@orechio/platform-angular 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Orechio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,64 @@
+# PlatformAngular
+
+This project was generated using [Angular CLI](https://github.com/angular/angular-cli) version 22.1.0.
+
+## Code scaffolding
+
+Angular CLI includes powerful code scaffolding tools. To generate a new component, run:
+
+```bash
+ng generate component component-name
+```
+
+For a complete list of available schematics (such as `components`, `directives`, or `pipes`), run:
+
+```bash
+ng generate --help
+```
+
+## Building
+
+To build the library, run:
+
+```bash
+ng build platform-angular
+```
+
+This command will compile your project, and the build artifacts will be placed in the `dist/` directory.
+
+### Publishing the Library
+
+Once the project is built, you can publish your library by following these steps:
+
+1. Navigate to the `dist` directory:
+
+   ```bash
+   cd dist/platform-angular
+   ```
+
+2. Run the `npm publish` command to publish your library to the npm registry:
+   ```bash
+   npm publish
+   ```
+
+## Running unit tests
+
+To execute unit tests with the [Karma](https://karma-runner.github.io) test runner, use the following command:
+
+```bash
+ng test
+```
+
+## Running end-to-end tests
+
+For end-to-end (e2e) testing, run:
+
+```bash
+ng e2e
+```
+
+Angular CLI does not come with an end-to-end testing framework by default. You can choose one that suits your needs.
+
+## Additional Resources
+
+For more information on using the Angular CLI, including detailed command references, visit the [Angular CLI Overview and Command Reference](https://angular.dev/tools/cli) page.

package/fesm2022/orechio-platform-angular.mjs

@@ -0,0 +1,360 @@
+import * as i0 from '@angular/core';
+import { InjectionToken, signal, computed, Injectable, inject, TemplateRef, ViewContainerRef, Input, Directive } from '@angular/core';
+import { HttpClient, HttpErrorResponse, provideHttpClient, withXsrfConfiguration, withInterceptors } from '@angular/common/http';
+import { map, tap, finalize, catchError, throwError, share, ReplaySubject, switchMap } from 'rxjs';
+import { Router } from '@angular/router';
+
+const PLATFORM_ANGULAR_CONFIG = new InjectionToken('PLATFORM_ANGULAR_CONFIG');
+function providePlatformAngularConfig(config) {
+    return { provide: PLATFORM_ANGULAR_CONFIG, useValue: config };
+}
+
+/**
+ * Generic signal-based session store. Mirrors the pattern already proven
+ * independently by both consumers (Portal's AuthService.user, Store's
+ * EstadoDaSessao) — deliberately NOT a richer state machine (unknown /
+ * loading / error states): neither consumer needed one, and ADR-010 §2.2
+ * ("projete para extração, não extraia por antecipação") argues against
+ * building one speculatively.
+ *
+ * Parameterized over TUser so each product can extend SessionUser with its
+ * own fields without needing a package release.
+ */
+class SessionStore {
+    state = signal(null, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "state" }] : /* istanbul ignore next */ []));
+    user = this.state.asReadonly();
+    isAuthenticated = computed(() => this.state() !== null, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "isAuthenticated" }] : /* istanbul ignore next */ []));
+    set(user) {
+        this.state.set(user);
+    }
+    clear() {
+        this.state.set(null);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: SessionStore, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: SessionStore, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: SessionStore, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/**
+ * Thin BFF client for the auth contract: login / refresh / logout, and an
+ * optional session-read ("me") endpoint. Deliberately does NOT decode JWTs,
+ * store bearer tokens, or treat itself as a security authority — per
+ * ADR-010 §12 and this package's explicit non-goal (no JWT client SDK): the
+ * BFF/backend is the only place tokens live, this class only reflects
+ * whatever session-shaped JSON the BFF hands back.
+ *
+ * Endpoint paths are entirely config-driven (PLATFORM_ANGULAR_CONFIG) — this
+ * class contains zero hardcoded URLs, so it works unmodified against
+ * Portal's /api/auth/{login,me,refresh,logout} (envelope-wrapped
+ * `{ user: UserInfo }` responses, unwrapped via config.auth.unwrapUser) and
+ * Store's /api/auth/{login,refresh,logout} (no `me`, unwrapped responses)
+ * alike.
+ */
+class AuthClient {
+    http = inject(HttpClient);
+    config = inject(PLATFORM_ANGULAR_CONFIG);
+    session = inject(SessionStore);
+    url(path) {
+        return `${this.config.apiBaseUrl}${path}`;
+    }
+    unwrap(body) {
+        const unwrapUser = this.config.auth.unwrapUser;
+        return (unwrapUser ? unwrapUser(body) : body);
+    }
+    login(credentials) {
+        return this.http.post(this.url(this.config.auth.login), credentials).pipe(map((body) => this.unwrap(body)), tap((user) => this.session.set(user)));
+    }
+    /**
+     * Reads the current session. Uses the configured `me` endpoint (GET) when
+     * present (Portal); falls back to `refresh` (POST) when it isn't (Store,
+     * which has no dedicated session-read endpoint and bootstraps via refresh).
+     */
+    initSession() {
+        if (this.config.auth.me) {
+            return this.http.get(this.url(this.config.auth.me)).pipe(map((body) => this.unwrap(body)), tap((user) => this.session.set(user)));
+        }
+        return this.refresh();
+    }
+    refresh() {
+        return this.http.post(this.url(this.config.auth.refresh), {}).pipe(map((body) => this.unwrap(body)), tap((user) => this.session.set(user)));
+    }
+    /**
+     * Clears the local session unconditionally — on success, on error, and on
+     * unsubscribe (`finalize`, not `tap`) — matching the behavior both
+     * consumers already converged on independently (Portal swallows the
+     * error before clearing; Store clears via `finalize` while still letting
+     * the error propagate). This does NOT swallow errors: callers that want
+     * Portal's "always succeed" UX compose their own `catchError` on top.
+     */
+    logout() {
+        return this.http
+            .post(this.url(this.config.auth.logout), {})
+            .pipe(finalize(() => this.session.clear()));
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: AuthClient, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: AuthClient, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: AuthClient, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/**
+ * INTERNAL. Not exported from public-api.ts — consumers never construct or configure this
+ * directly; it exists purely to back `sessionExpiryInterceptor`'s `'refresh-then-redirect'`
+ * strategy (WEB-0.2, ADR-016 §"WEB-0.2 note").
+ *
+ * Deduplicates concurrent `AuthClient.refresh()` calls that originate from the SAME Angular
+ * application context (one injector, i.e. one running app/tab). Before this existed, every
+ * 401'd request independently called `authClient.refresh()`, and since that method returns a
+ * cold Observable (`http.post(...)`, no multicasting), N simultaneous 401s produced N
+ * independent `POST /refresh` calls — proven by the characterization test in
+ * `provide-platform-angular-http.spec.ts`.
+ *
+ * This is defense-in-depth ONLY. The Platform already tolerates concurrent legitimate refresh
+ * rotations correctly and safely (PLATFORM-REFRESH-1/1A/1B, ADR-016's retry leeway) — this class
+ * exists to cut needless network traffic, cryptographic work, and rate-limit pressure on the
+ * Platform, not to be the thing that makes concurrent refreshes safe. It does not, and does not
+ * need to, coordinate across browser tabs/windows or other Angular application instances — see
+ * the "Multi-tab" note on `sessionExpiryInterceptor` for why that's explicitly out of scope here
+ * and handled server-side instead.
+ */
+class RefreshCoordinator {
+    authClient = inject(AuthClient);
+    session = inject(SessionStore);
+    router = inject(Router);
+    config = inject(PLATFORM_ANGULAR_CONFIG);
+    inFlight$ = null;
+    /**
+     * Returns the single in-flight refresh operation if one is already running, or starts a new
+     * one. Every caller — first or piggybacking — gets the SAME underlying HTTP call's outcome.
+     *
+     * Semantics (WEB-0.2):
+     * - Single-flight, not a permanent cache: once the shared operation settles (success or
+     *   error), the reference is cleared (`finalize`, placed BEFORE `share()` so it fires exactly
+     *   once per underlying HTTP call, not once per subscriber — see the `share()` config note
+     *   below). The next call to `refresh()` after that always starts a genuinely new request.
+     * - On failure, the session is cleared and the browser is navigated to the login route
+     *   exactly once, regardless of how many callers are waiting — not once per waiting caller.
+     *   Each caller still receives its own error notification (multicast by `share()`) and is
+     *   responsible for propagating whatever error IT needs to its own subscriber (see
+     *   `sessionExpiryInterceptor`, which re-throws the ORIGINAL 401 to the request that
+     *   triggered it, not this refresh failure).
