@molecule/app-angular 1.0.0

package/dist/services/logger.service.js

@@ -0,0 +1,110 @@
+/**
+ * Angular service for logging.
+ *
+ * @module
+ */
+import { Inject, Injectable } from '@angular/core';
+import { LOGGER_PROVIDER } from '../tokens.js';
+import * as i0 from "@angular/core";
+/**
+ * Angular service for logging.
+ *
+ * Wraps molecule logger provider.
+ *
+ * @example
+ * ```typescript
+ * @Component({
+ *   selector: 'app-user-profile',
+ *   template: `...`
+ * })
+ * export class UserProfileComponent implements OnInit, OnDestroy {
+ *   private logger = this.loggerService.getLogger('UserProfileComponent')
+ *
+ *   constructor(private loggerService: MoleculeLoggerService) {}
+ *
+ *   ngOnInit() {
+ *     this.logger.info('Component initialized')
+ *   }
+ *
+ *   ngOnDestroy() {
+ *     this.logger.debug('Component destroyed')
+ *   }
+ *
+ *   handleError(error: Error) {
+ *     this.logger.error('Operation failed', error)
+ *   }
+ * }
+ * ```
+ */
+export class MoleculeLoggerService {
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /**
+     * Get a logger instance.
+     *
+     * @param name - Logger name (usually component/service name)
+     * @returns The result.
+     */
+    getLogger(name) {
+        return this.provider.getLogger(name);
+    }
+    /**
+     * Create a logger with custom configuration.
+     *
+     * @param config - Logger configuration
+     * @returns The created instance.
+     */
+    createLogger(config) {
+        return this.provider.createLogger(config);
+    }
+    /**
+     * Set the global log level.
+     *
+     * @param level - Log level
+     */
+    setLevel(level) {
+        this.provider.setLevel(level);
+    }
+    /**
+     * Get the current global log level.
+     *
+     * @returns The result.
+     */
+    getLevel() {
+        return this.provider.getLevel();
+    }
+    /**
+     * Enable logging.
+     */
+    enable() {
+        this.provider.enable();
+    }
+    /**
+     * Disable logging.
+     */
+    disable() {
+        this.provider.disable();
+    }
+    /**
+     * Check if logging is enabled.
+     *
+     * @returns Whether logging is enabled
+     */
+    isEnabled() {
+        return this.provider.isEnabled();
+    }
+    static { this.ɵfac = function MoleculeLoggerService_Factory(__ngFactoryType__) { /* @ts-ignore */
+    return new (__ngFactoryType__ || MoleculeLoggerService)(i0.ɵɵinject(LOGGER_PROVIDER)); }; }
+    static { this.ɵprov = /*@__PURE__*/ i0.ɵɵdefineInjectable({ token: MoleculeLoggerService, factory: MoleculeLoggerService.ɵfac, providedIn: 'root' }); }
+}
+(() => { (typeof ngDevMode === "undefined" || ngDevMode) && i0.ɵsetClassMetadata(MoleculeLoggerService, [{
+        type: Injectable,
+        args: [{
+                providedIn: 'root',
+            }]
+    }], () => [{ type: undefined, decorators: [{
+                type: Inject,
+                args: [LOGGER_PROVIDER]
+            }] }], null); })();
+//# sourceMappingURL=logger.service.js.map

package/dist/services/logger.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.service.js","sourceRoot":"","sources":["../../src/services/logger.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAIlD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,MAAM,OAAO,qBAAqB;IAChC,YAA6C,QAAwB;QAAxB,aAAQ,GAAR,QAAQ,CAAgB;IAAG,CAAC;IAEzE;;;;;OAKG;IACH,SAAS,CAAC,IAAa;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACtC,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,MAAoB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC3C,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,KAA+D;QACtE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;IAED;;;;OAIG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA;IACjC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;IACxB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;IACzB,CAAC;IAED;;;;OAIG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAA;IAClC,CAAC;;qCA9DU,qBAAqB,cACZ,eAAe;uEADxB,qBAAqB,WAArB,qBAAqB,mBAFpB,MAAM;;iFAEP,qBAAqB;cAHjC,UAAU;eAAC;gBACV,UAAU,EAAE,MAAM;aACnB;;sBAEc,MAAM;uBAAC,eAAe"}

