@zeitvu97/cms-sdk 0.1.0

package/dist/server/auth/idp-unlink.delete.js

@@ -0,0 +1,38 @@
+import { defineEventHandler, createError, getQuery, parseCookies } from 'h3';
+import { $fetch } from 'ofetch';
+import { c as AUTH_ENDPOINT, b as HTTP_HEADER } from '../../chunks/auth.constant-DO7ZmsKg.js';
+import { r as readSdkConfig } from '../../chunks/_shared-48T7q0V3.js';
+import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant--64BDSPW.js';
+
+const idpUnlink_delete = defineEventHandler(async (event) => {
+  const { cmsUrl, clientId } = readSdkConfig(event);
+  if (!cmsUrl) throw createError({ statusCode: 500, message: "CMS URL not configured" });
+  const query = getQuery(event);
+  const provider = (query.provider ?? "").trim();
+  if (!provider) throw createError({ statusCode: 400, message: "provider is required" });
+  const cookies = parseCookies(event);
+  const token = cookies[TOKEN_STORAGE_KEY] || "";
+  if (!token) throw createError({ statusCode: 401, message: "Not authenticated" });
+  try {
+    return await $fetch(AUTH_ENDPOINT.idpUnlink(provider), {
+      baseURL: cmsUrl,
+      method: "DELETE",
+      headers: {
+        [HTTP_HEADER.CLIENT_ID]: clientId || "",
+        [HTTP_HEADER.AUTHORIZATION]: `Bearer ${token}`
+      }
+    });
+  } catch (err) {
+    const beData = err?.data ?? {};
+    const detail = beData.detail ?? {};
+    const message = detail.errorDescription ?? detail.error ?? beData.error ?? err?.message;
+    throw createError({
+      statusCode: err?.response?.status || err?.statusCode || 500,
+      message: message || "IdP unlink failed",
+      data: beData
+    });
+  }
+});
+
+export { idpUnlink_delete as default };
+//# sourceMappingURL=idp-unlink.delete.js.map

package/dist/server/auth/idp-unlink.delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-unlink.delete.js","sources":["../../../src/server/auth/idp-unlink.delete.ts"],"sourcesContent":["import { defineEventHandler, parseCookies, getQuery, createError } from 'h3';\nimport { $fetch } from 'ofetch';\nimport { AUTH_ENDPOINT } from '../../common/constants/auth.constant';\nimport { HTTP_HEADER } from '../../common/constants/http.constant';\nimport { readSdkConfig, TOKEN_STORAGE_KEY } from './_shared';\n\n/**\n * Thin auth proxy: DELETE /api/cms/idp-unlink → backend DELETE /api/auth/{provider}/unlink.\n *\n * Unlinks the IdP provider from the CURRENTLY signed-in CMS user. The backend\n * requires an authenticated caller, so the httpOnly access-token cookie is\n * forwarded as `Authorization: Bearer <token>`.\n */\nexport default defineEventHandler(async (event) => {\n  const { cmsUrl, clientId } = readSdkConfig(event);\n  if (!cmsUrl) throw createError({ statusCode: 500, message: 'CMS URL not configured' });\n\n  const query = getQuery(event) as { provider?: string };\n  const provider = (query.provider ?? '').trim();\n  if (!provider) throw createError({ statusCode: 400, message: 'provider is required' });\n\n  const cookies = parseCookies(event);\n  const token = cookies[TOKEN_STORAGE_KEY] || '';\n  if (!token) throw createError({ statusCode: 401, message: 'Not authenticated' });\n\n  try {\n    return await $fetch(AUTH_ENDPOINT.idpUnlink(provider), {\n      baseURL: cmsUrl,\n      method: 'DELETE',\n      headers: {\n        [HTTP_HEADER.CLIENT_ID]: clientId || '',\n        [HTTP_HEADER.AUTHORIZATION]: `Bearer ${token}`,\n      },\n    });\n  } catch (err: any) {\n    // The CMS nests the real error one level down:\n    // `{ error: \"HTTPException\", detail: { error, errorDescription } }`.\n    const beData = (err?.data ?? {}) as Record<string, any>;\n    const detail = (beData.detail ?? {}) as Record<string, any>;\n    const message = detail.errorDescription ?? detail.error ?? beData.error ?? err?.message;\n    throw createError({\n      statusCode: err?.response?.status || err?.statusCode || 500,\n      message: message || 'IdP unlink failed',\n      data: beData,\n    });\n  }\n});\n"],"names":[],"mappings":";;;;;;AAaA,yBAAe,kBAAA,CAAmB,OAAO,KAAA,KAAU;AACjD,EAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAS,GAAI,cAAc,KAAK,CAAA;AAChD,EAAA,IAAI,CAAC,QAAQ,MAAM,WAAA,CAAY,EAAE,UAAA,EAAY,GAAA,EAAK,OAAA,EAAS,wBAAA,EAA0B,CAAA;AAErF,EAAA,MAAM,KAAA,GAAQ,SAAS,KAAK,CAAA;AAC5B,EAAA,MAAM,QAAA,GAAA,CAAY,KAAA,CAAM,QAAA,IAAY,EAAA,EAAI,IAAA,EAAK;AAC7C,EAAA,IAAI,CAAC,UAAU,MAAM,WAAA,CAAY,EAAE,UAAA,EAAY,GAAA,EAAK,OAAA,EAAS,sBAAA,EAAwB,CAAA;AAErF,EAAA,MAAM,OAAA,GAAU,aAAa,KAAK,CAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,iBAAiB,CAAA,IAAK,EAAA;AAC5C,EAAA,IAAI,CAAC,OAAO,MAAM,WAAA,CAAY,EAAE,UAAA,EAAY,GAAA,EAAK,OAAA,EAAS,mBAAA,EAAqB,CAAA;AAE/E,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,MAAA,CAAO,aAAA,CAAc,SAAA,CAAU,QAAQ,CAAA,EAAG;AAAA,MACrD,OAAA,EAAS,MAAA;AAAA,MACT,MAAA,EAAQ,QAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,CAAC,WAAA,CAAY,SAAS,GAAG,QAAA,IAAY,EAAA;AAAA,QACrC,CAAC,WAAA,CAAY,aAAa,GAAG,UAAU,KAAK,CAAA;AAAA;AAC9C,KACD,CAAA;AAAA,EACH,SAAS,GAAA,EAAU;AAGjB,IAAA,MAAM,MAAA,GAAU,GAAA,EAAK,IAAA,IAAQ,EAAC;AAC9B,IAAA,MAAM,MAAA,GAAU,MAAA,CAAO,MAAA,IAAU,EAAC;AAClC,IAAA,MAAM,UAAU,MAAA,CAAO,gBAAA,IAAoB,OAAO,KAAA,IAAS,MAAA,CAAO,SAAS,GAAA,EAAK,OAAA;AAChF,IAAA,MAAM,WAAA,CAAY;AAAA,MAChB,UAAA,EAAY,GAAA,EAAK,QAAA,EAAU,MAAA,IAAU,KAAK,UAAA,IAAc,GAAA;AAAA,MACxD,SAAS,OAAA,IAAW,mBAAA;AAAA,MACpB,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF,CAAC,CAAA;;;;"}

