request Interface
- */
 interface ICreateCompanyRequest {
     name: string;
     slug: string;
@@ -246,15 +167,9 @@ interface ICreateCompanyRequest {
     settings?: Record<string, unknown>;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * Update Company Request Interface
- */
 interface IUpdateCompanyRequest extends Partial<ICreateCompanyRequest> {
     id: string;
 }
-/**
- * Company Response Interface
- */
 interface ICompany {
     id: string;
     name: string;
@@ -273,88 +188,34 @@ interface ICompany {
     updatedAt: Date | string;
 }
 
-/**
- * Permission item for batch assignment/revocation
- */
 interface IPermissionItem {
-    /** Target ID (Company ID or Branch ID) */
     targetId: string;
-    /** Action: true to add permission, false to remove permission */
     isAdd: boolean;
 }
-/**
- * Batch assign/revoke user-company permissions request
- */
 interface IAssignUserCompanyRequest {
-    /** User ID to assign/revoke permissions for */
     userId: string;
-    /** List of company permissions to add or remove */
     items: IPermissionItem[];
 }
-/**
- * Batch assign/revoke user-branch permissions request
- */
 interface IAssignUserBranchRequest {
-    /** User ID to assign/revoke permissions for */
     userId: string;
-    /** List of branch permissions to add or remove */
     items: IPermissionItem[];
 }
-/**
- * User company permission with populated company details
- */
 interface IUserCompanyPermission {
-    /** Permission ID */
     id: string;
-    /** User ID */
     userId: string;
-    /** Company ID */
     companyId: string;
-    /** Company name */
     companyName: string;
-    /** Company slug */
     companySlug: string;
 }
-/**
- * User branch permission with populated branch details
- */
 interface IUserBranchPermission {
-    /** Permission ID */
     id: string;
-    /** User ID */
     userId: string;
-    /** Branch ID */
     branchId: string;
-    /** Branch name */
     branchName: string;
-    /** Branch slug */
     branchSlug: string;
-    /** Company ID this branch belongs to */
     companyId: string;
 }
-/**
- * Response for user companies
- */
-interface IUserCompaniesResponse {
-    data: IUserCompanyPermission[];
-}
-/**
- * Response for user branches
- */
-interface IUserBranchesResponse {
-    data: IUserBranchPermission[];
-}
-/**
- * Batch operation result response
- */
-interface IBatchOperationResponse {
-    success: boolean;
-    message: string;
-}
 
-/**
- * Create User Request Interface
- */
 interface ICreateUserRequest {
     name: string;
     email: string;
@@ -366,14 +227,12 @@ interface ICreateUserRequest {
     phoneVerified?: boolean;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * Update User Request Interface
- */
 interface IUpdateUserRequest {
     id: string;
     name?: string;
     email?: string;
     password?: string;
+    oldPassword?: string;
     phone?: string;
     profilePictureId?: string;
     isActive?: boolean;
@@ -381,9 +240,6 @@ interface IUpdateUserRequest {
     phoneVerified?: boolean;
     additionalFields?: Record<string, unknown>;
 }
-/**
- * User Response Interface
- */
 interface IUser {
     id: string;
     name: string;
@@ -400,113 +256,34 @@ interface IUser {
     deletedAt?: Date | string | null;
 }
 
-/**
- * Auth API Service
- * Handles all authentication-related API calls matching NestJS auth endpoints
- */
 declare class AuthApiService {
     private readonly appConfig;
     private readonly http;
     private readonly baseUrl;
     constructor();
-    /**
-     * Login with email and password
-     * Returns either:
-     * - ILoginResponse (direct login success)
-     * - ICompanySelectionResponse (requires company/branch selection)
-     */
     login(data: ILoginRequest): Observable<AuthResponse>;
-    /**
-     * Register new user
-     * Supports simple registration and company-based registration
-     * Returns RegistrationResponse directly (not wrapped in SingleResponse)
-     */
     register(data: IRegistrationRequest): Observable<IRegistrationResponse>;
-    /**
-     * Select company and branch after login
-     * Used when login returns requiresSelection: true
-     * Returns LoginResponse directly (not wrapped)
-     */
     select(data: ISelectRequest): Observable<ILoginResponse>;
-    /**
-     * Switch company/branch for logged-in user
-     * Returns LoginResponse directly (not wrapped)
-     */
     switchCompany(data: ISwitchCompanyRequest): Observable<ILoginResponse>;
-    /**
-     * Refresh access token
-     * Refresh token is sent via HTTP-only cookie
-     * Returns RefreshTokenResponse directly (not wrapped)
-     */
     refresh(): Observable<IRefreshTokenResponse>;
-    /**
-     * Get current user info
-     * Returns only user data (no tokens) - IMeResponse
-     */
     me(): Observable<IMeResponse>;
-    /**
-     * Logout current user
-     */
     logout(): Observable<IMessageResponse>;
-    /**
-     * Change password for logged-in user
-     */
     changePassword(data: IChangePasswordRequest): Observable<IMessageResponse>;
-    /**
-     * Send forgot password email
-     */
     forgotPassword(email: string): Observable<IMessageResponse>;
-    /**
-     * Reset password with token
-     */
     resetPassword(token: string, newPassword: string): Observable<IMessageResponse>;
-    /**
-     * Resend verification email (unauthenticated)
-     */
     resendVerification(email: string): Observable<IMessageResponse>;
-    /**
-     * Verify email with token
-     * Returns IMessageResponse for existing user verification
-     * Returns IRegistrationResponse for pending registration completion
-     */
     verifyEmail(token: string): Observable<IMessageResponse | IRegistrationResponse>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthApiService>;
 }
 
-/**
- * Auth Initialization Service
- * Handles app startup authentication flow:
- * 1. Check if user has valid session (via refresh token cookie)
- * 2. Restore user state from /auth/me
- * 3. Handle company selection if needed
- *
- * IMPORTANT: Skips initialization during SSR to avoid cookie/localStorage issues
- */
 declare class AuthInitService {
     private readonly authState;
     private readonly authApi;
-    private readonly router;
     private readonly appConfig;
-    /** Whether initial auth check has completed */
-    readonly initialized: _angular_core.WritableSignal<boolean>;
-    /** Whether auth check is in progress */
-    readonly loading: _angular_core.WritableSignal<boolean>;
-    /** Error from auth check */
-    readonly error: _angular_core.WritableSignal<string | null>;
-    /** Cached initialization observable to prevent duplicate calls */
+    private readonly _initialized;
+    readonly initialized: _angular_core.Signal<boolean>;
     private initializationCache$;
-    /**
-     * Initialize authentication state on app startup.
-     *
-     * Flow:
-     * 1. If already authenticated with user data -> done
-     * 2. Try refresh token (via cookie) -> get new access token
-     * 3. Call /auth/me to get user info
-     * 4. Update state accordingly
-     *
-     * Uses shareReplay to prevent duplicate initialization calls.
-     */
     initialize(): Observable<boolean>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthInitService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthInitService>;
@@ -519,29 +296,54 @@ declare class AuthInitService {
 declare class AuthStateService {
     private readonly appConfig;
     private readonly router;
-    readonly user: _angular_core.WritableSignal<IUserInfo | null>;
-    readonly accessToken: _angular_core.WritableSignal<string>;
-    readonly company: _angular_core.WritableSignal<ICompanyInfo | null>;
-    readonly branch: _angular_core.WritableSignal<IBranchInfo | null>;
-    readonly selectionSessionId: _angular_core.WritableSignal<string | null>;
-    readonly availableCompanies: _angular_core.WritableSignal<ICompanyWithBranches[]>;
-    readonly selectionExpiresAt: _angular_core.WritableSignal<Date | null>;
+    private readonly platform;
+    private readonly translateAdapter;
+    private readonly _user;
+    private readonly _accessToken;
+    private readonly _tokenExpiresAt;
+    private readonly _company;
+    private readonly _branch;
+    readonly user: _angular_core.Signal<IUserInfo | null>;
+    readonly accessToken: _angular_core.Signal<string>;
+    readonly tokenExpiresAt: _angular_core.Signal<number | null>;
+    readonly company: _angular_core.Signal<ICompanyInfo | null>;
+    readonly branch: _angular_core.Signal<IBranchInfo | null>;
+    private readonly _selectionSessionId;
+    private readonly _availableCompanies;
+    readonly selectionSessionId: _angular_core.Signal<string | null>;
+    readonly availableCompanies: _angular_core.Signal<ICompanyWithBranches[]>;
     readonly isAuthenticated: _angular_core.Signal<boolean>;
     readonly requiresCompanySelection: _angular_core.Signal<boolean>;
     readonly userName: _angular_core.Signal<string>;
     readonly companyName: _angular_core.Signal<string>;
     readonly branchName: _angular_core.Signal<string>;
+    /**
+     * Check if token is expired or will expire soon (within 30 seconds).
+     * Used to proactively refresh token before requests fail.
+     */
+    readonly isTokenExpired: _angular_core.Signal<boolean>;
     readonly tenantId: _angular_core.Signal<string | null>;
     constructor();
-    setLoginState(response: ILoginResponse): void;
-    setSelectionState(response: ICompanySelectionResponse): void;
+    setLoginState(data: ILoginData): void;
+    setSelectionState(data: ICompanySelectionData): void;
     clearSelectionState(): void;
     resetState(): void;
+    setUser(user: IUserInfo | null): void;
+    setAccessToken(token: string): void;
+    setCompany(company: ICompanyInfo | null): void;
+    setBranch(branch: IBranchInfo | null): void;
     navigateToLogin(returnUrl?: string): void;
     navigateAfterLogin(returnUrl?: string): void;
+    /** Validates a return URL to prevent open redirect attacks */
+    private isValidReturnUrl;
     getStoredCompanyId(): string | null;
     getStoredBranchId(): string | null;
     private loadFromStorage;
+    /**
+     * Decode JWT expiry without verification (client-side only).
+     * Returns expiry timestamp in milliseconds.
+     */
+    private decodeTokenExpiry;
     private store;
     private get;
     private remove;
@@ -552,45 +354,9 @@ declare class AuthStateService {
 /**
  * Branch API Service
  * Signal-based service for branch CRUD operations
- * Branches default to current company context
- *
- * @example
- * ```typescript
- * branchService = inject(BranchApiService);
- *
- * // Set current company context
- * branchService.setCurrentCompanyId('company-uuid');
- *
- * // Access data via signals
- * branches = this.branchService.data;
- * isLoading = this.branchService.isLoading;
- *
- * // Fetch branches (will filter by current company)
- * this.branchService.fetchList('search');
- *
- * // Create branch (companyId will be auto-set if not provided)
- * await this.branchService.insertBranch({ name: 'New Branch', slug: 'new-branch' });
- * ```
  */
 declare class BranchApiService extends ApiResourceService<ICreateBranchRequest | IUpdateBranchRequest, IBranch> {
-    /** Current company context for branch operations */
-    readonly currentCompanyId: _angular_core.WritableSignal<string | null>;
-    /** Branches filtered by current company */
-    readonly companyBranches: _angular_core.Signal<IBranch[]>;
-    constructor(http: HttpClient);
-    /**
-     * Set the current company context for branch operations
-     */
-    setCurrentCompanyId(companyId: string | null): void;
-    /**
-     * Insert a new branch, auto-setting companyId if not provided
-     */
-    insertBranch(data: Omit<ICreateBranchRequest, 'companyId'> & {
-        companyId?: string;
-    }): Promise<ReturnType<typeof this.insertAsync>>;
-    /**
-     * Fetch branches for a specific company
-     */
+    constructor();
     fetchByCompany(companyId: string, search?: string): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<BranchApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<BranchApiService>;
@@ -599,64 +365,25 @@ declare class BranchApiService extends ApiResourceService<ICreateBranchRequest |
 /**
  * Company API Service
  * Signal-based service for company CRUD operations
- *
- * @example
- * ```typescript
- * companyService = inject(CompanyApiService);
- *
- * // Access data via signals
- * companies = this.companyService.data;
- * isLoading = this.companyService.isLoading;
- *
- * // Fetch companies
- * this.companyService.fetchList('search', { pagination: { currentPage: 0, pageSize: 10 } });
- *
- * // Create company
- * await this.companyService.insertAsync({ name: 'New Company', slug: 'new-company' });
- * ```
  */
 declare class CompanyApiService extends ApiResourceService<ICreateCompanyRequest | IUpdateCompanyRequest, ICompany> {
-    constructor(http: HttpClient);
+    constructor();
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<CompanyApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<CompanyApiService>;
 }
 
