@ulabase/kit-ng 0.12.0

package/README.md

@@ -0,0 +1,238 @@
+# @ulabase/kit-ng
+
+Wraps [`@ulabase/kit`](https://www.npmjs.com/package/@ulabase/kit) in Angular services with signals, route guards, and an HTTP interceptor — authentication in `RhAuthService`, and [payments](#rhpaymentsservice) in `RhPaymentsService`.
+
+Pairs with [Ulabase](https://cloud.restheart.com), which gives you a production-ready backend — MongoDB, REST API, authentication, signup/signin, all managed.
+
+## Installation
+
+```bash
+npm install @ulabase/kit-ng @ulabase/kit
+```
+
+> **v0.3.0+ requires RESTHeart 9.6.0 or later.** Bearer-mode `activate()`, `resetPassword()`, and `switchTeam()` rely on the `delivery=body` query parameter, introduced in RESTHeart 9.6.0. Against an older server the request still succeeds, but the kit won't be able to capture the bearer token from the response — you'll need to log in again to get a token. Cookie mode is unaffected.
+
+## Setup
+
+In `app.config.ts`:
+
+```typescript
+import { provideRhAuth } from '@ulabase/kit-ng';
+
+export const appConfig: ApplicationConfig = {
+  providers: [
+    provideRhAuth({ apiBaseUrl: environment.apiUrl }),
+  ],
+};
+```
+
+That one call registers `RhAuthService`, adds the HTTP interceptor (attaches the Bearer token, clears session on 401), and sets up the DI config.
+
+## How sessions work
+
+The kit supports **two authentication modes**:
+
+- **Bearer token** (default) — stored in `localStorage`, sent as `Authorization: Bearer <token>`
+- **Cookie** — JWT managed by the backend as an HttpOnly cookie, **same-origin only**
+
+Pass `mode: 'cookie'` to `login()`, `activate()`, `resetPassword()`, or `switchTeam()` only when the app is served from the same origin as the service. Since a Ulabase service lives on `*.restheart.com` while your app lives on your own domain, that cookie is third-party and is blocked by default in Safari and Firefox — regardless of the server's CORS configuration. **Cross-origin apps, which is the normal case, should stay on the default `'bearer'` mode.**
+
+Each of these calls a matching auto-login endpoint with `delivery=body` (bearer) or `delivery=cookie`, and in bearer mode gets the fresh token back in the same response — no extra login round-trip.
+
+For email verification, pass `delivery: 'fragment'` (default, cross-origin) or `delivery: 'cookie'` (same-origin) to `verify()`.
+
+- `login()` stores the token in `localStorage` and schedules a proactive refresh at 80% of the token's TTL (~12 minutes for a 15-minute token).
+- Every authenticated request sends `Authorization: Bearer <token>` automatically.
+- Sessions survive page reloads as long as the token hasn't expired.
+- If the token expires (laptop asleep, tab backgrounded too long, or the user hasn't interacted for 15+ minutes), the next API call gets a 401 and the session is cleared — the user sees "logged out," not a silent failure.
+
+## `RhAuthService`
+
+Inject it anywhere and use signals directly in templates:
+
+```typescript
+@Component({
+  template: `
+    @if (auth.isAuthenticated()) {
+      <span>{{ auth.user()?.profile?.firstName }}</span>
+      @if (auth.hasMultipleTeams()) {
+        <team-switcher [teams]="auth.teams()" />
+      }
+    }
+  `
+})
+export class AppComponent {
+  auth = inject(RhAuthService);
+}
+```
+
+### Signals
+
+| Signal | Type | Description |
+|---|---|---|
+| `user` | `Signal<UserInfo \| null>` | Authenticated user, or `null` |
+| `isAuthenticated` | `Signal<boolean>` | Derived from `user` |
+| `teams` | `Signal<TeamMembership[]>` | Teams the user belongs to |
+| `hasMultipleTeams` | `Signal<boolean>` | `true` when user has more than one team |
+
+### Methods
+
+All methods return `Observable`:
+
+```typescript
+auth.checkSession()                // Observable<UserInfo | null> — reads localStorage, no HTTP if no token
+auth.login(email, password, mode?)     // Observable<UserInfo> — mode: 'bearer' (default) | 'cookie'
+auth.logout()                      // Observable<void>
+auth.register(payload)             // Observable<void>
+auth.verify(email, token, delivery?)  // Observable<string> — delivery: 'fragment' (default) | 'cookie'
+auth.invite(email, role)           // Observable<void>
+auth.getInvitation(email, token)   // Observable<Invitation>
+auth.activate(payload, mode?)        // Observable<void> — mode: 'bearer' (default) | 'cookie'
+auth.acceptInvite(token)           // Observable<void>
+auth.switchTeam(teamId, mode?)       // Observable<void> — mode: 'bearer' (default) | 'cookie'; re-fetches session
+auth.forgotPassword(email)         // Observable<void>
+auth.resetPassword(payload, mode?)   // Observable<void> — mode: 'bearer' (default) | 'cookie'
+```
+
+## Your own collections
+
+`provideRhAuth()` registers `rhAuthInterceptor`, which applies the session to every
+`HttpClient` request bound for `apiBaseUrl`: the bearer token, the challenge suppression that
+keeps the browser's Basic Auth popup away on a `401`, and the cookie credentials. So your own
+data requests need no header of their own:
+
+```typescript
+private readonly http = inject(HttpClient);
+
+load() {
+  return this.http.get(`${environment.apiUrl}/my-collection?pagesize=10`);
+}
+```
+
+Requests to any other host pass through untouched — the token is a credential, and attaching
+it everywhere would hand it to whatever third party the app happens to call. An
+`Authorization` header you set yourself is left alone. The `401` handling applies to every
+request either way, because that is about the session and not the target.
+
+Adding your own interceptor alongside it takes a second `provideHttpClient` call, *after*
+`provideRhAuth`; `withInterceptors` registers each function as a `multi` provider, so the two
+add up rather than replacing one another. Do not name `rhAuthInterceptor` again there — it is
+already registered, and repeating it just runs it twice.
+
+### The kit's own calls go through `HttpClient` too
+
+`provideRhAuth()` also hands the kit an `HttpClient`-backed transport, so a login, a session
+check or a token renewal travels the same interceptor chain as everything else. Your tracing
+header, retry policy or error handler covers all of it, not just the requests you wrote.
+
+One asymmetry is deliberate: `rhAuthInterceptor` does **not** clear the session on a 401 to a
+kit endpoint. A 401 there does not always mean the session is over —
+`PATCH /auth/change-password` answers 401 for a wrong *current* password, `GET /token` for
+wrong credentials — and signing a user out for mistyping their old password would be a poor
+trade. The kit handles those itself; the interceptor's 401 handling is for your requests.
+
+To route the kit somewhere else entirely, pass your own `transport` in the config: an explicit
+one is left alone.
+
+```typescript
+provideRhAuth({ apiBaseUrl: environment.apiUrl, transport: myTransport }),
+```
+
+## Guards
+
+```typescript
+import { authGuard, publicGuard } from '@ulabase/kit-ng';
+
+export const routes: Routes = [
+  {
+    path: 'app',
+    canActivate: [authGuard],     // redirects to /auth/login if not authenticated
+    loadComponent: () => import('./shell/shell.component'),
+  },
+  {
+    path: 'auth/login',
+    canActivate: [publicGuard],   // redirects to /app if already authenticated
+    loadComponent: () => import('./pages/login/login.component'),
+  },
+];
+```
+
+`authGuard` checks the in-memory token first — no HTTP call if the user is already authenticated in the current session.
+
+## `RhPaymentsService`
+
+Payments live in their own service, because a subscription is not a session. It needs the
+`stripe` plugin on the service, and an explicit opt-in — without `payments: true` no
+`/stripe/*` call is ever made:
+
+```typescript
+provideRhAuth({
+  apiBaseUrl: 'https://my-service.restheart.com',
+  payments: true,
+  ownershipRole: 'owner',   // default; set it if your deployment overrides the role
+})
+```
+
+`subscription` loads on sign-in and reloads on `switchTeam` — nothing to wire up:
+
+```typescript
+@Component({
+  template: `
+    @if (payments.subscription(); as sub) {
+      <p>Plan: <strong>{{ sub.plan }}</strong> — {{ sub.active ? 'active' : 'inactive' }}</p>
+      @if (payments.canManageBilling()) {
+        <button (click)="upgrade()">Change plan</button>
+      }
+    }
+  `,
+})
+export class BillingComponent {
+  payments = inject(RhPaymentsService);
+
+  upgrade() {
+    this.payments.createCheckoutSession('gold', 'month').subscribe({
+      next: ({ url }) => (window.location.href = url),
+      // 409 means "already subscribed" — Stripe's Portal handles plan changes
+      error: (err) => err.status === 409 && this.openPortal(),
+    });
+  }
+
+  openPortal() {
+    this.payments.openBillingPortal().subscribe(({ url }) => (window.location.href = url));
+  }
+}
+```
+
+**Signals:** `subscription`, `plan`, `isSubscribed`, `canManageBilling`, `seatsAvailable`.
+
+**Methods:** `loadSubscription`, `getPlans`, `createCheckoutSession`, `openBillingPortal`,
+`getLicenses`, `grantLicense`, `revokeLicense`, `getCatalog`, `createOrder`, `getOrder`,
+`waitForSubscription`, `waitForOrder` — each returning an `Observable`.
+
+### The Checkout return page
+
+The redirect back from Stripe races the webhook, so reading `subscription()` as the page
+mounts can still show the old plan. Poll instead — and treat a timeout as "not yet", not as a
+failed payment:
+
+```typescript
+this.payments.waitForSubscription(s => s.plan === 'gold' && s.active).subscribe({
+  next: () => this.status.set('success'),
+  error: (err) => this.status.set(err.name === 'WaitTimeoutError' ? 'pending' : 'error'),
+});
+```
+
+`waitForSubscription` updates the `subscription` signal itself when it resolves. See the
+[core's payments guide](https://www.npmjs.com/package/@ulabase/kit#payments) for the
+full reasoning.
+
+## Quickstart
+
+The fastest path to a working app:
+
+1. Create a service on [Ulabase](https://cloud.restheart.com)
+2. Fork [`restheart-cloud-starter-ng`](https://github.com/SoftInstigate/restheart-cloud-starter-ng)
+3. Set `apiBaseUrl` in `environment.ts`
+4. `ng serve`
+
+You get login, signup, email verification, invitations, password reset, and multi-team switching — all wired up.

