@seedgrid/fe-security 2026.7.0 → 2026.7.1

package/dist/module.d.ts

@@ -0,0 +1,3 @@
+import type { SeedGridCliModuleManifest } from "@seedgrid/fe-core";
+export declare const module: SeedGridCliModuleManifest;
+//# sourceMappingURL=module.d.ts.map

package/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+BnE,eAAO,MAAM,MAAM,EAAE,yBAOpB,CAAC"}

package/dist/module.js

@@ -0,0 +1,37 @@
+// Reference implementation of the manifest read by the SeedGrid CLI (Rust).
+// See seedgrid-cli/docs/adr/0004-module-manifest-contract.md.
+//
+// `provider.from` is a scaffold-relative app alias (`@/modules/security`),
+// not an npm import: `AuthProvider` runs the full login/session/redirect
+// flow and only exists in scaffold (it hardcodes scaffold routes — see
+// scaffold/README.md for the lib-vs-scaffold split found while extracting
+// this module). The wiring mechanism is plain string substitution into a
+// marker, so it doesn't care whether `from` resolves to an npm package or an
+// app-local alias — this field just needs to be *some* valid import
+// specifier for the generated app.
+//
+// `@seedgrid/fe-security/client` also exports `PermissionProvider`, a
+// lighter permission-only context (ported from admin-web's
+// `AdminAccessProvider`) for apps that already have their own login/session
+// flow and only want permission checks. That's a different consumption
+// pattern from CLI-scaffolded apps, so it is not referenced here.
+//
+// `navigation` uses the scaffold-local hook via the `@/modules/security` alias
+// — same mechanism as `provider` above (plain string substitution into the
+// app-shell-navigation markers, so a scaffold alias is fine even though the
+// hook hardcodes scaffold routes). Without this the CLI never wires
+// `...useSecurityAppShellSections()` into the app shell and the generated app
+// ships with an EMPTY navigation menu.
+//
+// `env` lists only what is verified today (the service-token fallback read
+// directly from `admin-web/lib/seedgrid-report-api-server.ts`). The base API
+// URL is resolved per-tenant from the hostname, not a static env var, so it
+// is not listed here.
+export const module = {
+    id: "security",
+    configKey: "security",
+    env: ["SEEDGRID_REPORT_API_TOKEN"],
+    provider: [{ import: "AuthProvider", from: "@/modules/security" }],
+    navigation: { import: "useSecurityAppShellSections", from: "@/modules/security" },
+    messages: { import: "securityMessages", from: "@seedgrid/fe-security" },
+};

package/dist/module.json

@@ -0,0 +1,21 @@
+{
+  "id": "security",
+  "configKey": "security",
+  "env": [
+    "SEEDGRID_REPORT_API_TOKEN"
+  ],
+  "provider": [
+    {
+      "import": "AuthProvider",
+      "from": "@/modules/security"
+    }
+  ],
+  "navigation": {
+    "import": "useSecurityAppShellSections",
+    "from": "@/modules/security"
+  },
+  "messages": {
+    "import": "securityMessages",
+    "from": "@seedgrid/fe-security"
+  }
+}

package/dist/paths.d.ts

@@ -40,6 +40,7 @@ export declare const SecurityPaths: {
     /** ME (/me) — escopo do usuário corrente pelo token. */
     readonly me: {
         readonly permissions: "/me/permissions";
+        readonly companies: "/me/companies";
         readonly selectCompany: "/me/select-company";
     };
     /** COMPANIES (/companies, /public/companies). */