package/dist/server/auth/login.post.js

@@ -0,0 +1,42 @@
+import { defineEventHandler, createError, readBody, parseCookies, getRequestHeader, setCookie } from 'h3';
+import { $fetch } from 'ofetch';
+import { b as HTTP_HEADER, c as AUTH_ENDPOINT } from '../../chunks/auth.constant-DO7ZmsKg.js';
+import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-48T7q0V3.js';
+import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant--64BDSPW.js';
+
+const login_post = defineEventHandler(async (event) => {
+  const { cmsUrl, clientId } = readSdkConfig(event);
+  if (!cmsUrl) throw createError({ statusCode: 500, message: "CMS URL not configured" });
+  const body = await readBody(event);
+  const cookies = parseCookies(event);
+  const userAgent = getRequestHeader(event, HTTP_HEADER.USER_AGENT) || "";
+  try {
+    const response = await $fetch.raw(AUTH_ENDPOINT.LOGIN, {
+      baseURL: cmsUrl,
+      method: "POST",
+      body,
+      headers: {
+        [HTTP_HEADER.CLIENT_ID]: clientId || "",
+        [HTTP_HEADER.DEVICE_ID]: cookies.device_id || "",
+        [HTTP_HEADER.DEVICE_IP]: cookies.device_ip || "",
+        [HTTP_HEADER.USER_AGENT]: userAgent
+      }
+    });
+    const data = response._data ?? {};
+    const token = data.accessToken ?? data.access_token ?? "";
+    const refreshToken = data.refreshToken ?? data.refresh_token ?? "";
+    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, TOKEN_COOKIE_OPTIONS);
+    if (refreshToken)
+      setCookie(event, REFRESH_TOKEN_STORAGE_KEY, refreshToken, TOKEN_COOKIE_OPTIONS);
+    return { ...data, token };
+  } catch (err) {
+    throw createError({
+      statusCode: err?.response?.status || err?.statusCode || 500,
+      message: err?.data?.error || err?.data?.message || err?.message || "Login failed",
+      data: err?.data
+    });
+  }
+});
+
+export { login_post as default };
+//# sourceMappingURL=login.post.js.map

package/dist/server/auth/login.post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.post.js","sources":["../../../src/server/auth/login.post.ts"],"sourcesContent":["import {\n  defineEventHandler,\n  readBody,\n  parseCookies,\n  getRequestHeader,\n  setCookie,\n  createError,\n} from 'h3';\nimport { $fetch } from 'ofetch';\nimport { AUTH_ENDPOINT } from '../../common/constants/auth.constant';\nimport { HTTP_HEADER } from '../../common/constants/http.constant';\nimport {\n  readSdkConfig,\n  REFRESH_TOKEN_STORAGE_KEY,\n  TOKEN_COOKIE_OPTIONS,\n  TOKEN_STORAGE_KEY,\n} from './_shared';\n\n/**\n * Thin auth proxy: POST /api/cms/login → backend POST /api/auth/login.\n *\n * The real backend returns the access token in the response BODY as\n * `accessToken` (camelCase). This route reads it from the body, stores it as an\n * httpOnly cookie, and returns the body augmented with a `token` field so the\n * client can mirror the token in memory (the httpOnly cookie is the durable\n * copy used for SSR).\n *\n * Device id/ip and user-agent are forwarded from the incoming request.\n */\nexport default defineEventHandler(async (event) => {\n  const { cmsUrl, clientId } = readSdkConfig(event);\n  if (!cmsUrl) throw createError({ statusCode: 500, message: 'CMS URL not configured' });\n\n  const body = await readBody(event);\n  const cookies = parseCookies(event);\n  const userAgent = getRequestHeader(event, HTTP_HEADER.USER_AGENT) || '';\n\n  try {\n    const response = await $fetch.raw(AUTH_ENDPOINT.LOGIN, {\n      baseURL: cmsUrl,\n      method: 'POST',\n      body,\n      headers: {\n        [HTTP_HEADER.CLIENT_ID]: clientId || '',\n        [HTTP_HEADER.DEVICE_ID]: cookies.device_id || '',\n        [HTTP_HEADER.DEVICE_IP]: cookies.device_ip || '',\n        [HTTP_HEADER.USER_AGENT]: userAgent,\n      },\n    });\n    const data = (response._data ?? {}) as Record<string, unknown>;\n    // camelCase is the backend default; fall back to snake_case just in case.\n    const token =\n      (data.accessToken as string | undefined) ?? (data.access_token as string | undefined) ?? '';\n    const refreshToken =\n      (data.refreshToken as string | undefined) ?? (data.refresh_token as string | undefined) ?? '';\n    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, TOKEN_COOKIE_OPTIONS);\n    // Persist the refresh token as an httpOnly cookie so the SDK can rotate the\n    // access token silently when it expires.\n    if (refreshToken)\n      setCookie(event, REFRESH_TOKEN_STORAGE_KEY, refreshToken, TOKEN_COOKIE_OPTIONS);\n    return { ...data, token };\n  } catch (err: any) {\n    throw createError({\n      statusCode: err?.response?.status || err?.statusCode || 500,\n      message: err?.data?.error || err?.data?.message || err?.message || 'Login failed',\n      data: err?.data,\n    });\n  }\n});\n"],"names":[],"mappings":";;;;;;AA6BA,mBAAe,kBAAA,CAAmB,OAAO,KAAA,KAAU;AACjD,EAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAS,GAAI,cAAc,KAAK,CAAA;AAChD,EAAA,IAAI,CAAC,QAAQ,MAAM,WAAA,CAAY,EAAE,UAAA,EAAY,GAAA,EAAK,OAAA,EAAS,wBAAA,EAA0B,CAAA;AAErF,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,KAAK,CAAA;AACjC,EAAA,MAAM,OAAA,GAAU,aAAa,KAAK,CAAA;AAClC,EAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,KAAA,EAAO,WAAA,CAAY,UAAU,CAAA,IAAK,EAAA;AAErE,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,GAAA,CAAI,cAAc,KAAA,EAAO;AAAA,MACrD,OAAA,EAAS,MAAA;AAAA,MACT,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA,OAAA,EAAS;AAAA,QACP,CAAC,WAAA,CAAY,SAAS,GAAG,QAAA,IAAY,EAAA;AAAA,QACrC,CAAC,WAAA,CAAY,SAAS,GAAG,QAAQ,SAAA,IAAa,EAAA;AAAA,QAC9C,CAAC,WAAA,CAAY,SAAS,GAAG,QAAQ,SAAA,IAAa,EAAA;AAAA,QAC9C,CAAC,WAAA,CAAY,UAAU,GAAG;AAAA;AAC5B,KACD,CAAA;AACD,IAAA,MAAM,IAAA,GAAQ,QAAA,CAAS,KAAA,IAAS,EAAC;AAEjC,IAAA,MAAM,KAAA,GACH,IAAA,CAAK,WAAA,IAAuC,IAAA,CAAK,YAAA,IAAuC,EAAA;AAC3F,IAAA,MAAM,YAAA,GACH,IAAA,CAAK,YAAA,IAAwC,IAAA,CAAK,aAAA,IAAwC,EAAA;AAC7F,IAAA,IAAI,KAAA,EAAO,SAAA,CAAU,KAAA,EAAO,iBAAA,EAAmB,OAAO,oBAAoB,CAAA;AAG1E,IAAA,IAAI,YAAA;AACF,MAAA,SAAA,CAAU,KAAA,EAAO,yBAAA,EAA2B,YAAA,EAAc,oBAAoB,CAAA;AAChF,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,KAAA,EAAM;AAAA,EAC1B,SAAS,GAAA,EAAU;AACjB,IAAA,MAAM,WAAA,CAAY;AAAA,MAChB,UAAA,EAAY,GAAA,EAAK,QAAA,EAAU,MAAA,IAAU,KAAK,UAAA,IAAc,GAAA;AAAA,MACxD,OAAA,EAAS,KAAK,IAAA,EAAM,KAAA,IAAS,KAAK,IAAA,EAAM,OAAA,IAAW,KAAK,OAAA,IAAW,cAAA;AAAA,MACnE,MAAM,GAAA,EAAK;AAAA,KACZ,CAAA;AAAA,EACH;AACF,CAAC,CAAA;;;;"}

