uapp-communication-sdk 1.0.0-dev.54

package/types/features/api-keys/presentation/integration-guide-sections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-guide-sections.d.ts","sourceRoot":"","sources":["../../../../../../src/features/api-keys/presentation/integration-guide-sections.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAE1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAUL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAK7B;;;;;GAKG;AACH,oEAAoE;AACpE,eAAO,MAAM,YAAY,GAAI,sBAG1B;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;CAChC,KAAG,YA4CH,CAAC;AAEF,eAAO,MAAM,OAAO,GAAI,yBAGrB;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,KAAG,YA0CH,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,kCAItB;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;CAChC,KAAG,YA+BH,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,yBAGvB;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,KAAG,YAgDH,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,sBAG7B;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;CAChC,KAAG,YAwCH,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,aAE7B;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,KAAG,YAqBH,CAAC"}

package/types/features/api-keys/presentation/integration-guide.d.ts

@@ -0,0 +1,100 @@
+import { type ApiKey } from '../domain';
+/**
+ * Which guide an integrator needs.
+ *
+ * <p>Taken from the KEY's identity mode rather than from the tenant, because that is the thing that
+ * actually changes the integration: a `UappSso` key resolves the asserted email to the account that
+ * already signs in through the portal, so its signer may also describe the person's place in the
+ * organisation. An `Isolated` key owns a private namespace where the email proves nothing, so those
+ * claims are ignored and the visibility of its users has to be configured on the key instead.</p>
+ *
+ * <p>It lines up with the tenant anyway — the server refuses `UappSso` unless the tenant has UAPP SSO
+ * enabled — but keying on the mode is exact, and stays correct for a tenant holding both kinds.</p>
+ */
+export type GuideVariant = 'uapp' | 'third-party';
+export declare const guideVariantFor: (apiKey: ApiKey) => GuideVariant;
+/**
+ * The scopes this key may ask for. The widget sends them as OAuth scopes and every module endpoint
+ * is gated on them, so a snippet that omits one produces a widget that authenticates and then 403s
+ * on every call — the single most common failed integration.
+ */
+export declare const scopesFor: (apiKey: ApiKey) => readonly string[];
+export declare const elementsFor: (apiKey: ApiKey) => readonly string[];
+export interface GuideInputs {
+    readonly apiKey: ApiKey;
+    /** Absolute base URL of the Communication Hub API — the address the widget calls. */
+    readonly apiBaseUrl: string;
+}
+export declare const nodeAssertionSnippet: ({ apiKey, apiBaseUrl }: GuideInputs, variant: GuideVariant) => string;
+export declare const phpAssertionSnippet: ({ apiKey, apiBaseUrl }: GuideInputs, variant: GuideVariant) => string;
+/**
+ * Loading the bundle is only half of it. `defineCustomElements()` is what registers the tags — miss
+ * it and `<uapp-chat>` stays an unknown element: nothing renders, and the console says nothing,
+ * because an unrecognised tag is not an error in HTML.
+ */
+export declare const scriptSnippet: () => string;
+/**
+ * The bundler route, for integrators who already build their front end.
+ *
+ * <p>The two artifacts are NOT interchangeable and picking wrong is silent: the standalone bundle
+ * carries its own copy of React, so a bundler that resolves to it ships two Reacts and the widget's
+ * hooks fail in ways that look like the app's bug, not the SDK's. The package entry point is the
+ * library build, which treats React as a peer — hence the explicit `/standalone` subpath.</p>
+ */
+export declare const npmSnippet: () => string;
+export declare const embedSnippet: (inputs: GuideInputs) => string;
+/** The widgets this key can drive, with the tag to place and what it shows. */
+export declare const widgetRows: (apiKey: ApiKey) => readonly {
+    readonly tag: string;
+    readonly scope: string;
+    readonly covers: string;
+}[];
+/**
+ * The optional half of the config.
+ *
+ * <p>Every one of these is supported by the widget today and appeared nowhere in this guide, so the
+ * only way to find them was to read the SDK's source. For an embed that has to sit inside somebody
+ * else's product, theming is not a nicety — a widget in the wrong brand colour reads as a
+ * third-party bolt-on no matter how well it works.</p>
+ *
+ * <p>Deliberately absent: `timezone` and `locale`. The config schema accepts both and neither
+ * changes anything — `timezone` is written to a DOM attribute nothing reads, and `locale` is parsed
+ * and dropped. Times come from the viewer's own Hub preference instead. Listing them here would
+ * invite integrators to set a value, see no effect, and file it as a bug against their own code.</p>
+ */
+export declare const themeSnippet: () => string;
+/**
+ * What `onEvent` reports.
+ *
+ * <p>This is the widget's ONLY channel for what happens inside its own tree, and the reason it
+ * matters is that the widget's own failure notice is deliberately generic — the cause reaches the
+ * console, and a page carrying twenty other errors is not where anyone finds it. A handler that
+ * surfaces these turns "the chat is broken" into a sentence naming the module that was refused.</p>
+ */
+export declare const eventRows: () => readonly {
+    readonly type: string;
+    readonly meaning: string;
+}[];
+export interface TroubleshootingEntry {
+    readonly symptom: string;
+    /** May contain `backtick` spans; {@link splitCode} turns them into code, never literal ticks. */
+    readonly cause: string;
+}
+/**
+ * Splits copy on backtick spans so the renderer can mark the code parts up.
+ *
+ * <p>These strings are prose ABOUT identifiers — `modules`, `invalid_grant` — and the identifiers
+ * have to look like identifiers, or the reader cannot tell where the name ends. Writing them with
+ * backticks keeps the source readable; without this the ticks reached the page verbatim.</p>
+ */
+export declare const splitCode: (text: string) => readonly {
+    readonly text: string;
+    readonly isCode: boolean;
+}[];
+/**
+ * The failures integrators actually hit, in the order they hit them. Each names the cause rather
+ * than the fix, because in every one of these cases the fix follows immediately from knowing what
+ * went wrong — and guessing is what costs the day.
+ */
+export declare const troubleshooting: (apiKey: ApiKey) => readonly TroubleshootingEntry[];
+//# sourceMappingURL=integration-guide.d.ts.map