package/dist/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,aAAa;IACxB,6CAA6C;;;;;;;;IAS7C,gEAAgE;;;;;;;;;;IAWhE,sBAAsB;;;;;wCAKG,MAAM;oCACV,MAAM;wCAEF,MAAM,mBAAmB,MAAM;;IAIxD,sBAAsB;;;;wCAIG,MAAM;;IAG/B,kCAAkC;;;wCAGT,MAAM;;IAG/B,wDAAwD;;;;;IAMxD,iDAAiD;;;;wCAIxB,MAAM;;IAG/B,gFAAgF;;;;;mCAK5D,MAAM;oCACL,MAAM;mCACP,MAAM;+BACV,MAAM;8BACP,MAAM;4CACQ,MAAM;6CACL,MAAM;wCAEX,MAAM;;CAEvB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,aAAa;IACxB,6CAA6C;;;;;;;;IAS7C,gEAAgE;;;;;;;;;;IAWhE,sBAAsB;;;;;wCAKG,MAAM;oCACV,MAAM;wCAEF,MAAM,mBAAmB,MAAM;;IAIxD,sBAAsB;;;;wCAIG,MAAM;;IAG/B,kCAAkC;;;wCAGT,MAAM;;IAG/B,wDAAwD;;;;;;IASxD,iDAAiD;;;;wCAIxB,MAAM;;IAG/B,gFAAgF;;;;;mCAK5D,MAAM;oCACL,MAAM;mCACP,MAAM;+BACV,MAAM;8BACP,MAAM;4CACQ,MAAM;6CACL,MAAM;wCAEX,MAAM;;CAEvB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC"}

package/dist/paths.js

@@ -48,6 +48,9 @@ export const SecurityPaths = {
     /** ME (/me) — escopo do usuário corrente pelo token. */
     me: {
         permissions: "/me/permissions",
+        // Empresas (memberships) do usuário, para o seletor de empresa (login-tenancy).
+        companies: "/me/companies",
+        // Troca a empresa corrente e re-emite o par de tokens escopado (login-tenancy).
         selectCompany: "/me/select-company",
     },
     /** COMPANIES (/companies, /public/companies). */

package/dist/permissions.d.ts

@@ -0,0 +1,14 @@
+type PermissionInput = Iterable<string> | Set<string>;
+export declare function normalizePermission(permission: string | null | undefined): string;
+export declare function createPermissionSet(permissions: Iterable<string>): Set<string>;
+export declare function hasPermission(permissions: PermissionInput, permission: string | null | undefined): boolean;
+export declare function hasAnyPermission(permissions: PermissionInput, requiredPermissions: Array<string | null | undefined>): boolean;
+export declare function hasAllPermissions(permissions: PermissionInput, requiredPermissions: Array<string | null | undefined>): boolean;
+export declare function buildCrudPermissions(resource: string): {
+    read: string;
+    create: string;
+    update: string;
+    delete: string;
+};
+export {};
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA,KAAK,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;AAEtD,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,UAMxE;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,eAMhE;AAQD,wBAAgB,aAAa,CAC3B,WAAW,EAAE,eAAe,EAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,WAStC;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,eAAe,EAC5B,mBAAmB,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,WAKtD;AAED,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAC5B,mBAAmB,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,WAKtD;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM;;;;;EAYpD"}

package/dist/permissions.js

@@ -0,0 +1,39 @@
+export function normalizePermission(permission) {
+    return String(permission ?? "")
+        .trim()
+        .replace(/[.\s-]+/g, "_")
+        .replace(/__+/g, "_")
+        .toUpperCase();
+}
+export function createPermissionSet(permissions) {
+    return new Set(Array.from(permissions)
+        .map((permission) => normalizePermission(permission))
+        .filter(Boolean));
+}
+function ensurePermissionSet(permissions) {
+    return permissions instanceof Set
+        ? createPermissionSet(permissions)
+        : createPermissionSet(permissions);
+}
+export function hasPermission(permissions, permission) {
+    const normalizedPermission = normalizePermission(permission);
+    if (!normalizedPermission) {
+        return false;
+    }
+    return ensurePermissionSet(permissions).has(normalizedPermission);
+}
+export function hasAnyPermission(permissions, requiredPermissions) {
+    return requiredPermissions.some((permission) => hasPermission(permissions, permission));
+}
+export function hasAllPermissions(permissions, requiredPermissions) {
+    return requiredPermissions.every((permission) => hasPermission(permissions, permission));
+}
+export function buildCrudPermissions(resource) {
+    const normalizedResource = normalizePermission(resource).replace(/_(READ|CREATE|UPDATE|DELETE)$/, "");
+    return {
+        read: `${normalizedResource}_READ`,
+        create: `${normalizedResource}_CREATE`,
+        update: `${normalizedResource}_UPDATE`,
+        delete: `${normalizedResource}_DELETE`,
+    };
+}