 /**
  * Token Refresh State Service
- *
- * Manages token refresh state in a request-safe manner for SSR environments.
- * Replaces module-level state that would be shared across requests in SSR.
- *
- * @example
- * ```typescript
- * const refreshState = inject(TokenRefreshStateService);
- *
- * if (refreshState.isRefreshing()) {
- *   // Queue request
- * } else {
- *   refreshState.startRefresh();
- *   // Perform refresh
- * }
- * ```
+ * Manages token refresh state for SSR-safe request queuing.
+ * Uses BehaviorSubject for RxJS interop (multi-subscriber async coordination).
  */
 declare class TokenRefreshStateService {
-    /** Flag to track if token refresh is in progress */
     private readonly _isRefreshing;
     readonly isRefreshing: _angular_core.Signal<boolean>;
-    /** Subject to queue requests while refreshing */
     private readonly _refreshTokenSubject;
     readonly refreshTokenSubject$: rxjs.Observable<string | null>;
-    /**
-     * Mark refresh as started
-     */
     startRefresh(): void;
-    /**
-     * Mark refresh as completed and broadcast new token
-     */
     completeRefresh(newToken: string): void;
-    /**
-     * Mark refresh as failed
-     */
     failRefresh(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<TokenRefreshStateService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<TokenRefreshStateService>;
@@ -665,43 +392,9 @@ declare class TokenRefreshStateService {
 /**
  * User API Service
  * Signal-based service for user CRUD operations
- *
- * @example
- * ```typescript
- * userService = inject(UserApiService);
- *
- * // Access data via signals
- * users = this.userService.data;
- * isLoading = this.userService.isLoading;
- *
- * // Fetch users
- * this.userService.fetchList('search', { pagination: { currentPage: 0, pageSize: 10 } });
- *
- * // Create user
- * await this.userService.insertAsync({
- *   name: 'John Doe',
- *   email: 'john@example.com',
- *   password: 'password123'
- * });
- * ```
  */
 declare class UserApiService extends ApiResourceService<ICreateUserRequest | IUpdateUserRequest, IUser> {
-    constructor(http: HttpClient);
-    /**
-     * Verify user's email
-     */
-    verifyEmail(userId: string): Observable<IMessageResponse>;
-    /**
-     * Verify user's phone
-     */
-    verifyPhone(userId: string): Observable<IMessageResponse>;
-    /**
-     * Update user status (active/inactive)
-     */
-    updateStatus(userId: string, isActive: boolean): Observable<IMessageResponse>;
-    /**
-     * Update current user's profile
-     */
+    constructor();
     updateProfile(data: IUpdateUserRequest): Observable<ISingleResponse<IUser>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<UserApiService>;
@@ -709,194 +402,42 @@ declare class UserApiService extends ApiResourceService<ICreateUserRequest | IUp
 
 /**
  * User Permission API Service
- *
  * Handles user-company and user-branch permission assignments.
- * Uses batch operations for efficient permission management.
- *
- * Backend Endpoints:
- * - POST /administration/permissions/user-company/assign - Batch assign/revoke company permissions
- * - GET /administration/permissions/user-company?userId=xxx - Get user's companies
- * - POST /administration/permissions/user-branch/assign - Batch assign/revoke branch permissions
- * - GET /administration/permissions/user-branch?userId=xxx - Get user's branches
+ * Endpoint: POST /administration/permissions/*
  */
 declare class UserPermissionApiService {
     private readonly appConfig;
     private readonly http;
     private readonly baseUrl;
-    constructor();
-    /**
-     * Batch assign/revoke user-company permissions
-     *
-     * @example
-     * // Add company permissions
-     * service.assignUserCompanies({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'company-1', isAdd: true },
-     *     { targetId: 'company-2', isAdd: true }
-     *   ]
-     * });
-     *
-     * @example
-     * // Remove company permissions
-     * service.assignUserCompanies({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'company-1', isAdd: false }
-     *   ]
-     * });
-     */
-    assignUserCompanies(data: IAssignUserCompanyRequest): Observable<IBatchOperationResponse>;
-    /**
-     * Assign single company to user (convenience method)
-     */
-    assignUserToCompany(userId: string, companyId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Revoke single company from user (convenience method)
-     */
-    revokeUserFromCompany(userId: string, companyId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Get user's company permissions
-     *
-     * @param userId - User ID to get companies for
-     * @returns Observable with user's company permissions
-     */
-    getUserCompanies(userId: string): Observable<IUserCompaniesResponse>;
-    /**
-     * Batch assign/revoke user-branch permissions
-     *
-     * @example
-     * // Add branch permissions
-     * service.assignUserBranches({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'branch-1', isAdd: true },
-     *     { targetId: 'branch-2', isAdd: true }
-     *   ]
-     * });
-     *
-     * @example
-     * // Remove branch permissions
-     * service.assignUserBranches({
-     *   userId: 'user-id',
-     *   items: [
-     *     { targetId: 'branch-1', isAdd: false }
-     *   ]
-     * });
-     */
-    assignUserBranches(data: IAssignUserBranchRequest): Observable<IBatchOperationResponse>;
-    /**
-     * Assign single branch to user (convenience method)
-     */
-    assignUserToBranch(userId: string, branchId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Revoke single branch from user (convenience method)
-     */
-    revokeUserFromBranch(userId: string, branchId: string): Observable<IBatchOperationResponse>;
-    /**
-     * Get user's branch permissions
-     *
-     * @param userId - User ID to get branches for
-     * @returns Observable with user's branch permissions
-     */
-    getUserBranches(userId: string): Observable<IUserBranchesResponse>;
+    assignUserCompanies(data: IAssignUserCompanyRequest): Observable<IMessageResponse>;
+    assignUserToCompany(userId: string, companyId: string): Observable<IMessageResponse>;
+    revokeUserFromCompany(userId: string, companyId: string): Observable<IMessageResponse>;
+    getUserCompanies(userId: string): Observable<ISingleResponse<IUserCompanyPermission[]>>;
+    assignUserBranches(data: IAssignUserBranchRequest): Observable<IMessageResponse>;
+    assignUserToBranch(userId: string, branchId: string): Observable<IMessageResponse>;
+    revokeUserFromBranch(userId: string, branchId: string): Observable<IMessageResponse>;
+    getUserBranches(userId: string, companyId?: string): Observable<ISingleResponse<IUserBranchPermission[]>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserPermissionApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<UserPermissionApiService>;
 }
 