+     * - `resetOnRefCountZero: false` is load-bearing: if one waiting caller unsubscribes (e.g. a
+     *   cancelled navigation), the still-in-flight HTTP request for the OTHER callers must not be
+     *   aborted. Angular's `HttpClient` cancels the underlying network request when its Observable
+     *   loses its last subscriber — without this flag, one caller going away could silently
+     *   cancel the refresh everyone else is still waiting on.
+     * - `resetOnError`/`resetOnComplete` are left `false` too: this class never reuses a settled
+     *   `inFlight$` reference across cycles (the field is always nulled and rebuilt from scratch
+     *   by `finalize`), so `share()` itself never needs to reset its own internal connector.
+     */
+    refresh() {
+        if (this.inFlight$) {
+            return this.inFlight$;
+        }
+        this.inFlight$ = this.authClient.refresh().pipe(catchError((error) => {
+            this.session.clear();
+            void this.router.navigateByUrl(this.config.loginRoute ?? '/login');
+            return throwError(() => error);
+        }), finalize(() => {
+            this.inFlight$ = null;
+        }), share({
+            connector: () => new ReplaySubject(1),
+            resetOnError: false,
+            resetOnComplete: false,
+            resetOnRefCountZero: false,
+        }));
+        return this.inFlight$;
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: RefreshCoordinator, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: RefreshCoordinator, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: RefreshCoordinator, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+function isApiRequest(url, apiBaseUrl) {
+    return url === apiBaseUrl || url.startsWith(`${apiBaseUrl}/`);
+}
+function isAuthEndpoint(url, apiBaseUrl, auth) {
+    const authPaths = [auth.login, auth.refresh, auth.logout, auth.me].filter((p) => !!p);
+    return authPaths.some((p) => url === `${apiBaseUrl}${p}`);
+}
+/**
+ * Forces `withCredentials: true` on same-origin API requests, so the BFF's
+ * HttpOnly session cookie is sent. Proven identically in both consumers.
+ * XSRF header injection is intentionally NOT duplicated here — Angular's
+ * own `withXsrfConfiguration` (registered by `providePlatformAngularHttp`)
+ * already does that. Portal's local interceptor previously re-implemented
+ * XSRF header injection manually alongside `withXsrfConfiguration`; that
+ * was redundant, not a pattern to preserve.
+ */
+const credentialsInterceptor = (req, next) => {
+    const { apiBaseUrl } = inject(PLATFORM_ANGULAR_CONFIG);
+    if (!isApiRequest(req.url, apiBaseUrl)) {
+        return next(req);
+    }
+    return next(req.clone({ withCredentials: true }));
+};
+/**
+ * On 401 from a non-auth API request: 'redirect' (default) clears the
+ * session and navigates to the login route immediately (Store's proven
+ * behavior). 'refresh-then-redirect' attempts one silent refresh first and
+ * retries the original request on success, falling back to redirect
+ * (Portal's proven behavior). Configured via
+ * PlatformAngularConfig.unauthorizedStrategy.
+ *
+ * WEB-0.2: the 'refresh-then-redirect' path routes through `RefreshCoordinator`
+ * instead of calling `AuthClient.refresh()` directly — every 401 handled by
+ * the SAME running app shares one in-flight refresh instead of each request
+ * triggering its own. The 'redirect' strategy is untouched: it never calls
+ * refresh at all, so there is nothing to coordinate (see the config note on
+ * `PlatformAngularConfig.unauthorizedStrategy`). On refresh failure, the
+ * session-clear/navigate side effect now happens once inside the coordinator
+ * (shared across every waiting caller) rather than once per waiting caller;
+ * each caller still receives the ORIGINAL 401 error, not a refresh-specific
+ * one, exactly as before. Multi-tab/multi-window coordination is explicitly
+ * NOT handled here — see `RefreshCoordinator`'s doc comment — the Platform's
+ * own server-side retry leeway (ADR-016) is what makes concurrent refreshes
+ * from independent contexts safe.
+ */
+const sessionExpiryInterceptor = (req, next) => {
+    const config = inject(PLATFORM_ANGULAR_CONFIG);
+    const session = inject(SessionStore);
+    const router = inject(Router);
+    const refreshCoordinator = inject(RefreshCoordinator);
+    if (!isApiRequest(req.url, config.apiBaseUrl) ||
+        isAuthEndpoint(req.url, config.apiBaseUrl, config.auth)) {
+        return next(req);
+    }
+    return next(req).pipe(catchError((error) => {
+        if (!(error instanceof HttpErrorResponse) || error.status !== 401) {
+            return throwError(() => error);
+        }
+        if (config.unauthorizedStrategy !== 'refresh-then-redirect') {
+            session.clear();
+            void router.navigateByUrl(config.loginRoute ?? '/login');
+            return throwError(() => error);
+        }
+        return refreshCoordinator.refresh().pipe(switchMap(() => next(req)), 
+        // The coordinator already cleared the session and navigated once for
+        // this shared failure (see RefreshCoordinator.refresh()) — this
+        // request still needs to fail with its OWN original 401, not the
+        // refresh's error, exactly as before WEB-0.2.
+        catchError(() => throwError(() => error)));
+    }));
+};
+/**
+ * Bundles provideHttpClient with the XSRF configuration and interceptors
+ * proven necessary by both consumers. Cookie/header names default to
+ * 'XSRF-TOKEN'/'X-XSRF-TOKEN' (identical in both consumers today) but
+ * remain overridable via config. Consumers add their own extra
+ * provideHttpClient features (e.g. Portal's withXhr()) by calling
+ * provideHttpClient(...) separately — this function only owns the concerns
+ * proven common to both.
+ */
+function providePlatformAngularHttp(...extraFeatures) {
+    return provideHttpClient(withXsrfConfiguration({
+        cookieName: 'XSRF-TOKEN',
+        headerName: 'X-XSRF-TOKEN',
+    }), withInterceptors([credentialsInterceptor, sessionExpiryInterceptor]), ...extraFeatures);
+}
+
+function hasCapability(capabilities, key) {
+    return capabilities?.[key] === true;
+}
+
+/**
+ * Structural directive gating template content on a capability key from a
+ * consumer-supplied CapabilityMap. Net-new (neither consumer had factored
+ * their proven inline `@if (capabilities()?.x)` pattern into a directive),
+ * but grounded in Portal's validated usage — see capability.model.ts.
+ *
+ * UX ONLY — see capability.model.ts. Hiding an element here does not
+ * authorize anything; the backend re-validates on every mutating call.
+ *
+ * Usage: `<button *orxCapability="capabilities(); has: 'manageTenants'">`
+ */
+class CapabilityDirective {
+    templateRef = inject((TemplateRef));
+    viewContainer = inject(ViewContainerRef);
+    map;
+    key;
+    hasView = false;
+    set orxCapability(map) {
+        this.map = map;
+        this.render();
+    }
+    set has(key) {
+        this.key = key;
+        this.render();
+    }
+    render() {
+        const shouldShow = !!this.key && hasCapability(this.map, this.key);
+        if (shouldShow && !this.hasView) {
+            this.viewContainer.createEmbeddedView(this.templateRef);
+            this.hasView = true;
+        }
+        else if (!shouldShow && this.hasView) {
+            this.viewContainer.clear();
+            this.hasView = false;
+        }
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: CapabilityDirective, deps: [], target: i0.ɵɵFactoryTarget.Directive });
+    static ɵdir = i0.ɵɵngDeclareDirective({ minVersion: "14.0.0", version: "22.1.2", type: CapabilityDirective, isStandalone: true, selector: "[orxCapability]", inputs: { orxCapability: "orxCapability", has: ["orxCapabilityHas", "has"] }, ngImport: i0 });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: CapabilityDirective, decorators: [{
+            type: Directive,
+            args: [{
+                    selector: '[orxCapability]',
+                    standalone: true,
+                }]
+        }], propDecorators: { orxCapability: [{
+                type: Input
+            }], has: [{
+                type: Input,
+                args: ['orxCapabilityHas']
+            }] } });
+
+/**
+ * Normalizes an HttpErrorResponse into ProblemDetails. Mirrors Store's
+ * normalizarErroApi exactly, generalized to make `message` optional and to
+ * accept an HttpErrorResponse without any consumer-specific fallback
+ * message map (each product keeps its own code→message copy locally —
+ * that's product-specific text, not shared infrastructure).
+ */
+function normalizeProblemDetails(error) {
+    const body = error.error;
+    const code = typeof body?.['code'] === 'string' ? body['code'] : `http.${error.status || 0}`;
+    const message = typeof body?.['message'] === 'string' ? body['message'] : undefined;
+    const required = typeof body?.['required'] === 'string' ? body['required'] : undefined;
+    // Wire field is `correlation_id` (snake_case, ADR-017 §3) — kept as-is on the wire,
+    // exposed as `correlationId` here per TS/Angular convention (same server-side pattern:
+    // OrechioProblemDetails.CorrelationId is [JsonPropertyName("correlation_id")]).