package/dist/server/action.d.ts

@@ -0,0 +1,3 @@
+import type { ActionResult } from "../session-result";
+export declare function toActionResult<T>(run: () => Promise<T>): Promise<ActionResult<T>>;
+//# sourceMappingURL=action.d.ts.map

package/dist/server/action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../src/server/action.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtD,wBAAsB,cAAc,CAAC,CAAC,EACpC,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAM1B"}

package/dist/server/action.js

@@ -0,0 +1,21 @@
+// Helper de Server Action (mutações). Roda o motor de sessão e devolve um ActionResult
+// tipado — NUNCA lança pro client (evita a redação de erro do Next em produção).
+//
+// Uso na action:
+//   "use server";
+//   export async function updateUser(input) {
+//     return toActionResult(() =>
+//       security.apiFetchSecurity(SecurityPaths.users.byPublicId(input.id), {
+//         method: "PUT", body: JSON.stringify(input),
+//       }),
+//     );
+//   }
+import { toProblem } from "./to-problem";
+export async function toActionResult(run) {
+    try {
+        return { ok: true, data: await run() };
+    }
+    catch (error) {
+        return { ok: false, problem: toProblem(error) };
+    }
+}

package/dist/server/create-security-server.d.ts

@@ -0,0 +1,4 @@
+import type { SecurityServerConfig } from "../config";
+import type { SecurityServer } from "../server-contract";
+export declare function createSecurityServer(config: SecurityServerConfig): SecurityServer;
+//# sourceMappingURL=create-security-server.d.ts.map

package/dist/server/create-security-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-security-server.d.ts","sourceRoot":"","sources":["../../src/server/create-security-server.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAMtD,OAAO,KAAK,EAEV,cAAc,EACf,MAAM,oBAAoB,CAAC;AAE5B,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,oBAAoB,GAC3B,cAAc,CAsMhB"}