package/fesm2022/ulabase-kit-ng.mjs

@@ -0,0 +1,396 @@
+import * as i0 from "@angular/core";
+import { Injectable, InjectionToken, computed, effect, inject, makeEnvironmentProviders, signal, untracked } from "@angular/core";
+import { catchError, firstValueFrom, from, map, of, switchMap, tap, throwError } from "rxjs";
+import * as kit from "@ulabase/kit";
+import { DEFAULT_CART_STORAGE_KEY, addToCart, cancelRefresh, cartTotals, clearToken, getToken, loadCart, removeFromCart, saveCart, setCartQuantity, toOrderItems } from "@ulabase/kit";
+import { HttpClient, HttpContext, HttpContextToken, HttpErrorResponse, HttpHeaders, provideHttpClient, withInterceptors } from "@angular/common/http";
+import { Router } from "@angular/router";
+export * from "@ulabase/kit";
+const RH_AUTH_CONFIG = new InjectionToken("RH_AUTH_CONFIG");
+const RH_KIT_REQUEST = new HttpContextToken(() => false);
+var RhAuthService = class RhAuthService {
+	config = inject(RH_AUTH_CONFIG);
+	_user = signal(null, ...ngDevMode ? [{ debugName: "_user" }] : /* istanbul ignore next */ []);
+	_teams = signal([], ...ngDevMode ? [{ debugName: "_teams" }] : /* istanbul ignore next */ []);
+	user = this._user.asReadonly();
+	teams = this._teams.asReadonly();
+	isAuthenticated = computed(() => this._user() !== null, ...ngDevMode ? [{ debugName: "isAuthenticated" }] : /* istanbul ignore next */ []);
+	hasMultipleTeams = computed(() => this._teams().length > 1, ...ngDevMode ? [{ debugName: "hasMultipleTeams" }] : /* istanbul ignore next */ []);
+	checkSession() {
+		if (!kit.getToken()) {
+			this._user.set(null);
+			this._teams.set([]);
+			return of(null);
+		}
+		return from(kit.checkSession(this.config)).pipe(tap((u) => {
+			this._user.set(u);
+			if (!u) this._teams.set([]);
+		}), switchMap((u) => u === null ? of([]) : from(kit.getTeams(this.config)).pipe(catchError(() => of([])))), tap((ts) => this._teams.set(ts)), map(() => this._user()));
+	}
+	register(payload) {
+		return from(kit.register(this.config, payload));
+	}
+	verify(email, token, delivery = "fragment") {
+		return from(kit.verify(this.config, email, token, delivery));
+	}
+	login(email, password, mode = "bearer") {
+		return from(kit.login(this.config, email, password, mode)).pipe(tap((u) => this._user.set(u)), switchMap((u) => from(kit.getTeams(this.config)).pipe(catchError(() => of([])), tap((ts) => this._teams.set(ts)), map(() => u))));
+	}
+	logout() {
+		return from(kit.logout(this.config)).pipe(tap(() => {
+			this._user.set(null);
+			this._teams.set([]);
+		}));
+	}
+	invite(email, role) {
+		return from(kit.invite(this.config, email, role));
+	}
+	getInvitation(email, token) {
+		return from(kit.getInvitation(this.config, email, token));
+	}
+	activate(payload, mode = "bearer") {
+		return from(kit.activate(this.config, payload, mode)).pipe(map(() => void 0));
+	}
+	acceptInvite(token) {
+		return from(kit.acceptInvite(this.config, token)).pipe(switchMap(() => from(kit.getTeams(this.config)).pipe(catchError(() => of([])), tap((ts) => this._teams.set(ts)))), map(() => void 0));
+	}
+	resendInvite(email) {
+		return from(kit.resendInvite(this.config, email));
+	}
+	listInvitations() {
+		return from(kit.listInvitations(this.config));
+	}
+	loadTeams() {
+		return from(kit.getTeams(this.config)).pipe(tap((ts) => this._teams.set(ts)));
+	}
+	switchTeam(teamId, mode = "bearer") {
+		return from(kit.switchTeam(this.config, teamId, mode)).pipe(switchMap(() => this.checkSession()), map(() => void 0));
+	}
+	clearSession() {
+		kit.clearToken();
+		kit.cancelRefresh();
+		this._user.set(null);
+		this._teams.set([]);
+	}
+	forgotPassword(email) {
+		return from(kit.forgotPassword(this.config, email));
+	}
+	resetPassword(payload, mode = "bearer") {
+		return from(kit.resetPassword(this.config, payload, mode)).pipe(map(() => void 0));
+	}
+	listTeamMembers() {
+		return from(kit.listTeamMembers(this.config));
+	}
+	removeMember(email) {
+		return from(kit.removeMember(this.config, email));
+	}
+	updateMemberRole(email, role) {
+		return from(kit.updateMemberRole(this.config, email, role));
+	}
+	createTeam(teamName) {
+		return from(kit.createTeam(this.config, teamName));
+	}
+	updateTeam(updates) {
+		return from(kit.updateTeam(this.config, updates));
+	}
+	deleteTeam() {
+		return from(kit.deleteTeam(this.config));
+	}
+	updateProfile(updates) {
+		return from(kit.updateProfile(this.config, updates)).pipe(switchMap(() => this.checkSession()), map(() => void 0));
+	}
+	changePassword(currentPassword, newPassword) {
+		return from(kit.changePassword(this.config, currentPassword, newPassword));
+	}
+	updateUser(email, updates) {
+		return from(kit.updateUser(this.config, email, updates));
+	}
+	acceptConsents(body, mode = "bearer") {
+		const userId = this._user()?._id ?? kit.getTokenClaims()?.["sub"];
+		if (!userId) return throwError(() => ({
+			status: 0,
+			message: "acceptConsents requires a signed-in user"
+		}));
+		return from(kit.acceptConsents(this.config, userId, body, mode)).pipe(tap((u) => this._user.set(u)));
+	}
+	renewToken(mode = "bearer") {
+		return from(kit.renewToken(this.config, mode));
+	}
+	api(path, init) {
+		return from(kit.apiFetch(this.config, path, init));
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: RhAuthService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: RhAuthService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: RhAuthService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+var RhPaymentsService = class RhPaymentsService {
+	config = inject(RH_AUTH_CONFIG);
+	auth = inject(RhAuthService);
+	_subscription = signal(null, ...ngDevMode ? [{ debugName: "_subscription" }] : /* istanbul ignore next */ []);
+	subscription = this._subscription.asReadonly();
+	plan = computed(() => this._subscription()?.plan ?? null, ...ngDevMode ? [{ debugName: "plan" }] : /* istanbul ignore next */ []);
+	isSubscribed = computed(() => this._subscription()?.active ?? false, ...ngDevMode ? [{ debugName: "isSubscribed" }] : /* istanbul ignore next */ []);
+	canManageBilling = computed(() => this.auth.user()?.team?.role === (this.config.ownershipRole ?? "owner"), ...ngDevMode ? [{ debugName: "canManageBilling" }] : /* istanbul ignore next */ []);
+	seatsAvailable = computed(() => this._subscription()?.seats?.available ?? null, ...ngDevMode ? [{ debugName: "seatsAvailable" }] : /* istanbul ignore next */ []);
+	teamKey = computed(() => {
+		const user = this.auth.user();
+		return user ? user.team?._id?.$oid ?? "" : null;
+	}, ...ngDevMode ? [{ debugName: "teamKey" }] : /* istanbul ignore next */ []);
+	get paymentsEnabled() {
+		return this.config.payments === true;
+	}
+	constructor() {
+		if (this.paymentsEnabled) effect(() => {
+			const teamKey = this.teamKey();
+			untracked(() => {
+				if (teamKey === null) this._subscription.set(null);
+				else this.loadSubscription().subscribe();
+			});
+		});
+	}
+	loadSubscription() {
+		if (!this.paymentsEnabled) return of(null);
+		return from(kit.getSubscription(this.config)).pipe(tap((sub) => this._subscription.set(sub)), catchError(() => {
+			this._subscription.set(null);
+			return of(null);
+		}));
+	}
+	getPlans() {
+		return from(kit.getPlans(this.config));
+	}
+	createCheckoutSession(plan, interval) {
+		return from(kit.createCheckoutSession(this.config, plan, interval));
+	}
+	openBillingPortal() {
+		return from(kit.openBillingPortal(this.config));
+	}
+	getLicenses() {
+		return from(kit.getLicenses(this.config));
+	}
+	grantLicense(userId) {
+		return from(kit.grantLicense(this.config, userId));
+	}
+	revokeLicense(userId) {
+		return from(kit.revokeLicense(this.config, userId));
+	}
+	getCatalog(opts) {
+		return from(kit.getCatalog(this.config, opts));
+	}
+	createOrder(items, email, collection) {
+		return from(kit.createOrder(this.config, items, email, collection));
+	}
+	getOrder(id, secret, collection) {
+		return from(kit.getOrder(this.config, id, secret, collection));
+	}
+	waitForSubscription(predicate, opts) {
+		return from(kit.waitForSubscription(this.config, predicate, opts).then((sub) => {
+			this._subscription.set(sub);
+			return sub;
+		}));
+	}
+	waitForOrder(id, secret, opts) {
+		return from(kit.waitForOrder(this.config, id, secret, opts));
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: RhPaymentsService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: RhPaymentsService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: RhPaymentsService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}],
+	ctorParameters: () => []
+});
+const RH_CART_STORAGE_KEY = new InjectionToken("RH_CART_STORAGE_KEY", {
+	providedIn: "root",
+	factory: () => DEFAULT_CART_STORAGE_KEY
+});
+var RhCartService = class RhCartService {
+	storageKey = inject(RH_CART_STORAGE_KEY);
+	_lines = signal(loadCart(this.storageKey), ...ngDevMode ? [{ debugName: "_lines" }] : /* istanbul ignore next */ []);
+	lines = this._lines.asReadonly();
+	totals = computed(() => cartTotals(this._lines()), ...ngDevMode ? [{ debugName: "totals" }] : /* istanbul ignore next */ []);
+	totalItems = computed(() => this.totals().totalItems, ...ngDevMode ? [{ debugName: "totalItems" }] : /* istanbul ignore next */ []);
+	subtotal = computed(() => this.totals().subtotal, ...ngDevMode ? [{ debugName: "subtotal" }] : /* istanbul ignore next */ []);
+	currency = computed(() => this.totals().currency, ...ngDevMode ? [{ debugName: "currency" }] : /* istanbul ignore next */ []);
+	orderItems = computed(() => toOrderItems(this._lines()), ...ngDevMode ? [{ debugName: "orderItems" }] : /* istanbul ignore next */ []);
+	add(item, quantity = 1) {