+    const correlationId = typeof body?.['correlation_id'] === 'string' ? body['correlation_id'] : undefined;
+    return {
+        code,
+        message,
+        status: error.status,
+        ...(required ? { required } : {}),
+        ...(correlationId ? { correlationId } : {}),
+    };
+}
+
+/*
+ * Public API Surface of @orechio/platform-angular
+ */
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { AuthClient, CapabilityDirective, PLATFORM_ANGULAR_CONFIG, SessionStore, credentialsInterceptor, hasCapability, normalizeProblemDetails, providePlatformAngularConfig, providePlatformAngularHttp, sessionExpiryInterceptor };
+//# sourceMappingURL=orechio-platform-angular.mjs.map

package/fesm2022/orechio-platform-angular.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"orechio-platform-angular.mjs","sources":["../../../projects/platform-angular/src/lib/config/platform-angular-config.ts","../../../projects/platform-angular/src/lib/session/session-store.ts","../../../projects/platform-angular/src/lib/auth/auth-client.ts","../../../projects/platform-angular/src/lib/auth/refresh-coordinator.ts","../../../projects/platform-angular/src/lib/http/provide-platform-angular-http.ts","../../../projects/platform-angular/src/lib/capabilities/capability.model.ts","../../../projects/platform-angular/src/lib/capabilities/capability.directive.ts","../../../projects/platform-angular/src/lib/problem-details/problem-details.model.ts","../../../projects/platform-angular/src/public-api.ts","../../../projects/platform-angular/src/orechio-platform-angular.ts"],"sourcesContent":["import { InjectionToken, Provider } from '@angular/core';\r\n\r\n/**\r\n * BFF endpoint paths for the auth contract. All paths are relative to `apiBaseUrl`.\r\n * `me` is optional: some BFFs bootstrap the session via `refresh` alone (no dedicated\r\n * session-read endpoint) instead of a separate `me` call.\r\n */\r\nexport interface PlatformAngularAuthPaths {\r\n  login: string;\r\n  refresh: string;\r\n  logout: string;\r\n  me?: string;\r\n  /**\r\n   * Unwraps the raw auth-endpoint response body into TUser. Defaults to the\r\n   * identity function (response body IS the user object), matching Store's\r\n   * proven wire format. Portal's BFF wraps the user in an envelope\r\n   * (`{ user: UserInfo }`) — Portal supplies `(body) => body.user` here\r\n   * rather than the package assuming either shape.\r\n   */\r\n  unwrapUser?: (body: unknown) => unknown;\r\n}\r\n\r\nexport interface PlatformAngularConfig {\r\n  /** Same-origin API base path, e.g. '/api'. Never an absolute cross-origin URL — the\r\n   *  BFF/cookie-session pattern this library assumes requires same-origin requests. */\r\n  apiBaseUrl: string;\r\n  auth: PlatformAngularAuthPaths;\r\n  /** XSRF cookie/header names. Defaults match Angular's own defaults and both proven\r\n   *  consumers (Portal, Store): cookie 'XSRF-TOKEN', header 'X-XSRF-TOKEN'. */\r\n  xsrf?: {\r\n    cookieName?: string;\r\n    headerName?: string;\r\n  };\r\n  /** 401 handling strategy. 'redirect' clears the session and redirects immediately\r\n   *  (Store's proven behavior). 'refresh-then-redirect' attempts one silent refresh\r\n   *  before giving up (Portal's proven behavior). Defaults to 'redirect' — the simpler,\r\n   *  more conservative behavior — when omitted. */\r\n  unauthorizedStrategy?: 'redirect' | 'refresh-then-redirect';\r\n  /** Route to navigate to after a session is cleared. Defaults to '/login'. */\r\n  loginRoute?: string;\r\n}\r\n\r\nexport const PLATFORM_ANGULAR_CONFIG = new InjectionToken<PlatformAngularConfig>(\r\n  'PLATFORM_ANGULAR_CONFIG',\r\n);\r\n\r\nexport function providePlatformAngularConfig(config: PlatformAngularConfig): Provider {\r\n  return { provide: PLATFORM_ANGULAR_CONFIG, useValue: config };\r\n}\r\n","import { Injectable, Signal, computed, signal } from '@angular/core';\r\nimport { SessionUser } from './session-user.model';\r\n\r\n/**\r\n * Generic signal-based session store. Mirrors the pattern already proven\r\n * independently by both consumers (Portal's AuthService.user, Store's\r\n * EstadoDaSessao) — deliberately NOT a richer state machine (unknown /\r\n * loading / error states): neither consumer needed one, and ADR-010 §2.2\r\n * (\"projete para extração, não extraia por antecipação\") argues against\r\n * building one speculatively.\r\n *\r\n * Parameterized over TUser so each product can extend SessionUser with its\r\n * own fields without needing a package release.\r\n */\r\n@Injectable({ providedIn: 'root' })\r\nexport class SessionStore<TUser extends SessionUser = SessionUser> {\r\n  private readonly state = signal<TUser | null>(null);\r\n\r\n  readonly user: Signal<TUser | null> = this.state.asReadonly();\r\n  readonly isAuthenticated: Signal<boolean> = computed(() => this.state() !== null);\r\n\r\n  set(user: TUser): void {\r\n    this.state.set(user);\r\n  }\r\n\r\n  clear(): void {\r\n    this.state.set(null);\r\n  }\r\n}\r\n","import { HttpClient } from '@angular/common/http';\r\nimport { Injectable, inject } from '@angular/core';\r\nimport { Observable, finalize, map, tap } from 'rxjs';\r\nimport { PLATFORM_ANGULAR_CONFIG } from '../config/platform-angular-config';\r\nimport { SessionStore } from '../session/session-store';\r\nimport { SessionUser } from '../session/session-user.model';\r\n\r\n/**\r\n * Thin BFF client for the auth contract: login / refresh / logout, and an\r\n * optional session-read (\"me\") endpoint. Deliberately does NOT decode JWTs,\r\n * store bearer tokens, or treat itself as a security authority — per\r\n * ADR-010 §12 and this package's explicit non-goal (no JWT client SDK): the\r\n * BFF/backend is the only place tokens live, this class only reflects\r\n * whatever session-shaped JSON the BFF hands back.\r\n *\r\n * Endpoint paths are entirely config-driven (PLATFORM_ANGULAR_CONFIG) — this\r\n * class contains zero hardcoded URLs, so it works unmodified against\r\n * Portal's /api/auth/{login,me,refresh,logout} (envelope-wrapped\r\n * `{ user: UserInfo }` responses, unwrapped via config.auth.unwrapUser) and\r\n * Store's /api/auth/{login,refresh,logout} (no `me`, unwrapped responses)\r\n * alike.\r\n */\r\n@Injectable({ providedIn: 'root' })\r\nexport class AuthClient<TUser extends SessionUser = SessionUser> {\r\n  private readonly http = inject(HttpClient);\r\n  private readonly config = inject(PLATFORM_ANGULAR_CONFIG);\r\n  private readonly session = inject(SessionStore) as SessionStore<TUser>;\r\n\r\n  private url(path: string): string {\r\n    return `${this.config.apiBaseUrl}${path}`;\r\n  }\r\n\r\n  private unwrap(body: unknown): TUser {\r\n    const unwrapUser = this.config.auth.unwrapUser;\r\n    return (unwrapUser ? unwrapUser(body) : body) as TUser;\r\n  }\r\n\r\n  login(credentials: unknown): Observable<TUser> {\r\n    return this.http.post<unknown>(this.url(this.config.auth.login), credentials).pipe(\r\n      map((body) => this.unwrap(body)),\r\n      tap((user) => this.session.set(user)),\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Reads the current session. Uses the configured `me` endpoint (GET) when\r\n   * present (Portal); falls back to `refresh` (POST) when it isn't (Store,\r\n   * which has no dedicated session-read endpoint and bootstraps via refresh).\r\n   */\r\n  initSession(): Observable<TUser> {\r\n    if (this.config.auth.me) {\r\n      return this.http.get<unknown>(this.url(this.config.auth.me)).pipe(\r\n        map((body) => this.unwrap(body)),\r\n        tap((user) => this.session.set(user)),\r\n      );\r\n    }\r\n    return this.refresh();\r\n  }\r\n\r\n  refresh(): Observable<TUser> {\r\n    return this.http.post<unknown>(this.url(this.config.auth.refresh), {}).pipe(\r\n      map((body) => this.unwrap(body)),\r\n      tap((user) => this.session.set(user)),\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Clears the local session unconditionally — on success, on error, and on\r\n   * unsubscribe (`finalize`, not `tap`) — matching the behavior both\r\n   * consumers already converged on independently (Portal swallows the\r\n   * error before clearing; Store clears via `finalize` while still letting\r\n   * the error propagate). This does NOT swallow errors: callers that want\r\n   * Portal's \"always succeed\" UX compose their own `catchError` on top.