package/dist/server/auth/logout.post.js

@@ -0,0 +1,31 @@
+import { defineEventHandler, parseCookies, deleteCookie } from 'h3';
+import { $fetch } from 'ofetch';
+import { c as AUTH_ENDPOINT, b as HTTP_HEADER } from '../../chunks/auth.constant-DO7ZmsKg.js';
+import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-48T7q0V3.js';
+import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant--64BDSPW.js';
+
+const logout_post = defineEventHandler(async (event) => {
+  const { cmsUrl, clientId } = readSdkConfig(event);
+  const cookies = parseCookies(event);
+  const token = cookies[TOKEN_STORAGE_KEY] || "";
+  try {
+    if (cmsUrl && token) {
+      await $fetch.raw(AUTH_ENDPOINT.LOGOUT, {
+        baseURL: cmsUrl,
+        method: "POST",
+        headers: {
+          // The cookie stores the raw JWT; the backend expects a bearer header.
+          [HTTP_HEADER.AUTHORIZATION]: `Bearer ${token}`,
+          [HTTP_HEADER.CLIENT_ID]: clientId || ""
+        }
+      });
+    }
+  } catch {
+  }
+  deleteCookie(event, TOKEN_STORAGE_KEY, { path: TOKEN_COOKIE_OPTIONS.path });
+  deleteCookie(event, REFRESH_TOKEN_STORAGE_KEY, { path: TOKEN_COOKIE_OPTIONS.path });
+  return { success: true };
+});
+
+export { logout_post as default };
+//# sourceMappingURL=logout.post.js.map

package/dist/server/auth/logout.post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.post.js","sources":["../../../src/server/auth/logout.post.ts"],"sourcesContent":["import { defineEventHandler, parseCookies, deleteCookie } from 'h3';\nimport { $fetch } from 'ofetch';\nimport { AUTH_ENDPOINT } from '../../common/constants/auth.constant';\nimport { HTTP_HEADER } from '../../common/constants/http.constant';\nimport {\n  readSdkConfig,\n  REFRESH_TOKEN_STORAGE_KEY,\n  TOKEN_COOKIE_OPTIONS,\n  TOKEN_STORAGE_KEY,\n} from './_shared';\n\n/**\n * Thin auth proxy: POST /api/cms/logout → backend POST /api/auth/logout.\n *\n * Best-effort backend logout using the token from the httpOnly cookie (the real\n * backend expects `Authorization: Bearer <jwt>`), then clears the cookie\n * regardless of backend outcome.\n */\nexport default defineEventHandler(async (event) => {\n  const { cmsUrl, clientId } = readSdkConfig(event);\n  const cookies = parseCookies(event);\n  const token = cookies[TOKEN_STORAGE_KEY] || '';\n\n  try {\n    if (cmsUrl && token) {\n      await $fetch.raw(AUTH_ENDPOINT.LOGOUT, {\n        baseURL: cmsUrl,\n        method: 'POST',\n        headers: {\n          // The cookie stores the raw JWT; the backend expects a bearer header.\n          [HTTP_HEADER.AUTHORIZATION]: `Bearer ${token}`,\n          [HTTP_HEADER.CLIENT_ID]: clientId || '',\n        },\n      });\n    }\n  } catch {\n    // Backend logout failure should not prevent clearing the local cookie.\n  }\n\n  deleteCookie(event, TOKEN_STORAGE_KEY, { path: TOKEN_COOKIE_OPTIONS.path });\n  deleteCookie(event, REFRESH_TOKEN_STORAGE_KEY, { path: TOKEN_COOKIE_OPTIONS.path });\n  return { success: true };\n});\n"],"names":[],"mappings":";;;;;;AAkBA,oBAAe,kBAAA,CAAmB,OAAO,KAAA,KAAU;AACjD,EAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAS,GAAI,cAAc,KAAK,CAAA;AAChD,EAAA,MAAM,OAAA,GAAU,aAAa,KAAK,CAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,iBAAiB,CAAA,IAAK,EAAA;AAE5C,EAAA,IAAI;AACF,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,MAAM,MAAA,CAAO,GAAA,CAAI,aAAA,CAAc,MAAA,EAAQ;AAAA,QACrC,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA;AAAA,UAEP,CAAC,WAAA,CAAY,aAAa,GAAG,UAAU,KAAK,CAAA,CAAA;AAAA,UAC5C,CAAC,WAAA,CAAY,SAAS,GAAG,QAAA,IAAY;AAAA;AACvC,OACD,CAAA;AAAA,IACH;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,YAAA,CAAa,OAAO,iBAAA,EAAmB,EAAE,IAAA,EAAM,oBAAA,CAAqB,MAAM,CAAA;AAC1E,EAAA,YAAA,CAAa,OAAO,yBAAA,EAA2B,EAAE,IAAA,EAAM,oBAAA,CAAqB,MAAM,CAAA;AAClF,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB,CAAC,CAAA;;;;"}