-/**
- * Auth Guard
- * Protects routes that require authentication.
- *
- * Session restoration is handled by guestGuard. This guard assumes
- * the session has already been restored if user accessed login page first.
- *
- * Handles company feature:
- * - If company feature enabled and no company selected, redirects to login
- *   (login page handles company selection as step 2)
- * - If not authenticated, redirects to login
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'dashboard',
- *   loadComponent: () => import('./dashboard.component'),
- *   canActivate: [authGuard]
- * }
- * ```
- */
+/** Protects routes requiring authentication */
 declare const authGuard: CanActivateFn;
-/**
- * Guest Guard
- * Protects auth routes (login, register) from authenticated users.
- * Redirects authenticated users to home page.
- *
- * CRITICAL: Unlike old implementation, this guard RESTORES the session first
- * before checking authentication. This handles the case when users directly
- * navigate to /auth/login via browser URL while having valid refresh token.
- *
- * Flow:
- * 1. Restore session (if needed) via AuthInitService.initialize()
- * 2. Check if user is authenticated
- * 3. If authenticated -> redirect to dashboard
- * 4. If not authenticated -> allow access to login page
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'auth/login',
- *   loadComponent: () => import('./login.component'),
- *   canActivate: [guestGuard]
- * }
- * ```
- */
+/** Protects auth routes from authenticated users, restores session first */
 declare const guestGuard: CanActivateFn;
-/**
- * Company Feature Guard
- * Protects routes that require company feature to be enabled.
- * Redirects to home if company feature is disabled.
- *
- * Use this guard on company/branch management routes.
- *
- * @example
- * ```typescript
- * // In routes configuration
- * {
- *   path: 'administration/company',
- *   loadComponent: () => import('./company-list.component'),
- *   canActivate: [authGuard, companyFeatureGuard]
- * }
- * ```
- */
+/** Protects routes requiring company feature to be enabled */
 declare const companyFeatureGuard: CanActivateFn;
+/** Protects routes requiring email feature to be enabled */
+declare const emailFeatureGuard: CanActivateFn;
+/** Protects routes requiring sign-up feature to be enabled */
+declare const signUpFeatureGuard: CanActivateFn;
 
 /**
  * Auth Interceptor - Adds auth headers and cookie credentials to requests
  */
 declare function authInterceptor(req: HttpRequest<unknown>, next: HttpHandlerFn): Observable<HttpEvent<unknown>>;
 
-/**
- * Token Refresh Interceptor
- * Handles 401 errors by refreshing the access token.
- *
- * - Intercepts 401 Unauthorized responses
- * - Calls refresh token endpoint
- * - Retries failed request with new token
- * - Queues concurrent requests during refresh
- * - Redirects to login on refresh failure
- * - SSR-safe: Uses injectable service instead of module-level state
- *
- * @example
- * ```typescript
- * // In app.config.ts
- * provideHttpClient(
- *   withFetch(),
- *   withInterceptors([authInterceptor, tokenRefreshInterceptor])
- * )
- * ```
- */
+/** Token Refresh Interceptor - Proactive and reactive token refresh with request queuing */
 declare function tokenRefreshInterceptor(req: HttpRequest<unknown>, next: HttpHandlerFn): Observable<HttpEvent<unknown>>;
 
 /**
@@ -919,86 +460,49 @@ declare const ADMINISTRATION_ROUTES: Routes;
 declare const PROFILE_ROUTES: Routes;
 
 /**
- * Auth Layout State Adapter
- * Bridges AuthStateService signals to ILayoutAuthState interface.
- * Provides ready-to-use integration between ng-auth, ng-layout, and ng-shared provider tokens.
+ * Auth Layout Provider Adapters
+ *
+ * Implements provider interfaces from ng-layout using ng-auth services.
+ * Bridges auth state and API to layout components.
+ *
+ * @example
+ * // In app.config.ts
+ * import { provideAuthLayoutIntegration } from '@flusys/ng-auth';
+ * providers: [...provideAuthLayoutIntegration()]
  */
 declare class AuthLayoutStateAdapter implements ILayoutAuthState {
     private readonly authState;
-    /**
-     * Maps company info to company info for layout.
-     * Falls back to app name from config when no company is selected.
-     */
     readonly currentCompanyInfo: Signal<ICompanyInfo$1 | null>;
-    /**
-     * Maps branch info to branch info for layout.
-     * Returns null when no branch is selected.
-     */
     readonly currentBranchInfo: Signal<IBranchInfo$1 | null>;
-    /**
-     * Maps user info from auth state to layout user info.
-     * Profile picture URL is managed separately by AuthLayoutSyncService via FileUrlService.
-     */
     readonly loginUserData: Signal<IUserInfo$1 | null>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthLayoutStateAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthLayoutStateAdapter>;
 }
-/**
- * Auth Layout API Adapter
- * Bridges AuthApiService to ILayoutAuthApi interface.
- * Handles logout and navigation for layout components.
- */
 declare class AuthLayoutApiAdapter implements ILayoutAuthApi {
     private readonly authApi;
     private readonly authState;
     private readonly permissionApi;
     private readonly router;
-    /**
-     * Logout the current user.
-     * Calls backend logout endpoint and resets local auth state.
-     * Auth state reset handles clearing all localStorage including company/branch.
-     */
     logOut(): Observable<any>;
-    /**
-     * Navigate to login page.
-     * Optionally preserves current URL as return URL.
-     */
     navigateLogin(withUrl?: boolean): void;
-    /**
-     * Switch to a different company and branch.
-     * Calls backend switch endpoint, then triggers full page reload to
-     * refresh permissions, reset component state, and re-filter all data.
-     */
     switchCompany(companyId: string, branchId: string): Observable<any>;
-    /**
-     * Get list of companies the logged-in user has permissions for.
-     * Uses permission API to filter by user's actual company-level permissions.
-     */
     getUserCompanies(): Observable<ICompanyInfo$1[]>;
-    /**
-     * Get branches for a specific company that the logged-in user has access to.
-     * Fetches all user branches and filters by companyId.
-     */
     getCompanyBranches(companyId: string): Observable<IBranchInfo$1[]>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthLayoutApiAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthLayoutApiAdapter>;
 }
 
 /**
- * Auth User Provider Adapter
+ * Auth Shared Provider Adapters
  *
- * Implements IUserProvider interface from ng-shared using UserApiService from ng-auth.
- * This allows IAM and other packages to access user data without depending on ng-auth directly.
+ * Implements provider interfaces from ng-shared using ng-auth services.
+ * Allows IAM, Storage, and Form-Builder packages to access auth data
+ * without depending on ng-auth directly.
  *
  * @example
  * // In app.config.ts
- * providers: [
- *   { provide: USER_PROVIDER, useClass: AuthUserProviderAdapter }
- * ]
- *
- * // In IAM component
- * private readonly userProvider = inject(USER_PROVIDER);
- * this.userProvider.getUsers({ page: 0, pageSize: 50 }).subscribe(...);
+ * import { provideAuthProviders } from '@flusys/ng-auth';
+ * providers: [...provideAuthProviders()]
  */
 declare class AuthUserProviderAdapter implements IUserProvider {
     private readonly userApi;
@@ -1006,27 +510,12 @@ declare class AuthUserProviderAdapter implements IUserProvider {
         page?: number;
         pageSize?: number;
         search?: string;
-        companyId?: string;
-        branchId?: string;
         isActive?: boolean;
         [key: string]: any;
     }): Observable<IListResponse<IUserBasicInfo>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthUserProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthUserProviderAdapter>;
 }
-
-/**
- * Auth Company API Provider Adapter
- *
- * Implements ICompanyApiProvider interface from ng-shared using CompanyApiService.
- * Allows IAM package to access company data without depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: COMPANY_API_PROVIDER, useClass: AuthCompanyApiProviderAdapter }
- * ]
- */
 declare class AuthCompanyApiProviderAdapter implements ICompanyApiProvider {
     private readonly companyApi;
     getCompanies(filter?: {
@@ -1037,107 +526,250 @@ declare class AuthCompanyApiProviderAdapter implements ICompanyApiProvider {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthCompanyApiProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthCompanyApiProviderAdapter>;
 }
-
-/**
- * Auth User Permission Provider Adapter
- *
- * Implements IUserPermissionProvider interface from ng-shared using UserPermissionApiService.
- * Allows IAM package to query user permissions without depending on ng-auth directly.
- *
- * @example
- * // In app.config.ts
- * providers: [
- *   { provide: USER_PERMISSION_PROVIDER, useClass: AuthUserPermissionProviderAdapter }
- * ]
- */
 declare class AuthUserPermissionProviderAdapter implements IUserPermissionProvider {
     private readonly userPermissionApi;
-    getUserBranchPermissions(userId: string): Observable<ISingleResponse<any>>;
+    getUserBranchPermissions(userId: string, companyId?: string): Observable<ISingleResponse<IUserBranchPermission$1[]>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthUserPermissionProviderAdapter, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthUserPermissionProviderAdapter>;
 }
+declare class AuthStateProviderAdapter implements IAuthStateProvider {
+    private readonly authState;
+    private readonly authInit;
+    get isAuthenticated(): Signal<boolean>;
+    initialize(): Observable<void>;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthStateProviderAdapter, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthStateProviderAdapter>;
+}
 
-/**
- * Provides auth layout integration for ng-layout.
- * Call this in your app.config.ts to integrate ng-auth with ng-layout.
- *
- * Also registers LAYOUT_AUTH_STATE since AuthLayoutStateAdapter
- * implements both ILayoutAuthState and ICompanyContextProvider.
- *
- * @example
- * ```typescript
- * // In app.config.ts
- * export const appConfig: ApplicationConfig = {
- *   providers: [
- *     ...provideAuthLayoutIntegration(),
- *   ],
- * };
- * ```
- */
+/** Provides auth integration for ng-layout */
 declare function provideAuthLayoutIntegration(): Provider[];
 