\r\n   */\r\n  logout(): Observable<void> {\r\n    return this.http\r\n      .post<void>(this.url(this.config.auth.logout), {})\r\n      .pipe(finalize(() => this.session.clear()));\r\n  }\r\n}\r\n","import { inject, Injectable } from '@angular/core';\r\nimport { Router } from '@angular/router';\r\nimport { Observable, ReplaySubject, catchError, finalize, share, throwError } from 'rxjs';\r\nimport { PLATFORM_ANGULAR_CONFIG } from '../config/platform-angular-config';\r\nimport { SessionStore } from '../session/session-store';\r\nimport { SessionUser } from '../session/session-user.model';\r\nimport { AuthClient } from './auth-client';\r\n\r\n/**\r\n * INTERNAL. Not exported from public-api.ts — consumers never construct or configure this\r\n * directly; it exists purely to back `sessionExpiryInterceptor`'s `'refresh-then-redirect'`\r\n * strategy (WEB-0.2, ADR-016 §\"WEB-0.2 note\").\r\n *\r\n * Deduplicates concurrent `AuthClient.refresh()` calls that originate from the SAME Angular\r\n * application context (one injector, i.e. one running app/tab). Before this existed, every\r\n * 401'd request independently called `authClient.refresh()`, and since that method returns a\r\n * cold Observable (`http.post(...)`, no multicasting), N simultaneous 401s produced N\r\n * independent `POST /refresh` calls — proven by the characterization test in\r\n * `provide-platform-angular-http.spec.ts`.\r\n *\r\n * This is defense-in-depth ONLY. The Platform already tolerates concurrent legitimate refresh\r\n * rotations correctly and safely (PLATFORM-REFRESH-1/1A/1B, ADR-016's retry leeway) — this class\r\n * exists to cut needless network traffic, cryptographic work, and rate-limit pressure on the\r\n * Platform, not to be the thing that makes concurrent refreshes safe. It does not, and does not\r\n * need to, coordinate across browser tabs/windows or other Angular application instances — see\r\n * the \"Multi-tab\" note on `sessionExpiryInterceptor` for why that's explicitly out of scope here\r\n * and handled server-side instead.\r\n */\r\n@Injectable({ providedIn: 'root' })\r\nexport class RefreshCoordinator {\r\n  private readonly authClient = inject(AuthClient);\r\n  private readonly session = inject(SessionStore);\r\n  private readonly router = inject(Router);\r\n  private readonly config = inject(PLATFORM_ANGULAR_CONFIG);\r\n\r\n  private inFlight$: Observable<SessionUser> | null = null;\r\n\r\n  /**\r\n   * Returns the single in-flight refresh operation if one is already running, or starts a new\r\n   * one. Every caller — first or piggybacking — gets the SAME underlying HTTP call's outcome.\r\n   *\r\n   * Semantics (WEB-0.2):\r\n   * - Single-flight, not a permanent cache: once the shared operation settles (success or\r\n   *   error), the reference is cleared (`finalize`, placed BEFORE `share()` so it fires exactly\r\n   *   once per underlying HTTP call, not once per subscriber — see the `share()` config note\r\n   *   below). The next call to `refresh()` after that always starts a genuinely new request.\r\n   * - On failure, the session is cleared and the browser is navigated to the login route\r\n   *   exactly once, regardless of how many callers are waiting — not once per waiting caller.\r\n   *   Each caller still receives its own error notification (multicast by `share()`) and is\r\n   *   responsible for propagating whatever error IT needs to its own subscriber (see\r\n   *   `sessionExpiryInterceptor`, which re-throws the ORIGINAL 401 to the request that\r\n   *   triggered it, not this refresh failure).\r\n   * - `resetOnRefCountZero: false` is load-bearing: if one waiting caller unsubscribes (e.g. a\r\n   *   cancelled navigation), the still-in-flight HTTP request for the OTHER callers must not be\r\n   *   aborted. Angular's `HttpClient` cancels the underlying network request when its Observable\r\n   *   loses its last subscriber — without this flag, one caller going away could silently\r\n   *   cancel the refresh everyone else is still waiting on.\r\n   * - `resetOnError`/`resetOnComplete` are left `false` too: this class never reuses a settled\r\n   *   `inFlight$` reference across cycles (the field is always nulled and rebuilt from scratch\r\n   *   by `finalize`), so `share()` itself never needs to reset its own internal connector.\r\n   */\r\n  refresh(): Observable<SessionUser> {\r\n    if (this.inFlight$) {\r\n      return this.inFlight$;\r\n    }\r\n\r\n    this.inFlight$ = this.authClient.refresh().pipe(\r\n      catchError((error: unknown) => {\r\n        this.session.clear();\r\n        void this.router.navigateByUrl(this.config.loginRoute ?? '/login');\r\n        return throwError(() => error);\r\n      }),\r\n      finalize(() => {\r\n        this.inFlight$ = null;\r\n      }),\r\n      share({\r\n        connector: () => new ReplaySubject<SessionUser>(1),\r\n        resetOnError: false,\r\n        resetOnComplete: false,\r\n        resetOnRefCountZero: false,\r\n      }),\r\n    );\r\n\r\n    return this.inFlight$;\r\n  }\r\n}\r\n","import {\r\n  HttpErrorResponse,\r\n  HttpInterceptorFn,\r\n  provideHttpClient,\r\n  withInterceptors,\r\n  withXsrfConfiguration,\r\n  HttpFeature,\r\n  HttpFeatureKind,\r\n} from '@angular/common/http';\r\nimport { inject } from '@angular/core';\r\nimport { Router } from '@angular/router';\r\nimport { catchError, switchMap, throwError } from 'rxjs';\r\nimport { PLATFORM_ANGULAR_CONFIG, PlatformAngularAuthPaths } from '../config/platform-angular-config';\r\nimport { RefreshCoordinator } from '../auth/refresh-coordinator';\r\nimport { SessionStore } from '../session/session-store';\r\n\r\nfunction isApiRequest(url: string, apiBaseUrl: string): boolean {\r\n  return url === apiBaseUrl || url.startsWith(`${apiBaseUrl}/`);\r\n}\r\n\r\nfunction isAuthEndpoint(url: string, apiBaseUrl: string, auth: PlatformAngularAuthPaths): boolean {\r\n  const authPaths = [auth.login, auth.refresh, auth.logout, auth.me].filter(\r\n    (p): p is string => !!p,\r\n  );\r\n  return authPaths.some((p) => url === `${apiBaseUrl}${p}`);\r\n}\r\n\r\n/**\r\n * Forces `withCredentials: true` on same-origin API requests, so the BFF's\r\n * HttpOnly session cookie is sent. Proven identically in both consumers.\r\n * XSRF header injection is intentionally NOT duplicated here — Angular's\r\n * own `withXsrfConfiguration` (registered by `providePlatformAngularHttp`)\r\n * already does that. Portal's local interceptor previously re-implemented\r\n * XSRF header injection manually alongside `withXsrfConfiguration`; that\r\n * was redundant, not a pattern to preserve.\r\n */\r\nexport const credentialsInterceptor: HttpInterceptorFn = (req, next) => {\r\n  const { apiBaseUrl } = inject(PLATFORM_ANGULAR_CONFIG);\r\n  if (!isApiRequest(req.url, apiBaseUrl)) {\r\n    return next(req);\r\n  }\r\n  return next(req.clone({ withCredentials: true }));\r\n};\r\n\r\n/**\r\n * On 401 from a non-auth API request: 'redirect' (default) clears the\r\n * session and navigates to the login route immediately (Store's proven\r\n * behavior). 'refresh-then-redirect' attempts one silent refresh first and\r\n * retries the original request on success, falling back to redirect\r\n * (Portal's proven behavior). Configured via\r\n * PlatformAngularConfig.unauthorizedStrategy.\r\n *\r\n * WEB-0.2: the 'refresh-then-redirect' path routes through `RefreshCoordinator`\r\n * instead of calling `AuthClient.refresh()` directly — every 401 handled by\r\n * the SAME running app shares one in-flight refresh instead of each request\r\n * triggering its own. The 'redirect' strategy is untouched: it never calls\r\n * refresh at all, so there is nothing to coordinate (see the config note on\r\n * `PlatformAngularConfig.unauthorizedStrategy`). On refresh failure, the\r\n * session-clear/navigate side effect now happens once inside the coordinator\r\n * (shared across every waiting caller) rather than once per waiting caller;\r\n * each caller still receives the ORIGINAL 401 error, not a refresh-specific\r\n * one, exactly as before. Multi-tab/multi-window coordination is explicitly\r\n * NOT handled here — see `RefreshCoordinator`'s doc comment — the Platform's\r\n * own server-side retry leeway (ADR-016) is what makes concurrent refreshes\r\n * from independent contexts safe.