package/dist/server/create-security-server.js

@@ -0,0 +1,166 @@
+// Motor de sessão server-side do SeedGrid Security (portado do admin-web
+// lib/seedgrid-report-api-server.ts, com os hardcodes parametrizados via
+// SecurityServerConfig). SERVER-ONLY: usa next/headers.
+//
+// O app cria uma instância uma vez e importa os helpers ligados nos route handlers:
+//   export const security = createSecurityServer({ apiBaseUrl, cookies, ... });
+import { cookies } from "next/headers";
+import { ApiClientError } from "@seedgrid/fe-core";
+import { SecurityPaths } from "../paths";
+import { isLoginSuccess, } from "../session-contract";
+import { ApiConnectionError, ApiRequestError } from "./errors";
+export function createSecurityServer(config) {
+    const secure = config.secureCookies ?? process.env.NODE_ENV === "production";
+    async function buildHeaders(headers) {
+        const cookieStore = await cookies();
+        const sessionToken = cookieStore.get(config.cookies.token)?.value;
+        const tenancy = config.resolveTenancyHeaders
+            ? await config.resolveTenancyHeaders()
+            : undefined;
+        return {
+            ...(sessionToken ? { Authorization: `Bearer ${sessionToken}` } : {}),
+            ...(!sessionToken && config.serviceToken
+                ? { Authorization: `Bearer ${config.serviceToken}` }
+                : {}),
+            ...tenancy,
+            ...headers,
+        };
+    }
+    async function safeFetch(path, options = {}) {
+        try {
+            return await fetch(`${config.apiBaseUrl}${path}`, {
+                ...options,
+                headers: await buildHeaders({
+                    "Content-Type": "application/json",
+                    ...options.headers,
+                }),
+                cache: "no-store",
+            });
+        }
+        catch (error) {
+            throw new ApiConnectionError(path, error);
+        }
+    }
+    async function applySessionCookies(data) {
+        const cookieStore = await cookies();
+        const opts = { httpOnly: true, path: "/", sameSite: "lax", secure };
+        cookieStore.set(config.cookies.token, data.token, opts);
+        if (typeof data.refreshToken === "string") {
+            cookieStore.set(config.cookies.refresh, data.refreshToken, opts);
+        }
+        if (data.changePasswordRequired) {
+            cookieStore.set(config.cookies.passwordChangeRequired, "1", opts);
+        }
+        else {
+            cookieStore.delete(config.cookies.passwordChangeRequired);
+        }
+    }
+    async function clearAuthCookies() {
+        const cookieStore = await cookies();
+        cookieStore.delete(config.cookies.token);
+        cookieStore.delete(config.cookies.refresh);
+        cookieStore.delete(config.cookies.passwordChangeRequired);
+    }
+    async function tryRefreshSession() {
+        const cookieStore = await cookies();
+        const refreshToken = cookieStore.get(config.cookies.refresh)?.value;
+        if (!refreshToken) {
+            await clearAuthCookies();
+            return false;
+        }
+        let response;
+        try {
+            response = await fetch(`${config.apiBaseUrl}${SecurityPaths.auth.refresh}`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ refreshToken }),
+                cache: "no-store",
+            });
+        }
+        catch (error) {
+            await clearAuthCookies();
+            throw new ApiConnectionError(SecurityPaths.auth.refresh, error);
+        }
+        if (!response.ok) {
+            await clearAuthCookies();
+            return false;
+        }
+        const payload = (await response.json());
+        if (!isLoginSuccess(payload)) {
+            await clearAuthCookies();
+            return false;
+        }
+        await applySessionCookies(payload);
+        return true;
+    }
+    async function fetchWithSession(path, options = {}) {
+        let response = await safeFetch(path, options);
+        if (response.status !== 401) {
+            return response;
+        }
+        const refreshed = await tryRefreshSession();
+        if (!refreshed) {
+            return response;
+        }
+        response = await safeFetch(path, options);
+        return response;
+    }
+    function isInvalidSessionResponse(status, body) {
+        // Apenas 401 = sessão inválida/expirada (limpa cookies → login). 403 NÃO: é
+        // autenticado SEM permissão (sessão válida) — a tela só mostra "Acesso negado",
+        // nunca desloga. Tratar 403 como inválido fazia clicar num item proibido jogar o
+        // usuário pro /login.
+        if (status === 401) {
+            return true;
+        }
+        const normalized = body.toLocaleLowerCase("pt-BR");
+        return (normalized.includes("usuario nao encontrado") ||
+            normalized.includes("usuário não encontrado"));
+    }
+    function parseResponseBody(text) {
+        const trimmed = text.trim();
+        if (!trimmed) {
+            return null;
+        }
+        try {
+            return JSON.parse(trimmed);
+        }
+        catch {
+            return text;
+        }
+    }
+    async function apiFetchServer(path, options = {}) {
+        const response = await fetchWithSession(path, options);
+        if (!response.ok) {
+            const text = await response.text();
+            if (isInvalidSessionResponse(response.status, text)) {
+                await clearAuthCookies();
+            }
+            throw new ApiRequestError(response.status, text);
+        }
+        return (await response.json());
+    }
+    async function apiFetchSecurity(path, options = {}) {
+        const response = await fetchWithSession(path, options);
+        if (!response.ok) {
+            const text = await response.text();
+            if (isInvalidSessionResponse(response.status, text)) {
+                await clearAuthCookies();
+            }
+            throw new ApiClientError(`API request failed with status ${response.status}`, response.status, parseResponseBody(text));
+        }
+        if (response.status === 204) {
+            return null;
+        }
+        return (await response.json());
+    }
+    return {
+        fetchWithSession,
+        apiFetchSecurity,
+        apiFetchServer,
+        buildHeaders,
+        applySessionCookies,
+        clearAuthCookies,
+        isInvalidSessionResponse,
+    };
+}