-/**
- * Provide Auth Provider Adapters
- *
- * Registers auth implementations for provider interfaces from ng-shared.
- * This allows IAM and Storage packages to use auth services without direct dependencies.
- *
- * @example
- * // In app.config.ts
- * import { provideAuthProviders } from '@flusys/ng-auth';
- *
- * export const appConfig: ApplicationConfig = {
- *   providers: [
- *     provideAuthProviders(),
- *     // ... other providers
- *   ]
- * };
- *
- * @returns Array of Angular providers
- */
+/** Provides auth implementations for ng-shared provider interfaces */
 declare function provideAuthProviders(): Provider[];
 
+interface IEmailValidationConfig {
+    pattern?: RegExp;
+    message?: string;
+    messageKey?: string;
+    messageParam?: Record<string, string | number>;
+}
+interface IPasswordValidationConfig {
+    minLength?: number;
+    maxLength?: number;
+    requireUppercase?: boolean;
+    requireLowercase?: boolean;
+    requireNumbers?: boolean;
+    requireSpecialChars?: boolean;
+    pattern?: RegExp;
+    message?: string;
+    messageKey?: string;
+    messageParam?: Record<string, string | number>;
+}
+interface IAuthValidationConfig {
+    email?: IEmailValidationConfig;
+    password?: IPasswordValidationConfig;
+}
+declare const AUTH_VALIDATION_CONFIG: InjectionToken<IAuthValidationConfig>;
+interface IRegistrationFieldTemplateContext {
+    field: IRegistrationExtraField;
+    value: unknown;
+    updateValue: (value: unknown) => void;
+}
+declare const REGISTRATION_FIELD_CONTEXT: InjectionToken<IRegistrationFieldTemplateContext>;
+interface IRegistrationExtraField {
+    key: string;
+    label: string;
+    labelKey?: string;
+    type: 'text' | 'number' | 'select' | 'checkbox' | 'textarea' | 'date' | 'template';
+    placeholder?: string;
+    placeholderKey?: string;
+    required?: boolean;
+    defaultValue?: unknown;
+    options?: Array<{
+        label: string;
+        labelKey?: string;
+        value: unknown;
+    }>;
+    pattern?: RegExp;
+    validationMessage?: string;
+    validationMessageKey?: string;
+    validationMessageParam?: Record<string, string | number>;
+    order?: number;
+    containerClass?: string;
+    template?: TemplateRef<IRegistrationFieldTemplateContext>;
+    component?: Type<unknown>;
+    injector?: Injector;
+}
+interface IRegistrationExtensionProvider {
+    getExtraFields(): IRegistrationExtraField[];
+    transformRegistrationData?(data: Record<string, unknown>): Record<string, unknown>;
+    validateExtraFields?(data: Record<string, unknown>): string | null;
+}
+declare const AUTH_REGISTRATION_EXTENSION: InjectionToken<IRegistrationExtensionProvider>;
+interface IUserListExtraColumn {
+    key: string;
+    header: string;
+    headerKey?: string;
+    field?: string;
+    template?: TemplateRef<{
+        $implicit: IUser;
+    }>;
+    styleClass?: string;
+    width?: string;
+    sortable?: boolean;
+    order?: number;
+}
+interface IUserListExtraAction {
+    key: string;
+    label: string;
+    labelKey?: string;
+    icon: string;
+    severity?: 'info' | 'success' | 'warn' | 'danger' | 'secondary' | 'contrast';
+    permission?: string;
+    onClick: (user: IUser) => void;
+    isVisible?: (user: IUser) => boolean;
+    isDisabled?: (user: IUser) => boolean;
+    order?: number;
+}
+interface IUserListExtensionProvider {
+    getExtraColumns(): IUserListExtraColumn[];
+    getExtraActions(): IUserListExtraAction[];
+    enrichUserData?(users: IUser[]): Observable<IUser[]>;
+}
+declare const AUTH_USER_LIST_EXTENSION: InjectionToken<IUserListExtensionProvider>;
+interface IProfileExtraSection {
+    key: string;
+    title: string;
+    titleKey?: string;
+    icon?: string;
+    order?: number;
+    component?: Type<unknown>;
+    template?: TemplateRef<{
+        user: IUser;
+    }>;
+    collapsible?: boolean;
+    collapsed?: boolean;
+    editPermission?: string | ILogicNode;
+}
+interface IProfileFieldTemplateContext {
+    field: IProfileExtraField;
+    value: unknown;
+    updateValue: (value: unknown) => void;
+}
+declare const PROFILE_FIELD_CONTEXT: InjectionToken<IProfileFieldTemplateContext>;
+interface IProfileExtraField {
+    key: string;
+    label: string;
+    labelKey?: string;
+    type: 'text' | 'number' | 'select' | 'checkbox' | 'textarea' | 'date' | 'template';
+    placeholder?: string;
+    placeholderKey?: string;
+    editable?: boolean;
+    required?: boolean;
+    options?: Array<{
+        label: string;
+        labelKey?: string;
+        value: unknown;
+    }>;
+    pattern?: RegExp;
+    validationMessage?: string;
+    validationMessageKey?: string;
+    validationMessageParam?: Record<string, string | number>;
+    order?: number;
+    sectionKey?: string;
+    template?: TemplateRef<IProfileFieldTemplateContext>;
+    component?: Type<unknown>;
+    injector?: Injector;
+}
+interface IProfileExtensionProvider {
+    getExtraSections?(): IProfileExtraSection[];
+    getExtraFields?(): IProfileExtraField[];
+    getExtraFieldValues?(userId: string): Observable<Record<string, unknown>>;
+    saveExtraFieldValues?(userId: string, data: Record<string, unknown>): Observable<void>;
+    validateExtraFields?(data: Record<string, unknown>): string | null;
+}
+declare const AUTH_PROFILE_EXTENSION: InjectionToken<IProfileExtensionProvider>;
+interface IUserFormFieldTemplateContext {
+    field: IUserFormExtraField;
+    value: unknown;
+    updateValue: (value: unknown) => void;
+}
+declare const USER_FORM_FIELD_CONTEXT: InjectionToken<IUserFormFieldTemplateContext>;
+interface IUserFormExtraField {
+    key: string;
+    label: string;
+    labelKey?: string;
+    type: 'text' | 'number' | 'select' | 'checkbox' | 'textarea' | 'date' | 'template';
+    placeholder?: string;
+    placeholderKey?: string;
+    required?: boolean;
+    options?: Array<{
+        label: string;
+        labelKey?: string;
+        value: unknown;
+    }>;
+    pattern?: RegExp;
+    validationMessage?: string;
+    validationMessageKey?: string;
+    validationMessageParam?: Record<string, string | number>;
+    order?: number;
+    template?: TemplateRef<IUserFormFieldTemplateContext>;
+    component?: Type<unknown>;
+    injector?: Injector;
+}
+interface IUserFormExtensionProvider {
+    getExtraFields?(): IUserFormExtraField[];
+    getExtraFieldValues?(userId: string): Observable<Record<string, unknown>>;
+    saveExtraFieldValues?(userId: string, data: Record<string, unknown>): Observable<void>;
+    validateExtraFields?(data: Record<string, unknown>): string | null;
+}
+declare const AUTH_USER_FORM_EXTENSION: InjectionToken<IUserFormExtensionProvider>;
+type UserDetailViewMode = 'dialog' | 'sidebar' | 'page';
+interface IUserDetailViewConfig {
+    viewMode: UserDetailViewMode;
+    allowEdit?: boolean;
+    width?: string;
+    component?: Type<unknown>;
+    tabs?: Array<{
+        key: string;
+        label: string;
+        labelKey?: string;
+        icon?: string;
+        component?: Type<unknown>;
+        template?: TemplateRef<{
+            user: IUser;
+        }>;
+    }>;
+}
+declare const AUTH_USER_DETAIL_CONFIG: InjectionToken<IUserDetailViewConfig>;
+declare function validatePassword(password: string, config: IPasswordValidationConfig): string | null;
+declare function validateEmail(email: string, config?: IEmailValidationConfig): string | null;
+
 /**
  * Authentication API Endpoints
  *
  * Centralized endpoint definitions to prevent inconsistencies across interceptors
  * and services. All auth-related endpoints should be referenced from here.
- *
- * @example
- * ```typescript
- * if (isAuthEndpoint(req.url)) {
- *   // Skip interceptor logic
- * }
- * ```
  */
 declare const AUTH_ENDPOINTS: {
     readonly LOGIN: "/auth/login";
     readonly LOGOUT: "/auth/logout";
     readonly REFRESH: "/auth/refresh";
     readonly REGISTER: "/auth/register";
+    readonly ME: "/auth/me";
     readonly SELECT: "/auth/select";
     readonly SWITCH_COMPANY: "/auth/switch-company";
+    readonly CHANGE_PASSWORD: "/auth/change-password";
     readonly VERIFY_EMAIL: "/auth/verify-email";
     readonly FORGOT_PASSWORD: "/auth/forgot-password";
     readonly RESET_PASSWORD: "/auth/reset-password";
     readonly RESEND_VERIFICATION: "/auth/resend-verification";
 };
-/**
- * Check if a URL is an auth-related endpoint
- */
-declare function isAuthEndpoint(url: string): boolean;
-/**
- * Check if a URL is a specific auth endpoint
- */
+/** Check if a URL matches a specific endpoint */
 declare function isEndpoint(url: string, endpoint: string): boolean;
 