package/types/features/api-keys/presentation/integration-guide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-guide.d.ts","sourceRoot":"","sources":["../../../../../../src/features/api-keys/presentation/integration-guide.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAI3D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,aAAa,CAAC;AAElD,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,YAC2B,CAAC;AAU7E;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,MAAM,KAAG,SAAS,MAAM,EAGvD,CAAC;AAUJ,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,KAAG,SAAS,MAAM,EAGN,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAuBD,eAAO,MAAM,oBAAoB,GAC/B,wBAAwB,WAAW,EACnC,SAAS,YAAY,KACpB,MAqCC,CAAC;AAEL,eAAO,MAAM,mBAAmB,GAC9B,wBAAwB,WAAW,EACnC,SAAS,YAAY,KACpB,MA+ByD,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,aAAa,QAAO,MASvB,CAAC;AAOX;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,QAAO,MAYyD,CAAC;AAExF,eAAO,MAAM,YAAY,GAAI,QAAQ,WAAW,KAAG,MAmClD,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,UAAU,GACrB,QAAQ,MAAM,KACb,SAAS;IACV,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,EAYA,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,QAAO,MAgB7B,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,QAAO,SAAS;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,EAqBA,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,GACpB,MAAM,MAAM,KACX,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,EAIpB,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,SAAS,oBAAoB,EA4D7E,CAAC"}

package/types/features/api-keys/presentation/sdk-script-url.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The absolute URL an integrator should point their `<script>` at.
+ *
+ * <p>The bundle is served by the app itself — this page and the SDK come out of the same deploy — so
+ * the origin serving the guide is the origin serving the script. Reading it from `window` rather
+ * than a build-time constant means the value is right in every environment without a variable that
+ * can be set wrong: a staging guide hands out the staging URL.</p>
+ *
+ * <p>The rolling channel, not a pinned version, because the failure it prevents is the expensive
+ * one. Every embed that self-hosts a copy keeps whatever bugs it shipped with until that site
+ * redeploys — and an integrator has no way to know a fix exists. Pointing at <code>{@link
+ * ROLLING_CHANNEL}</code> means a fix reaches them on the next page load. Anyone who needs a frozen
+ * artifact can pin <code>/sdk/&lt;version&gt;/</code>, which is served immutably beside it.</p>
+ */
+export declare const resolveSdkScriptUrl: () => string;
+//# sourceMappingURL=sdk-script-url.d.ts.map