package/dist/services/login.service.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Angular utility for login with async state tracking.
+ *
+ * @module
+ */
+import type { Observable } from 'rxjs';
+import type { AuthClient, AuthResult, LoginCredentials } from '@molecule/app-auth';
+import type { PromiseState } from '@molecule/app-utilities';
+/**
+ * Login state manager.
+ */
+export interface LoginStateManager<T = unknown> {
+    state$: Observable<PromiseState<AuthResult<T>>>;
+    getState: () => PromiseState<AuthResult<T>>;
+    login: (credentials: LoginCredentials) => Promise<AuthResult<T>>;
+    reset: () => void;
+    destroy: () => void;
+}
+/**
+ * Creates a login state manager with async state tracking.
+ *
+ * @param client - Auth client
+ * @returns Login state manager
+ *
+ * @example
+ * ```typescript
+ * const loginManager = createLoginState(authClient)
+ *
+ * loginManager.state$.subscribe(state => {
+ *   console.log(state.status) // 'idle' | 'pending' | 'resolved' | 'rejected'
+ * })
+ *
+ * await loginManager.login({ email: 'user@example.com', password: 'secret' })
+ * ```
+ */
+export declare function createLoginState<T = unknown>(client: AuthClient<T>): LoginStateManager<T>;
+//# sourceMappingURL=login.service.d.ts.map

package/dist/services/login.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.service.d.ts","sourceRoot":"","sources":["../../src/services/login.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAI3D;;GAEG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,OAAO;IAC5C,MAAM,EAAE,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,QAAQ,EAAE,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3C,KAAK,EAAE,CAAC,WAAW,EAAE,gBAAgB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAChE,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAUzF"}

package/dist/services/login.service.js

@@ -0,0 +1,34 @@
+/**
+ * Angular utility for login with async state tracking.
+ *
+ * @module
+ */
+import { createPromiseState } from './promise.service.js';
+/**
+ * Creates a login state manager with async state tracking.
+ *
+ * @param client - Auth client
+ * @returns Login state manager
+ *
+ * @example
+ * ```typescript
+ * const loginManager = createLoginState(authClient)
+ *
+ * loginManager.state$.subscribe(state => {
+ *   console.log(state.status) // 'idle' | 'pending' | 'resolved' | 'rejected'
+ * })
+ *
+ * await loginManager.login({ email: 'user@example.com', password: 'secret' })
+ * ```
+ */
+export function createLoginState(client) {
+    const manager = createPromiseState((credentials) => client.login(credentials));
+    return {
+        state$: manager.state$,
+        getState: manager.getState,
+        login: manager.call,
+        reset: manager.reset,
+        destroy: manager.destroy,
+    };
+}
+//# sourceMappingURL=login.service.js.map

package/dist/services/login.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.service.js","sourceRoot":"","sources":["../../src/services/login.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAazD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAc,MAAqB;IACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAA6B,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAEhG,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC"}