+		this.apply((current) => addToCart(current, item, quantity));
+	}
+	setQuantity(productId, quantity) {
+		this.apply((current) => setCartQuantity(current, productId, quantity));
+	}
+	remove(productId) {
+		this.apply((current) => removeFromCart(current, productId));
+	}
+	clear() {
+		this.apply(() => []);
+	}
+	apply(next) {
+		const updated = next(this._lines());
+		saveCart(updated, this.storageKey);
+		this._lines.set(updated);
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: RhCartService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Injectable
+	});
+	static ɵprov = i0.ɵɵngDeclareInjectable({
+		minVersion: "12.0.0",
+		version: "22.2.0",
+		ngImport: i0,
+		type: RhCartService,
+		providedIn: "root"
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.0",
+	ngImport: i0,
+	type: RhCartService,
+	decorators: [{
+		type: Injectable,
+		args: [{ providedIn: "root" }]
+	}]
+});
+const authGuard = () => {
+	const auth = inject(RhAuthService);
+	const router = inject(Router);
+	if (auth.isAuthenticated()) return true;
+	return auth.checkSession().pipe(map((user) => user !== null), tap((ok) => {
+		if (!ok) router.navigate(["/auth/login"]);
+	}));
+};
+const publicGuard = () => {
+	const auth = inject(RhAuthService);
+	const router = inject(Router);
+	if (!auth.isAuthenticated()) return true;
+	return auth.checkSession().pipe(map((user) => user === null), tap((isPublic) => {
+		if (!isPublic) router.navigate(["/"]);
+	}));
+};
+function readToken(config) {
+	return config.getToken ? config.getToken() : getToken();
+}
+function isPromise(v) {
+	return typeof v?.then === "function";
+}
+const rhAuthInterceptor = (req, next) => {
+	const auth = inject(RhAuthService);
+	const config = inject(RH_AUTH_CONFIG);
+	const ownsIts401s = req.context.get(RH_KIT_REQUEST);
+	const onError = (source) => source.pipe(catchError((err) => {
+		if (!ownsIts401s && err instanceof HttpErrorResponse && err.status === 401) {
+			clearToken();
+			cancelRefresh();
+			auth.clearSession();
+		}
+		return throwError(() => err);
+	}));
+	if (!req.url.startsWith(config.apiBaseUrl)) return next(req).pipe(onError);
+	const withCredentials = (token) => next(req.clone({
+		setHeaders: {
+			...token && !req.headers.has("Authorization") ? { Authorization: `Bearer ${token}` } : {},
+			...req.headers.has("No-Auth-Challenge") ? {} : { "No-Auth-Challenge": "true" }
+		},
+		withCredentials: true
+	})).pipe(onError);
+	const token = readToken(config);
+	return isPromise(token) ? from(token).pipe(switchMap(withCredentials)) : withCredentials(token);
+};
+const NULL_BODY_STATUS = /* @__PURE__ */ new Set([
+	101,
+	103,
+	204,
+	205,
+	304
+]);
+function toHttpHeaders(source) {
+	let headers = new HttpHeaders();
+	new Headers(source).forEach((value, name) => {
+		headers = headers.set(name, value);
+	});
+	return headers;
+}
+function toHeaders(source) {
+	const headers = new Headers();
+	for (const name of source.keys()) for (const value of source.getAll(name) ?? []) headers.append(name, value);
+	return headers;
+}
+function toResponse(body, status, statusText, headers) {
+	return new Response(NULL_BODY_STATUS.has(status) ? null : body, {
+		status,
+		statusText,
+		headers: toHeaders(headers)
+	});
+}
+function httpClientTransport(http) {
+	return (url, init) => {
+		return firstValueFrom(http.request(init?.method ?? "GET", url, {
+			body: init?.body ?? null,
+			headers: toHttpHeaders(init?.headers),
+			observe: "response",
+			responseType: "text",
+			context: new HttpContext().set(RH_KIT_REQUEST, true),
+			withCredentials: true
+		})).then((res) => toResponse(res.body, res.status, res.statusText, res.headers), (err) => {
+			if (err instanceof HttpErrorResponse && err.status !== 0) return toResponse(typeof err.error === "string" ? err.error : JSON.stringify(err.error ?? null), err.status, err.statusText, err.headers);
+			throw err;
+		});
+	};
+}
+function provideRhAuth(config) {
+	return makeEnvironmentProviders([provideHttpClient(withInterceptors([rhAuthInterceptor])), {
+		provide: RH_AUTH_CONFIG,
+		useFactory: () => ({
+			...config,
+			transport: config.transport ?? httpClientTransport(inject(HttpClient))
+		})
+	}]);
+}
+export { RH_AUTH_CONFIG, RH_CART_STORAGE_KEY, RhAuthService, RhCartService, RhPaymentsService, authGuard, httpClientTransport, provideRhAuth, publicGuard, rhAuthInterceptor };
+
+//# sourceMappingURL=ulabase-kit-ng.mjs.map

package/fesm2022/ulabase-kit-ng.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ulabase-kit-ng.mjs","names":[],"sources":["../../src/tokens.ts","../../src/auth.service.ts","../../src/payments.service.ts","../../src/cart.service.ts","../../src/auth.guard.ts","../../src/auth.interceptor.ts","../../src/http-transport.ts","../../src/provide-rh-auth.ts"],"sourcesContent":["import { InjectionToken } from '@angular/core';\nimport { HttpContextToken } from '@angular/common/http';\nimport type { AuthConfig } from '@ulabase/kit';\n\nexport const RH_AUTH_CONFIG = new InjectionToken<AuthConfig>('RH_AUTH_CONFIG');\n\n\n/**\n * Marks a request as originating from the kit rather than from application\n * code. Set by `httpClientTransport`, read by `rhAuthInterceptor`.\n *\n * The kit owns the meaning of a 401 on its own endpoints, and that meaning is\n * not always \"the session is dead\": `PATCH /auth/change-password` answers 401\n * when the *current password* is wrong, and `GET /token` when the credentials\n * are. Letting the interceptor clear the session on those would sign a user\n * out for mistyping their old password.\n */\nexport const RH_KIT_REQUEST = new HttpContextToken<boolean>(() => false);\n","import { Injectable, computed, inject, signal } from '@angular/core';\nimport { Observable, catchError, from, map, of, switchMap, tap, throwError } from 'rxjs';\nimport type { UserInfo, TeamMembership, TeamMember, PendingInvitation, AuthConfig, LoginMode } from '@ulabase/kit';\nimport * as kit from '@ulabase/kit';\nimport { RH_AUTH_CONFIG } from './tokens.js';\n\n@Injectable({ providedIn: 'root' })\nexport class RhAuthService {\n  private readonly config: AuthConfig = inject(RH_AUTH_CONFIG);\n\n  private readonly _user = signal<UserInfo | null>(null);\n  private readonly _teams = signal<TeamMembership[]>([]);\n\n  readonly user = this._user.asReadonly();\n  readonly teams = this._teams.asReadonly();\n  readonly isAuthenticated = computed(() => this._user() !== null);\n  readonly hasMultipleTeams = computed(() => this._teams().length > 1);\n\n  /**\n   * Check the current session state.\n   *\n   * Reads the token from localStorage — if present and not expired,\n   * returns user info from the server. Otherwise returns null.\n   */\n  checkSession(): Observable<UserInfo | null> {\n    // If no valid token in localStorage, we're logged out — no HTTP call needed\n    if (!kit.getToken()) {\n      this._user.set(null);\n      this._teams.set([]);\n      return of(null);\n    }\n\n    return from(kit.checkSession(this.config)).pipe(\n      tap(u => {\n        this._user.set(u);\n        if (!u) {\n          this._teams.set([]);\n        }\n      }),\n      switchMap(u =>\n        u === null\n          ? of([])\n          : from(kit.getTeams(this.config)).pipe(catchError(() => of([])))\n      ),\n      tap(ts => this._teams.set(ts)),\n      map(() => this._user())\n    );\n  }\n\n  register(payload: {\n    email: string;\n    password: string;\n    teamName: string;\n    firstName: string;\n    lastName: string;\n    [key: string]: unknown;\n  }): Observable<void> {\n    return from(kit.register(this.config, payload));\n  }\n\n  verify(email: string, token: string, delivery: 'cookie' | 'fragment' = 'fragment'): Observable<string> {\n    return from(kit.verify(this.config, email, token, delivery));\n  }\n\n  login(email: string, password: string, mode: LoginMode = 'bearer'): Observable<UserInfo> {\n    return from(kit.login(this.config, email, password, mode)).pipe(\n      tap(u => this._user.set(u)),\n      switchMap(u =>\n        from(kit.getTeams(this.config)).pipe(\n          catchError(() => of([])),\n          tap(ts => this._teams.set(ts)),\n          map(() => u)\n        )\n      )\n    );\n  }\n\n  logout(): Observable<void> {\n    return from(kit.logout(this.config)).pipe(\n      tap(() => {\n        this._user.set(null);\n        this._teams.set([]);\n      })\n    );\n  }\n\n  invite(email: string, role: 'owner' | 'member'): Observable<void> {\n    return from(kit.invite(this.config, email, role));\n  }\n\n  getInvitation(email: string, token: string) {\n    return from(kit.getInvitation(this.config, email, token));\n  }\n\n  activate(payload: { email: string; token: string; password: string }, mode: LoginMode = 'bearer'): Observable<void> {\n    return from(kit.activate(this.config, payload, mode)).pipe(map(() => undefined));\n  }\n\n  acceptInvite(token: string): Observable<void> {\n    return from(kit.acceptInvite(this.config, token)).pipe(\n      switchMap(() =>\n        from(kit.getTeams(this.config)).pipe(\n          catchError(() => of([])),\n          tap(ts => this._teams.set(ts))\n        )\n      ),\n      map(() => undefined)\n    );\n  }\n\n  resendInvite(email: string): Observable<void> {\n    return from(kit.resendInvite(this.config, email));\n  }\n\n  listInvitations(): Observable<PendingInvitation[]> {\n    return from(kit.listInvitations(this.config));\n  }\n\n  loadTeams(): Observable<TeamMembership[]> {\n    return from(kit.getTeams(this.config)).pipe(\n      tap(ts => this._teams.set(ts))\n    );\n  }\n\n  switchTeam(teamId: { $oid: string }, mode: LoginMode = 'bearer'): Observable<void> {\n    return