package/dist/server/errors.d.ts

@@ -0,0 +1,13 @@
+/** Erro de request com corpo cru (usado pelo apiFetchServer, retrocompat). */
+export declare class ApiRequestError extends Error {
+    readonly status: number;
+    readonly body: string;
+    constructor(status: number, body: string);
+}
+/** Falha de conexão com o report-api (rede indisponível, DNS, etc.). */
+export declare class ApiConnectionError extends Error {
+    readonly path: string;
+    constructor(path: string, cause?: unknown);
+}
+export declare function isApiConnectionError(error: unknown): error is ApiConnectionError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/server/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/server/errors.ts"],"names":[],"mappings":"AAGA,8EAA8E;AAC9E,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAMzC;AAED,wEAAwE;AACxE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM1C;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAEhF"}

package/dist/server/errors.js

@@ -0,0 +1,26 @@
+// Erros do motor de sessão server-side. `ApiClientError` (repasse do problem+json)
+// vem do @seedgrid/fe-core e é usado pelo apiFetchSecurity/problemResponse.
+/** Erro de request com corpo cru (usado pelo apiFetchServer, retrocompat). */
+export class ApiRequestError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(body || `API request failed: ${status}`);
+        this.name = "ApiRequestError";
+        this.status = status;
+        this.body = body;
+    }
+}
+/** Falha de conexão com o report-api (rede indisponível, DNS, etc.). */
+export class ApiConnectionError extends Error {
+    path;
+    constructor(path, cause) {
+        super(`Não foi possível conectar à API em ${path}.`);
+        this.name = "ApiConnectionError";
+        this.path = path;
+        this.cause = cause;
+    }
+}
+export function isApiConnectionError(error) {
+    return error instanceof ApiConnectionError;
+}

package/dist/server/index.d.ts

@@ -0,0 +1,8 @@
+export { createSecurityServer } from "./create-security-server";
+export type { SecurityServer, SecurityFetchOptions, } from "../server-contract";
+export { ApiRequestError, ApiConnectionError, isApiConnectionError, } from "./errors";
+export { problemResponse } from "./problem-response";
+export { toProblem } from "./to-problem";
+export { toActionResult } from "./action";
+export { toRouteResponse } from "./route";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,YAAY,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,8 @@
+// Barrel SERVER-ONLY (@seedgrid/fe-security/server). Usa next/headers e next/server —
+// NÃO importe daqui em componentes client.
+export { createSecurityServer } from "./create-security-server";
+export { ApiRequestError, ApiConnectionError, isApiConnectionError, } from "./errors";
+export { problemResponse } from "./problem-response";
+export { toProblem } from "./to-problem";
+export { toActionResult } from "./action";
+export { toRouteResponse } from "./route";

package/dist/server/problem-response.d.ts

@@ -0,0 +1,3 @@
+import { NextResponse } from "next/server";
+export declare function problemResponse(error: unknown): NextResponse;
+//# sourceMappingURL=problem-response.d.ts.map

package/dist/server/problem-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"problem-response.d.ts","sourceRoot":"","sources":["../../src/server/problem-response.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAiC5D"}

package/dist/server/problem-response.js

@@ -0,0 +1,28 @@
+// Converte o erro lançado por uma chamada server-side (ApiClientError) na resposta que
+// o route handler do Next devolve ao client. Repassa o `responseBody` (problem+json
+// original do report-api) com o `status` upstream, como application/problem+json —
+// assim o `extractApiErrorMessage` do lado client recupera a mensagem íntegra.
+import { NextResponse } from "next/server";
+import { ApiClientError } from "@seedgrid/fe-core";
+export function problemResponse(error) {
+    if (error instanceof ApiClientError) {
+        const { responseBody, status } = error;
+        if (typeof responseBody === "string") {
+            return new NextResponse(responseBody, {
+                status,
+                headers: { "Content-Type": "application/problem+json" },
+            });
+        }
+        if (responseBody != null) {
+            return NextResponse.json(responseBody, {
+                status,
+                headers: { "Content-Type": "application/problem+json" },
+            });
+        }
+        return NextResponse.json({ status, title: error.message }, { status, headers: { "Content-Type": "application/problem+json" } });
+    }
+    const detail = error instanceof Error
+        ? error.message
+        : "Não foi possível conectar à API.";
+    return NextResponse.json({ status: 502, title: "Bad Gateway", detail }, { status: 502, headers: { "Content-Type": "application/problem+json" } });
+}