package/dist/services/oauth.service.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Angular utility for OAuth authentication.
+ *
+ * Builds provider initiation URLs, starts the full-page redirect flow, and
+ * automatically handles the OAuth callback: when the page loads with a `code`
+ * (+ optional `state`) URL parameter and a stashed provider, the code is
+ * exchanged for a session via `POST {baseURL}{loginEndpoint}`.
+ *
+ * Session establishment uses the auth client passed via
+ * {@link OAuthOptions.authClient} (inject the `AUTH_CLIENT` token and pass it
+ * through). Without a client, the code exchange itself has already
+ * established the httpOnly-cookie session server-side, so a user-carrying
+ * response still counts as a successful login.
+ *
+ * @module
+ */
+import { type Observable } from 'rxjs';
+import type { AuthClient } from '@molecule/app-auth';
+/**
+ * OAuth configuration options.
+ */
+export interface OAuthOptions {
+    /** Base URL for the API server (e.g. `https://api.example.com`). */
+    baseURL?: string;
+    /** List of supported OAuth provider names (e.g. `['github', 'google']`). */
+    oauthProviders?: string[];
+    /** Path prefix for OAuth initiation routes. Defaults to `/oauth`. */
+    oauthEndpoint?: string;
+    /** Path for the OAuth login POST endpoint. Defaults to `/users/log-in/oauth`. */
+    loginEndpoint?: string;
+    /** Called after a successful OAuth login (session established). */
+    onSuccess?: () => void;
+    /**
+     * Called with a failure message when the OAuth login fails. Failures are
+     * also emitted on {@link OAuthStateManager.error$}.
+     */
+    onError?: (error: string) => void;
+    /**
+     * Auth client used to establish the session after the code exchange. This
+     * is THE way to wire session establishment in Angular: inject the
+     * `AUTH_CLIENT` token and pass the client here. When omitted, the helper
+     * falls back to the server-established httpOnly-cookie session (see
+     * {@link OAuthStateManager.handleCallback}).
+     */
+    authClient?: AuthClient<unknown>;
+}
+/**
+ * OAuth state manager.
+ */
+export interface OAuthStateManager {
+    /** Observable of the configured OAuth provider names. */
+    providers$: Observable<string[]>;
+    /**
+     * Observable of OAuth failure messages (from the callback code exchange).
+     * Completed by {@link OAuthStateManager.destroy}.
+     */
+    error$: Observable<string>;
+    /** Returns the configured OAuth provider names. */
+    getProviders: () => string[];
+    /** Builds the OAuth initiation URL for a provider. */
+    getOAuthUrl: (provider: string) => string;
+    /** Starts the full-page redirect flow for a provider. */
+    redirect: (provider: string) => void;
+    /**
+     * Handles the OAuth callback: exchanges the `code` URL parameter for a
+     * session. Invoked automatically at creation (see {@link createOAuthState});
+     * exposed for callers that need to re-run it manually. No-ops unless
+     * running in a browser with a `code` URL parameter and a stashed provider.
+     *
+     * When an auth client was provided, the session is established locally
+     * (`setAccessToken` + `setUser` + `initialize`). When no client is
+     * available, the server has already established the httpOnly-cookie
+     * session during the exchange, so a user-carrying response still counts
+     * as success.
+     */
+    handleCallback: () => Promise<void>;
+    /** Completes the `providers$` and `error$` observables. */
+    destroy: () => void;
+}
+/**
+ * Creates an OAuth state manager.
+ *
+ * Automatically handles OAuth callbacks: when created in a browser, it
+ * invokes {@link OAuthStateManager.handleCallback} immediately (a guarded
+ * no-op when the URL carries no `code` parameter).
+ *
+ * @param options - OAuth configuration
+ *
+ * @example
+ * ```typescript
+ * const oauthManager = createOAuthState({
+ *   baseURL: 'https://api.example.com',
+ *   oauthProviders: ['github', 'google'],
+ *   authClient: inject(AUTH_CLIENT),
+ *   onSuccess: () => router.navigate(['/dashboard']),
+ * })
+ *
+ * oauthManager.providers$.subscribe(providers => {
+ *   console.log(providers) // ['github', 'google']
+ * })
+ * oauthManager.error$.subscribe(error => {
+ *   console.error(error)
+ * })
+ *
+ * const url = oauthManager.getOAuthUrl('github')
+ * ```
+ * @returns The created instance.
+ */
+export declare function createOAuthState(options?: OAuthOptions): OAuthStateManager;
+//# sourceMappingURL=oauth.service.d.ts.map

package/dist/services/oauth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.service.d.ts","sourceRoot":"","sources":["../../src/services/oauth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAmB,KAAK,UAAU,EAAW,MAAM,MAAM,CAAA;AAEhE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChC;;;OAGG;IACH,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAC1B,mDAAmD;IACnD,YAAY,EAAE,MAAM,MAAM,EAAE,CAAA;IAC5B,sDAAsD;IACtD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,yDAAyD;IACzD,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;IACpC;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,2DAA2D;IAC3D,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,iBAAiB,CAqL1E"}