-interface ITab {
-    id: string;
-    label: string;
-    icon: string;
-    route: string;
-    requiresCompanyFeature?: boolean;
-}
+declare const AUTH_MESSAGES: Record<string, string>;
+
 /**
  * Administration Page Component
  * Unified administration page with tabs for:
@@ -1147,14 +779,14 @@ interface ITab {
  */
 declare class AdministrationPageComponent {
     private readonly appConfig;
+    private readonly permissionValidator;
+    private readonly translateService;
     /** All available tabs */
     private readonly allTabs;
     /** Check if company feature is enabled */
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
-    /** Visible tabs based on config */
-    readonly visibleTabs: _angular_core.Signal<ITab[]>;
-    /** Dynamic subtitle based on visible features */
-    readonly subtitle: _angular_core.Signal<"Manage users, companies, and branches" | "Manage users">;
+    /** Visible tabs based on config and permissions */
+    readonly visibleTabs: _angular_core.Signal<RouterTabItem[]>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AdministrationPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AdministrationPageComponent, "lib-administration-page", never, {}, {}, never, never, true, never>;
 }
@@ -1174,13 +806,17 @@ interface IBranchFormModel {
  * Handles creating and editing branches.
  * Defaults to current company context.
  */
-declare class BranchFormComponent implements OnInit {
+declare class BranchFormComponent {
     private readonly router;
     private readonly route;
     private readonly messageService;
     private readonly branchService;
     private readonly companyService;
     private readonly authState;
+    private readonly translateAdapter;
+    private translate;
+    private readonly routeParams;
+    private readonly queryParams;
     /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     /** Existing branch data when editing */
@@ -1192,24 +828,32 @@ declare class BranchFormComponent implements OnInit {
     /** Form model */
     readonly formModel: _angular_core.WritableSignal<IBranchFormModel>;
     /** Form with validation schema */
-    readonly branchForm: _angular_forms_signals.FieldTree<IBranchFormModel, string | number>;
+    readonly branchForm: _angular_forms_signals.FieldTree<IBranchFormModel, string | number, "writable">;
     /** Check if form is valid */
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     loadBranch(id: string): Promise<void>;
+    private toFormModel;
     generateSlug(): void;
     onSubmit(): Promise<void>;
+    private updateBranch;
+    private createBranch;
+    private buildOptionalFields;
+    private onSaveSuccess;
+    private getTargetCompanyId;
+    private navigateToList;
     onCancel(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<BranchFormComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<BranchFormComponent, "lib-branch-form", never, {}, {}, never, never, true, never>;
 }
 
-/**
- * Branch List Component
- * Displays a list of branches for a company with CRUD operations.
- * Defaults to current company context.
- */
-declare class BranchListComponent implements OnInit {
+declare class BranchListComponent {
+    readonly BRANCH_PERMISSIONS: {
+        readonly CREATE: "branch.create";
+        readonly READ: "branch.read";
+        readonly UPDATE: "branch.update";
+        readonly DELETE: "branch.delete";
+    };
     private readonly router;
     private readonly route;
     private readonly messageService;
@@ -1217,8 +861,12 @@ declare class BranchListComponent implements OnInit {
     private readonly branchService;
     private readonly companyService;
     private readonly authState;
-    /** Selected company ID */
-    selectedCompanyId: string | null;
+    private readonly translateAdapter;
+    private translate;
+    private readonly queryParamMap;
+    private initialized;
+    /** Selected company ID (signal for zoneless change detection) */
+    readonly selectedCompanyId: _angular_core.WritableSignal<string | null>;
     /** Companies list for dropdown */
     readonly companies: _angular_core.Signal<_flusys_ng_auth.ICompany[]>;
     /** Branches from service */
@@ -1227,8 +875,8 @@ declare class BranchListComponent implements OnInit {
     readonly isLoading: _angular_core.Signal<boolean>;
     /** Total count from service */
     readonly total: _angular_core.Signal<number>;
-    ngOnInit(): void;
-    loadBranches(): void;
+    constructor();
+    loadBranches(page?: number, pageSize?: number): void;
     onCompanyChange(): void;
     onLazyLoad(event: {
         first?: number | null;
@@ -1241,72 +889,34 @@ declare class BranchListComponent implements OnInit {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<BranchListComponent, "lib-branch-list", never, {}, {}, never, never, true, never>;
 }
 
-/** Company form model interface */
-interface ICompanyFormModel$1 {
-    name: string;
-    slug: string;
-    email: string;
-    phone: string;
-    website: string;
-    address: string;
-    isActive: boolean;
-}
-/**
- * Company Form Component
- * Handles creating and editing companies.
- */
-declare class CompanyFormComponent implements OnInit {
-    private readonly router;
+declare class CompanyFormComponent {
     private readonly route;
-    private readonly messageService;
-    private readonly companyService;
-    /** Loading state */
-    readonly isLoading: _angular_core.WritableSignal<boolean>;
-    /** Existing company data when editing */
-    readonly existingCompany: _angular_core.WritableSignal<ICompany | null>;
-    /** Whether in edit mode */
-    readonly isEditMode: _angular_core.Signal<boolean>;
-    /** Form model */
-    readonly formModel: _angular_core.WritableSignal<ICompanyFormModel$1>;
-    /** Form with validation schema */
-    readonly companyForm: _angular_forms_signals.FieldTree<ICompanyFormModel$1, string | number>;
-    /** Check if form is valid */
-    readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
-    loadCompany(id: string): Promise<void>;
-    generateSlug(): void;
-    onSubmit(): Promise<void>;
-    onCancel(): void;
+    private readonly translateAdapter;
+    readonly companyService: CompanyApiService;
+    readonly formRef: _angular_core.Signal<BaseFormComponent | undefined>;
+    private readonly routeParams;
+    readonly editId: _angular_core.Signal<string | null>;
+    readonly fields: IFormField[];
+    readonly buildRequest: (data: Record<string, unknown>, editId: string | null) => unknown;
+    readonly toFormModel: (entity: unknown) => Record<string, unknown>;
+    onFormValueChange(data: Record<string, unknown>): void;
+    private t;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<CompanyFormComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<CompanyFormComponent, "lib-company-form", never, {}, {}, never, never, true, never>;
 }
 
-/**
- * Company List Component
- * Displays a list of companies with CRUD operations.
- * Only visible when company feature is enabled.
- */
-declare class CompanyListComponent implements OnInit {
+declare class CompanyListComponent {
+    private readonly permissionValidator;
+    private readonly translateAdapter;
     private readonly router;
-    private readonly messageService;
-    private readonly confirmationService;
-    private readonly companyService;
-    /** Companies from service */
-    readonly companies: _angular_core.Signal<ICompany[]>;
-    /** Loading state from service */
-    readonly isLoading: _angular_core.Signal<boolean>;
-    /** Total count from service */
-    readonly total: _angular_core.Signal<number>;
-    ngOnInit(): void;
-    loadCompanies(): void;
-    onLazyLoad(event: {
-        first?: number | null;
-        rows?: number | null;
-    }): void;
-    onCreate(): void;
-    onEdit(company: ICompany): void;
-    onViewBranches(company: ICompany): void;
-    onDelete(company: ICompany): void;
+    readonly companyService: CompanyApiService;
+    readonly canCreate: _angular_core.Signal<boolean>;
+    readonly canEditFn: (_item: unknown) => boolean;
+    readonly canDeleteFn: (item: unknown) => boolean;
+    readonly viewBranchesAction: ITableAction[];
+    readonly columns: ITableColumn[];
+    asCompany(item: unknown): ICompany;
+    private t;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<CompanyListComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<CompanyListComponent, "lib-company-list", never, {}, {}, never, never, true, never>;
 }
@@ -1318,72 +928,66 @@ declare class ForgotPasswordPageComponent {
     private readonly destroyRef;
     private readonly messageService;
     private readonly authApi;
+    private readonly translateAdapter;
+    private translate;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly emailSent: _angular_core.WritableSignal<boolean>;
     readonly submittedEmail: _angular_core.WritableSignal<string>;
     readonly formModel: _angular_core.WritableSignal<IForgotPasswordFormModel>;
-    readonly forgotForm: _angular_forms_signals.FieldTree<IForgotPasswordFormModel, string | number>;
+    readonly forgotForm: _angular_forms_signals.FieldTree<IForgotPasswordFormModel, string | number, "writable">;
     readonly isFormValid: _angular_core.Signal<boolean>;
     onSubmit(): void;
+    private showEmailSent;
     resetForm(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<ForgotPasswordPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<ForgotPasswordPageComponent, "lib-forgot-password-page", never, {}, {}, never, never, true, never>;
 }
 