from(kit.switchTeam(this.config, teamId, mode)).pipe(\n      switchMap(() => this.checkSession()),\n      map(() => undefined)\n    );\n  }\n\n  clearSession(): void {\n    kit.clearToken();\n    kit.cancelRefresh();\n    this._user.set(null);\n    this._teams.set([]);\n  }\n\n  forgotPassword(email: string): Observable<void> {\n    return from(kit.forgotPassword(this.config, email));\n  }\n\n  resetPassword(payload: { email: string; token: string; password: string }, mode: LoginMode = 'bearer'): Observable<void> {\n    return from(kit.resetPassword(this.config, payload, mode)).pipe(map(() => undefined));\n  }\n\n  // ── Team members ─────────────────────────────────────────────────────────\n\n  listTeamMembers(): Observable<TeamMember[]> {\n    return from(kit.listTeamMembers(this.config));\n  }\n\n  removeMember(email: string): Observable<void> {\n    return from(kit.removeMember(this.config, email));\n  }\n\n  updateMemberRole(email: string, role: 'owner' | 'member'): Observable<void> {\n    return from(kit.updateMemberRole(this.config, email, role));\n  }\n\n  // ── Team lifecycle ───────────────────────────────────────────────────────\n\n  createTeam(teamName: string): Observable<TeamMembership> {\n    return from(kit.createTeam(this.config, teamName));\n  }\n\n  updateTeam(updates: { name?: string; description?: string }): Observable<void> {\n    return from(kit.updateTeam(this.config, updates));\n  }\n\n  deleteTeam(): Observable<void> {\n    return from(kit.deleteTeam(this.config));\n  }\n\n  // ── Profile & password ──────────────────────────────────────────────────\n\n  updateProfile(updates: { firstName?: string; lastName?: string }): Observable<void> {\n    return from(kit.updateProfile(this.config, updates)).pipe(\n      switchMap(() => this.checkSession()),\n      map(() => undefined)\n    );\n  }\n\n  changePassword(currentPassword: string, newPassword: string): Observable<void> {\n    return from(kit.changePassword(this.config, currentPassword, newPassword));\n  }\n\n  updateUser(email: string, updates: Record<string, unknown>): Observable<void> {\n    return from(kit.updateUser(this.config, email, updates));\n  }\n\n  // ── Consents ────────────────────────────────────────────────────────────\n\n  /**\n   * Record the signed-in user's acceptance of the application's consents,\n   * renew the token so the guard sees it, and update the `user` signal.\n   */\n  acceptConsents(body?: Record<string, unknown>, mode: LoginMode = 'bearer'): Observable<UserInfo> {\n    // The user document may be missing precisely because the rule is blocking\n    // `/users/me` — the case this call exists to get out of. The token still\n    // says who they are.\n    const userId = this._user()?._id ?? (kit.getTokenClaims()?.['sub'] as string | undefined);\n    if (!userId) {\n      return throwError(() => ({ status: 0, message: 'acceptConsents requires a signed-in user' }));\n    }\n    return from(kit.acceptConsents(this.config, userId, body, mode)).pipe(\n      tap(u => this._user.set(u))\n    );\n  }\n\n  /** Force a new token, carrying the user document as it is now. */\n  renewToken(mode: LoginMode = 'bearer'): Observable<string | null> {\n    return from(kit.renewToken(this.config, mode));\n  }\n\n  /**\n   * An authenticated `fetch` against the service, returned as an Observable.\n   *\n   * The Angular counterpart of React's `auth.api()` — the bearer token is\n   * attached automatically, and the request goes through the Angular\n   * interceptor chain (when `httpClientTransport` is configured).\n   *\n   * ```ts\n   * this.auth.api('/demo').pipe(\n   *   switchMap(res => res.json()),\n   * ).subscribe(data => console.log(data));\n   * ```\n   *\n   * For a POST:\n   * ```ts\n   * this.auth.api('/demo', {\n   *   method: 'POST',\n   *   body: JSON.stringify({ name: 'hello' }),\n   * }).pipe(switchMap(res => res.json()));\n   * ```\n   *\n   * Rejects with an `ApiError` (`{ status, message }`) on any non-2xx response.\n   */\n  api(path: string, init?: RequestInit): Observable<Response> {\n    return from(kit.apiFetch(this.config, path, init));\n  }\n}\n","import { Injectable, computed, effect, inject, signal, untracked } from '@angular/core';\nimport { Observable, catchError, from, of, tap } from 'rxjs';\nimport type {\n  AuthConfig,\n  CatalogItem,\n  GrantLicenseResult,\n  Licenses,\n  Order,\n  Plan,\n  Subscription,\n  WaitOptions,\n  CatalogQuery,\n} from '@ulabase/kit';\nimport * as kit from '@ulabase/kit';\nimport { RH_AUTH_CONFIG } from './tokens.js';\nimport { RhAuthService } from './auth.service.js';\n\n/**\n * Subscription, billing and order management.\n *\n * Separated from {@link RhAuthService} because payments are not authentication.\n * Reads the current user from {@link RhAuthService} to derive\n * `canManageBilling`, but owns its own subscription state.\n *\n * Subscription is loaded automatically when the user signs in and reloaded\n * when they switch team (via an `effect` watching {@link teamKey}). No manual\n * wiring needed.\n *\n * Only active when `config.payments` is `true` — otherwise every method\n * is a no-op and no `/stripe/*` call is ever made.\n */\n@Injectable({ providedIn: 'root' })\nexport class RhPaymentsService {\n  private readonly config: AuthConfig = inject(RH_AUTH_CONFIG);\n  private readonly auth = inject(RhAuthService);\n\n  private readonly _subscription = signal<Subscription | null>(null);\n\n  readonly subscription = this._subscription.asReadonly();\n  readonly plan = computed(() => this._subscription()?.plan ?? null);\n  readonly isSubscribed = computed(() => this._subscription()?.active ?? false);\n  readonly canManageBilling = computed(\n    () => this.auth.user()?.team?.role === (this.config.ownershipRole ?? 'owner')\n  );\n  readonly seatsAvailable = computed(() => this._subscription()?.seats?.available ?? null);\n\n  /**\n   * The team the subscription belongs to: `null` when signed out, `''` for a\n   * signed-in user with no team.\n   *\n   * The effect below tracks this rather than `auth.user()` itself. Both\n   * `updateProfile` and `acceptConsents` re-run `checkSession`, which replaces\n   * the user with a freshly parsed document — tracking that object's identity\n   * would reload the subscription on every profile edit and consent\n   * acceptance, which the adapter contract rules out. A subscription changes\n   * with the team, not with the profile.\n   */\n  private readonly teamKey = computed(() => {\n    const user = this.auth.user();\n    return user ? (user.team?._id?.$oid ?? '') : null;\n  });\n\n  private get paymentsEnabled(): boolean {\n    return this.config.payments === true;\n  }\n\n  constructor() {\n    if (this.paymentsEnabled) {\n      effect(() => {\n        const teamKey = this.teamKey();\n        untracked(() => {\n          if (teamKey === null) {\n            this._subscription.set(null);\n          } else {\n            this.loadSubscription().subscribe();\n          }\n        });\n      });\n    }\n  }\n\n  /** Reload the team's subscription. No-op when `config.payments` is not `true`. */\n  loadSubscription(): Observable<Subscription | null> {\n    if (!this.paymentsEnabled) return of(null);\n    return from(kit.getSubscription(this.config)).pipe(\n      tap(sub => this._subscription.set(sub)),\n      catchError(() => {\n        this._subscription.set(null);\n        return of(null);\n      })\n    );\n  }\n\n  /** The service's subscription plan catalog. No session required. */\n  getPlans(): Observable<{ default_plan: string; plans: Plan[] }> {\n    return from(kit.getPlans(this.config));\n  }\n\n  /**\n   * Start a Stripe Checkout session.\n   *\n   * **Rejects with `status: 409`** when the team already has an active\n   * subscription — send them to {@link openBillingPortal} instead.\n   */\n  createCheckoutSession(plan: string, interval: 'month' | 'year'): Observable<{ url: string }> {\n    return from(kit.createCheckoutSession(this.config, plan, interval));\n  }\n\n  /** Open the Stripe Customer Portal for self-service plan changes. */\n  openBillingPortal(): Observable<{ url: string }> {\n    return from(kit.openBillingPortal(this.config));\n  }\n\n  /** The team's seat licences. Requires `canManageBilling`. */\n  getLicenses(): Observable<Licenses> {\n    return from(kit.getLicenses(this.config));\n  }\n\n  /**\n   * Grant a seat licence. Returns `'granted'` or `'already-licensed'`.\n   * Rejects with `status: 409` when no seat is available.\n   */\n  grantLicense(userId: string): Observable<GrantLicenseResult> {\n    return from(kit.grantLicense(this.config, userId));\n  }\n\n  /** Revoke a seat licence. */\n  revokeLicense(userId: string): Observable<void> {\n    return from(kit.revokeLicense(this.config, userId));\n  }\n\n  /** Read the product catalog. */\n  getCatalog(opts?: CatalogQuery): Observable<CatalogItem[]> {\n    return from(kit.getCatalog(this.config, opts));\n  }\n\n  /**\n   * Create an order and start Checkout.\n   *\n   * @param email Required for guest checkout.\n   */\n  createOrder(\n    items: { productId: string; quantity: number }[],\n    email?: string,\n    collection?: string\n  ): Observable<{ _id: { $oid: string }; checkout_url: string; secret: string }> {\n    return from(kit.createOrder(this.config, items, email, collection));\n  }\n\n  /** Read an order back. */\n  getOrder(id: string, secret?: string, collection?: string): Observable<Order> {\n    return from(kit.getOrder(this.config, id, secret, collection));\n  }\n\n  /**\n   * Poll until the subscription satisfies `predicate`.\n   *\n   * Use on the Checkout success page — the redirect back from Stripe races\n   * the webhook, so a bare `getSubscription` can still show the old plan.