package/dist/services/oauth.service.js

@@ -0,0 +1,214 @@
+/**
+ * Angular utility for OAuth authentication.
+ *
+ * Builds provider initiation URLs, starts the full-page redirect flow, and
+ * automatically handles the OAuth callback: when the page loads with a `code`
+ * (+ optional `state`) URL parameter and a stashed provider, the code is
+ * exchanged for a session via `POST {baseURL}{loginEndpoint}`.
+ *
+ * Session establishment uses the auth client passed via
+ * {@link OAuthOptions.authClient} (inject the `AUTH_CLIENT` token and pass it
+ * through). Without a client, the code exchange itself has already
+ * established the httpOnly-cookie session server-side, so a user-carrying
+ * response still counts as a successful login.
+ *
+ * @module
+ */
+import { BehaviorSubject, Subject } from 'rxjs';
+/**
+ * Creates an OAuth state manager.
+ *
+ * Automatically handles OAuth callbacks: when created in a browser, it
+ * invokes {@link OAuthStateManager.handleCallback} immediately (a guarded
+ * no-op when the URL carries no `code` parameter).
+ *
+ * @param options - OAuth configuration
+ *
+ * @example
+ * ```typescript
+ * const oauthManager = createOAuthState({
+ *   baseURL: 'https://api.example.com',
+ *   oauthProviders: ['github', 'google'],
+ *   authClient: inject(AUTH_CLIENT),
+ *   onSuccess: () => router.navigate(['/dashboard']),
+ * })
+ *
+ * oauthManager.providers$.subscribe(providers => {
+ *   console.log(providers) // ['github', 'google']
+ * })
+ * oauthManager.error$.subscribe(error => {
+ *   console.error(error)
+ * })
+ *
+ * const url = oauthManager.getOAuthUrl('github')
+ * ```
+ * @returns The created instance.
+ */
+export function createOAuthState(options) {
+    const baseURL = options?.baseURL ?? '';
+    const oauthEndpoint = options?.oauthEndpoint ?? '/oauth';
+    const loginEndpoint = options?.loginEndpoint ?? '/users/log-in/oauth';
+    const providersList = options?.oauthProviders ?? [];
+    const authClient = options?.authClient ?? null;
+    const subject = new BehaviorSubject(providersList);
+    const errorSubject = new Subject();
+    const getOAuthUrl = (provider) => {
+        // Encode the provider as a single path segment so a (future) caller passing an
+        // untrusted value can never inject a path/query/scheme into the opened URL —
+        // defense-in-depth on top of the upstream static provider allowlist. Plain
+        // provider names ('github', 'google') pass through unchanged.
+        return `${baseURL}${oauthEndpoint}/${encodeURIComponent(provider)}`;
+    };
+    /** Stash which provider initiated the flow so the callback knows it's ours. */
+    const stashProvider = (provider) => {
+        try {
+            sessionStorage.setItem('oauth_provider', provider);
+        }
+        catch (_error) {
+            /* SSR-safe — sessionStorage is unavailable in SSR/sandboxed environments */
+        }
+    };
+    /**
+     * Append the current page's PATH as `redirect_to` so the api's initiation
+     * endpoint (`GET /users/oauth/:provider`) builds a provider `redirect_uri`
+     * that lands the callback back on THIS page — the one where the manager is
+     * created (e.g. `/login`) — instead of the app root, where nothing may be
+     * listening for the `code` param. Path only (no origin/query): the server
+     * validates it as a same-origin absolute path, so it can never become an
+     * open redirect. Servers that predate the param simply ignore it.
+     */
+    const withReturnPath = (url) => {
+        const path = typeof window !== 'undefined' ? window.location.pathname : '';
+        if (!path || path === '/')
+            return url;
+        return `${url}${url.includes('?') ? '&' : '?'}redirect_to=${encodeURIComponent(path)}`;
+    };
+    const redirect = (provider) => {
+        stashProvider(provider);
+        window.location.href = withReturnPath(getOAuthUrl(provider));
+    };
+    /** Surface a failure message via BOTH the onError callback and `error$`. */
+    const surfaceError = (error) => {
+        options?.onError?.(error);
+        errorSubject.next(error);
+    };
+    /**
+     * Establish the authenticated session from an exchange result: seed the
+     * access token + user and let `initialize()` flip `authenticated`. Mirrors
+     * what `authClient.login()` does for password login. Returns whether a user
+     * was set (a result with no user is not a real session).
+     */
+    const establishSession = async (client, token, user) => {
+        // Seed the token via the auth client's configured token storage adapter
+        // (in-memory by default) — NOT localStorage directly. Writing the bearer