\r\n */\r\nexport const sessionExpiryInterceptor: HttpInterceptorFn = (req, next) => {\r\n  const config = inject(PLATFORM_ANGULAR_CONFIG);\r\n  const session = inject(SessionStore);\r\n  const router = inject(Router);\r\n  const refreshCoordinator = inject(RefreshCoordinator);\r\n\r\n  if (\r\n    !isApiRequest(req.url, config.apiBaseUrl) ||\r\n    isAuthEndpoint(req.url, config.apiBaseUrl, config.auth)\r\n  ) {\r\n    return next(req);\r\n  }\r\n\r\n  return next(req).pipe(\r\n    catchError((error: unknown) => {\r\n      if (!(error instanceof HttpErrorResponse) || error.status !== 401) {\r\n        return throwError(() => error);\r\n      }\r\n\r\n      if (config.unauthorizedStrategy !== 'refresh-then-redirect') {\r\n        session.clear();\r\n        void router.navigateByUrl(config.loginRoute ?? '/login');\r\n        return throwError(() => error);\r\n      }\r\n\r\n      return refreshCoordinator.refresh().pipe(\r\n        switchMap(() => next(req)),\r\n        // The coordinator already cleared the session and navigated once for\r\n        // this shared failure (see RefreshCoordinator.refresh()) — this\r\n        // request still needs to fail with its OWN original 401, not the\r\n        // refresh's error, exactly as before WEB-0.2.\r\n        catchError(() => throwError(() => error)),\r\n      );\r\n    }),\r\n  );\r\n};\r\n\r\n/**\r\n * Bundles provideHttpClient with the XSRF configuration and interceptors\r\n * proven necessary by both consumers. Cookie/header names default to\r\n * 'XSRF-TOKEN'/'X-XSRF-TOKEN' (identical in both consumers today) but\r\n * remain overridable via config. Consumers add their own extra\r\n * provideHttpClient features (e.g. Portal's withXhr()) by calling\r\n * provideHttpClient(...) separately — this function only owns the concerns\r\n * proven common to both.\r\n */\r\nexport function providePlatformAngularHttp(...extraFeatures: HttpFeature<HttpFeatureKind>[]) {\r\n  return provideHttpClient(\r\n    withXsrfConfiguration({\r\n      cookieName: 'XSRF-TOKEN',\r\n      headerName: 'X-XSRF-TOKEN',\r\n    }),\r\n    withInterceptors([credentialsInterceptor, sessionExpiryInterceptor]),\r\n    ...extraFeatures,\r\n  );\r\n}\r\n","/**\r\n * Generic capability map: a flat set of boolean feature flags fetched once\r\n * from the BFF (Portal's proven pattern — GET .../capabilities returning a\r\n * flat boolean-keyed object). Deliberately a generic `Record<string,\r\n * boolean>` rather than a typed interface enumerating every field: Portal's\r\n * capability set already has 17 product-specific fields and Store will\r\n * grow its own, unrelated set. A typed interface would require a package\r\n * release for every new product capability (see ADR-010 §18 — evolution\r\n * cadence mismatch is a real argument against sharing). Each product\r\n * defines its own capability keys locally and reads them through this map.\r\n *\r\n * UX ONLY. This does not replace server-side authorization. Every consumer\r\n * MUST continue to handle 403 from the actual mutating/reading endpoint —\r\n * capability checks here are a consultive pre-check, exactly as already\r\n * documented in Portal's application.service.ts before this extraction.\r\n */\r\nexport type CapabilityMap = Readonly<Record<string, boolean>>;\r\n\r\nexport function hasCapability(capabilities: CapabilityMap | null | undefined, key: string): boolean {\r\n  return capabilities?.[key] === true;\r\n}\r\n","import { Directive, Input, TemplateRef, ViewContainerRef, inject } from '@angular/core';\r\nimport { CapabilityMap, hasCapability } from './capability.model';\r\n\r\n/**\r\n * Structural directive gating template content on a capability key from a\r\n * consumer-supplied CapabilityMap. Net-new (neither consumer had factored\r\n * their proven inline `@if (capabilities()?.x)` pattern into a directive),\r\n * but grounded in Portal's validated usage — see capability.model.ts.\r\n *\r\n * UX ONLY — see capability.model.ts. Hiding an element here does not\r\n * authorize anything; the backend re-validates on every mutating call.\r\n *\r\n * Usage: `<button *orxCapability=\"capabilities(); has: 'manageTenants'\">`\r\n */\r\n@Directive({\r\n  selector: '[orxCapability]',\r\n  standalone: true,\r\n})\r\nexport class CapabilityDirective {\r\n  private readonly templateRef = inject(TemplateRef<unknown>);\r\n  private readonly viewContainer = inject(ViewContainerRef);\r\n\r\n  private map: CapabilityMap | null | undefined;\r\n  private key: string | undefined;\r\n  private hasView = false;\r\n\r\n  @Input()\r\n  set orxCapability(map: CapabilityMap | null | undefined) {\r\n    this.map = map;\r\n    this.render();\r\n  }\r\n\r\n  @Input('orxCapabilityHas')\r\n  set has(key: string) {\r\n    this.key = key;\r\n    this.render();\r\n  }\r\n\r\n  private render(): void {\r\n    const shouldShow = !!this.key && hasCapability(this.map, this.key);\r\n    if (shouldShow && !this.hasView) {\r\n      this.viewContainer.createEmbeddedView(this.templateRef);\r\n      this.hasView = true;\r\n    } else if (!shouldShow && this.hasView) {\r\n      this.viewContainer.clear();\r\n      this.hasView = false;\r\n    }\r\n  }\r\n}\r\n","import { HttpErrorResponse } from '@angular/common/http';\r\n\r\n/**\r\n * Canonical error shape, generalized from Store's already-proven\r\n * ErroApresentavel/normalizarErroApi (the more mature of the two consumers'\r\n * error handling — Portal had no typed contract at all, just five\r\n * duplicated `error.error.code` reads). `message` is optional: Portal never\r\n * received a server-supplied message field, only `code`, and resolves\r\n * user-facing text locally — so this contract cannot require it.\r\n *\r\n * `correlation_id` (API-1, ADR-017 §3.3): added after confirming directly\r\n * from Orechio.Platform's `ProblemResponses.cs` that it IS present in the\r\n * JSON body of every error response the Platform host produces (not just\r\n * the `X-Correlation-ID` response header), and that Portal's BFF relays\r\n * that body byte-for-byte, unreshaped, for every typed endpoint. The\r\n * earlier NG-1-era absence was accurate for what it tested at the time but\r\n * incomplete relative to Platform's actual wire contract. Optional: not\r\n * every error path in every consumer emits this field today (Store's own\r\n * narrower auth/CSRF error shapes don't) — its absence must not be treated\r\n * as a parse failure.\r\n *\r\n * Domain-specific error codes (e.g. 'access.platform_only',\r\n * 'tenant.not_found', 'csrf.invalid') are NOT enumerated here — `code`\r\n * stays a plain string so any code survives normalization unmodified and\r\n * remains identifiable by callers, per Passo 28.\r\n */\r\nexport interface ProblemDetails {\r\n  code: string;\r\n  message?: string;\r\n  status: number;\r\n  required?: string;\r\n  correlationId?: string;\r\n}\r\n\r\n/**\r\n * Normalizes an HttpErrorResponse into ProblemDetails. Mirrors Store's\r\n * normalizarErroApi exactly, generalized to make `message` optional and to\r\n * accept an HttpErrorResponse without any consumer-specific fallback\r\n * message map (each product keeps its own code→message copy locally —\r\n * that's product-specific text, not shared infrastructure).\r\n */\r\nexport function normalizeProblemDetails(error: HttpErrorResponse): ProblemDetails {\r\n  const body = error.error as Record<string, unknown> | null | undefined;\r\n  const code = typeof body?.['code'] === 'string' ? (body['code'] as string) : `http.${error.status || 0}`;\r\n  const message = typeof body?.