-/** Login form model interface */
 interface ILoginFormModel {
     email: string;
     password: string;
     rememberMe: boolean;
 }
-/** Company selection form model interface */
 interface ISelectionFormModel {
     companyId: string;
     branchId: string;
     rememberSelection: boolean;
 }
 type LoginStep = 'credentials' | 'company-selection' | 'email-verification';
-/**
- * Login Page Component
- * Multi-step authentication flow:
- * - Step 1: Email/Password credentials
- * - Step 2: Company/Branch selection (when company feature enabled and user has multiple)
- */
-declare class LoginPageComponent implements OnInit {
+declare class LoginPageComponent {
     private readonly destroyRef;
     private readonly appConfig;
     private readonly messageService;
     private readonly authApi;
     private readonly authState;
+    private readonly translateAdapter;
+    private readonly validationConfig;
+    private translate;
     readonly returnUrl: _angular_core.InputSignal<string>;
     readonly currentStep: _angular_core.WritableSignal<LoginStep>;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly unverifiedEmail: _angular_core.WritableSignal<string>;
-    /** Login form model */
     readonly loginFormModel: _angular_core.WritableSignal<ILoginFormModel>;
-    /** Login form with validation schema */
-    readonly loginForm: _angular_forms_signals.FieldTree<ILoginFormModel, string | number>;
-    /** Check if login form is valid */
+    private readonly emailErrorMessage;
+    private readonly passwordMinLength;
+    private readonly passwordErrorMessage;
+    readonly loginForm: _angular_forms_signals.FieldTree<ILoginFormModel, string | number, "writable">;
+    readonly emailValidationError: _angular_core.Signal<string | null>;
+    readonly passwordValidationError: _angular_core.Signal<string | null>;
     readonly isLoginFormValid: _angular_core.Signal<boolean>;
-    /** Selection form model */
     readonly selectionFormModel: _angular_core.WritableSignal<ISelectionFormModel>;
-    /** Selection form with validation schema */
-    readonly selectionForm: _angular_forms_signals.FieldTree<ISelectionFormModel, string | number>;
-    /** Check if selection form is valid */
+    readonly selectionForm: _angular_forms_signals.FieldTree<ISelectionFormModel, string | number, "writable">;
     readonly isSelectionFormValid: _angular_core.Signal<boolean>;
-    /** Whether company feature is enabled */
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
-    /** Session ID for company selection */
+    readonly emailFeatureEnabled: _angular_core.Signal<boolean>;
+    readonly signUpEnabled: _angular_core.Signal<boolean>;
     private sessionId;
-    /** Available companies */
     readonly companies: _angular_core.WritableSignal<ICompanyWithBranches[]>;
-    /** User's name */
     readonly userName: _angular_core.WritableSignal<string>;
-    /** Branches for selected company */
     readonly branches: _angular_core.Signal<IBranchSelectionInfo[]>;
-    ngOnInit(): void;
+    constructor();
+    private restorePendingSelectionState;
     onSubmit(): void;
-    /** Handle company selection change */
     onCompanyChange(): void;
     onSelectCompany(): void;
     goBackToCredentials(): void;
@@ -1393,32 +997,16 @@ declare class LoginPageComponent implements OnInit {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<LoginPageComponent, "lib-login-page", never, { "returnUrl": { "alias": "returnUrl"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
 }
 
-/** Profile form model */
 interface IProfileFormModel {
     name: string;
     phone: string;
 }
-/** Password form model */
 interface IPasswordFormModel {
     currentPassword: string;
     newPassword: string;
     confirmPassword: string;
 }
-/**
- * Profile Page Component
- *
- * Allows users to view and update their profile information.
- * Features:
- * - Update name, phone, profile picture (if storage enabled)
- * - View company/branch info (read-only, if company feature enabled)
- * - View roles/actions (read-only, if IAM enabled via optional injection)
- *
- * Package Independence:
- * - Uses PROFILE_UPLOAD_PROVIDER (optional) for storage functionality
- * - Uses PROFILE_PERMISSION_PROVIDER (optional) for IAM functionality
- * - No direct imports from ng-storage or ng-iam
- */
-declare class ProfilePageComponent implements OnInit {
+declare class ProfilePageComponent {
     private readonly destroyRef;
     private readonly appConfig;
     private readonly messageService;
@@ -1426,16 +1014,30 @@ declare class ProfilePageComponent implements OnInit {
     private readonly userService;
     private readonly authApiService;
     private readonly fileUrlService;
-    private readonly uploadProvider;
+    private readonly fileProvider;
     private readonly permissionProvider;
+    private readonly profileExtension;
+    private readonly userFormExtension;
+    private readonly translateAdapter;
+    private translate;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly isLoadingPermissions: _angular_core.WritableSignal<boolean>;
+    readonly isLoadingExtraFields: _angular_core.WritableSignal<boolean>;
     private readonly _profilePictureUrl;
     readonly profilePictureUrl: _angular_core.Signal<string | null>;
     private readonly _userRoles;
     readonly userRoles: _angular_core.Signal<IProfileRoleInfo[]>;
     private readonly _userActions;
     readonly userActions: _angular_core.Signal<IProfileActionInfo[]>;
+    readonly extraSections: _angular_core.Signal<IProfileExtraSection[]>;
+    readonly editableFields: _angular_core.Signal<IProfileExtraField[]>;
+    readonly viewOnlyFields: _angular_core.Signal<IUserFormExtraField[]>;
+    readonly hasExtraContent: _angular_core.Signal<boolean>;
+    readonly extraFieldsModel: _angular_core.WritableSignal<Record<string, unknown>>;
+    readonly originalExtraFieldsModel: _angular_core.WritableSignal<Record<string, unknown>>;
+    readonly adminFieldsModel: _angular_core.WritableSignal<Record<string, unknown>>;
+    readonly isExtraFieldsDirty: _angular_core.Signal<boolean>;
+    readonly extraFieldsValidationError: _angular_core.Signal<string | null>;
     readonly userEmail: _angular_core.Signal<string>;
     readonly userName: _angular_core.Signal<string>;
     readonly userInitials: _angular_core.Signal<string>;
@@ -1448,19 +1050,34 @@ declare class ProfilePageComponent implements OnInit {
     readonly showRoles: _angular_core.Signal<boolean>;
     readonly showActions: _angular_core.Signal<boolean>;
     readonly showBottomRow: _angular_core.Signal<boolean>;
+    private readonly originalFormModel;
     readonly formModel: _angular_core.WritableSignal<IProfileFormModel>;
-    readonly formTree: _angular_forms_signals.FieldTree<IProfileFormModel, string | number>;
+    readonly formTree: _angular_forms_signals.FieldTree<IProfileFormModel, string | number, "writable">;
     readonly isFormValid: _angular_core.Signal<boolean>;
+    readonly isFormDirty: _angular_core.Signal<boolean>;
+    updateExtraField(key: string, value: unknown): void;
+    getExtraFieldValue(key: string): unknown;
+    getAdminFieldValue(key: string): unknown;
+    getSelectLabel(field: IProfileExtraField | IUserFormExtraField, value: unknown): string;
+    getFieldTemplateContext(field: IProfileExtraField): IProfileFieldTemplateContext;
+    private readonly parentInjector;
+    getFieldInjector(field: IProfileExtraField): Injector;
     readonly passwordModel: _angular_core.WritableSignal<IPasswordFormModel>;
+    readonly visiblePasswords: _angular_core.WritableSignal<Record<keyof IPasswordFormModel, boolean>>;
     readonly isPasswordLoading: _angular_core.WritableSignal<boolean>;
     readonly isPasswordFormValid: _angular_core.Signal<boolean>;
     readonly passwordsMatch: _angular_core.Signal<boolean>;
-    readonly uploadFileFn: UploadFileFn;
-    /** Map upload result to IUploadedFile format */
-    private mapUploadResultToUploadedFile;
-    ngOnInit(): void;
+    readonly profileUploadOptions: {
+        folderPath: string;
+        compress: boolean;
+        maxWidth: number;
+        maxHeight: number;
+        isPrivate: boolean;
+    };
+    constructor();
     private loadUserData;
     private loadPermissions;
+    private loadExtraFields;
     onProfilePictureUploaded(file: {
         id?: string;
         name: string;
@@ -1469,6 +1086,7 @@ declare class ProfilePageComponent implements OnInit {
         contentType: string;
     }): void;
     onSubmit(): void;
+    togglePasswordVisibility(field: keyof IPasswordFormModel): void;
     updatePasswordField(field: keyof IPasswordFormModel, value: string): void;
     onChangePassword(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<ProfilePageComponent, never>;
@@ -1490,7 +1108,7 @@ interface ICompanyFormModel {
     newCompanyPhone: string;
     newCompanyAddress: string;
 }
-declare class RegisterPageComponent implements OnInit {
+declare class RegisterPageComponent {
     private readonly destroyRef;
     private readonly appConfig;
     private readonly messageService;
@@ -1498,16 +1116,39 @@ declare class RegisterPageComponent implements OnInit {
     private readonly authState;
     private readonly route;
     private readonly router;
+    private readonly validationConfig;
+    private readonly registrationExtension;
+    private readonly translateAdapter;
+    private translate;
+    private readonly queryParamMap;
+    private companySlugInitialized;
     readonly returnUrl: _angular_core.InputSignal<string>;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
+    readonly defaultCompanySlug: _angular_core.Signal<string | undefined>;
+    readonly defaultBranchSlug: _angular_core.Signal<string | undefined>;
+    readonly hasDefaultCompany: _angular_core.Signal<boolean>;
+    readonly hasDefaultBranch: _angular_core.Signal<boolean>;
+    readonly extraFields: _angular_core.Signal<IRegistrationExtraField[]>;
+    readonly extraFieldsModel: _angular_core.WritableSignal<Record<string, unknown>>;
+    private readonly emailErrorMessage;
+    readonly passwordMinLength: _angular_core.Signal<number>;
+    private readonly passwordErrorMessage;
     readonly userFormModel: _angular_core.WritableSignal<IUserFormModel$1>;
-    readonly userForm: _angular_forms_signals.FieldTree<IUserFormModel$1, string | number>;
+    readonly userForm: _angular_forms_signals.FieldTree<IUserFormModel$1, string | number, "writable">;
     readonly companyFormModel: _angular_core.WritableSignal<ICompanyFormModel>;
-    readonly companyForm: _angular_forms_signals.FieldTree<ICompanyFormModel, string | number>;
+    readonly companyForm: _angular_forms_signals.FieldTree<ICompanyFormModel, string | number, "writable">;
+    readonly emailValidationError: _angular_core.Signal<string | null>;
+    readonly passwordValidationError: _angular_core.Signal<string | null>;
+    readonly extraFieldsValidationError: _angular_core.Signal<string | null>;
     readonly passwordsMatch: _angular_core.Signal<boolean>;
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    private validateRequiredExtraFields;
+    updateExtraField(key: string, value: unknown): void;
+    getFieldTemplateContext(field: IRegistrationExtraField): IRegistrationFieldTemplateContext;
+    private readonly parentInjector;
+    getFieldInjector(field: IRegistrationExtraField): Injector;
+    constructor();
     onCreateCompanyToggle(): void;
     onSubmit(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<RegisterPageComponent, never>;
@@ -1519,25 +1160,28 @@ interface IResetPasswordFormModel {
     confirmPassword: string;
 }
 type PageState$1 = 'form' | 'success' | 'invalid-token';
-declare class ResetPasswordPageComponent implements OnInit {
+declare class ResetPasswordPageComponent {
     private readonly destroyRef;
     private readonly route;
     private readonly messageService;
     private readonly authApi;
+    private readonly translateAdapter;
+    private translate;
+    private readonly queryParams;
+    private tokenInitialized;
     private token;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly pageState: _angular_core.WritableSignal<PageState$1>;
     readonly formModel: _angular_core.WritableSignal<IResetPasswordFormModel>;
-    readonly resetForm: _angular_forms_signals.FieldTree<IResetPasswordFormModel, string | number>;
+    readonly resetForm: _angular_forms_signals.FieldTree<IResetPasswordFormModel, string | number, "writable">;
     readonly passwordMismatch: _angular_core.Signal<boolean>;
     readonly canSubmit: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     onSubmit(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<ResetPasswordPageComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<ResetPasswordPageComponent, "lib-reset-password-page", never, {}, {}, never, never, true, never>;
 }
 