+        // token to localStorage violates the in-memory-default storage contract and
+        // makes it JS-readable (XSS-exfiltratable).
+        if (token)
+            client.setAccessToken(token);
+        if (user && typeof user === 'object') {
+            client.setUser(user);
+            await client.initialize();
+            return true;
+        }
+        return false;
+    };
+    const handleCallback = async () => {
+        if (typeof window === 'undefined')
+            return;
+        const params = new URLSearchParams(window.location.search);
+        const code = params.get('code');
+        const state = params.get('state');
+        if (!code)
+            return;
+        // Retrieve the provider that initiated the flow
+        let provider = null;
+        try {
+            provider = sessionStorage.getItem('oauth_provider');
+        }
+        catch (_error) {
+            /* SSR-safe — sessionStorage is unavailable in SSR/sandboxed environments */
+        }
+        if (!provider)
+            return;
+        // Clean up URL (remove code/state params) and sessionStorage
+        const cleanUrl = new URL(window.location.href);
+        cleanUrl.searchParams.delete('code');
+        cleanUrl.searchParams.delete('state');
+        window.history.replaceState({}, '', cleanUrl.toString());
+        try {
+            sessionStorage.removeItem('oauth_provider');
+        }
+        catch (_error) {
+            /* SSR-safe — sessionStorage is unavailable in SSR/sandboxed environments */
+        }
+        // Exchange code for session
+        try {
+            const response = await fetch(`${baseURL}${loginEndpoint}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include', // Send cookies (oauth_state) for state validation
+                body: JSON.stringify({
+                    server: provider,
+                    code,
+                    state: state || undefined,
+                    redirect_uri: window.location.origin,
+                }),
+            });
+            if (!response.ok) {
+                const data = (await response.json().catch(() => null));
+                surfaceError(data && typeof data.error === 'string' && data.error ? data.error : 'OAuth login failed');
+                return;
+            }
+            const data = await response.json().catch(() => null);
+            // Store the token from the response
+            const authHeader = response.headers.get('authorization') || response.headers.get('set-authorization');
+            const token = authHeader ? authHeader.replace('Bearer ', '') : null;
+            // The authenticated user is `props` (molecule resource convention) or `user`
+            // (generic AuthResult). OAuth issues no refresh token, so we carry the token +
+            // user to whoever will own the session.
+            const user = data && typeof data === 'object'
+                ? (data.props ??
+                    data.user ??
+                    null)
+                : null;
+            if (authClient) {
+                const ok = await establishSession(authClient, token, user);
+                if (ok)
+                    options?.onSuccess?.();
+                else
+                    surfaceError('OAuth login failed');
+                return;
+            }
+            // No auth client available: the server already established the
+            // httpOnly-cookie session during the code exchange, so a user-carrying
+            // response still counts as a successful login. A response with no user
+            // means no session was established — surface the failure.
+            if (user && typeof user === 'object')
+                options?.onSuccess?.();
+            else
+                surfaceError('OAuth login failed');
+        }
+        catch (err) {
+            surfaceError(err instanceof Error && err.message ? err.message : 'OAuth login failed');
+        }
+    };
+    // Auto-handle the OAuth callback at creation when running in a browser.
+    // handleCallback itself no-ops unless the URL carries a `code` param and a
+    // provider was stashed, so this is a guarded no-op on ordinary page loads.
+    if (typeof window !== 'undefined') {
+        void handleCallback();
+    }
+    return {
+        providers$: subject.asObservable(),
+        error$: errorSubject.asObservable(),
+        getProviders: () => providersList,
+        getOAuthUrl,
+        redirect,
+        handleCallback,
+        destroy: () => {
+            subject.complete();
+            errorSubject.complete();
+        },
+    };
+}
+//# sourceMappingURL=oauth.service.js.map