['message'] === 'string' ? (body['message'] as string) : undefined;\r\n  const required = typeof body?.['required'] === 'string' ? (body['required'] as string) : undefined;\r\n  // Wire field is `correlation_id` (snake_case, ADR-017 §3) — kept as-is on the wire,\r\n  // exposed as `correlationId` here per TS/Angular convention (same server-side pattern:\r\n  // OrechioProblemDetails.CorrelationId is [JsonPropertyName(\"correlation_id\")]).\r\n  const correlationId =\r\n    typeof body?.['correlation_id'] === 'string' ? (body['correlation_id'] as string) : undefined;\r\n\r\n  return {\r\n    code,\r\n    message,\r\n    status: error.status,\r\n    ...(required ? { required } : {}),\r\n    ...(correlationId ? { correlationId } : {}),\r\n  };\r\n}\r\n","/*\r\n * Public API Surface of @orechio/platform-angular\r\n */\r\n\r\nexport type { PlatformAngularConfig, PlatformAngularAuthPaths } from './lib/config/platform-angular-config';\r\nexport { PLATFORM_ANGULAR_CONFIG, providePlatformAngularConfig } from './lib/config/platform-angular-config';\r\n\r\nexport type { SessionUser } from './lib/session/session-user.model';\r\nexport { SessionStore } from './lib/session/session-store';\r\n\r\nexport { AuthClient } from './lib/auth/auth-client';\r\n\r\nexport { credentialsInterceptor, sessionExpiryInterceptor, providePlatformAngularHttp } from './lib/http/provide-platform-angular-http';\r\n\r\nexport type { CapabilityMap } from './lib/capabilities/capability.model';\r\nexport { hasCapability } from './lib/capabilities/capability.model';\r\nexport { CapabilityDirective } from './lib/capabilities/capability.directive';\r\n\r\nexport type { ProblemDetails } from './lib/problem-details/problem-details.model';\r\nexport { normalizeProblemDetails } from './lib/problem-details/problem-details.model';\r\n\r\nexport type { PagedResult } from './lib/pagination/paged-result.model';\r\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":[],"mappings":";;;;;;MA0Ca,uBAAuB,GAAG,IAAI,cAAc,CACvD,yBAAyB;AAGrB,SAAU,4BAA4B,CAAC,MAA6B,EAAA;IACxE,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE;AAC/D;;AC7CA;;;;;;;;;;AAUG;MAEU,YAAY,CAAA;IACN,KAAK,GAAG,MAAM,CAAe,IAAI;8EAAC;AAE1C,IAAA,IAAI,GAAyB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;IACpD,eAAe,GAAoB,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI;wFAAC;AAEjF,IAAA,GAAG,CAAC,IAAW,EAAA;AACb,QAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IACtB;IAEA,KAAK,GAAA;AACH,QAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IACtB;uGAZW,YAAY,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAZ,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,YAAY,cADC,MAAM,EAAA,CAAA;;2FACnB,YAAY,EAAA,UAAA,EAAA,CAAA;kBADxB,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACPlC;;;;;;;;;;;;;;AAcG;MAEU,UAAU,CAAA;AACJ,IAAA,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;AACzB,IAAA,MAAM,GAAG,MAAM,CAAC,uBAAuB,CAAC;AACxC,IAAA,OAAO,GAAG,MAAM,CAAC,YAAY,CAAwB;AAE9D,IAAA,GAAG,CAAC,IAAY,EAAA;QACtB,OAAO,CAAA,EAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA,EAAG,IAAI,CAAA,CAAE;IAC3C;AAEQ,IAAA,MAAM,CAAC,IAAa,EAAA;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU;AAC9C,QAAA,QAAQ,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI;IAC9C;AAEA,IAAA,KAAK,CAAC,WAAoB,EAAA;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAChF,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAChC,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACtC;IACH;AAEA;;;;AAIG;IACH,WAAW,GAAA;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;YACvB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAC/D,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAChC,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACtC;QACH;AACA,QAAA,OAAO,IAAI,CAAC,OAAO,EAAE;IACvB;IAEA,OAAO,GAAA;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CACzE,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAChC,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACtC;IACH;AAEA;;;;;;;AAOG;IACH,MAAM,GAAA;QACJ,OAAO,IAAI,CAAC;AACT,aAAA,IAAI,CAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;AAChD,aAAA,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/C;uGAvDW,UAAU,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAV,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,UAAU,cADG,MAAM,EAAA,CAAA;;2FACnB,UAAU,EAAA,UAAA,EAAA,CAAA;kBADtB,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACdlC;;;;;;;;;;;;;;;;;;;AAmBG;MAEU,kBAAkB,CAAA;AACZ,IAAA,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;AAC/B,IAAA,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;AAC9B,IAAA,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AACvB,IAAA,MAAM,GAAG,MAAM,CAAC,uBAAuB,CAAC;IAEjD,SAAS,GAAmC,IAAI;AAExD;;;;;;;;;;;;;;;;;;;;;;;AAuBG;IACH,OAAO,GAAA;AACL,QAAA,IAAI,IAAI,CAAC,SAAS,EAAE;YAClB,OAAO,IAAI,CAAC,SAAS;QACvB;AAEA,QAAA,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,CAC7C,UAAU,CAAC,CAAC,KAAc,KAAI;AAC5B,YAAA,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;AACpB,YAAA,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC;AAClE,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;AAChC,QAAA,CAAC,CAAC,EACF,QAAQ,CAAC,MAAK;AACZ,YAAA,IAAI,CAAC,SAAS,GAAG,IAAI;QACvB,CAAC,CAAC,EACF,KAAK,CAAC;YACJ,SAAS,EAAE,MAAM,IAAI,aAAa,CAAc,CAAC,CAAC;AAClD,YAAA,YAAY,EAAE,KAAK;AACnB,YAAA,eAAe,EAAE,KAAK;AACtB,YAAA,mBAAmB,EAAE,KAAK;AAC3B,SAAA,CAAC,CACH;QAED,OAAO,IAAI,CAAC,SAAS;IACvB;uGAvDW,kBAAkB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAlB,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,kBAAkB,cADL,MAAM,EAAA,CAAA;;2FACnB,kBAAkB,EAAA,UAAA,EAAA,CAAA;kBAD9B,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACZlC,SAAS,YAAY,CAAC,GAAW,EAAE,UAAkB,EAAA;AACnD,IAAA,OAAO,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA,EAAG,UAAU,CAAA,CAAA,CAAG,CAAC;AAC/D;AAEA,SAAS,cAAc,CAAC,GAAW,EAAE,UAAkB,EAAE,IAA8B,EAAA;AACrF,IAAA,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CACvE,CAAC,CAAC,KAAkB,CAAC,CAAC,CAAC,CACxB;AACD,IAAA,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAA,EAAG,UAAU,GAAG,CAAC,CAAA,CAAE,CAAC;AAC3D;AAEA;;;;;;;;AAQG;MACU,sBAAsB,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;IACrE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,uBAAuB,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE;AACtC,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB;AACA,IAAA,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD;AAEA;;;;;;;;;;;;;;;;;;;;;AAqBG;MACU,wBAAwB,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;AACvE,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,uBAAuB,CAAC;AAC9C,IAAA,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;AACpC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAC7B,IAAA,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IAErD,IACE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;AACzC,QAAA,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EACvD;AACA,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB;AAEA,IAAA,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,UAAU,CAAC,CAAC,KAAc,KAAI;AAC5B,QAAA,IAAI,EAAE,KAAK,YAAY,iBAAiB,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE;AACjE,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC;AAEA,QAAA,IAAI,MAAM,CAAC,oBAAoB,KAAK,uBAAuB,EAAE;YAC3D,OAAO,CAAC,KAAK,EAAE;YACf,KAAK,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC;AACxD,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC;AAEA,QAAA,OAAO,kBAAkB,CAAC,OAAO,EAAE,CAAC,IAAI,CACtC,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;;;;;AAK1B,QAAA,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAC1C;IACH,CAAC,CAAC,CACH;AACH;AAEA;;;;;;;;AAQG;AACG,SAAU,0BAA0B,CAAC,GAAG,aAA6C,EAAA;IACzF,OAAO,iBAAiB,CACtB,qBAAqB,CAAC;AACpB,QAAA,UAAU,EAAE,YAAY;AACxB,QAAA,UAAU,EAAE,cAAc;AAC3B,KAAA,CAAC,EACF,gBAAgB,CAAC,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC,EACpE,GAAG,aAAa,CACjB;AACH;;ACvGM,SAAU,aAAa,CAAC,YAA8C,EAAE,GAAW,EAAA;AACvF,IAAA,OAAO,YAAY,GAAG,GAAG,CAAC,KAAK,IAAI;AACrC;;ACjBA;;;;;;;;;;AAUG;MAKU,mBAAmB,CAAA;AACb,IAAA,WAAW,GAAG,MAAM,EAAC,WAAoB,EAAC;AAC1C,IAAA,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAEjD,IAAA,GAAG;AACH,IAAA,GAAG;IACH,OAAO,GAAG,KAAK;IAEvB,IACI,aAAa,CAAC,GAAqC,EAAA;AACrD,QAAA,IAAI,CAAC,GAAG,GAAG,GAAG;QACd,IAAI,CAAC,MAAM,EAAE;IACf;IAEA,IACI,GAAG,CAAC,GAAW,EAAA;AACjB,QAAA,IAAI,CAAC,GAAG,GAAG,GAAG;QACd,IAAI,CAAC,MAAM,EAAE;IACf;IAEQ,MAAM,GAAA;AACZ,QAAA,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAClE,QAAA,IAAI,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAC/B,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;AACvD,YAAA,IAAI,CAAC,OAAO,GAAG,IAAI;QACrB;AAAO,aAAA,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE;AACtC,YAAA,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE;AAC1B,YAAA,IAAI,CAAC,OAAO,GAAG,KAAK;QACtB;IACF;uGA7BW,mBAAmB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA;2FAAnB,mBAAmB,EAAA,YAAA,EAAA,IAAA,EAAA,QAAA,EAAA,iBAAA,EAAA,MAAA,EAAA,EAAA,aAAA,EAAA,eAAA,EAAA,GAAA,EAAA,CAAA,kBAAA,EAAA,KAAA,CAAA,EAAA,EAAA,QAAA,EAAA,EAAA,EAAA,CAAA;;2FAAnB,mBAAmB,EAAA,UAAA,EAAA,CAAA;kBAJ/B,SAAS;AAAC,YAAA,IAAA,EAAA,CAAA;AACT,oBAAA,QAAQ,EAAE,iBAAiB;AAC3B,oBAAA,UAAU,EAAE,IAAI;AACjB,iBAAA;;sBASE;;sBAMA,KAAK;uBAAC,kBAAkB;;;ACE3B;;;;;;AAMG;AACG,SAAU,uBAAuB,CAAC,KAAwB,EAAA;AAC9D,IAAA,MAAM,IAAI,GAAG,KAAK,CAAC,KAAmD;IACtE,MAAM,IAAI,GAAG,OAAO,IAAI,GAAG,MAAM,CAAC,KAAK,QAAQ,GAAI,IAAI,CAAC,MAAM,CAAY,GAAG,CAAA,KAAA,EAAQ,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA,CAAE;IACxG,MAAM,OAAO,GAAG,OAAO,IAAI,GAAG,SAAS,CAAC,KAAK,QAAQ,GAAI,IAAI,CAAC,SAAS,CAAY,GAAG,SAAS;IAC/F,MAAM,QAAQ,GAAG,OAAO,IAAI,GAAG,UAAU,CAAC,KAAK,QAAQ,GAAI,IAAI,CAAC,UAAU,CAAY,GAAG,SAAS;;;;IAIlG,MAAM,aAAa,GACjB,OAAO,IAAI,GAAG,gBAAgB,CAAC,KAAK,QAAQ,GAAI,IAAI,CAAC,gBAAgB,CAAY,GAAG,SAAS;IAE/F,OAAO;QACL,IAAI;QACJ,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;AACpB,QAAA,IAAI,QAAQ,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AACjC,QAAA,IAAI,aAAa,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;KAC5C;AACH;;AC3DA;;AAEG;;ACFH;;AAEG;;;;"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@orechio/platform-angular",
+  "version": "0.2.0",
+  "description": "Angular integration contracts for Orechio applications: BFF cookie-session auth client, session store, capabilities, runtime config, XSRF/HTTP interceptors, ProblemDetails and pagination.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/orechio-io/orechio-web.git"
+  },
+  "homepage": "https://github.com/orechio-io/orechio-web",
+  "bugs": {
+    "url": "https://github.com/orechio-io/orechio-web/issues"
+  },
+  "peerDependencies": {
+    "@angular/common": "^22.1.0",
+    "@angular/core": "^22.1.0",
+    "@angular/router": "^22.1.0",
+    "rxjs": "^7.8.0"
+  },
+  "dependencies": {
+    "tslib": "^2.3.0"
+  },
+  "sideEffects": false,
+  "module": "fesm2022/orechio-platform-angular.mjs",
+  "typings": "types/orechio-platform-angular.d.ts",
+  "exports": {
+    "./package.json": {
+      "default": "./package.json"
+    },
+    ".": {
+      "types": "./types/orechio-platform-angular.d.ts",
+      "default": "./fesm2022/orechio-platform-angular.mjs"
+    }
+  },
+  "type": "module"
+}

package/types/orechio-platform-angular.d.ts

@@ -0,0 +1,275 @@
+import * as i0 from '@angular/core';
+import { InjectionToken, Provider, Signal } from '@angular/core';
+import { Observable } from 'rxjs';
+import { HttpInterceptorFn, HttpFeature, HttpFeatureKind, HttpErrorResponse } from '@angular/common/http';
+
+/**
+ * BFF endpoint paths for the auth contract. All paths are relative to `apiBaseUrl`.
+ * `me` is optional: some BFFs bootstrap the session via `refresh` alone (no dedicated
+ * session-read endpoint) instead of a separate `me` call.
+ */
+interface PlatformAngularAuthPaths {
+    login: string;
+    refresh: string;
+    logout: string;
+    me?: string;
+    /**
+     * Unwraps the raw auth-endpoint response body into TUser. Defaults to the
+     * identity function (response body IS the user object), matching Store's
+     * proven wire format. Portal's BFF wraps the user in an envelope
+     * (`{ user: UserInfo }`) — Portal supplies `(body) => body.user` here
+     * rather than the package assuming either shape.
+     */
+    unwrapUser?: (body: unknown) => unknown;
+}
+interface PlatformAngularConfig {
+    /** Same-origin API base path, e.g. '/api'. Never an absolute cross-origin URL — the
+     *  BFF/cookie-session pattern this library assumes requires same-origin requests. */
+    apiBaseUrl: string;
+    auth: PlatformAngularAuthPaths;
+    /** XSRF cookie/header names. Defaults match Angular's own defaults and both proven
+     *  consumers (Portal, Store): cookie 'XSRF-TOKEN', header 'X-XSRF-TOKEN'. */
+    xsrf?: {
+        cookieName?: string;
+        headerName?: string;
+    };
+    /** 401 handling strategy. 'redirect' clears the session and redirects immediately
+     *  (Store's proven behavior). 'refresh-then-redirect' attempts one silent refresh
+     *  before giving up (Portal's proven behavior). Defaults to 'redirect' — the simpler,
+     *  more conservative behavior — when omitted. */
+    unauthorizedStrategy?: 'redirect' | 'refresh-then-redirect';
+    /** Route to navigate to after a session is cleared. Defaults to '/login'. */
+    loginRoute?: string;
+}
+declare const PLATFORM_ANGULAR_CONFIG: InjectionToken<PlatformAngularConfig>;
+declare function providePlatformAngularConfig(config: PlatformAngularConfig): Provider;
+
+/**
+ * Minimal common core of the session-user shape proven identical across both
+ * consumers (Portal's UserInfo, Store's Sessao). Product-specific fields
+ * (Portal's appId/branches[], Store's expiresAt/mustChangePassword) are NOT
+ * included here — extend this interface locally per product instead of
+ * requesting a package release for every product-specific field.
+ */
+interface SessionUser {
+    userId: string | null;
+    tenantId: string | null;
+    branchId: string | null;
+    roles: string[];
+    name: string | null;
+    email: string | null;
+}
+
+/**
+ * Generic signal-based session store. Mirrors the pattern already proven
+ * independently by both consumers (Portal's AuthService.user, Store's
+ * EstadoDaSessao) — deliberately NOT a richer state machine (unknown /
+ * loading / error states): neither consumer needed one, and ADR-010 §2.2
+ * ("projete para extração, não extraia por antecipação") argues against
+ * building one speculatively.
+ *
+ * Parameterized over TUser so each product can extend SessionUser with its
+ * own fields without needing a package release.
+ */
+declare class SessionStore<TUser extends SessionUser = SessionUser> {
+    private readonly state;
+    readonly user: Signal<TUser | null>;
+    readonly isAuthenticated: Signal<boolean>;
+    set(user: TUser): void;
+    clear(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<SessionStore<any>, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<SessionStore<any>>;
+}
+
+/**
+ * Thin BFF client for the auth contract: login / refresh / logout, and an
+ * optional session-read ("me") endpoint. Deliberately does NOT decode JWTs,
+ * store bearer tokens, or treat itself as a security authority — per
+ * ADR-010 §12 and this package's explicit non-goal (no JWT client SDK): the
+ * BFF/backend is the only place tokens live, this class only reflects
+ * whatever session-shaped JSON the BFF hands back.
+ *
+ * Endpoint paths are entirely config-driven (PLATFORM_ANGULAR_CONFIG) — this
+ * class contains zero hardcoded URLs, so it works unmodified against
+ * Portal's /api/auth/{login,me,refresh,logout} (envelope-wrapped
+ * `{ user: UserInfo }` responses, unwrapped via config.auth.unwrapUser) and
+ * Store's /api/auth/{login,refresh,logout} (no `me`, unwrapped responses)
+ * alike.
+ */
+declare class AuthClient<TUser extends SessionUser = SessionUser> {
+    private readonly http;
+    private readonly config;
+    private readonly session;
+    private url;
+    private unwrap;
+    login(credentials: unknown): Observable<TUser>;
+    /**
+     * Reads the current session. Uses the configured `me` endpoint (GET) when
+     * present (Portal); falls back to `refresh` (POST) when it isn't (Store,
+     * which has no dedicated session-read endpoint and bootstraps via refresh).