\n   *\n   * **Timing out is not a payment failure.** Rejects with\n   * `WaitTimeoutError` when the webhook hasn't arrived yet.\n   */\n  waitForSubscription(\n    predicate: (subscription: Subscription) => boolean,\n    opts?: WaitOptions\n  ): Observable<Subscription> {\n    return from(\n      kit.waitForSubscription(this.config, predicate, opts).then(sub => {\n        this._subscription.set(sub);\n        return sub;\n      })\n    );\n  }\n\n  /**\n   * Poll until the order leaves `'pending_payment'`.\n   *\n   * Same race as {@link waitForSubscription} — use on the order success page.\n   *\n   * **Timing out is not a payment failure.** Rejects with\n   * `WaitTimeoutError` when the webhook hasn't arrived yet.\n   */\n  waitForOrder(\n    id: string,\n    secret?: string,\n    opts?: WaitOptions & { collection?: string }\n  ): Observable<Order> {\n    return from(kit.waitForOrder(this.config, id, secret, opts));\n  }\n}\n","import { Injectable, InjectionToken, computed, inject, signal } from '@angular/core';\nimport {\n  addToCart,\n  cartTotals,\n  loadCart,\n  removeFromCart,\n  saveCart,\n  setCartQuantity,\n  toOrderItems,\n  DEFAULT_CART_STORAGE_KEY,\n  type CartItem,\n  type CartLine,\n} from '@ulabase/kit';\n/**\n * Where {@link RhCartService} keeps the cart in `localStorage`. Defaults to `'rh-cart'`.\n *\n * Worth providing when two of your apps share an origin, which is one deployment decision away\n * from happening by accident.\n *\n * Declared here rather than in `tokens.ts`: that file is the authentication surface, and a cart\n * needs no session. Importing the kit into it to reach one constant also dragged the kit's module\n * into every spec that touches `RH_AUTH_CONFIG`, where it is auto-mocked — which shifted module\n * initialisation enough to make two unrelated guard tests fail, in CI only.\n */\nexport const RH_CART_STORAGE_KEY = new InjectionToken<string>('RH_CART_STORAGE_KEY', {\n  providedIn: 'root',\n  factory: () => DEFAULT_CART_STORAGE_KEY,\n});\n\n/**\n * The shopping cart.\n *\n * Independent of {@link import('./auth.service.js').RhAuthService | RhAuthService}\n * and of `RH_AUTH_CONFIG`: a cart belongs to the browser, not to a session, and\n * a shop that makes people sign in before they can put something in a basket\n * loses most of them there. It becomes an order — which does need a config —\n * when {@link RhCartService.orderItems} is handed to `createOrder`.\n *\n * On the server, `localStorage` does not exist and the cart reads as empty.\n * That is correct for a rendered page — a request carries no basket — but it\n * does mean a server-rendered cart count starts at zero and fills in once the\n * browser takes over.\n */\n@Injectable({ providedIn: 'root' })\nexport class RhCartService {\n  private readonly storageKey = inject(RH_CART_STORAGE_KEY);\n\n  // Declared after `storageKey` so the field is there: initializers run in order.\n  private readonly _lines = signal<CartLine[]>(loadCart(this.storageKey));\n\n  /** The lines, in the order they were added. */\n  readonly lines = this._lines.asReadonly();\n\n  private readonly totals = computed(() => cartTotals(this._lines()));\n\n  /** Units, not lines: two of one thing counts two. */\n  readonly totalItems = computed(() => this.totals().totalItems);\n  /** Display only. Minor units, meaningful when every line shares a currency. */\n  readonly subtotal = computed(() => this.totals().subtotal);\n  /** The first line's currency, or `'eur'` when empty. */\n  readonly currency = computed(() => this.totals().currency);\n  /** The cart as `createOrder` wants it. */\n  readonly orderItems = computed(() => toOrderItems(this._lines()));\n\n  /** Adds an item, or increases the line already holding it. */\n  add(item: CartItem, quantity = 1): void {\n    this.apply(current => addToCart(current, item, quantity));\n  }\n\n  /** Sets a line's quantity. Zero removes it. */\n  setQuantity(productId: string, quantity: number): void {\n    this.apply(current => setCartQuantity(current, productId, quantity));\n  }\n\n  remove(productId: string): void {\n    this.apply(current => removeFromCart(current, productId));\n  }\n\n  clear(): void {\n    this.apply(() => []);\n  }\n\n  /**\n   * State and storage move together, in the operation that changed them.\n   *\n   * Deliberately not an `effect` reacting to the signal: an effect runs after\n   * the fact and can be skipped or reordered, and the failure that produces is\n   * a line coming back from storage after somebody removed it.\n   */\n  private apply(next: (current: CartLine[]) => CartLine[]): void {\n    const updated = next(this._lines());\n    saveCart(updated, this.storageKey);\n    this._lines.set(updated);\n  }\n}\n","import { inject } from '@angular/core';\nimport { Router, type CanActivateFn } from '@angular/router';\nimport { map, tap } from 'rxjs';\nimport { RhAuthService } from './auth.service.js';\n\nexport const authGuard: CanActivateFn = () => {\n  const auth = inject(RhAuthService);\n  const router = inject(Router);\n\n  if (auth.isAuthenticated()) return true;\n\n  return auth.checkSession().pipe(\n    map(user => user !== null),\n    tap(ok => { if (!ok) router.navigate(['/auth/login']); })\n  );\n};\n\nexport const publicGuard: CanActivateFn = () => {\n  const auth = inject(RhAuthService);\n  const router = inject(Router);\n\n  if (!auth.isAuthenticated()) return true;\n\n  return auth.checkSession().pipe(\n    map(user => user === null),\n    tap(isPublic => { if (!isPublic) router.navigate(['/']); })\n  );\n};\n","import { inject } from '@angular/core';\nimport {\n  HttpRequest,\n  HttpHandlerFn,\n  HttpInterceptorFn,\n  HttpErrorResponse,\n} from '@angular/common/http';\nimport { Observable, catchError, from, switchMap, throwError } from 'rxjs';\nimport { RhAuthService } from './auth.service.js';\nimport { RH_AUTH_CONFIG, RH_KIT_REQUEST } from './tokens.js';\nimport { clearToken, cancelRefresh, getToken } from '@ulabase/kit';\nimport type { AuthConfig } from '@ulabase/kit';\n\n/** The token source is pluggable and may be async — keep the sync path sync. */\nfunction readToken(config: AuthConfig): string | null | Promise<string | null> {\n  return config.getToken ? config.getToken() : getToken();\n}\n\nfunction isPromise<T>(v: T | Promise<T>): v is Promise<T> {\n  return typeof (v as Promise<T>)?.then === 'function';\n}\n\n/**\n * Authenticates the application's own `HttpClient` requests, and clears the\n * session when the service rejects one with a 401.\n *\n * The kit's own calls go out through `fetch` and never reach an Angular\n * interceptor, so without this an app querying its own collections had to\n * attach the bearer token by hand at every call site.\n *\n * **Only requests to `apiBaseUrl` are touched.** The token is a credential:\n * attaching it to every outgoing request would hand it to any third-party host\n * the app happens to call. Requests elsewhere pass through untouched — they\n * still get the 401 handling, which is about the session and not the target.\n *\n * An `Authorization` header already on the request is left alone, so a call\n * that needs different credentials can say so.\n */\nexport const rhAuthInterceptor: HttpInterceptorFn = (\n  req: HttpRequest<unknown>,\n  next: HttpHandlerFn\n) => {\n  const auth = inject(RhAuthService);\n  const config = inject(RH_AUTH_CONFIG);\n\n  // A 401 on the kit's own endpoints does not always mean the session is dead\n  // — change-password and token answer 401 for wrong *supplied* credentials —\n  // and the kit already handles those. Clearing here would sign a user out for\n  // mistyping their old password.\n  const ownsIts401s = req.context.get(RH_KIT_REQUEST);\n\n  const onError = (source: Observable<unknown>) =>\n    source.pipe(\n      catchError((err: unknown) => {\n        if (!ownsIts401s && err instanceof HttpErrorResponse && err.status === 401) {\n          clearToken();\n          cancelRefresh();\n          auth.clearSession();\n        }\n        return throwError(() => err);\n      })\n    );\n\n  if (!req.url.startsWith(config.apiBaseUrl)) {\n    return next(req).pipe(onError) as ReturnType<HttpHandlerFn>;\n  }\n\n  const withCredentials = (token: string | null) =>\n    next(\n      req.clone({\n        setHeaders: {\n          ...(token && !req.headers.has('Authorization')\n            ? { Authorization: `Bearer ${token}` }\n            : {}),\n          // Suppress RESTHeart's WWW-Authenticate challenge on a 401 —\n          // without it the browser shows its native Basic Auth popup.\n          ...(req.headers.has('No-Auth-Challenge') ? {} : { 'No-Auth-Challenge': 'true' }),\n        },\n        // Matches the kit's own `credentials: 'include'`, so a cookie-mode\n        // session authenticates these requests too.