package/dist/server/auth/refresh.post.js

@@ -0,0 +1,46 @@
+import { defineEventHandler, createError, parseCookies, setCookie } from 'h3';
+import { $fetch } from 'ofetch';
+import { c as AUTH_ENDPOINT, b as HTTP_HEADER, R as RESPONSE_CASING_VALUE } from '../../chunks/auth.constant-DO7ZmsKg.js';
+import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-48T7q0V3.js';
+import { R as REFRESH_TOKEN_STORAGE_KEY, T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant--64BDSPW.js';
+
+const refresh_post = defineEventHandler(async (event) => {
+  const { cmsUrl, clientId, requestCasing, responseCasing } = readSdkConfig(event);
+  if (!cmsUrl) throw createError({ statusCode: 500, message: "CMS URL not configured" });
+  const cookies = parseCookies(event);
+  const refreshToken = cookies[REFRESH_TOKEN_STORAGE_KEY] || "";
+  if (!refreshToken) {
+    throw createError({ statusCode: 401, message: "No refresh token" });
+  }
+  const snake = requestCasing === RESPONSE_CASING_VALUE.SNAKE;
+  const body = snake ? { grant_type: "refresh_token", refresh_token: refreshToken } : { grantType: "refresh_token", refreshToken };
+  const headers = {
+    [HTTP_HEADER.CLIENT_ID]: clientId || ""
+  };
+  if (snake) headers[HTTP_HEADER.REQUEST_CASING] = RESPONSE_CASING_VALUE.SNAKE;
+  if (responseCasing === RESPONSE_CASING_VALUE.SNAKE) {
+    headers[HTTP_HEADER.RESPONSE_CASING] = RESPONSE_CASING_VALUE.SNAKE;
+  }
+  try {
+    const data = await $fetch(AUTH_ENDPOINT.REFRESH, {
+      baseURL: cmsUrl,
+      method: "POST",
+      body,
+      headers
+    });
+    const token = data.accessToken ?? data.access_token ?? "";
+    const newRefresh = data.refreshToken ?? data.refresh_token ?? "";
+    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, TOKEN_COOKIE_OPTIONS);
+    if (newRefresh) setCookie(event, REFRESH_TOKEN_STORAGE_KEY, newRefresh, TOKEN_COOKIE_OPTIONS);
+    return { ...data, token };
+  } catch (err) {
+    throw createError({
+      statusCode: err?.response?.status || err?.statusCode || 401,
+      message: err?.data?.error || err?.data?.message || err?.message || "Token refresh failed",
+      data: err?.data
+    });
+  }
+});
+
+export { refresh_post as default };
+//# sourceMappingURL=refresh.post.js.map

package/dist/server/auth/refresh.post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.post.js","sources":["../../../src/server/auth/refresh.post.ts"],"sourcesContent":["import { defineEventHandler, parseCookies, setCookie, createError } from 'h3';\nimport { $fetch } from 'ofetch';\nimport { AUTH_ENDPOINT } from '../../common/constants/auth.constant';\nimport { HTTP_HEADER, RESPONSE_CASING_VALUE } from '../../common/constants/http.constant';\nimport {\n  readSdkConfig,\n  REFRESH_TOKEN_STORAGE_KEY,\n  TOKEN_COOKIE_OPTIONS,\n  TOKEN_STORAGE_KEY,\n} from './_shared';\n\n/**\n * Thin auth proxy: POST /api/cms/refresh → backend POST /api/oauth/token.\n *\n * Exchanges the httpOnly `cms_refresh_token` cookie for a new access (+ refresh)\n * token via the backend OAuth token endpoint (`grant_type=refresh_token`), then\n * rotates both httpOnly cookies. Returns the new access token in the body\n * (`{ token }`) so the client can mirror it in memory.\n *\n * Request body casing: camelCase by default (`{ grantType, refreshToken }`);\n * when `requestCasing: 'snake'` is configured, sends snake_case keys +\n * `x-request-casing: snake`. Response keys are read with a snake fallback so\n * the proxy is robust to either casing.\n */\nexport default defineEventHandler(async (event) => {\n  const { cmsUrl, clientId, requestCasing, responseCasing } = readSdkConfig(event);\n  if (!cmsUrl) throw createError({ statusCode: 500, message: 'CMS URL not configured' });\n\n  const cookies = parseCookies(event);\n  const refreshToken = cookies[REFRESH_TOKEN_STORAGE_KEY] || '';\n  if (!refreshToken) {\n    throw createError({ statusCode: 401, message: 'No refresh token' });\n  }\n\n  const snake = requestCasing === RESPONSE_CASING_VALUE.SNAKE;\n  const body = snake\n    ? { grant_type: 'refresh_token', refresh_token: refreshToken }\n    : { grantType: 'refresh_token', refreshToken };\n\n  const headers: Record<string, string> = {\n    [HTTP_HEADER.CLIENT_ID]: clientId || '',\n  };\n  if (snake) headers[HTTP_HEADER.REQUEST_CASING] = RESPONSE_CASING_VALUE.SNAKE;\n  if (responseCasing === RESPONSE_CASING_VALUE.SNAKE) {\n    headers[HTTP_HEADER.RESPONSE_CASING] = RESPONSE_CASING_VALUE.SNAKE;\n  }\n\n  try {\n    const data = (await $fetch(AUTH_ENDPOINT.REFRESH, {\n      baseURL: cmsUrl,\n      method: 'POST',\n      body,\n      headers,\n    })) as Record<string, unknown>;\n\n    const token =\n      (data.accessToken as string | undefined) ?? (data.access_token as string | undefined) ?? '';\n    const newRefresh =\n      (data.refreshToken as string | undefined) ?? (data.refresh_token as string | undefined) ?? '';\n\n    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, TOKEN_COOKIE_OPTIONS);\n    if (newRefresh) setCookie(event, REFRESH_TOKEN_STORAGE_KEY, newRefresh, TOKEN_COOKIE_OPTIONS);\n\n    return { ...data, token };\n  } catch (err: any) {\n    throw createError({\n      statusCode: err?.response?.status || err?.statusCode || 401,\n      message: err?.data?.error || err?.data?.message || err?.message || 'Token refresh failed',\n      data: err?.data,\n    });\n  }\n});\n"],"names":[],"mappings":";;;;;;AAwBA,qBAAe,kBAAA,CAAmB,OAAO,KAAA,KAAU;AACjD,EAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,eAAe,cAAA,EAAe,GAAI,cAAc,KAAK,CAAA;AAC/E,EAAA,IAAI,CAAC,QAAQ,MAAM,WAAA,CAAY,EAAE,UAAA,EAAY,GAAA,EAAK,OAAA,EAAS,wBAAA,EAA0B,CAAA;AAErF,EAAA,MAAM,OAAA,GAAU,aAAa,KAAK,CAAA;AAClC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,yBAAyB,CAAA,IAAK,EAAA;AAC3D,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,MAAM,YAAY,EAAE,UAAA,EAAY,GAAA,EAAK,OAAA,EAAS,oBAAoB,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,KAAA,GAAQ,kBAAkB,qBAAA,CAAsB,KAAA;AACtD,EAAA,MAAM,IAAA,GAAO,KAAA,GACT,EAAE,UAAA,EAAY,eAAA,EAAiB,aAAA,EAAe,YAAA,EAAa,GAC3D,EAAE,SAAA,EAAW,eAAA,EAAiB,YAAA,EAAa;AAE/C,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,CAAC,WAAA,CAAY,SAAS,GAAG,QAAA,IAAY;AAAA,GACvC;AACA,EAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,WAAA,CAAY,cAAc,IAAI,qBAAA,CAAsB,KAAA;AACvE,EAAA,IAAI,cAAA,KAAmB,sBAAsB,KAAA,EAAO;AAClD,IAAA,OAAA,CAAQ,WAAA,CAAY,eAAe,CAAA,GAAI,qBAAA,CAAsB,KAAA;AAAA,EAC/D;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAQ,MAAM,MAAA,CAAO,aAAA,CAAc,OAAA,EAAS;AAAA,MAChD,OAAA,EAAS,MAAA;AAAA,MACT,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,MAAM,KAAA,GACH,IAAA,CAAK,WAAA,IAAuC,IAAA,CAAK,YAAA,IAAuC,EAAA;AAC3F,IAAA,MAAM,UAAA,GACH,IAAA,CAAK,YAAA,IAAwC,IAAA,CAAK,aAAA,IAAwC,EAAA;AAE7F,IAAA,IAAI,KAAA,EAAO,SAAA,CAAU,KAAA,EAAO,iBAAA,EAAmB,OAAO,oBAAoB,CAAA;AAC1E,IAAA,IAAI,UAAA,EAAY,SAAA,CAAU,KAAA,EAAO,yBAAA,EAA2B,YAAY,oBAAoB,CAAA;AAE5F,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,KAAA,EAAM;AAAA,EAC1B,SAAS,GAAA,EAAU;AACjB,IAAA,MAAM,WAAA,CAAY;AAAA,MAChB,UAAA,EAAY,GAAA,EAAK,QAAA,EAAU,MAAA,IAAU,KAAK,UAAA,IAAc,GAAA;AAAA,MACxD,OAAA,EAAS,KAAK,IAAA,EAAM,KAAA,IAAS,KAAK,IAAA,EAAM,OAAA,IAAW,KAAK,OAAA,IAAW,sBAAA;AAAA,MACnE,MAAM,GAAA,EAAK;AAAA,KACZ,CAAA;AAAA,EACH;AACF,CAAC,CAAA;;;;"}