-/** User form model interface */
 interface IUserFormModel {
     name: string;
     email: string;
@@ -1546,12 +1190,7 @@ interface IUserFormModel {
     isActive: boolean;
     emailVerified: boolean;
 }
-/**
- * User Form Component
- * Handles creating and editing users.
- * When company feature is enabled, automatically assigns new users to current company/branch.
- */
-declare class UserFormComponent implements OnInit {
+declare class UserFormComponent {
     private readonly destroyRef;
     private readonly router;
     private readonly route;
@@ -1560,60 +1199,81 @@ declare class UserFormComponent implements OnInit {
     private readonly userService;
     private readonly permissionService;
     private readonly authState;
-    /** Loading state */
+    private readonly translateAdapter;
+    private readonly userFormExtension;
+    private readonly parentInjector;
+    private translate;
+    private readonly routeParams;
+    private userLoadTriggered;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
-    /** Existing user data when editing */
     readonly existingUser: _angular_core.WritableSignal<IUser | null>;
-    /** Whether in edit mode */
     readonly isEditMode: _angular_core.Signal<boolean>;
-    /** Whether company feature is enabled */
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
-    /** Current company name */
     readonly currentCompanyName: _angular_core.Signal<string>;
-    /** Current branch name */
     readonly currentBranchName: _angular_core.Signal<string>;
-    /** Form model */
     readonly formModel: _angular_core.WritableSignal<IUserFormModel>;
-    /** Form with validation schema */
-    readonly formTree: _angular_forms_signals.FieldTree<IUserFormModel, string | number>;
-    /** Check if form is valid */
+    readonly formTree: _angular_forms_signals.FieldTree<IUserFormModel, string | number, "writable">;
+    readonly isLoadingExtraFields: _angular_core.WritableSignal<boolean>;
+    readonly extraFieldsModel: _angular_core.WritableSignal<Record<string, unknown>>;
+    readonly originalExtraFieldsModel: _angular_core.WritableSignal<Record<string, unknown>>;
+    readonly extraFields: _angular_core.Signal<IUserFormExtraField[]>;
+    readonly hasExtraFields: _angular_core.Signal<boolean>;
+    readonly extraFieldsValidationError: _angular_core.Signal<string | null>;
+    readonly isExtraFieldsDirty: _angular_core.Signal<boolean>;
+    updateExtraField(key: string, value: unknown): void;
+    getExtraFieldValue(key: string): unknown;
+    getFieldTemplateContext(field: IUserFormExtraField): IUserFormFieldTemplateContext;
+    getFieldInjector(field: IUserFormExtraField): Injector;
     readonly isFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
-    loadUser(id: string): void;
+    constructor();
+    loadUser(id: string): Promise<void>;
+    private loadExtraFields;
+    private toFormModel;
     onSubmit(): void;
-    /**
-     * Assign user to current company and branch
-     */
+    private updateUser;
+    private createUser;
+    private saveExtraFieldsForNewUser;
+    private onSaveSuccess;
     private assignUserToCompanyAndBranch;
     onCancel(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserFormComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserFormComponent, "lib-user-form", never, {}, {}, never, never, true, never>;
 }
 
-/**
- * User List Component
- * Displays a list of users with CRUD operations.
- */
-declare class UserListComponent implements OnInit {
+declare class UserListComponent {
+    readonly USER_PERMISSIONS: {
+        readonly CREATE: "user.create";
+        readonly READ: "user.read";
+        readonly UPDATE: "user.update";
+        readonly DELETE: "user.delete";
+    };
     private readonly router;
     private readonly appConfig;
     private readonly messageService;
     private readonly confirmationService;
     private readonly userService;
-    /** Users from service */
+    private readonly userListExtension;
+    readonly userDetailConfig: _flusys_ng_auth.IUserDetailViewConfig | null;
+    private readonly translateAdapter;
+    private translate;
     readonly users: _angular_core.Signal<IUser[]>;
-    /** Loading state from service */
     readonly isLoading: _angular_core.Signal<boolean>;
-    /** Total count from service */
     readonly total: _angular_core.Signal<number>;
-    /** Whether company feature is enabled */
     readonly companyFeatureEnabled: _angular_core.Signal<boolean>;
-    /** Dialog visibility */
+    readonly extraColumns: _angular_core.Signal<IUserListExtraColumn[]>;
+    readonly extraActions: _angular_core.Signal<IUserListExtraAction[]>;
+    readonly hasUserDetailView: _angular_core.Signal<boolean>;
+    readonly tableColspan: _angular_core.Signal<number>;
     readonly showCompanyDialog: _angular_core.WritableSignal<boolean>;
     readonly showBranchDialog: _angular_core.WritableSignal<boolean>;
-    /** Selected user for permission management */
+    readonly showUserDetailDialog: _angular_core.WritableSignal<boolean>;
     readonly selectedUser: _angular_core.WritableSignal<IUser | null>;
-    ngOnInit(): void;
+    getFieldValue(user: IUser, field: string): unknown;
+    isActionVisible(action: IUserListExtraAction, user: IUser): boolean;
+    isActionDisabled(action: IUserListExtraAction, user: IUser): boolean;
+    onExtraAction(action: IUserListExtraAction, user: IUser): void;
+    onViewDetails(user: IUser): void;
+    closeUserDetailDialog(): void;
     loadUsers(): void;
     onLazyLoad(event: {
         first?: number | null;
@@ -1623,6 +1283,7 @@ declare class UserListComponent implements OnInit {
     onEdit(user: IUser): void;
     onManageCompanyPermissions(user: IUser): void;
     onManageBranchPermissions(user: IUser): void;
+    private openPermissionDialog;
     onDelete(user: IUser): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserListComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserListComponent, "lib-user-list", never, {}, {}, never, never, true, never>;
@@ -1632,21 +1293,25 @@ interface IResendFormModel {
     email: string;
 }
 type PageState = 'verifying' | 'success' | 'invalid-token' | 'resend';
-declare class VerifyEmailPageComponent implements OnInit {
+declare class VerifyEmailPageComponent {
     private readonly platformId;
     private readonly transferState;
     private readonly destroyRef;
     private readonly route;
     private readonly messageService;
     private readonly authApi;
+    private readonly translateAdapter;
+    private translate;
+    private readonly queryParams;
+    private verificationTriggered;
     readonly isLoading: _angular_core.WritableSignal<boolean>;
     readonly pageState: _angular_core.WritableSignal<PageState>;
     readonly resendSuccess: _angular_core.WritableSignal<boolean>;
     readonly submittedEmail: _angular_core.WritableSignal<string>;
     readonly resendFormModel: _angular_core.WritableSignal<IResendFormModel>;
-    readonly resendForm: _angular_forms_signals.FieldTree<IResendFormModel, string | number>;
+    readonly resendForm: _angular_forms_signals.FieldTree<IResendFormModel, string | number, "writable">;
     readonly isResendFormValid: _angular_core.Signal<boolean>;
-    ngOnInit(): void;
+    constructor();
     private verifyEmail;
     private handleVerificationResult;
     showResendForm(): void;
@@ -1656,89 +1321,66 @@ declare class VerifyEmailPageComponent implements OnInit {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<VerifyEmailPageComponent, "lib-verify-email-page", never, {}, {}, never, never, true, never>;
 }
 