package/dist/server/route.d.ts

@@ -0,0 +1,3 @@
+import { NextResponse } from "next/server";
+export declare function toRouteResponse<T>(run: () => Promise<T>): Promise<NextResponse>;
+//# sourceMappingURL=route.d.ts.map

package/dist/server/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/server/route.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,wBAAsB,eAAe,CAAC,CAAC,EACrC,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,YAAY,CAAC,CAUvB"}

package/dist/server/route.js

@@ -0,0 +1,22 @@
+// Helper de route handler (leituras GET — cacheáveis). Roda o motor de sessão e
+// devolve um NextResponse: sucesso → json; erro → application/problem+json (repassa o
+// problem+json do report-api íntegro, pro extractApiErrorMessage do client ler).
+//
+// Uso no route handler:
+//   export async function GET() {
+//     return toRouteResponse(() => security.apiFetchSecurity(SecurityPaths.users.base));
+//   }
+import { NextResponse } from "next/server";
+import { problemResponse } from "./problem-response";
+export async function toRouteResponse(run) {
+    try {
+        const data = await run();
+        if (data === null || data === undefined) {
+            return new NextResponse(null, { status: 204 });
+        }
+        return NextResponse.json(data);
+    }
+    catch (error) {
+        return problemResponse(error);
+    }
+}

package/dist/server/to-problem.d.ts

@@ -0,0 +1,3 @@
+import type { ProblemDetail } from "../session-result";
+export declare function toProblem(error: unknown): ProblemDetail;
+//# sourceMappingURL=to-problem.d.ts.map

package/dist/server/to-problem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-problem.d.ts","sourceRoot":"","sources":["../../src/server/to-problem.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAoBvD"}

package/dist/server/to-problem.js

@@ -0,0 +1,22 @@
+// Converte um erro server-side (ApiClientError do motor de sessão, ou falha de rede)
+// num ProblemDetail serializável. Base compartilhada por route handler e Server Action.
+import { ApiClientError } from "@seedgrid/fe-core";
+export function toProblem(error) {
+    if (error instanceof ApiClientError) {
+        const body = error.responseBody;
+        // problem+json do report-api: repassa o corpo inteiro (detail/violations/title),
+        // preservando o status do body quando presente.
+        if (body && typeof body === "object") {
+            return { status: error.status, ...body };
+        }
+        if (typeof body === "string") {
+            return { status: error.status, detail: body };
+        }
+        return { status: error.status, title: error.message };
+    }
+    return {
+        status: 502,
+        title: "Bad Gateway",
+        detail: error instanceof Error ? error.message : "Erro de conexão.",
+    };
+}

package/dist/server-contract.d.ts

@@ -0,0 +1,23 @@
+import type { SecurityLoginResponse } from "./session-contract";
+export type SecurityFetchOptions = Omit<RequestInit, "headers"> & {
+    headers?: HeadersInit;
+};
+export interface SecurityServer {
+    /** Fetch cru contra o report-api com sessão (cookie→Bearer) e refresh em 401. */
+    fetchWithSession(path: string, options?: SecurityFetchOptions): Promise<Response>;
+    /** Canônico do fluxo de segurança: em erro lança ApiClientError (p/ problemResponse). */
+    apiFetchSecurity<T>(path: string, options?: SecurityFetchOptions): Promise<T>;
+    /** Variante retrocompat: em erro lança ApiRequestError (corpo cru). */
+    apiFetchServer<T>(path: string, options?: SecurityFetchOptions): Promise<T>;
+    /** Monta os headers (Authorization da sessão/service + tenancy) para uma request. */
+    buildHeaders(headers?: HeadersInit): Promise<HeadersInit>;
+    /** Grava os cookies de sessão a partir de um login/select-company OK. */
+    applySessionCookies(data: Extract<SecurityLoginResponse, {
+        status: "OK";
+    }>): Promise<void>;
+    /** Apaga os cookies de sessão. */
+    clearAuthCookies(): Promise<void>;
+    /** 401 = sessão inválida (desloga). 403 = autenticado sem permissão (NÃO desloga). */
+    isInvalidSessionResponse(status: number, body: string): boolean;
+}
+//# sourceMappingURL=server-contract.d.ts.map