package/types/features/api-keys/presentation/sdk-script-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-script-url.d.ts","sourceRoot":"","sources":["../../../../../../src/features/api-keys/presentation/sdk-script-url.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,QAAO,MAGtC,CAAC"}

package/types/features/api-keys/presentation/use-api-keys-module.d.ts

@@ -0,0 +1,4 @@
+import type { ApiKeysModule } from '../api-keys-module';
+/** Resolve the injected api-keys use cases. Throws if used outside the provider. */
+export declare const useApiKeysModule: () => ApiKeysModule;
+//# sourceMappingURL=use-api-keys-module.d.ts.map

package/types/features/api-keys/presentation/use-api-keys-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-api-keys-module.d.ts","sourceRoot":"","sources":["../../../../../../src/features/api-keys/presentation/use-api-keys-module.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,QAAO,aAMnC,CAAC"}

package/types/features/api-keys/presentation/use-api-keys-page-controller.d.ts

@@ -0,0 +1,39 @@
+import type { ApiKeyCredentials, CreateApiKeyCommand, UpdateApiKeyCommand, ApiKey } from '../domain';
+/**
+ * A destructive action awaiting the admin's confirmation. Modelled as ONE discriminated union
+ * rather than a boolean/id per action, so exactly one confirmation can ever be open.
+ */
+export type ApiKeyPendingAction = {
+    readonly kind: 'rotate';
+    readonly id: string;
+} | {
+    readonly kind: 'confirm-rotation';
+    readonly id: string;
+} | {
+    readonly kind: 'delete';
+    readonly id: string;
+};
+export interface UseApiKeysPageControllerReturn {
+    readonly apiKeys: readonly ApiKey[] | undefined;
+    readonly isLoading: boolean;
+    readonly error: Error | null;
+    readonly actionError: string | null;
+    readonly isCreateOpen: boolean;
+    readonly setIsCreateOpen: (v: boolean) => void;
+    /** The key whose edit form is open, or null. */
+    readonly editing: ApiKey | null;
+    readonly setEditing: (v: ApiKey | null) => void;
+    /** The key whose integration guide is open, or null. */
+    readonly guideFor: ApiKey | null;
+    readonly setGuideFor: (v: ApiKey | null) => void;
+    readonly credentials: ApiKeyCredentials | null;
+    readonly setCredentials: (v: ApiKeyCredentials | null) => void;
+    readonly pendingAction: ApiKeyPendingAction | null;
+    readonly setPendingAction: (v: ApiKeyPendingAction | null) => void;
+    readonly handleCreate: (cmd: CreateApiKeyCommand) => Promise<void>;
+    /** Resolves `true` when the save succeeded, so the form can stay open on a refusal. */
+    readonly handleUpdate: (id: string, cmd: UpdateApiKeyCommand) => Promise<boolean>;
+    readonly handleConfirmPendingAction: () => Promise<void>;
+}
+export declare const useApiKeysPageController: () => UseApiKeysPageControllerReturn;
+//# sourceMappingURL=use-api-keys-page-controller.d.ts.map

package/types/features/api-keys/presentation/use-api-keys-page-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-api-keys-page-controller.d.ts","sourceRoot":"","sources":["../../../../../../src/features/api-keys/presentation/use-api-keys-page-controller.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,EACP,MAAM,WAAW,CAAC;AAEnB;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AA2CrD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC/C,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/D,QAAQ,CAAC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,mBAAmB,GAAG,IAAI,KAAK,IAAI,CAAC;IACnE,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,uFAAuF;IACvF,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,QAAQ,CAAC,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,eAAO,MAAM,wBAAwB,QAAO,8BAuE3C,CAAC"}