\n        withCredentials: true,\n      })\n    ).pipe(onError) as ReturnType<HttpHandlerFn>;\n\n  const token = readToken(config);\n  return isPromise(token)\n    ? (from(token).pipe(switchMap(withCredentials)) as ReturnType<HttpHandlerFn>)\n    : withCredentials(token);\n};\n","import {\n  HttpClient,\n  HttpContext,\n  HttpErrorResponse,\n  HttpHeaders,\n  HttpResponse,\n} from '@angular/common/http';\nimport { firstValueFrom } from 'rxjs';\nimport type { AuthConfig } from '@ulabase/kit';\nimport { RH_KIT_REQUEST } from './tokens.js';\n\n/** Statuses the Fetch spec forbids a body on — `new Response(body, …)` throws. */\nconst NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);\n\nfunction toHttpHeaders(source: HeadersInit | undefined): HttpHeaders {\n  let headers = new HttpHeaders();\n  new Headers(source).forEach((value, name) => {\n    headers = headers.set(name, value);\n  });\n  return headers;\n}\n\nfunction toHeaders(source: HttpHeaders): Headers {\n  const headers = new Headers();\n  for (const name of source.keys()) {\n    for (const value of source.getAll(name) ?? []) {\n      headers.append(name, value);\n    }\n  }\n  return headers;\n}\n\nfunction toResponse(body: string | null, status: number, statusText: string, headers: HttpHeaders): Response {\n  return new Response(NULL_BODY_STATUS.has(status) ? null : body, {\n    status,\n    statusText,\n    headers: toHeaders(headers),\n  });\n}\n\n/**\n * A {@link AuthConfig.transport} backed by Angular's `HttpClient`, so the kit's\n * own calls go through the interceptor chain like everything else the\n * application sends.\n *\n * Without it the kit speaks `fetch` directly and an interceptor never sees a\n * login, a session check or a token renewal — which makes any cross-cutting\n * concern written as an interceptor quietly partial.\n *\n * Two mismatches with `fetch` are reconciled here:\n *\n * - **`HttpClient` throws on a non-2xx response.** `fetch` resolves and lets\n *   the caller read the status, which is what the core does to build its\n *   `ApiError`. So an `HttpErrorResponse` carrying a real response is turned\n *   back into a resolved `Response`.\n * - **`status === 0` is not a response**, it is a network or CORS failure with\n *   nothing behind it. `new Response` would reject the status anyway, so the\n *   original error is rethrown and surfaces as a rejected promise, exactly as\n *   a failed `fetch` would.\n *\n * The body is read as text and left unparsed: the core calls `.json()` itself,\n * and on an error response it needs the raw body to pull out the message.\n */\nexport function httpClientTransport(http: HttpClient) {\n  return (url: string, init?: RequestInit): Promise<Response> => {\n    const request = firstValueFrom(\n      http.request(init?.method ?? 'GET', url, {\n        body: init?.body ?? null,\n        headers: toHttpHeaders(init?.headers as HeadersInit | undefined),\n        observe: 'response',\n        responseType: 'text',\n        // The kit handles 401s on its own endpoints; see RH_KIT_REQUEST.\n        context: new HttpContext().set(RH_KIT_REQUEST, true),\n        // Mirrors the core's `credentials: 'include'` — cookie-mode sessions\n        // authenticate on the cookie alone.\n        withCredentials: true,\n      })\n    );\n\n    return request.then(\n      (res: HttpResponse<string>) => toResponse(res.body, res.status, res.statusText, res.headers),\n      (err: unknown) => {\n        if (err instanceof HttpErrorResponse && err.status !== 0) {\n          const body = typeof err.error === 'string' ? err.error : JSON.stringify(err.error ?? null);\n          return toResponse(body, err.status, err.statusText, err.headers);\n        }\n        throw err;\n      }\n    );\n  };\n}\n","import { EnvironmentProviders, inject, makeEnvironmentProviders } from '@angular/core';\nimport { HttpClient, provideHttpClient, withInterceptors } from '@angular/common/http';\nimport type { AuthConfig } from '@ulabase/kit';\nimport { RH_AUTH_CONFIG } from './tokens.js';\nimport { rhAuthInterceptor } from './auth.interceptor.js';\nimport { httpClientTransport } from './http-transport.js';\n\nexport function provideRhAuth(config: AuthConfig): EnvironmentProviders {\n  return makeEnvironmentProviders([\n    provideHttpClient(withInterceptors([rhAuthInterceptor])),\n    {\n      provide: RH_AUTH_CONFIG,\n      // A factory, not a value, so the kit's own calls can be routed through\n      // `HttpClient` — which does not exist yet when the caller builds the\n      // config. An explicit `transport` is left alone, so an application can\n      // still supply its own.\n      useFactory: (): AuthConfig => ({\n        ...config,\n        transport: config.transport ?? httpClientTransport(inject(HttpClient)),\n      }),\n    },\n  ]);\n}\n"],"mappings":";;;;;;;;AAIA,MAAa,iBAAiB,IAAI,eAA2B,gBAAgB;AAa7E,MAAa,iBAAiB,IAAI,uBAAgC,KAAK;ACVvE,IAAa,gBAAb,MAAa,cAAa;CACP,SAAqB,OAAO,cAAc;CAE1C,QAAQ,OAAwB,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,QAAA,CAAA,+BAAA,CAAA,CAAA;CACrC,SAAS,OAAyB,CAAA,GAAG,GAAA,YAAA,CAAA,EAAA,WAAA,SAAA,CAAA,+BAAA,CAAA,CAAA;CAE7C,OAAO,KAAK,MAAM,WAAU;CAC5B,QAAQ,KAAK,OAAO,WAAU;CAC9B,kBAAkB,eAAe,KAAK,MAAK,MAAO,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,kBAAA,CAAA,+BAAA,CAAA,CAAA;CACvD,mBAAmB,eAAe,KAAK,OAAM,CAAE,CAAC,SAAS,GAAE,GAAA,YAAA,CAAA,EAAA,WAAA,mBAAA,CAAA,+BAAA,CAAA,CAAA;CAQpE,eAAY;EAEV,IAAI,CAAC,IAAI,SAAQ,GAAI;GACnB,KAAK,MAAM,IAAI,IAAI;GACnB,KAAK,OAAO,IAAI,CAAA,CAAE;GAClB,OAAO,GAAG,IAAI;EAChB;EAEA,OAAO,KAAK,IAAI,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,KACzC,KAAI,MAAI;GACN,KAAK,MAAM,IAAI,CAAC;GAChB,IAAI,CAAC,GACH,KAAK,OAAO,IAAI,CAAA,CAAE;EAEtB,CAAC,GACD,WAAU,MACR,MAAM,OACF,GAAG,CAAA,CAAE,IACL,KAAK,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,iBAAiB,GAAG,CAAA,CAAE,CAAC,CAAC,CAAC,GAEpE,KAAI,OAAM,KAAK,OAAO,IAAI,EAAE,CAAC,GAC7B,UAAU,KAAK,MAAK,CAAE,CAAC;CAE3B;CAEA,SAAS,SAOR;EACC,OAAO,KAAK,IAAI,SAAS,KAAK,QAAQ,OAAO,CAAC;CAChD;CAEA,OAAO,OAAe,OAAe,WAAkC,YAAU;EAC/E,OAAO,KAAK,IAAI,OAAO,KAAK,QAAQ,OAAO,OAAO,QAAQ,CAAC;CAC7D;CAEA,MAAM,OAAe,UAAkB,OAAkB,UAAQ;EAC/D,OAAO,KAAK,IAAI,MAAM,KAAK,QAAQ,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,KACzD,KAAI,MAAK,KAAK,MAAM,IAAI,CAAC,CAAC,GAC1B,WAAU,MACR,KAAK,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAC9B,iBAAiB,GAAG,CAAA,CAAE,CAAC,GACvB,KAAI,OAAM,KAAK,OAAO,IAAI,EAAE,CAAC,GAC7B,UAAU,CAAC,CAAC,CACb,CACF;CAEL;CAEA,SAAM;EACJ,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,KACnC,UAAS;GACP,KAAK,MAAM,IAAI,IAAI;GACnB,KAAK,OAAO,IAAI,CAAA,CAAE;EACpB,CAAC,CAAC;CAEN;CAEA,OAAO,OAAe,MAAwB;EAC5C,OAAO,KAAK,IAAI,OAAO,KAAK,QAAQ,OAAO,IAAI,CAAC;CAClD;CAEA,cAAc,OAAe,OAAa;EACxC,OAAO,KAAK,IAAI,cAAc,KAAK,QAAQ,OAAO,KAAK,CAAC;CAC1D;CAEA,SAAS,SAA6D,OAAkB,UAAQ;EAC9F,OAAO,KAAK,IAAI,SAAS,KAAK,QAAQ,SAAS,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,MAAS,CAAC;CACjF;CAEA,aAAa,OAAa;EACxB,OAAO,KAAK,IAAI,aAAa,KAAK,QAAQ,KAAK,CAAC,CAAC,CAAC,KAChD,gBACE,KAAK,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAC9B,iBAAiB,GAAG,CAAA,CAAE,CAAC,GACvB,KAAI,OAAM,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC,CAC/B,GAEH,UAAU,MAAS,CAAC;CAExB;CAEA,aAAa,OAAa;EACxB,OAAO,KAAK,IAAI,aAAa,KAAK,QAAQ,KAAK,CAAC;CAClD;CAEA,kBAAe;EACb,OAAO,KAAK,IAAI,gBAAgB,KAAK,MAAM,CAAC;CAC9C;CAEA,YAAS;EACP,OAAO,KAAK,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KACrC,KAAI,OAAM,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC;CAElC;CAEA,WAAW,QAA0B,OAAkB,UAAQ;EAC7D,OAAO,KAAK,IAAI,WAAW,KAAK,QAAQ,QAAQ,IAAI,CAAC,CAAC,CAAC,KACrD,gBAAgB,KAAK,aAAY,CAAE,GACnC,UAAU,MAAS,CAAC;CAExB;CAEA,eAAY;EACV,IAAI,WAAU;EACd,IAAI,cAAa;EACjB,KAAK,MAAM,IAAI,IAAI;EACnB,KAAK,OAAO,IAAI,CAAA,CAAE;CACpB;CAEA,eAAe,OAAa;EAC1B,OAAO,KAAK,IAAI,eAAe,KAAK,QAAQ,KAAK,CAAC;CACpD;CAEA,cAAc,SAA6D,OAAkB,UAAQ;EACnG,OAAO,KAAK,IAAI,cAAc,KAAK,QAAQ,SAAS,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,MAAS,CAAC;CACtF;CAIA,kBAAe;EACb,OAAO,KAAK,IAAI,gBAAgB,KAAK,MAAM,CAAC;CAC9C;CAEA,aAAa,OAAa;EACxB,OAAO,KAAK,IAAI,aAAa,KAAK,QAAQ,KAAK,CAAC;CAClD;CAEA,iBAAiB,OAAe,MAAwB;EACtD,OAAO,KAAK,IAAI,iBAAiB,KAAK,QAAQ,OAAO,IAAI,CAAC;CAC5D;CAIA,WAAW,UAAgB;EACzB,OAAO,KAAK,IAAI,WAAW,KAAK,QAAQ,QAAQ,CAAC;CACnD;CAEA,WAAW,SAAgD;EACzD,OAAO,KAAK,IAAI,WAAW,KAAK,QAAQ,OAAO,CAAC;CAClD;CAEA,aAAU;EACR,OAAO,KAAK,IAAI,WAAW,KAAK,MAAM,CAAC;CACzC;CAIA,cAAc,SAAkD;EAC9D,OAAO,KAAK,IAAI,cAAc,KAAK,QAAQ,OAAO,CAAC,CAAC,CAAC,KACnD,gBAAgB,KAAK,aAAY,CAAE,GACnC,UAAU,MAAS,CAAC;CAExB;CAEA,eAAe,iBAAyB,aAAmB;EACzD,OAAO,KAAK,IAAI,eAAe,KAAK,QAAQ,iBAAiB,WAAW,CAAC;CAC3E;CAEA,WAAW,OAAe,SAAgC;EACxD,OAAO,KAAK,IAAI,WAAW,KAAK,QAAQ,OAAO,OAAO,CAAC;CACzD;CAQA,eAAe,MAAgC,OAAkB,UAAQ;EAIvE,MAAM,SAAS,KAAK,MAAK,CAAE,EAAE,OAAQ,IAAI,eAAc,CAAE,GAAG;EAC5D,IAAI,CAAC,QACH,OAAO,kBAAkB;GAAE,QAAQ;GAAG,SAAS;EAA0C,EAAG;EAE9F,OAAO,KAAK,IAAI,eAAe,KAAK,QAAQ,QAAQ,MAAM,IAAI,CAAC,CAAC,CAAC,KAC/D,KAAI,MAAK,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC;CAE/B;CAGA,WAAW,OAAkB,UAAQ;EACnC,OAAO,KAAK,IAAI,WAAW,KAAK,QAAQ,IAAI,CAAC;CAC/C;CAyBA,IAAI,MAAc,MAAkB;EAClC,OAAO,KAAK,IAAI,SAAS,KAAK,QAAQ,MAAM,IAAI,CAAC;CACnD;CAzOW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAa,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAb,OAAA,QAAA,GAAA,sBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAa,YADA;CAAM,CAAA;;AACnB,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAa,YAAA,CAAA;EADzB,MAAA;EAAW,MAAA,CAAA,EAAE,YAAY,OAAM,CAAE;;;AC0BlC,IAAa,oBAAb,MAAa,kBAAiB;CACX,SAAqB,OAAO,cAAc;CAC1C,OAAO,OAAO,aAAa;CAE3B,gBAAgB,OAA4B,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,gBAAA,CAAA,+BAAA,CAAA,CAAA;CAEzD,eAAe,KAAK,cAAc,WAAU;CAC5C,OAAO,eAAe,KAAK,cAAa,CAAE,EAAE,QAAQ,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,OAAA,CAAA,+BAAA,CAAA,CAAA;CACzD,eAAe,eAAe,KAAK,cAAa,CAAE,EAAE,UAAU,OAAM,GAAA,YAAA,CAAA,EAAA,WAAA,eAAA,CAAA,+BAAA,CAAA,CAAA;CACpE,mBAAmB,eACpB,KAAK,KAAK,KAAI,CAAE,EAAE,MAAM,UAAU,KAAK,OAAO,iBAAiB,UACtE,GAAA,YAAA,CAAA,EAAA,WAAA,mBAAA,CAAA,+BAAA,CAAA,CAAA;CACQ,iBAAiB,eAAe,KAAK,cAAa,CAAE,EAAE,OAAO,aAAa,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,iBAAA,CAAA,+BAAA,CAAA,CAAA;CAavE,UAAU,eAAc;EACvC,MAAM,OAAO,KAAK,KAAK,KAAI;EAC3B,OAAO,OAAQ,KAAK,MAAM,KAAK,QAAQ,KAAM;CAC/C,GAAE,GAAA,YAAA,CAAA,EAAA,WAAA,UAAA,CAAA,+BAAA,CAAA,CAAA;CAEF,IAAY,kBAAe;EACzB,OAAO,KAAK,OAAO,aAAa;CAClC;CAEA,cAAA;EACE,IAAI,KAAK,iBACP,aAAY;GACV,MAAM,UAAU,KAAK,QAAO;GAC5B,gBAAe;IACb,IAAI,YAAY,MACd,KAAK,cAAc,IAAI,IAAI;SAE3B,KAAK,iBAAgB,CAAE,CAAC,UAAS;GAErC,CAAC;EACH,CAAC;CAEL;CAGA,mBAAgB;EACd,