package/dist/server/clear-token.delete.js

@@ -0,0 +1,12 @@
+import { defineEventHandler, deleteCookie } from 'h3';
+import { T as TOKEN_STORAGE_KEY, a as COOKIE_DEFAULTS } from '../chunks/storage.constant--64BDSPW.js';
+
+const clearToken_delete = defineEventHandler(async (event) => {
+  deleteCookie(event, TOKEN_STORAGE_KEY, {
+    path: COOKIE_DEFAULTS.PATH
+  });
+  return { success: true };
+});
+
+export { clearToken_delete as default };
+//# sourceMappingURL=clear-token.delete.js.map

package/dist/server/clear-token.delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear-token.delete.js","sources":["../../src/server/clear-token.delete.ts"],"sourcesContent":["import { defineEventHandler, deleteCookie } from 'h3';\nimport { COOKIE_DEFAULTS, TOKEN_STORAGE_KEY } from '../common/constants/storage.constant';\n\nexport default defineEventHandler(async (event) => {\n  deleteCookie(event, TOKEN_STORAGE_KEY, {\n    path: COOKIE_DEFAULTS.PATH,\n  });\n  return { success: true };\n});\n"],"names":[],"mappings":";;;AAGA,0BAAe,kBAAA,CAAmB,OAAO,KAAA,KAAU;AACjD,EAAA,YAAA,CAAa,OAAO,iBAAA,EAAmB;AAAA,IACrC,MAAM,eAAA,CAAgB;AAAA,GACvB,CAAA;AACD,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB,CAAC,CAAA;;;;"}

package/dist/server/persist.post.js

@@ -0,0 +1,31 @@
+import { defineEventHandler, readBody, createError, deleteCookie, setCookie } from 'h3';
+import { b as PERSIST_ALLOWED_KEYS, T as TOKEN_STORAGE_KEY, a as COOKIE_DEFAULTS, c as PERSIST_MAX_BYTES } from '../chunks/storage.constant--64BDSPW.js';
+
+const PERSIST_COOKIE_OPTIONS = {
+  httpOnly: COOKIE_DEFAULTS.HTTP_ONLY,
+  secure: COOKIE_DEFAULTS.SECURE,
+  sameSite: COOKIE_DEFAULTS.SAME_SITE.toLowerCase(),
+  path: COOKIE_DEFAULTS.PATH,
+  maxAge: COOKIE_DEFAULTS.MAX_AGE_SECONDS
+};
+const ALLOWED_KEYS = new Set(PERSIST_ALLOWED_KEYS);
+const persist_post = defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const key = body?.key;
+  const value = body?.value ?? null;
+  if (typeof key !== "string" || !ALLOWED_KEYS.has(key) || key === TOKEN_STORAGE_KEY) {
+    throw createError({ statusCode: 400, message: "Invalid persist key" });
+  }
+  if (value === null) {
+    deleteCookie(event, key, { path: PERSIST_COOKIE_OPTIONS.path });
+    return { ok: true };
+  }
+  if (typeof value !== "string" || value.length >= PERSIST_MAX_BYTES) {
+    throw createError({ statusCode: 400, message: "Invalid or too large persist value" });
+  }
+  setCookie(event, key, value, PERSIST_COOKIE_OPTIONS);
+  return { ok: true };
+});
+
+export { persist_post as default };
+//# sourceMappingURL=persist.post.js.map

package/dist/server/persist.post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist.post.js","sources":["../../src/server/persist.post.ts"],"sourcesContent":["import { defineEventHandler, readBody, setCookie, deleteCookie, createError } from 'h3';\nimport {\n  PERSIST_ALLOWED_KEYS,\n  PERSIST_MAX_BYTES,\n  TOKEN_STORAGE_KEY,\n} from '../common/constants/storage.constant';\nimport { COOKIE_DEFAULTS } from '../common/constants/storage.constant';\n\n/**\n * Common persistence endpoint. The internal Pinia persistence plugin POSTs\n * client-side httpOnly writes here so the server sets the httpOnly cookie (a\n * client cannot set an httpOnly cookie itself).\n *\n * Security guards (mandatory):\n *  - `key` must be in `PERSIST_ALLOWED_KEYS` (and never the token key).\n *  - cookie options are fixed (httpOnly/secure/sameSite/path) — the client\n *    cannot weaken them.\n *  - value size is capped (< PERSIST_MAX_BYTES).\n */\nconst PERSIST_COOKIE_OPTIONS = {\n  httpOnly: COOKIE_DEFAULTS.HTTP_ONLY,\n  secure: COOKIE_DEFAULTS.SECURE,\n  sameSite: COOKIE_DEFAULTS.SAME_SITE.toLowerCase() as 'lax',\n  path: COOKIE_DEFAULTS.PATH,\n  maxAge: COOKIE_DEFAULTS.MAX_AGE_SECONDS,\n};\n\nconst ALLOWED_KEYS = new Set<string>(PERSIST_ALLOWED_KEYS);\n\ninterface IPersistBody {\n  key?: unknown;\n  value?: unknown;\n}\n\nexport default defineEventHandler(async (event) => {\n  const body = await readBody<IPersistBody>(event);\n  const key = body?.key;\n  const value = body?.value ?? null;\n\n  if (typeof key !== 'string' || !ALLOWED_KEYS.has(key) || key === TOKEN_STORAGE_KEY) {\n    throw createError({ statusCode: 400, message: 'Invalid persist key' });\n  }\n\n  if (value === null) {\n    deleteCookie(event, key, { path: PERSIST_COOKIE_OPTIONS.path });\n    return { ok: true };\n  }\n\n  if (typeof value !== 'string' || value.length >= PERSIST_MAX_BYTES) {\n    throw createError({ statusCode: 400, message: 'Invalid or too large persist value' });\n  }\n\n  setCookie(event, key, value, PERSIST_COOKIE_OPTIONS);\n  return { ok: true };\n});\n"],"names":[],"mappings":";;;AAmBA,MAAM,sBAAA,GAAyB;AAAA,EAC7B,UAAU,eAAA,CAAgB,SAAA;AAAA,EAC1B,QAAQ,eAAA,CAAgB,MAAA;AAAA,EACxB,QAAA,EAAU,eAAA,CAAgB,SAAA,CAAU,WAAA,EAAY;AAAA,EAChD,MAAM,eAAA,CAAgB,IAAA;AAAA,EACtB,QAAQ,eAAA,CAAgB;AAC1B,CAAA;AAEA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAY,oBAAoB,CAAA;AAOzD,qBAAe,kBAAA,CAAmB,OAAO,KAAA,KAAU;AACjD,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAuB,KAAK,CAAA;AAC/C,EAAA,MAAM,MAAM,IAAA,EAAM,GAAA;AAClB,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,IAAA;AAE7B,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,CAAC,aAAa,GAAA,CAAI,GAAG,CAAA,IAAK,GAAA,KAAQ,iBAAA,EAAmB;AAClF,IAAA,MAAM,YAAY,EAAE,UAAA,EAAY,GAAA,EAAK,OAAA,EAAS,uBAAuB,CAAA;AAAA,EACvE;AAEA,EAAA,IAAI,UAAU,IAAA,EAAM;AAClB,IAAA,YAAA,CAAa,OAAO,GAAA,EAAK,EAAE,IAAA,EAAM,sBAAA,CAAuB,MAAM,CAAA;AAC9D,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB;AAEA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAU,iBAAA,EAAmB;AAClE,IAAA,MAAM,YAAY,EAAE,UAAA,EAAY,GAAA,EAAK,OAAA,EAAS,sCAAsC,CAAA;AAAA,EACtF;AAEA,EAAA,SAAA,CAAU,KAAA,EAAO,GAAA,EAAK,KAAA,EAAO,sBAAsB,CAAA;AACnD,EAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AACpB,CAAC,CAAA;;;;"}