package/types/features/api-keys/presentation/use-create-api-key-form-state.d.ts

@@ -0,0 +1,35 @@
+import { type UseFormRegister, type FieldErrors } from 'react-hook-form';
+import { type CreateApiKeyCommand } from '../domain';
+export interface CreateApiKeyFormValues {
+    readonly displayName: string;
+    readonly defaultAbpRole: string;
+    /** One origin per line, as typed. Parsed on submit. */
+    readonly allowedOrigins: string;
+    /**
+     * Held as the string a `<select>` yields, not as the enum. Coercing on submit rather than trusting
+     * the field type is what stops `"1"` reaching the API as an identity mode.
+     */
+    readonly identityMode: string;
+    readonly defaultUserTypeId: string;
+    readonly enableChat: boolean;
+    readonly enableFeed: boolean;
+    readonly enableSchedule: boolean;
+    readonly enableBookings: boolean;
+}
+export interface UseCreateApiKeyFormStateReturn {
+    readonly register: UseFormRegister<CreateApiKeyFormValues>;
+    readonly errors: FieldErrors<CreateApiKeyFormValues>;
+    readonly enableChat: boolean;
+    readonly enableFeed: boolean;
+    readonly enableSchedule: boolean;
+    readonly enableBookings: boolean;
+    readonly isSubmitting: boolean;
+    readonly originsError: string | null;
+    readonly setEnableChat: (v: boolean) => void;
+    readonly setEnableFeed: (v: boolean) => void;
+    readonly setEnableSchedule: (v: boolean) => void;
+    readonly setEnableBookings: (v: boolean) => void;
+    readonly handleFormSubmit: () => Promise<void>;
+}
+export declare const useCreateApiKeyFormState: (onSubmit: (cmd: CreateApiKeyCommand) => Promise<void>, onClose: () => void) => UseCreateApiKeyFormStateReturn;
+//# sourceMappingURL=use-create-api-key-form-state.d.ts.map

package/types/features/api-keys/presentation/use-create-api-key-form-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-create-api-key-form-state.d.ts","sourceRoot":"","sources":["../../../../../../src/features/api-keys/presentation/use-create-api-key-form-state.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAIL,KAAK,mBAAmB,EAEzB,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAYD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACjD,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACjD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,eAAO,MAAM,wBAAwB,GACnC,UAAU,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,EACrD,SAAS,MAAM,IAAI,KAClB,8BAwFF,CAAC"}

package/types/features/api-keys/presentation/use-edit-api-key-form-state.d.ts

@@ -0,0 +1,41 @@
+import { type ApiKey, type SdkIdentityMode, type UpdateApiKeyCommand } from '../domain';
+export interface EditApiKeyFormValues {
+    readonly displayName: string;
+    readonly defaultAbpRole: string;
+    readonly isActive: boolean;
+    readonly identityMode: SdkIdentityMode;
+    readonly defaultUserTypeId: string;
+    /** One origin per line, as typed. Parsed on submit. */
+    readonly allowedOrigins: string;
+    readonly enableChat: boolean;
+    readonly enableFeed: boolean;
+    readonly enableSchedule: boolean;
+    readonly enableBookings: boolean;
+}
+export interface UseEditApiKeyFormStateReturn {
+    readonly values: EditApiKeyFormValues;
+    readonly patch: (changes: Partial<EditApiKeyFormValues>) => void;
+    readonly originsError: string | null;
+    readonly isSubmitting: boolean;
+    readonly handleFormSubmit: () => Promise<void>;
+}
+/**
+ * Edit-form state for an existing SDK key.
+ *
+ * <p>Hand-rolled rather than react-hook-form (which the create form uses): every field is seeded from
+ * an existing record and the only validation is over the origin list as a whole, not per input, so a
+ * field-validator resolver would be scaffolding around a single check.</p>
+ *
+ * <p>Seeded once, from the initial state. The modal is mounted per opened key (`key={apiKey.id}`), so
+ * a different key is a different instance and re-seeding never has to be detected.</p>
+ *
+ * <p>Role mappings are carried through untouched. They are not editable on this form, and the update
+ * command replaces the whole set — omitting them would erase an integrator's host-role map as a side
+ * effect of, say, toggling a module.</p>
+ *
+ * @param onSubmit Resolves `true` when the save succeeded. A rejected save keeps the modal open: the
+ * server refuses UAPP SSO mode where the feature is off, and closing on that would throw away
+ * everything the admin had entered while the reason scrolled past behind the modal.
+ */
+export declare const useEditApiKeyFormState: (apiKey: ApiKey, onSubmit: (id: string, cmd: UpdateApiKeyCommand) => Promise<boolean>, onClose: () => void) => UseEditApiKeyFormStateReturn;
+//# sourceMappingURL=use-edit-api-key-form-state.d.ts.map