IAAI,CAAC,KAAK,iBAAiB,OAAO,GAAG,IAAI;EACzC,OAAO,KAAK,IAAI,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,KAC5C,KAAI,QAAO,KAAK,cAAc,IAAI,GAAG,CAAC,GACtC,iBAAgB;GACd,KAAK,cAAc,IAAI,IAAI;GAC3B,OAAO,GAAG,IAAI;EAChB,CAAC,CAAC;CAEN;CAGA,WAAQ;EACN,OAAO,KAAK,IAAI,SAAS,KAAK,MAAM,CAAC;CACvC;CAQA,sBAAsB,MAAc,UAA0B;EAC5D,OAAO,KAAK,IAAI,sBAAsB,KAAK,QAAQ,MAAM,QAAQ,CAAC;CACpE;CAGA,oBAAiB;EACf,OAAO,KAAK,IAAI,kBAAkB,KAAK,MAAM,CAAC;CAChD;CAGA,cAAW;EACT,OAAO,KAAK,IAAI,YAAY,KAAK,MAAM,CAAC;CAC1C;CAMA,aAAa,QAAc;EACzB,OAAO,KAAK,IAAI,aAAa,KAAK,QAAQ,MAAM,CAAC;CACnD;CAGA,cAAc,QAAc;EAC1B,OAAO,KAAK,IAAI,cAAc,KAAK,QAAQ,MAAM,CAAC;CACpD;CAGA,WAAW,MAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW,KAAK,QAAQ,IAAI,CAAC;CAC/C;CAOA,YACE,OACA,OACA,YAAmB;EAEnB,OAAO,KAAK,IAAI,YAAY,KAAK,QAAQ,OAAO,OAAO,UAAU,CAAC;CACpE;CAGA,SAAS,IAAY,QAAiB,YAAmB;EACvD,OAAO,KAAK,IAAI,SAAS,KAAK,QAAQ,IAAI,QAAQ,UAAU,CAAC;CAC/D;CAWA,oBACE,WACA,MAAkB;EAElB,OAAO,KACL,IAAI,oBAAoB,KAAK,QAAQ,WAAW,IAAI,CAAC,CAAC,MAAK,QAAM;GAC/D,KAAK,cAAc,IAAI,GAAG;GAC1B,OAAO;EACT,CAAC,CAAC;CAEN;CAUA,aACE,IACA,QACA,MAA4C;EAE5C,OAAO,KAAK,IAAI,aAAa,KAAK,QAAQ,IAAI,QAAQ,IAAI,CAAC;CAC7D;CA7JW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAiB,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAjB,OAAA,QAAA,GAAA,sBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAiB,YADJ;CAAM,CAAA;;AACnB,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAiB,YAAA,CAAA;EAD7B,MAAA;EAAW,MAAA,CAAA,EAAE,YAAY,OAAM,CAAE;;;;ACPlC,MAAa,sBAAsB,IAAI,eAAuB,uBAAuB;CACnF,YAAY;CACZ,eAAe;AAChB,CAAA;AAiBD,IAAa,gBAAb,MAAa,cAAa;CACP,aAAa,OAAO,mBAAmB;CAGvC,SAAS,OAAmB,SAAS,KAAK,UAAU,GAAE,GAAA,YAAA,CAAA,EAAA,WAAA,SAAA,CAAA,+BAAA,CAAA,CAAA;CAG9D,QAAQ,KAAK,OAAO,WAAU;CAEtB,SAAS,eAAe,WAAW,KAAK,OAAM,CAAE,GAAE,GAAA,YAAA,CAAA,EAAA,WAAA,SAAA,CAAA,+BAAA,CAAA,CAAA;CAG1D,aAAa,eAAe,KAAK,OAAM,CAAE,CAAC,YAAW,GAAA,YAAA,CAAA,EAAA,WAAA,aAAA,CAAA,+BAAA,CAAA,CAAA;CAErD,WAAW,eAAe,KAAK,OAAM,CAAE,CAAC,UAAS,GAAA,YAAA,CAAA,EAAA,WAAA,WAAA,CAAA,+BAAA,CAAA,CAAA;CAEjD,WAAW,eAAe,KAAK,OAAM,CAAE,CAAC,UAAS,GAAA,YAAA,CAAA,EAAA,WAAA,WAAA,CAAA,+BAAA,CAAA,CAAA;CAEjD,aAAa,eAAe,aAAa,KAAK,OAAM,CAAE,GAAE,GAAA,YAAA,CAAA,EAAA,WAAA,aAAA,CAAA,+BAAA,CAAA,CAAA;CAGjE,IAAI,MAAgB,WAAW,GAAC;EAC9B,KAAK,OAAM,YAAW,UAAU,SAAS,MAAM,QAAQ,CAAC;CAC1D;CAGA,YAAY,WAAmB,UAAgB;EAC7C,KAAK,OAAM,YAAW,gBAAgB,SAAS,WAAW,QAAQ,CAAC;CACrE;CAEA,OAAO,WAAiB;EACtB,KAAK,OAAM,YAAW,eAAe,SAAS,SAAS,CAAC;CAC1D;CAEA,QAAK;EACH,KAAK,YAAY,CAAA,CAAE;CACrB;CASQ,MAAM,MAAyC;EACrD,MAAM,UAAU,KAAK,KAAK,OAAM,CAAE;EAClC,SAAS,SAAS,KAAK,UAAU;EACjC,KAAK,OAAO,IAAI,OAAO;CACzB;CAjDW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAa,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAb,OAAA,QAAA,GAAA,sBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAa,YADA;CAAM,CAAA;;AACnB,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAa,YAAA,CAAA;EADzB,MAAA;EAAW,MAAA,CAAA,EAAE,YAAY,OAAM,CAAE;;;ACtClC,MAAa,kBAAgC;CAC3C,MAAM,OAAO,OAAO,aAAa;CACjC,MAAM,SAAS,OAAO,MAAM;CAE5B,IAAI,KAAK,gBAAe,GAAI,OAAO;CAEnC,OAAO,KAAK,aAAY,CAAE,CAAC,KACzB,KAAI,SAAQ,SAAS,IAAI,GACzB,KAAI,OAAK;EAAG,IAAI,CAAC,IAAI,OAAO,SAAS,CAAC,aAAa,CAAC;CAAG,CAAC,CAAC;AAE7D;AAEA,MAAa,oBAAkC;CAC7C,MAAM,OAAO,OAAO,aAAa;CACjC,MAAM,SAAS,OAAO,MAAM;CAE5B,IAAI,CAAC,KAAK,gBAAe,GAAI,OAAO;CAEpC,OAAO,KAAK,aAAY,CAAE,CAAC,KACzB,KAAI,SAAQ,SAAS,IAAI,GACzB,KAAI,aAAW;EAAG,IAAI,CAAC,UAAU,OAAO,SAAS,CAAC,GAAG,CAAC;CAAG,CAAC,CAAC;AAE/D;ACbA,SAAS,UAAU,QAAkB;CACnC,OAAO,OAAO,WAAW,OAAO,SAAQ,IAAK,SAAQ;AACvD;AAEA,SAAS,UAAa,GAAiB;CACrC,OAAO,OAAQ,GAAkB,SAAS;AAC5C;AAkBA,MAAa,qBACX,KACA,SACE;CACF,MAAM,OAAO,OAAO,aAAa;CACjC,MAAM,SAAS,OAAO,cAAc;CAMpC,MAAM,cAAc,IAAI,QAAQ,IAAI,cAAc;CAElD,MAAM,WAAW,WACf,OAAO,KACL,YAAY,QAAgB;EAC1B,IAAI,CAAC,eAAe,eAAe,qBAAqB,IAAI,WAAW,KAAK;GAC1E,WAAU;GACV,cAAa;GACb,KAAK,aAAY;EACnB;EACA,OAAO,iBAAiB,GAAG;CAC7B,CAAC,CAAC;CAGN,IAAI,CAAC,IAAI,IAAI,WAAW,OAAO,UAAU,GACvC,OAAO,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;CAG/B,MAAM,mBAAmB,UACvB,KACE,IAAI,MAAM;EACR,YAAY;GACV,GAAI,SAAS,CAAC,IAAI,QAAQ,IAAI,eAAe,IACzC,EAAE,eAAe,UAAU,QAAO,IAClC,CAAA;GAGJ,GAAI,IAAI,QAAQ,IAAI,mBAAmB,IAAI,CAAA,IAAK,EAAE,qBAAqB,OAAM;EAC9E;EAGD,iBAAiB;CAClB,CAAA,CAAC,CACH,CAAC,KAAK,OAAO;CAEhB,MAAM,QAAQ,UAAU,MAAM;CAC9B,OAAO,UAAU,KAAK,IACjB,KAAK,KAAK,CAAC,CAAC,KAAK,UAAU,eAAe,CAAC,IAC5C,gBAAgB,KAAK;AAC3B;AC5EA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC;AAE1D,SAAS,cAAc,QAA+B;CACpD,IAAI,UAAU,IAAI,YAAW;CAC7B,IAAI,QAAQ,MAAM,CAAC,CAAC,SAAS,OAAO,SAAQ;EAC1C,UAAU,QAAQ,IAAI,MAAM,KAAK;CACnC,CAAC;CACD,OAAO;AACT;AAEA,SAAS,UAAU,QAAmB;CACpC,MAAM,UAAU,IAAI,QAAO;CAC3B,KAAK,MAAM,QAAQ,OAAO,KAAI,GAC5B,KAAK,MAAM,SAAS,OAAO,OAAO,IAAI,KAAK,CAAA,GACzC,QAAQ,OAAO,MAAM,KAAK;CAG9B,OAAO;AACT;AAEA,SAAS,WAAW,MAAqB,QAAgB,YAAoB,SAAoB;CAC/F,OAAO,IAAI,SAAS,iBAAiB,IAAI,MAAM,IAAI,OAAO,MAAM;EAC9D;EACA;EACA,SAAS,UAAU,OAAO;CAC3B,CAAA;AACH;AAyBA,SAAgB,oBAAoB,MAAgB;CAClD,QAAQ,KAAa,SAAyC;EAe5D,OAdgB,eACd,KAAK,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvC,MAAM,MAAM,QAAQ;GACpB,SAAS,cAAc,MAAM,OAAkC;GAC/D,SAAS;GACT,cAAc;GAEd,SAAS,IAAI,YAAW,CAAE,CAAC,IAAI,gBAAgB,IAAI;GAGnD,iBAAiB;EAClB,CAAA,CAGI,CAAA,CAAQ,MACZ,QAA8B,WAAW,IAAI,MAAM,IAAI,QAAQ,IAAI,YAAY,IAAI,OAAO,IAC1F,QAAgB;GACf,IAAI,eAAe,qBAAqB,IAAI,WAAW,GAErD,OAAO,WADM,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,KAAK,UAAU,IAAI,SAAS,IAAI,GACjE,IAAI,QAAQ,IAAI,YAAY,IAAI,OAAO;GAEjE,MAAM;EACR,CAAC;CAEL;AACF;ACnFA,SAAgB,cAAc,QAAkB;CAC9C,OAAO,yBAAyB,CAC9B,kBAAkB,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,GACvD;EACE,SAAS;EAKT,mBAA+B;GAC7B,GAAG;GACH,WAAW,OAAO,aAAa,oBAAoB,OAAO,UAAU,CAAC;EACtE;CACF,CACF,CAAA;AACH"}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@ulabase/kit-ng",
+  "version": "0.12.0",
+  "description": "Angular services, route guards, and HTTP interceptor for Ulabase authentication and payments — wraps @ulabase/kit.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ulabase/kit.git",
+    "directory": "packages/kit-ng"
+  },
+  "license": "MIT",
+  "peerDependencies": {
+    "@angular/common": ">=21",
+    "@angular/core": ">=21",
+    "@angular/router": ">=21",
+    "rxjs": ">=7"
+  },
+  "dependencies": {
+    "@ulabase/kit": "0.12.0",
+    "tslib": "^2.3.0"
+  },
+  "module": "fesm2022/ulabase-kit-ng.mjs",
+  "typings": "types/ulabase-kit-ng.d.ts",
+  "exports": {
+    "./package.json": {
+      "default": "./package.json"
+    },
+    ".": {
+      "types": "./types/ulabase-kit-ng.d.ts",
+      "default": "./fesm2022/ulabase-kit-ng.mjs"
+    }
+  },
+  "sideEffects": false,
+  "type": "module"
+}

package/types/ulabase-kit-ng.d.ts

@@ -0,0 +1,326 @@
+import { Observable } from "rxjs";
+import * as kit from "@ulabase/kit";
+import { AuthConfig, CartItem, CartLine, CatalogItem, CatalogQuery, GrantLicenseResult, Licenses, LoginMode, Order, PendingInvitation, Plan, Subscription, TeamMember, TeamMembership, UserInfo, WaitOptions } from "@ulabase/kit";
+import * as i0 from "@angular/core";
+import { EnvironmentProviders, InjectionToken } from "@angular/core";
+import { CanActivateFn } from "@angular/router";
+import { HttpClient, HttpContextToken, HttpInterceptorFn } from "@angular/common/http";
+export * from "@ulabase/kit";
+export declare class RhAuthService {
+  private readonly config;
+  private readonly _user;
+  private readonly _teams;
+  readonly user: import("@angular/core").Signal<UserInfo | null>;
+  readonly teams: import("@angular/core").Signal<TeamMembership[]>;
+  readonly isAuthenticated: import("@angular/core").Signal<boolean>;
+  readonly hasMultipleTeams: import("@angular/core").Signal<boolean>;
+  /**
+   * Check the current session state.
+   *
+   * Reads the token from localStorage — if present and not expired,
+   * returns user info from the server. Otherwise returns null.
+   */
+  checkSession(): Observable<UserInfo | null>;
+  register(payload: {
+    email: string;
+    password: string;
+    teamName: string;
+    firstName: string;
+    lastName: string;
+    [key: string]: unknown;
+  }): Observable<void>;
+  verify(email: string, token: string, delivery?: 'cookie' | 'fragment'): Observable<string>;
+  login(email: string, password: string, mode?: LoginMode): Observable<UserInfo>;
+  logout(): Observable<void>;
+  invite(email: string, role: 'owner' | 'member'): Observable<void>;
+  getInvitation(email: string, token: string): Observable<kit.Invitation>;
+  activate(payload: {
+    email: string;
+    token: string;
+    password: string;
+  }, mode?: LoginMode): Observable<void>;
+  acceptInvite(token: string): Observable<void>;
+  resendInvite(email: string): Observable<void>;
+  listInvitations(): Observable<PendingInvitation[]>;
+  loadTeams(): Observable<TeamMembership[]>;
+  switchTeam(teamId: {
+    $oid: string;
+  }, mode?: LoginMode): Observable<void>;
+  clearSession(): void;
+  forgotPassword(email: string): Observable<void>;
+  resetPassword(payload: {
+    email: string;
+    token: string;
+    password: string;
+  }, mode?: LoginMode): Observable<void>;
+  listTeamMembers(): Observable<TeamMember[]>;
+  removeMember(email: string): Observable<void>;
+  updateMemberRole(email: string, role: 'owner' | 'member'): Observable<void>;
+  createTeam(teamName: string): Observable<TeamMembership>;
+  updateTeam(updates: {
+    name?: string;
+    description?: string;
+  }): Observable<void>;
+  deleteTeam(): Observable<void>;
+  updateProfile(updates: {
+    firstName?: string;
+    lastName?: string;
+  }): Observable<void>;
+  changePassword(currentPassword: string, newPassword: string): Observable<void>;
+  updateUser(email: string, updates: Record<string, unknown>): Observable<void>;
+  /**
+   * Record the signed-in user's acceptance of the application's consents,
+   * renew the token so the guard sees it, and update the `user` signal.