-/**
- * User Branch Permission Dialog
- *
- * Workflow:
- * 1. Dialog opens → Shows company dropdown with user's permitted companies
- * 2. User selects a company → Branches load for that company
- * 3. Branches show with checkboxes (checked = already assigned)
- * 4. Check to assign, uncheck to revoke
- *
- * Company dropdown only shows companies the user has company-level permissions for.
- * Branch permissions can only be assigned within user's permitted companies.
- */
+interface BranchWithAssignment extends IBranch {
+    isAssigned: boolean;
+}
 declare class UserBranchPermissionDialogComponent {
     private readonly branchApi;
     private readonly permissionApi;
-    private readonly authState;
     private readonly messageService;
-    /** Dialog visibility */
+    private readonly translateAdapter;
+    private t;
     readonly visible: _angular_core.InputSignal<boolean>;
-    /** User to manage permissions for */
     readonly user: _angular_core.InputSignal<IUser | null>;
-    /** Close event */
     readonly closed: _angular_core.OutputEmitterRef<void>;
-    /** Refresh event after changes */
     readonly permissionsChanged: _angular_core.OutputEmitterRef<void>;
-    /** Loading state */
-    readonly isLoading: _angular_core.WritableSignal<boolean>;
-    /** Saving state */
     readonly isSaving: _angular_core.WritableSignal<boolean>;
-    /** Branches with assignment status */
-    readonly branches: _angular_core.WritableSignal<BranchWithAssignment[]>;
-    /** Available companies (filtered by user's company permissions) */
-    readonly companies: _angular_core.WritableSignal<{
+    readonly selectedCompanyId: _angular_core.WritableSignal<string | null>;
+    readonly companiesResource: _angular_core.ResourceRef<{
         id: string;
         name: string;
-    }[]>;
-    /** Selected company ID */
-    selectedCompanyId: string | null;
-    /** Current company from auth state */
-    readonly currentCompany: _angular_core.Signal<_flusys_ng_auth.ICompanyInfo | null>;
-    /** Currently assigned branch IDs */
-    private assignedBranchIds;
-    constructor();
-    /**
-     * Load user's assigned companies (does not auto-select or load branches)
-     */
-    private loadUserCompaniesAndData;
-    private loadData;
-    onCompanyChange(): void;
-    onBranchToggle(branch: BranchWithAssignment): Promise<void>;
+    }[] | undefined>;
+    readonly branchesResource: _angular_core.ResourceRef<{
+        isAssigned: boolean;
+        id: string;
+        name: string;
+        slug: string;
+        companyId: string;
+        parentId?: string | null;
+        logoId?: string | null;
+        address?: string | null;
+        phone?: string | null;
+        email?: string | null;
+        serial?: number;
+        isActive: boolean;
+        readOnly: boolean;
+        additionalFields?: Record<string, unknown> | null;
+        createdAt: Date | string;
+        updatedAt: Date | string;
+    }[] | undefined>;
+    readonly isInitialLoading: _angular_core.Signal<boolean>;
+    onBranchToggle(branch: BranchWithAssignment, isAssigned: boolean): Promise<void>;
     onClose(): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserBranchPermissionDialogComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserBranchPermissionDialogComponent, "lib-user-branch-permission-dialog", never, { "visible": { "alias": "visible"; "required": true; "isSignal": true; }; "user": { "alias": "user"; "required": true; "isSignal": true; }; }, { "closed": "closed"; "permissionsChanged": "permissionsChanged"; }, never, never, true, never>;
 }
-interface BranchWithAssignment extends IBranch {
+
+interface CompanyWithAssignment extends ICompany {
     isAssigned: boolean;
 }
-
-/**
- * User Company Permission Dialog
- * Shows all companies with checkboxes
- * Initially assigned companies are checked
- * Check to assign, uncheck to revoke
- */
 declare class UserCompanyPermissionDialogComponent {
     private readonly companyApi;
     private readonly permissionApi;
     private readonly messageService;
-    /** Dialog visibility */
+    private readonly translateAdapter;
+    private t;
     readonly visible: _angular_core.InputSignal<boolean>;
-    /** User to manage permissions for */
     readonly user: _angular_core.InputSignal<IUser | null>;
-    /** Close event */
     readonly closed: _angular_core.OutputEmitterRef<void>;
-    /** Refresh event after changes */
     readonly permissionsChanged: _angular_core.OutputEmitterRef<void>;
-    /** Loading state */
     readonly isLoading: _angular_core.WritableSignal<boolean>;
-    /** Saving state */
     readonly isSaving: _angular_core.WritableSignal<boolean>;
-    /** Companies with assignment status */
     readonly companies: _angular_core.WritableSignal<CompanyWithAssignment[]>;
-    /** Currently assigned company IDs */
     private assignedCompanyIds;
     constructor();
     private loadData;
@@ -1747,9 +1389,6 @@ declare class UserCompanyPermissionDialogComponent {
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserCompanyPermissionDialogComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserCompanyPermissionDialogComponent, "lib-user-company-permission-dialog", never, { "visible": { "alias": "visible"; "required": true; "isSignal": true; }; "user": { "alias": "user"; "required": true; "isSignal": true; }; }, { "closed": "closed"; "permissionsChanged": "permissionsChanged"; }, never, never, true, never>;
 }
-interface CompanyWithAssignment extends ICompany {
-    isAssigned: boolean;
-}
 
-export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_ROUTES, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, ForgotPasswordPageComponent, LoginPageComponent, PROFILE_ROUTES, ProfilePageComponent, RegisterPageComponent, ResetPasswordPageComponent, TokenRefreshStateService, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, VerifyEmailPageComponent, authGuard, authInterceptor, companyFeatureGuard, guestGuard, isAuthEndpoint, isCompanySelectionResponse, isEmailVerificationRequired, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, tokenRefreshInterceptor };
-export type { AuthResponse, IAssignUserBranchRequest, IAssignUserCompanyRequest, IBatchOperationResponse, IBranch, IBranchInfo, IBranchSelectionInfo, IChangePasswordRequest, ICompany, ICompanyInfo, ICompanySelectionResponse, ICompanyWithBranches, ICreateBranchRequest, ICreateCompanyRequest, ICreateUserRequest, ILoginRequest, ILoginRequiresEmailVerification, ILoginResponse, IMeResponse, IPermissionItem, IRefreshTokenResponse, IRegistrationRequest, IRegistrationResponse, ISelectRequest, ISwitchCompanyRequest, IUpdateBranchRequest, IUpdateCompanyRequest, IUpdateUserRequest, IUser, IUserBranchPermission, IUserBranchesResponse, IUserCompaniesResponse, IUserCompanyPermission, IUserInfo };
+export { ADMINISTRATION_ROUTES, AUTH_ENDPOINTS, AUTH_MESSAGES, AUTH_PROFILE_EXTENSION, AUTH_REGISTRATION_EXTENSION, AUTH_ROUTES, AUTH_USER_DETAIL_CONFIG, AUTH_USER_FORM_EXTENSION, AUTH_USER_LIST_EXTENSION, AUTH_VALIDATION_CONFIG, AdministrationPageComponent, AuthApiService, AuthCompanyApiProviderAdapter, AuthInitService, AuthLayoutApiAdapter, AuthLayoutStateAdapter, AuthStateProviderAdapter, AuthStateService, AuthUserPermissionProviderAdapter, AuthUserProviderAdapter, BranchApiService, BranchFormComponent, BranchListComponent, CompanyApiService, CompanyFormComponent, CompanyListComponent, ForgotPasswordPageComponent, LoginPageComponent, PROFILE_FIELD_CONTEXT, PROFILE_ROUTES, ProfilePageComponent, REGISTRATION_FIELD_CONTEXT, RegisterPageComponent, ResetPasswordPageComponent, TokenRefreshStateService, USER_FORM_FIELD_CONTEXT, UserApiService, UserBranchPermissionDialogComponent, UserCompanyPermissionDialogComponent, UserFormComponent, UserListComponent, UserPermissionApiService, VerifyEmailPageComponent, authGuard, authInterceptor, companyFeatureGuard, emailFeatureGuard, guestGuard, isCompanySelectionResponse, isEmailVerificationRequired, isEndpoint, isLoginResponse, provideAuthLayoutIntegration, provideAuthProviders, signUpFeatureGuard, tokenRefreshInterceptor, validateEmail, validatePassword };
+export type { AuthResponse, IAssignUserBranchRequest, IAssignUserCompanyRequest, IAuthValidationConfig, IBranch, IBranchInfo, IBranchSelectionInfo, IChangePasswordRequest, ICompany, ICompanyInfo, ICompanySelectionData, ICompanySelectionResponse, ICompanyWithBranches, ICreateBranchRequest, ICreateCompanyRequest, ICreateUserRequest, IEmailValidationConfig, IEmailVerificationData, ILoginData, ILoginRequest, ILoginRequiresEmailVerification, ILoginResponse, IMeData, IMeResponse, IPasswordValidationConfig, IPermissionItem, IProfileExtensionProvider, IProfileExtraField, IProfileExtraSection, IProfileFieldTemplateContext, IRefreshTokenResponse, IRegistrationData, IRegistrationExtensionProvider, IRegistrationExtraField, IRegistrationFieldTemplateContext, IRegistrationRequest, IRegistrationResponse, ISelectRequest, ISwitchCompanyRequest, IUpdateBranchRequest, IUpdateCompanyRequest, IUpdateUserRequest, IUser, IUserBranchPermission, IUserCompanyPermission, IUserDetailViewConfig, IUserFormExtensionProvider, IUserFormExtraField, IUserFormFieldTemplateContext, IUserInfo, IUserListExtensionProvider, IUserListExtraAction, IUserListExtraColumn, UserDetailViewMode };