package/dist/server/set-token.post.js

@@ -0,0 +1,27 @@
+import { defineEventHandler, readBody, setCookie } from 'h3';
+import { T as TOKEN_STORAGE_KEY, a as COOKIE_DEFAULTS } from '../chunks/storage.constant--64BDSPW.js';
+
+const setToken_post = defineEventHandler(async (event) => {
+  try {
+    const body = await readBody(event);
+    const token = body?.token || body?.accessToken || "";
+    if (!token) {
+      event.node.res.statusCode = 400;
+      return { error: "Missing token in request body" };
+    }
+    setCookie(event, TOKEN_STORAGE_KEY, token, {
+      httpOnly: COOKIE_DEFAULTS.HTTP_ONLY,
+      secure: COOKIE_DEFAULTS.SECURE,
+      sameSite: COOKIE_DEFAULTS.SAME_SITE.toLowerCase(),
+      path: COOKIE_DEFAULTS.PATH,
+      maxAge: COOKIE_DEFAULTS.MAX_AGE_SECONDS
+    });
+    return { success: true };
+  } catch (err) {
+    event.node.res.statusCode = err?.statusCode || 500;
+    return { error: err?.message || "Failed to set token" };
+  }
+});
+
+export { setToken_post as default };
+//# sourceMappingURL=set-token.post.js.map

package/dist/server/set-token.post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-token.post.js","sources":["../../src/server/set-token.post.ts"],"sourcesContent":["import { defineEventHandler, readBody, setCookie } from 'h3';\nimport { COOKIE_DEFAULTS, TOKEN_STORAGE_KEY } from '../common/constants/storage.constant';\n\nexport default defineEventHandler(async (event) => {\n  try {\n    const body = await readBody(event);\n    const token = body?.token || body?.accessToken || '';\n\n    if (!token) {\n      event.node.res.statusCode = 400;\n      return { error: 'Missing token in request body' };\n    }\n\n    setCookie(event, TOKEN_STORAGE_KEY, token, {\n      httpOnly: COOKIE_DEFAULTS.HTTP_ONLY,\n      secure: COOKIE_DEFAULTS.SECURE,\n      sameSite: COOKIE_DEFAULTS.SAME_SITE.toLowerCase() as 'lax',\n      path: COOKIE_DEFAULTS.PATH,\n      maxAge: COOKIE_DEFAULTS.MAX_AGE_SECONDS,\n    });\n\n    return { success: true };\n  } catch (err: any) {\n    event.node.res.statusCode = err?.statusCode || 500;\n    return { error: err?.message || 'Failed to set token' };\n  }\n});\n"],"names":[],"mappings":";;;AAGA,sBAAe,kBAAA,CAAmB,OAAO,KAAA,KAAU;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,KAAK,CAAA;AACjC,IAAA,MAAM,KAAA,GAAQ,IAAA,EAAM,KAAA,IAAS,IAAA,EAAM,WAAA,IAAe,EAAA;AAElD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,KAAA,CAAM,IAAA,CAAK,IAAI,UAAA,GAAa,GAAA;AAC5B,MAAA,OAAO,EAAE,OAAO,+BAAA,EAAgC;AAAA,IAClD;AAEA,IAAA,SAAA,CAAU,KAAA,EAAO,mBAAmB,KAAA,EAAO;AAAA,MACzC,UAAU,eAAA,CAAgB,SAAA;AAAA,MAC1B,QAAQ,eAAA,CAAgB,MAAA;AAAA,MACxB,QAAA,EAAU,eAAA,CAAgB,SAAA,CAAU,WAAA,EAAY;AAAA,MAChD,MAAM,eAAA,CAAgB,IAAA;AAAA,MACtB,QAAQ,eAAA,CAAgB;AAAA,KACzB,CAAA;AAED,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB,SAAS,GAAA,EAAU;AACjB,IAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,UAAA,GAAa,GAAA,EAAK,UAAA,IAAc,GAAA;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,GAAA,EAAK,OAAA,IAAW,qBAAA,EAAsB;AAAA,EACxD;AACF,CAAC,CAAA;;;;"}

package/dist/services/auth/auth.type.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Auth domain DTOs.
+ *
+ * Field names are camelCase to align with the CMS backend contract and the
+ * project naming convention for all public SDK data shapes.
+ *
+ * The access token is NOT part of these DTOs — it travels in the response
+ * header and is captured by the `createApi` `onResponse` hook into
+ * `TokenManager` (single source of truth).
+ */
+export interface IAuthUser {
+    id: number;
+    /** `users.uuid` — the People pack identity ref (registry §3.19). */
+    uuid?: string;
+    email: string;
+    name?: string;
+    firstName?: string;
+    lastName?: string;
+    phone?: string;
+    country?: string;
+    state?: string;
+    allowRoutes?: string[];
+    kycId?: number;
+    clientId?: number;
+}
+export interface IEmployee {
+    id: number;
+    email?: string;
+    name?: string;
+}
+/** Response of login — a subset session profile. */
+export interface IAuthSessionResponse {
+    user?: IAuthUser;
+    employee?: IEmployee;
+}
+export interface ILoginPayload {
+    email: string;
+    password: string;
+}
+/**
+ * Row of `GET /api/auth/users` — the CMS user registry. The backend may
+ * return any subset of label fields; every field except `id` is optional.
+ */
+export interface ICmsUser {
+    id: number;
+    /** `users.uuid` — the People pack identity ref (registry §3.19:
+     * `subject_ref`/`requester_ref` = users.uuid). Optional until every
+     * engine deployment projects it. */
+    uuid?: string;
+    email?: string;
+    name?: string;
+    firstName?: string;
+    lastName?: string;
+    username?: string;
+    fullName?: string;
+    phone?: string;
+    clientId?: number;
+}
+/** Query for `GET /api/auth/users`. */
+export interface IUsersQuery {
+    page?: number;
+    perPage?: number;
+    /** Free-text search across the user label fields (backend-defined). */
+    search?: string;
+}
+//# sourceMappingURL=auth.type.d.ts.map

package/dist/services/auth/auth.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.type.d.ts","sourceRoot":"","sources":["../../../src/services/auth/auth.type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX;;wCAEoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/services/auth/index.d.ts