package/dist/services/oauth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.service.js","sourceRoot":"","sources":["../../src/services/oauth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAmB,OAAO,EAAE,MAAM,MAAM,CAAA;AAmEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,EAAE,CAAA;IACtC,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,QAAQ,CAAA;IACxD,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,qBAAqB,CAAA;IACrE,MAAM,aAAa,GAAG,OAAO,EAAE,cAAc,IAAI,EAAE,CAAA;IACnD,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,IAAI,CAAA;IAE9C,MAAM,OAAO,GAAG,IAAI,eAAe,CAAW,aAAa,CAAC,CAAA;IAC5D,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAA;IAE1C,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE;QAC/C,+EAA+E;QAC/E,6EAA6E;QAC7E,2EAA2E;QAC3E,8DAA8D;QAC9D,OAAO,GAAG,OAAO,GAAG,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;IACrE,CAAC,CAAA;IAED,+EAA+E;IAC/E,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAQ,EAAE;QAC/C,IAAI,CAAC;YACH,cAAc,CAAC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,4EAA4E;QAC9E,CAAC;IACH,CAAC,CAAA;IAED;;;;;;;;OAQG;IACH,MAAM,cAAc,GAAG,CAAC,GAAW,EAAU,EAAE;QAC7C,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;QAC1E,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,GAAG,CAAA;QACrC,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAA;IACxF,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAQ,EAAE;QAC1C,aAAa,CAAC,QAAQ,CAAC,CAAA;QACvB,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC9D,CAAC,CAAA;IAED,4EAA4E;IAC5E,MAAM,YAAY,GAAG,CAAC,KAAa,EAAQ,EAAE;QAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;QACzB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC,CAAA;IAED;;;;;OAKG;IACH,MAAM,gBAAgB,GAAG,KAAK,EAC5B,MAA2B,EAC3B,KAAoB,EACpB,IAAa,EACK,EAAE;QACpB,wEAAwE;QACxE,yEAAyE;QACzE,4EAA4E;QAC5E,4CAA4C;QAC5C,IAAI,KAAK;YAAE,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACpB,MAAM,MAAM,CAAC,UAAU,EAAE,CAAA;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,KAAK,IAAmB,EAAE;QAC/C,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAM;QAEzC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAEjC,IAAI,CAAC,IAAI;YAAE,OAAM;QAEjB,gDAAgD;QAChD,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,4EAA4E;QAC9E,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAM;QAErB,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC9C,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACpC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC;YACH,cAAc,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,4EAA4E;QAC9E,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,aAAa,EAAE,EAAE;gBACzD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,WAAW,EAAE,SAAS,EAAE,kDAAkD;gBAC1E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,IAAI;oBACJ,KAAK,EAAE,KAAK,IAAI,SAAS;oBACzB,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;iBACrC,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA+B,CAAA;gBACpF,YAAY,CACV,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CACzF,CAAA;gBACD,OAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YAC7D,oCAAoC;YACpC,MAAM,UAAU,GACd,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;YACpF,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAEnE,6EAA6E;YAC7E,+EAA+E;YAC/E,wCAAwC;YACxC,MAAM,IAAI,GACR,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAC9B,CAAC,CAAC,CAAE,IAA4C,CAAC,KAAK;oBACnD,IAA4C,CAAC,IAAI;oBAClD,IAAI,CAAC;gBACP,CAAC,CAAC,IAAI,CAAA;YAEV,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;gBAC1D,IAAI,EAAE;oBAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAA;;oBACzB,YAAY,CAAC,oBAAoB,CAAC,CAAA;gBACvC,OAAM;YACR,CAAC;YAED,+DAA+D;YAC/D,uEAAuE;YACvE,uEAAuE;YACvE,0DAA0D;YAC1D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAA;;gBACvD,YAAY,CAAC,oBAAoB,CAAC,CAAA;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;QACxF,CAAC;IACH,CAAC,CAAA;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,KAAK,cAAc,EAAE,CAAA;IACvB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;QAClC,MAAM,EAAE,YAAY,CAAC,YAAY,EAAE;QACnC,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa;QACjC,WAAW;QACX,QAAQ;QACR,cAAc;QACd,OAAO,EAAE,GAAG,EAAE;YACZ,OAAO,CAAC,QAAQ,EAAE,CAAA;YAClB,YAAY,CAAC,QAAQ,EAAE,CAAA;QACzB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/services/password-reset.service.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Angular utility for password reset with async state tracking.
+ *
+ * @module
+ */
+import type { Observable } from 'rxjs';
+import type { AuthClient, PasswordResetConfirm, PasswordResetRequest } from '@molecule/app-auth';
+import type { PromiseState } from '@molecule/app-utilities';
+/**
+ * Password reset state manager.
+ */
+export interface PasswordResetStateManager {
+    requestState$: Observable<PromiseState<void>>;
+    confirmState$: Observable<PromiseState<void>>;
+    getRequestState: () => PromiseState<void>;
+    getConfirmState: () => PromiseState<void>;
+    requestReset: (data: PasswordResetRequest) => Promise<void>;
+    confirmReset: (data: PasswordResetConfirm) => Promise<void>;
+    reset: () => void;
+    destroy: () => void;
+}
+/**
+ * Creates a password reset state manager with async state tracking.
+ *
+ * @param client - Auth client
+ * @returns Password reset state manager
+ *
+ * @example
+ * ```typescript
+ * const resetManager = createPasswordResetState(authClient)
+ *
+ * resetManager.requestState$.subscribe(state => {
+ *   console.log(state.status) // 'idle' | 'pending' | 'resolved' | 'rejected'
+ * })
+ *
+ * await resetManager.requestReset({ email: 'user@example.com' })
+ * await resetManager.confirmReset({ token: 'abc123', password: 'newpass' })
+ * ```
+ */
+export declare function createPasswordResetState(client: AuthClient): PasswordResetStateManager;
+//# sourceMappingURL=password-reset.service.d.ts.map