+   */
+  acceptConsents(body?: Record<string, unknown>, mode?: LoginMode): Observable<UserInfo>;
+  /** Force a new token, carrying the user document as it is now. */
+  renewToken(mode?: LoginMode): Observable<string | null>;
+  /**
+   * An authenticated `fetch` against the service, returned as an Observable.
+   *
+   * The Angular counterpart of React's `auth.api()` — the bearer token is
+   * attached automatically, and the request goes through the Angular
+   * interceptor chain (when `httpClientTransport` is configured).
+   *
+   * ```ts
+   * this.auth.api('/demo').pipe(
+   *   switchMap(res => res.json()),
+   * ).subscribe(data => console.log(data));
+   * ```
+   *
+   * For a POST:
+   * ```ts
+   * this.auth.api('/demo', {
+   *   method: 'POST',
+   *   body: JSON.stringify({ name: 'hello' }),
+   * }).pipe(switchMap(res => res.json()));
+   * ```
+   *
+   * Rejects with an `ApiError` (`{ status, message }`) on any non-2xx response.
+   */
+  api(path: string, init?: RequestInit): Observable<Response>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<RhAuthService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/**
+ * Subscription, billing and order management.
+ *
+ * Separated from {@link RhAuthService} because payments are not authentication.
+ * Reads the current user from {@link RhAuthService} to derive
+ * `canManageBilling`, but owns its own subscription state.
+ *
+ * Subscription is loaded automatically when the user signs in and reloaded
+ * when they switch team (via an `effect` watching {@link teamKey}). No manual
+ * wiring needed.
+ *
+ * Only active when `config.payments` is `true` — otherwise every method
+ * is a no-op and no `/stripe/*` call is ever made.
+ */
+export declare class RhPaymentsService {
+  private readonly config;
+  private readonly auth;
+  private readonly _subscription;
+  readonly subscription: import("@angular/core").Signal<Subscription | null>;
+  readonly plan: import("@angular/core").Signal<string | null>;
+  readonly isSubscribed: import("@angular/core").Signal<boolean>;
+  readonly canManageBilling: import("@angular/core").Signal<boolean>;
+  readonly seatsAvailable: import("@angular/core").Signal<number | null>;
+  /**
+   * The team the subscription belongs to: `null` when signed out, `''` for a
+   * signed-in user with no team.
+   *
+   * The effect below tracks this rather than `auth.user()` itself. Both
+   * `updateProfile` and `acceptConsents` re-run `checkSession`, which replaces
+   * the user with a freshly parsed document — tracking that object's identity
+   * would reload the subscription on every profile edit and consent
+   * acceptance, which the adapter contract rules out. A subscription changes
+   * with the team, not with the profile.
+   */
+  private readonly teamKey;
+  private get paymentsEnabled();
+  constructor();
+  /** Reload the team's subscription. No-op when `config.payments` is not `true`. */
+  loadSubscription(): Observable<Subscription | null>;
+  /** The service's subscription plan catalog. No session required. */
+  getPlans(): Observable<{
+    default_plan: string;
+    plans: Plan[];
+  }>;
+  /**
+   * Start a Stripe Checkout session.
+   *
+   * **Rejects with `status: 409`** when the team already has an active
+   * subscription — send them to {@link openBillingPortal} instead.
+   */
+  createCheckoutSession(plan: string, interval: 'month' | 'year'): Observable<{
+    url: string;
+  }>;
+  /** Open the Stripe Customer Portal for self-service plan changes. */
+  openBillingPortal(): Observable<{
+    url: string;
+  }>;
+  /** The team's seat licences. Requires `canManageBilling`. */
+  getLicenses(): Observable<Licenses>;
+  /**
+   * Grant a seat licence. Returns `'granted'` or `'already-licensed'`.
+   * Rejects with `status: 409` when no seat is available.
+   */
+  grantLicense(userId: string): Observable<GrantLicenseResult>;
+  /** Revoke a seat licence. */
+  revokeLicense(userId: string): Observable<void>;
+  /** Read the product catalog. */
+  getCatalog(opts?: CatalogQuery): Observable<CatalogItem[]>;
+  /**
+   * Create an order and start Checkout.
+   *
+   * @param email Required for guest checkout.
+   */
+  createOrder(items: {
+    productId: string;
+    quantity: number;
+  }[], email?: string, collection?: string): Observable<{
+    _id: {
+      $oid: string;
+    };
+    checkout_url: string;
+    secret: string;
+  }>;
+  /** Read an order back. */
+  getOrder(id: string, secret?: string, collection?: string): Observable<Order>;
+  /**
+   * Poll until the subscription satisfies `predicate`.
+   *
+   * Use on the Checkout success page — the redirect back from Stripe races
+   * the webhook, so a bare `getSubscription` can still show the old plan.
+   *
+   * **Timing out is not a payment failure.** Rejects with
+   * `WaitTimeoutError` when the webhook hasn't arrived yet.
+   */
+  waitForSubscription(predicate: (subscription: Subscription) => boolean, opts?: WaitOptions): Observable<Subscription>;
+  /**
+   * Poll until the order leaves `'pending_payment'`.
+   *
+   * Same race as {@link waitForSubscription} — use on the order success page.
+   *
+   * **Timing out is not a payment failure.** Rejects with
+   * `WaitTimeoutError` when the webhook hasn't arrived yet.
+   */
+  waitForOrder(id: string, secret?: string, opts?: WaitOptions & {
+    collection?: string;
+  }): Observable<Order>;
+  static ɵfac: i0.ɵɵFactoryDeclaration<RhPaymentsService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+/**
+ * Where {@link RhCartService} keeps the cart in `localStorage`. Defaults to `'rh-cart'`.
+ *
+ * Worth providing when two of your apps share an origin, which is one deployment decision away
+ * from happening by accident.
+ *
+ * Declared here rather than in `tokens.ts`: that file is the authentication surface, and a cart
+ * needs no session. Importing the kit into it to reach one constant also dragged the kit's module
+ * into every spec that touches `RH_AUTH_CONFIG`, where it is auto-mocked — which shifted module
+ * initialisation enough to make two unrelated guard tests fail, in CI only.
+ */
+export declare const RH_CART_STORAGE_KEY: InjectionToken<string>;
+/**
+ * The shopping cart.
+ *
+ * Independent of {@link import('./auth.service.js').RhAuthService | RhAuthService}
+ * and of `RH_AUTH_CONFIG`: a cart belongs to the browser, not to a session, and
+ * a shop that makes people sign in before they can put something in a basket
+ * loses most of them there. It becomes an order — which does need a config —
+ * when {@link RhCartService.orderItems} is handed to `createOrder`.
+ *
+ * On the server, `localStorage` does not exist and the cart reads as empty.
+ * That is correct for a rendered page — a request carries no basket — but it
+ * does mean a server-rendered cart count starts at zero and fills in once the
+ * browser takes over.
+ */
+export declare class RhCartService {
+  private readonly storageKey;
+  private readonly _lines;
+  /** The lines, in the order they were added. */
+  readonly lines: import("@angular/core").Signal<CartLine[]>;
+  private readonly totals;
+  /** Units, not lines: two of one thing counts two. */
+  readonly totalItems: import("@angular/core").Signal<number>;
+  /** Display only. Minor units, meaningful when every line shares a currency. */
+  readonly subtotal: import("@angular/core").Signal<number>;
+  /** The first line's currency, or `'eur'` when empty. */
+  readonly currency: import("@angular/core").Signal<string>;
+  /** The cart as `createOrder` wants it. */
+  readonly orderItems: import("@angular/core").Signal<import("@ulabase/kit").OrderItem[]>;
+  /** Adds an item, or increases the line already holding it. */
+  add(item: CartItem, quantity?: number): void;
+  /** Sets a line's quantity. Zero removes it. */
+  setQuantity(productId: string, quantity: number): void;
+  remove(productId: string): void;
+  clear(): void;
+  /**
+   * State and storage move together, in the operation that changed them.
+   *
+   * Deliberately not an `effect` reacting to the signal: an effect runs after
+   * the fact and can be skipped or reordered, and the failure that produces is
+   * a line coming back from storage after somebody removed it.
+   */
+  private apply;
+  static ɵfac: i0.ɵɵFactoryDeclaration<RhCartService, never>;
+  static ɵprov: i0.ɵɵInjectableDeclaration<any>;
+}
+export declare const authGuard: CanActivateFn;
+export declare const publicGuard: CanActivateFn;
+/**
+ * Authenticates the application's own `HttpClient` requests, and clears the
+ * session when the service rejects one with a 401.
+ *
+ * The kit's own calls go out through `fetch` and never reach an Angular
+ * interceptor, so without this an app querying its own collections had to
+ * attach the bearer token by hand at every call site.
+ *
+ * **Only requests to `apiBaseUrl` are touched.** The token is a credential:
+ * attaching it to every outgoing request would hand it to any third-party host
+ * the app happens to call. Requests elsewhere pass through untouched — they
+ * still get the 401 handling, which is about the session and not the target.
+ *
+ * An `Authorization` header already on the request is left alone, so a call
+ * that needs different credentials can say so.
+ */
+export declare const rhAuthInterceptor: HttpInterceptorFn;
+/**
+ * A {@link AuthConfig.transport} backed by Angular's `HttpClient`, so the kit's
+ * own calls go through the interceptor chain like everything else the
+ * application sends.
+ *
+ * Without it the kit speaks `fetch` directly and an interceptor never sees a
+ * login, a session check or a token renewal — which makes any cross-cutting
+ * concern written as an interceptor quietly partial.
+ *
+ * Two mismatches with `fetch` are reconciled here:
+ *
+ * - **`HttpClient` throws on a non-2xx response.** `fetch` resolves and lets
+ *   the caller read the status, which is what the core does to build its
+ *   `ApiError`. So an `HttpErrorResponse` carrying a real response is turned
+ *   back into a resolved `Response`.
+ * - **`status === 0` is not a response**, it is a network or CORS failure with
+ *   nothing behind it. `new Response` would reject the status anyway, so the
+ *   original error is rethrown and surfaces as a rejected promise, exactly as
+ *   a failed `fetch` would.
+ *
+ * The body is read as text and left unparsed: the core calls `.json()` itself,
+ * and on an error response it needs the raw body to pull out the message.
+ */
+export declare function httpClientTransport(http: HttpClient): (url: string, init?: RequestInit) => Promise<Response>;
+export declare function provideRhAuth(config: AuthConfig): EnvironmentProviders;
+export declare const RH_AUTH_CONFIG: InjectionToken<AuthConfig>;
+/**
+ * Marks a request as originating from the kit rather than from application
+ * code. Set by `httpClientTransport`, read by `rhAuthInterceptor`.
+ *
+ * The kit owns the meaning of a 401 on its own endpoints, and that meaning is
+ * not always "the session is dead": `PATCH /auth/change-password` answers 401
+ * when the *current password* is wrong, and `GET /token` when the credentials
+ * are. Letting the interceptor clear the session on those would sign a user
+ * out for mistyping their old password.
+ */
+declare const RH_KIT_REQUEST: HttpContextToken<boolean>;