@@ -0,0 +1,127 @@
+import { $Fetch } from 'ofetch';
+import { IAuthSessionResponse, ICmsUser, ILoginPayload, IUsersQuery } from './auth.type';
+export interface IAuthServiceOptions {
+    /** The CMS `$Fetch` instance (one of `sdk.apis`). */
+    api: $Fetch;
+    /**
+     * Optional `$Fetch` for token-lifecycle flows (login/logout/token). The
+     * Nuxt module points this at `/api/cms/*` server routes so those flows set
+     * the httpOnly cookie atomically and return the token in the body. When
+     * omitted, token-lifecycle flows call the backend directly via `api` (token
+     * captured by the `createApi` `onResponse` hook).
+     */
+    routeApi?: $Fetch;
+    /** Lazy flag — when true, the service returns fake data. */
+    mock: () => boolean;
+}
+/** Session response possibly augmented with `token` (when served via a route). */
+export type IAuthRouteResponse = IAuthSessionResponse & {
+    token?: string;
+};
+/** Response of the OAuth token (refresh) endpoint. */
+export interface ITokenResponse {
+    /** New access token (present when served via the Nuxt proxy). */
+    token?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    [key: string]: unknown;
+}
+/** Response of `POST /api/v1/auth/oauth/cbs/start` ("Login with CBS" init). */
+export interface ICbsStartResponse {
+    /** CBS `/oauth/authorize` URL (carries the PKCE challenge) the browser navigates to. */
+    authorizeUrl: string;
+    /** Opaque handle echoed back to `/cbs-callback`; pairs the flow with the server-side PKCE/state. */
+    stateKey: string;
+    /** Same as `authorizeUrl` (kept for client-API symmetry). */
+    redirectTarget: string;
+}
+/**
+ * Registered IdP SSO provider names (api_references §2). Only providers the
+ * engine has credentials for are active — others 404 on the login init.
+ */
+export type AuthIdpProvider = 'microsoft' | (string & {});
+/** Response of the IdP SSO login init (`GET /api/auth/{provider}/login`). */
+export interface IIdpLoginStartResponse {
+    /** Provider authorize URL (e.g. `login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize`) — the browser navigates here. */
+    authorizationUrl: string;
+    /** One-use state bound to the flow (TTL 600s); echo it back on the callback. */
+    state: string;
+}
+/**
+ * Response of the IdP SSO callback (`GET /api/auth/{provider}/callback`).
+ * The access token is a JWT resolved via JWKS — usable as a normal Bearer
+ * credential for every protected API.
+ */
+export interface IIdpCallbackResponse extends IAuthSessionResponse {
+    /** CMS user id behind the IdP identity. */
+    userId?: number;
+    /** True when the callback created a new CMS user. */
+    isNewUser?: boolean;
+    /** Provider name (e.g. `microsoft`). */
+    provider?: string;
+    /** Access token mirror (present when served via the Nuxt proxy). */
+    token?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    /** Access-token lifetime in seconds. */
+    expiresIn?: number;
+}
+/** Response of `GET /api/auth/users` — list envelope (paginated or bare array). */
+export interface IUsersResponse {
+    items: ICmsUser[];
+    total?: number;
+    page?: number;
+    perPage?: number;
+}
+export interface IAuthService {
+    login(payload: ILoginPayload, userAgent?: string): Promise<IAuthRouteResponse>;
+    logout(): Promise<unknown>;
+    /** Exchange the refresh token for a new access token (`POST /api/oauth/token`). */
+    token(): Promise<ITokenResponse>;
+    /**
+     * User registry (`GET /api/auth/users`) — the CMS auth users. Accepts
+     * pagination + free-text search; normalizes bare-array responses into
+     * `{ items }`.
+     */
+    users(query?: IUsersQuery): Promise<IUsersResponse>;
+    /** Initialise a "Login with CBS" attempt (`POST /api/v1/auth/oauth/cbs/start`). */
+    cbsStart(): Promise<ICbsStartResponse>;
+    /** Complete a "Login with CBS" attempt (`POST /api/v1/auth/oauth/cbs/callback`). */
+    cbsCallback(code: string, state: string, stateKey: string): Promise<IAuthRouteResponse>;
+    /**
+     * Initialise an IdP SSO login (`GET /api/auth/{provider}/login`). Returns the
+     * provider authorize URL + one-use state; navigate the browser there.
+     */
+    idpLogin(provider: AuthIdpProvider, redirectUri: string): Promise<IIdpLoginStartResponse>;
+    /**
+     * Complete an IdP SSO login (`GET /api/auth/{provider}/callback`). Exchanges
+     * `{code, state, redirectUri}` for a CMS JWT + refresh token; when served via
+     * the Nuxt proxy the httpOnly cookies are already set and `token` mirrors the
+     * access token.
+     */
+    idpCallback(provider: AuthIdpProvider, code: string, state: string, redirectUri: string): Promise<IIdpCallbackResponse>;
+    /** Link the signed-in user to the provider (`POST /api/auth/{provider}/link`). */
+    idpLink(provider: AuthIdpProvider): Promise<unknown>;
+    /** Unlink the provider from the signed-in user (`DELETE /api/auth/{provider}/unlink`). */
+    idpUnlink(provider: AuthIdpProvider): Promise<unknown>;
+}
+/**
+ * Auth domain service. Mirrors the CMS backend auth surface, which exposes
+ * exactly three endpoints:
+ *
+ *   POST   /api/auth/login    → login   (confirmed — real backend)
+ *   POST   /api/auth/logout   → logout  (confirmed — real backend, POST)
+ *   POST   /api/oauth/token   → token   (confirmed — OAuth, grant_type=refresh_token)
+ *
+ * The access token is NOT returned in the login body — it travels in the
+ * response header and is auto-captured by the `createApi` `onResponse` hook
+ * into `TokenManager`. Callers therefore only deal with session domain data.
+ * The `token()` method (refresh) returns the new access token in the body
+ * (`{ token }`) so the caller can mirror it in memory.
+ *
+ * When a `routeApi` (Nuxt module) is configured, all three flows route through
+ * the app-origin proxies (`/api/cms/login`, `/api/cms/logout`, `/api/cms/refresh`)
+ * so the httpOnly cookies are set/cleared/rotated atomically.
+ */
+export declare function createAuthService(opts: IAuthServiceOptions): IAuthService;
+//# sourceMappingURL=index.d.ts.map