package/dist/server-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-contract.d.ts","sourceRoot":"","sources":["../src/server-contract.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG;IAChE,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,yFAAyF;IACzF,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9E,uEAAuE;IACvE,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,qFAAqF;IACrF,YAAY,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,yEAAyE;IACzE,mBAAmB,CACjB,IAAI,EAAE,OAAO,CAAC,qBAAqB,EAAE;QAAE,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,kCAAkC;IAClC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,sFAAsF;IACtF,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACjE"}

package/dist/server-contract.js

@@ -0,0 +1,4 @@
+// Contrato PURO do motor de sessão (client-safe — só tipos, sem next/*). Fica na raiz
+// pra outros pacotes (ex.: fe-login-tenancy) importarem o tipo SecurityServer sem
+// puxar a implementação server (next/headers). A implementação vive em ./server.
+export {};

package/dist/session-contract.d.ts

@@ -0,0 +1,36 @@
+export type SecurityLoginResponse = {
+    status: "OK";
+    token: string;
+    tokenType?: string;
+    refreshToken?: string;
+    publicId?: string;
+    changePasswordRequired?: boolean;
+    twoFactorEnabled?: boolean;
+} | {
+    status: "2F_REQUIRED";
+    tempToken: string;
+    method?: string;
+} | {
+    status: string;
+    [key: string]: unknown;
+};
+export type SecurityResend2FAResponse = {
+    status: string;
+    method?: string;
+    message?: string;
+    tempToken?: string;
+    metadata?: Record<string, unknown>;
+    error?: string;
+};
+/** Escopo de permissões do usuário corrente (GET /me/permissions). */
+export interface MePermissions {
+    userPublicId: string;
+    name: string;
+    roles: string[];
+    permissions: string[];
+}
+/** Narrowing: login concluído com token (status "OK"). */
+export declare function isLoginSuccess(payload: SecurityLoginResponse): payload is Extract<SecurityLoginResponse, {
+    status: "OK";
+}>;
+//# sourceMappingURL=session-contract.d.ts.map

package/dist/session-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-contract.d.ts","sourceRoot":"","sources":["../src/session-contract.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,qBAAqB,GAC7B;IACE,MAAM,EAAE,IAAI,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GACD;IACE,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEN,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAC5B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,IAAI,OAAO,CAAC,qBAAqB,EAAE;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,CAAC,CAM7D"}

package/dist/session-contract.js

@@ -0,0 +1,8 @@
+// Contrato de resposta do login do seedgrid-security (espelha o backend). É genérico
+// aos dois modos de tenancy — por isso mora no barrel client-safe, não no /server.
+/** Narrowing: login concluído com token (status "OK"). */
+export function isLoginSuccess(payload) {
+    return (payload.status === "OK" &&
+        "token" in payload &&
+        typeof payload.token === "string");
+}

package/dist/session-result.d.ts

@@ -0,0 +1,22 @@
+/** Problem Details (RFC 7807) serializável — o corpo de erro do report-api. */
+export interface ProblemDetail {
+    status: number;
+    title?: string;
+    detail?: string;
+    /** Violações de validação (se o backend enviar). */
+    violations?: Array<{
+        field?: string;
+        message?: string;
+    }>;
+    [key: string]: unknown;
+}
+export type ActionResult<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    problem: ProblemDetail;
+};
+/** Lê a mensagem exibível de um ProblemDetail (detail → 1ª violação → title → status). */
+export declare function readProblemMessage(problem: ProblemDetail): string;
+//# sourceMappingURL=session-result.d.ts.map