+     */
+    initSession(): Observable<TUser>;
+    refresh(): Observable<TUser>;
+    /**
+     * Clears the local session unconditionally — on success, on error, and on
+     * unsubscribe (`finalize`, not `tap`) — matching the behavior both
+     * consumers already converged on independently (Portal swallows the
+     * error before clearing; Store clears via `finalize` while still letting
+     * the error propagate). This does NOT swallow errors: callers that want
+     * Portal's "always succeed" UX compose their own `catchError` on top.
+     */
+    logout(): Observable<void>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AuthClient<any>, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AuthClient<any>>;
+}
+
+/**
+ * Forces `withCredentials: true` on same-origin API requests, so the BFF's
+ * HttpOnly session cookie is sent. Proven identically in both consumers.
+ * XSRF header injection is intentionally NOT duplicated here — Angular's
+ * own `withXsrfConfiguration` (registered by `providePlatformAngularHttp`)
+ * already does that. Portal's local interceptor previously re-implemented
+ * XSRF header injection manually alongside `withXsrfConfiguration`; that
+ * was redundant, not a pattern to preserve.
+ */
+declare const credentialsInterceptor: HttpInterceptorFn;
+/**
+ * On 401 from a non-auth API request: 'redirect' (default) clears the
+ * session and navigates to the login route immediately (Store's proven
+ * behavior). 'refresh-then-redirect' attempts one silent refresh first and
+ * retries the original request on success, falling back to redirect
+ * (Portal's proven behavior). Configured via
+ * PlatformAngularConfig.unauthorizedStrategy.
+ *
+ * WEB-0.2: the 'refresh-then-redirect' path routes through `RefreshCoordinator`
+ * instead of calling `AuthClient.refresh()` directly — every 401 handled by
+ * the SAME running app shares one in-flight refresh instead of each request
+ * triggering its own. The 'redirect' strategy is untouched: it never calls
+ * refresh at all, so there is nothing to coordinate (see the config note on
+ * `PlatformAngularConfig.unauthorizedStrategy`). On refresh failure, the
+ * session-clear/navigate side effect now happens once inside the coordinator
+ * (shared across every waiting caller) rather than once per waiting caller;
+ * each caller still receives the ORIGINAL 401 error, not a refresh-specific
+ * one, exactly as before. Multi-tab/multi-window coordination is explicitly
+ * NOT handled here — see `RefreshCoordinator`'s doc comment — the Platform's
+ * own server-side retry leeway (ADR-016) is what makes concurrent refreshes
+ * from independent contexts safe.
+ */
+declare const sessionExpiryInterceptor: HttpInterceptorFn;
+/**
+ * Bundles provideHttpClient with the XSRF configuration and interceptors
+ * proven necessary by both consumers. Cookie/header names default to
+ * 'XSRF-TOKEN'/'X-XSRF-TOKEN' (identical in both consumers today) but
+ * remain overridable via config. Consumers add their own extra
+ * provideHttpClient features (e.g. Portal's withXhr()) by calling
+ * provideHttpClient(...) separately — this function only owns the concerns
+ * proven common to both.
+ */
+declare function providePlatformAngularHttp(...extraFeatures: HttpFeature<HttpFeatureKind>[]): i0.EnvironmentProviders;
+
+/**
+ * Generic capability map: a flat set of boolean feature flags fetched once
+ * from the BFF (Portal's proven pattern — GET .../capabilities returning a
+ * flat boolean-keyed object). Deliberately a generic `Record<string,
+ * boolean>` rather than a typed interface enumerating every field: Portal's
+ * capability set already has 17 product-specific fields and Store will
+ * grow its own, unrelated set. A typed interface would require a package
+ * release for every new product capability (see ADR-010 §18 — evolution
+ * cadence mismatch is a real argument against sharing). Each product
+ * defines its own capability keys locally and reads them through this map.
+ *
+ * UX ONLY. This does not replace server-side authorization. Every consumer
+ * MUST continue to handle 403 from the actual mutating/reading endpoint —
+ * capability checks here are a consultive pre-check, exactly as already
+ * documented in Portal's application.service.ts before this extraction.
+ */
+type CapabilityMap = Readonly<Record<string, boolean>>;
+declare function hasCapability(capabilities: CapabilityMap | null | undefined, key: string): boolean;
+
+/**
+ * Structural directive gating template content on a capability key from a
+ * consumer-supplied CapabilityMap. Net-new (neither consumer had factored
+ * their proven inline `@if (capabilities()?.x)` pattern into a directive),
+ * but grounded in Portal's validated usage — see capability.model.ts.
+ *
+ * UX ONLY — see capability.model.ts. Hiding an element here does not
+ * authorize anything; the backend re-validates on every mutating call.
+ *
+ * Usage: `<button *orxCapability="capabilities(); has: 'manageTenants'">`
+ */
+declare class CapabilityDirective {
+    private readonly templateRef;
+    private readonly viewContainer;
+    private map;
+    private key;
+    private hasView;
+    set orxCapability(map: CapabilityMap | null | undefined);
+    set has(key: string);
+    private render;
+    static ɵfac: i0.ɵɵFactoryDeclaration<CapabilityDirective, never>;
+    static ɵdir: i0.ɵɵDirectiveDeclaration<CapabilityDirective, "[orxCapability]", never, { "orxCapability": { "alias": "orxCapability"; "required": false; }; "has": { "alias": "orxCapabilityHas"; "required": false; }; }, {}, never, never, true, never>;
+}
+
+/**
+ * Canonical error shape, generalized from Store's already-proven
+ * ErroApresentavel/normalizarErroApi (the more mature of the two consumers'
+ * error handling — Portal had no typed contract at all, just five
+ * duplicated `error.error.code` reads). `message` is optional: Portal never
+ * received a server-supplied message field, only `code`, and resolves
+ * user-facing text locally — so this contract cannot require it.
+ *
+ * `correlation_id` (API-1, ADR-017 §3.3): added after confirming directly
+ * from Orechio.Platform's `ProblemResponses.cs` that it IS present in the
+ * JSON body of every error response the Platform host produces (not just
+ * the `X-Correlation-ID` response header), and that Portal's BFF relays
+ * that body byte-for-byte, unreshaped, for every typed endpoint. The
+ * earlier NG-1-era absence was accurate for what it tested at the time but
+ * incomplete relative to Platform's actual wire contract. Optional: not
+ * every error path in every consumer emits this field today (Store's own
+ * narrower auth/CSRF error shapes don't) — its absence must not be treated
+ * as a parse failure.
+ *
+ * Domain-specific error codes (e.g. 'access.platform_only',
+ * 'tenant.not_found', 'csrf.invalid') are NOT enumerated here — `code`
+ * stays a plain string so any code survives normalization unmodified and
+ * remains identifiable by callers, per Passo 28.
+ */
+interface ProblemDetails {
+    code: string;
+    message?: string;
+    status: number;
+    required?: string;
+    correlationId?: string;
+}
+/**
+ * Normalizes an HttpErrorResponse into ProblemDetails. Mirrors Store's
+ * normalizarErroApi exactly, generalized to make `message` optional and to
+ * accept an HttpErrorResponse without any consumer-specific fallback
+ * message map (each product keeps its own code→message copy locally —
+ * that's product-specific text, not shared infrastructure).
+ */
+declare function normalizeProblemDetails(error: HttpErrorResponse): ProblemDetails;
+
+/**
+ * Canonical paged-result envelope, mirroring
+ * Orechio.BuildingBlocks.Pagination.PageResult<T> (ADR-010 §7 / doc 011 §3)
+ * on the wire — Portal's InvoicePage already matches this shape field for
+ * field (it was generic'd from a concrete, non-generic type here). Per
+ * ADR-010 §24.4, the ecosystem must not grow parallel paging conventions;
+ * Store's local `PaginaResultado<T>` (Portuguese field names) is exactly
+ * the kind of parallel convention this canonical shape replaces — Store's
+ * migration to this type is deferred to a future phase pending
+ * confirmation of its actual wire format (see NG-1 report, item 56).
+ */
+interface PagedResult<T> {
+    items: T[];
+    page: number;
+    pageSize: number;
+    totalItems: number;
+    totalPages: number;
+    hasNext: boolean;
+    hasPrevious: boolean;
+}
+
+export { AuthClient, CapabilityDirective, PLATFORM_ANGULAR_CONFIG, SessionStore, credentialsInterceptor, hasCapability, normalizeProblemDetails, providePlatformAngularConfig, providePlatformAngularHttp, sessionExpiryInterceptor };
+export type { CapabilityMap, PagedResult, PlatformAngularAuthPaths, PlatformAngularConfig, ProblemDetails, SessionUser };