package/dist/services/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAKrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE9F,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,OAAO,CAAC;CACrB;AAED,kFAAkF;AAClF,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3E,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE1D,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACrC,6HAA6H;IAC7H,gBAAgB,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/E,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3B,mFAAmF;IACnF,KAAK,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACpD,mFAAmF;IACnF,QAAQ,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvC,oFAAoF;IACpF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxF;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC1F;;;;;OAKG;IACH,WAAW,CACT,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,kFAAkF;IAClF,OAAO,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,0FAA0F;IAC1F,SAAS,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAkLzE"}

package/dist/services/auth/mock.d.ts

@@ -0,0 +1,13 @@
+import { IAuthSessionResponse, IAuthUser } from './auth.type';
+/**
+ * Fake auth data for mock mode.
+ *
+ * NOTE: in mock mode the request never reaches the network, so the
+ * `createApi` `onResponse` hook (which captures the token from the response
+ * header) does NOT fire. To simulate a logged-in session under mock, call
+ * `sdk.tokenManager.set('<fake-token>')` explicitly, or wire it from the
+ * store's mock login branch.
+ */
+export declare const MOCK_AUTH_USER: IAuthUser;
+export declare const MOCK_SESSION: IAuthSessionResponse;
+//# sourceMappingURL=mock.d.ts.map

package/dist/services/auth/mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../../../src/services/auth/mock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAa,MAAM,aAAa,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,EAAE,SAY5B,CAAC;AAIF,eAAO,MAAM,YAAY,EAAE,oBAG1B,CAAC"}

package/dist/services/bars/bars.type.d.ts

@@ -0,0 +1,78 @@
+import { MT5_INTERVAL, MT5Interval } from '../../common/constants/mt5.constant';
+/** Single source-interval value (always M1; doc §5.5.2). */
+type M1Only = typeof MT5_INTERVAL.M1;
+/**
+ * Chart-bars query — mirrors BE `GET /api/v1/chart/bars` (doc §5.5.1).
+ * All fields use camelCase; the service forwards them verbatim to the backend.
+ */
+export interface BarsQuery {
+    symbol: string;
+    /**
+     * Accepts FE-style ('1m','5m','15m','30m','1h','4h','1d','1w','1M')
+     * OR MT5-style ('M1'…'MN1'). Passed through verbatim; the backend maps
+     * both to the same bucket width.
+     */
+    interval: MT5Interval | ChartIntervalFe | (string & {});
+    /** ISO-8601, inclusive lower bound. */
+    fromTime: string;
+    /** ISO-8601, exclusive upper bound, strictly > fromTime. */
+    toTime: string;
+    /** MT5 server filter. Defaults to MT5_SERVER_NAME when omitted. */
+    serverName?: string;
+    /** 1..5000, applied AFTER aggregation. Default 1000. */
+    limit?: number;
+    /** 'asc' (oldest first, default) | 'desc' (newest first). */
+    sortDirection?: BarsSortDirection;
+}
+export type BarsSortDirection = 'asc' | 'desc';
+/** Aggregation-source label for a derived bar (doc §5.5.2). Distinct from
+ *  MT5ChartBarSource (raw Mt5ChartBar.data.source, doc §4.6). */
+export type BarsItemSource = 'aggregated' | 'live' | 'backfill';
+export interface BarItem {
+    symbol: string;
+    /** Canonical MT5-style bucket width. */
+    interval: MT5Interval;
+    /** ISO-8601 UTC; bucket-start for aggregated bars. */
+    mt5Ts: string;
+    open: number;
+    high: number;
+    low: number;
+    close: number;
+    tickVolume: number | null;
+    volume: number | null;
+    spread: number | null;
+    source: BarsItemSource | null;
+}
+export interface BarsResponse {
+    items: BarItem[];
+    symbol: string;
+    /** Canonical label returned by the backend. */
+    interval: MT5Interval;
+    /** ISO-8601 UTC (= parsed fromTime). */
+    fromTime: string;
+    /** ISO-8601 UTC (= parsed toTime). */
+    toTime: string;
+    /** Always 'M1' — the only persisted interval. */
+    sourceInterval: M1Only;
+    /** items.length. */
+    count: number;
+    /** true iff interval !== 'M1' and bucketing occurred. */
+    aggregated: boolean;
+}
+/** FE-style timeframe labels accepted by GET /api/v1/chart/bars (doc §5.5.1). */
+export declare const CHART_INTERVAL: {
+    readonly M1: "1m";
+    readonly M5: "5m";
+    readonly M15: "15m";
+    readonly M30: "30m";
+    readonly H1: "1h";
+    readonly H4: "4h";
+    readonly D1: "1d";
+    readonly W1: "1w";
+    readonly MN1: "1M";
+};
+export type ChartIntervalFe = (typeof CHART_INTERVAL)[keyof typeof CHART_INTERVAL];
+/** Map either dialect to the canonical MT5 label. */
+export declare function normalizeChartInterval(input: MT5Interval | ChartIntervalFe | string): MT5Interval;
+export {};
+//# sourceMappingURL=bars.type.d.ts.map

package/dist/services/bars/bars.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bars.type.d.ts","sourceRoot":"","sources":["../../../src/services/bars/bars.type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAErF,4DAA4D;AAC5D,KAAK,MAAM,GAAG,OAAO,YAAY,CAAC,EAAE,CAAC;AAErC;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,EAAE,WAAW,GAAG,eAAe,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACxD,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,MAAM,CAAC;AAE/C;iEACiE;AACjE,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAEhE,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,QAAQ,EAAE,WAAW,CAAC;IACtB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,QAAQ,EAAE,WAAW,CAAC;IACtB,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,iFAAiF;AACjF,eAAO,MAAM,cAAc;;;;;;;;;;CAUjB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAenF,qDAAqD;AACrD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,WAAW,CAGjG"}

package/dist/services/bars/index.d.ts

@@ -0,0 +1,24 @@
+import { $Fetch } from 'ofetch';
+import { BarsQuery, BarsResponse } from './bars.type';
+export interface IBarsServiceOptions {
+    /** The CMS `$Fetch` instance (one of `sdk.apis`). */
+    api: $Fetch;
+    /** Lazy flag — when true, the service returns fake data. */
+    mock: () => boolean;
+}
+export interface IBarsService {
+    getBars(query: BarsQuery): Promise<BarsResponse>;
+}
+/**
+ * Chart-bars service (read-only). Wraps `GET /api/v1/chart/bars` — the
+ * canonical OHLC read path for chart rendering of any timeframe. Storage
+ * is always M1; larger timeframes are derived on demand via bucket-and-reduce.
+ *
+ * Endpoint contract (`eaera_cms/chart/routes.py`, doc §5.5):
+ *   GET /api/v1/chart/bars → BarsResponse
+ *
+ * While `mock()` returns true, all methods resolve against the local fake
+ * dataset and never touch `api`.
+ */
+export declare function createBarsService(opts: IBarsServiceOptions): IBarsService;
+//# sourceMappingURL=index.d.ts.map

package/dist/services/bars/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/bars/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIrC,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,IAAI,EAAE,MAAM,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAClD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAmCzE"}