package/dist/services/password-reset.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.service.d.ts","sourceRoot":"","sources":["../../src/services/password-reset.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAChG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAI3D;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,aAAa,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,eAAe,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;IACzC,eAAe,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;IACzC,YAAY,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,YAAY,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,yBAAyB,CAyBtF"}

package/dist/services/password-reset.service.js

@@ -0,0 +1,45 @@
+/**
+ * Angular utility for password reset with async state tracking.
+ *
+ * @module
+ */
+import { createPromiseState } from './promise.service.js';
+/**
+ * Creates a password reset state manager with async state tracking.
+ *
+ * @param client - Auth client
+ * @returns Password reset state manager
+ *
+ * @example
+ * ```typescript
+ * const resetManager = createPasswordResetState(authClient)
+ *
+ * resetManager.requestState$.subscribe(state => {
+ *   console.log(state.status) // 'idle' | 'pending' | 'resolved' | 'rejected'
+ * })
+ *
+ * await resetManager.requestReset({ email: 'user@example.com' })
+ * await resetManager.confirmReset({ token: 'abc123', password: 'newpass' })
+ * ```
+ */
+export function createPasswordResetState(client) {
+    const requestManager = createPromiseState((data) => client.requestPasswordReset(data));
+    const confirmManager = createPromiseState((data) => client.confirmPasswordReset(data));
+    return {
+        requestState$: requestManager.state$,
+        confirmState$: confirmManager.state$,
+        getRequestState: requestManager.getState,
+        getConfirmState: confirmManager.getState,
+        requestReset: requestManager.call,
+        confirmReset: confirmManager.call,
+        reset: () => {
+            requestManager.reset();
+            confirmManager.reset();
+        },
+        destroy: () => {
+            requestManager.destroy();
+            confirmManager.destroy();
+        },
+    };
+}
+//# sourceMappingURL=password-reset.service.js.map

package/dist/services/password-reset.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.service.js","sourceRoot":"","sources":["../../src/services/password-reset.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAgBzD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAkB;IACzD,MAAM,cAAc,GAAG,kBAAkB,CAAC,CAAC,IAA0B,EAAE,EAAE,CACvE,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAClC,CAAA;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,CAAC,IAA0B,EAAE,EAAE,CACvE,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAClC,CAAA;IAED,OAAO;QACL,aAAa,EAAE,cAAc,CAAC,MAAM;QACpC,aAAa,EAAE,cAAc,CAAC,MAAM;QACpC,eAAe,EAAE,cAAc,CAAC,QAAQ;QACxC,eAAe,EAAE,cAAc,CAAC,QAAQ;QACxC,YAAY,EAAE,cAAc,CAAC,IAAI;QACjC,YAAY,EAAE,cAAc,CAAC,IAAI;QACjC,KAAK,EAAE,GAAG,EAAE;YACV,cAAc,CAAC,KAAK,EAAE,CAAA;YACtB,cAAc,CAAC,KAAK,EAAE,CAAA;QACxB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACZ,cAAc,CAAC,OAAO,EAAE,CAAA;YACxB,cAAc,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/services/platform.service.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Angular platform service for accessing platform information.
+ *
+ * @module
+ */
+import type { Platform } from '@molecule/app-platform';
+/**
+ * Platform service interface.
+ */
+export interface PlatformService {
+    platform: Platform;
+    isNative: boolean;
+    isMobile: boolean;
+    isDesktop: boolean;
+    isWeb: boolean;
+    isDevelopment: boolean;
+    isProduction: boolean;
+    isPlatform: (...platforms: Platform[]) => boolean;
+}
+/**
+ * Creates an Angular platform service with static platform information.
+ *
+ * @returns Platform service with platform flags and isPlatform check
+ *
+ * @example
+ * ```typescript
+ * const platform = createPlatformService()
+ *
+ * if (platform.isMobile) {
+ *   console.log('Running on mobile')
+ * }
+ *
+ * if (platform.isPlatform('ios', 'android')) {
+ *   console.log('Running on iOS or Android')
+ * }
+ * ```
+ */
+export declare const createPlatformService: () => PlatformService;
+//# sourceMappingURL=platform.service.d.ts.map