package/types/features/api-keys/presentation/use-edit-api-key-form-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-edit-api-key-form-state.d.ts","sourceRoot":"","sources":["../../../../../../src/features/api-keys/presentation/use-edit-api-key-form-state.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,WAAW,CAAC;AAGnB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,KAAK,IAAI,CAAC;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAwBD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB,GACjC,QAAQ,MAAM,EACd,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,EACpE,SAAS,MAAM,IAAI,KAClB,4BA4CF,CAAC"}

package/types/features/auth/application/index.d.ts

@@ -0,0 +1,5 @@
+export * from './use-cases/complete-sso-login';
+export * from './use-cases/logout';
+export * from './use-cases/restore-session';
+export * from './use-cases/refresh-session';
+//# sourceMappingURL=index.d.ts.map

package/types/features/auth/application/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/application/index.ts"],"names":[],"mappings":"AAAA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC"}

package/types/features/auth/application/use-cases/complete-sso-login.d.ts

@@ -0,0 +1,23 @@
+import { type Result } from '@core/result';
+import type { Logger } from '@core/logger';
+import { type AuthError, type AuthGateway, type AuthSession, type SessionStore } from '../../domain';
+export interface CompleteSsoLoginUseCaseDeps {
+    readonly authGateway: AuthGateway;
+    readonly sessionStore: SessionStore;
+    readonly logger: Logger;
+}
+/**
+ * Complete a UAPP SSO sign-in: take the one-time secret handed back to the login callback, exchange
+ * it for a session via the domain port, and persist it on success.
+ *
+ * Pure orchestration — there is no business rule here the domain doesn't already own; the use case
+ * just validates that a secret is present, sequences the steps, and never persists on failure.
+ */
+export declare class CompleteSsoLoginUseCase {
+    private readonly authGateway;
+    private readonly sessionStore;
+    private readonly logger;
+    constructor(deps: CompleteSsoLoginUseCaseDeps);
+    execute(secret: string): Promise<Result<AuthSession, AuthError>>;
+}
+//# sourceMappingURL=complete-sso-login.d.ts.map

package/types/features/auth/application/use-cases/complete-sso-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-sso-login.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/application/use-cases/complete-sso-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EAElB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,2BAA2B;IAMvC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;CAgB9E"}

package/types/features/auth/application/use-cases/logout.d.ts

@@ -0,0 +1,16 @@
+import type { Logger } from '@core/logger';
+import type { AuthGateway, AuthSession, SessionStore } from '../../domain';
+export interface LogoutUseCaseDeps {
+    readonly authGateway: AuthGateway;
+    readonly sessionStore: SessionStore;
+    readonly logger: Logger;
+}
+/** Sign the current user out: revoke server-side (best effort) and always clear local state. */
+export declare class LogoutUseCase {
+    private readonly authGateway;
+    private readonly sessionStore;
+    private readonly logger;
+    constructor(deps: LogoutUseCaseDeps);
+    execute(session: AuthSession | null): Promise<void>;
+}
+//# sourceMappingURL=logout.d.ts.map

package/types/features/auth/application/use-cases/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/application/use-cases/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gGAAgG;AAChG,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,iBAAiB;IAM7B,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAOjE"}

package/types/features/auth/application/use-cases/refresh-session.d.ts

@@ -0,0 +1,21 @@
+import { type Result } from '@core/result';
+import type { Logger } from '@core/logger';
+import { type AuthError, type AuthGateway, type AuthSession, type SessionStore } from '../../domain';
+export interface RefreshSessionUseCaseDeps {
+    readonly authGateway: AuthGateway;
+    readonly sessionStore: SessionStore;
+    readonly logger: Logger;
+}
+/**
+ * Exchange the current session's refresh token for a fresh one and persist it. Used by the HTTP
+ * auth-refresh decorator to recover from a `401`. Any failure (missing token or a rejected
+ * exchange) clears the stored session so the app falls back to sign-in.
+ */
+export declare class RefreshSessionUseCase {
+    private readonly authGateway;
+    private readonly sessionStore;
+    private readonly logger;
+    constructor(deps: RefreshSessionUseCaseDeps);
+    execute(session: AuthSession): Promise<Result<AuthSession, AuthError>>;
+}
+//# sourceMappingURL=refresh-session.d.ts.map

package/types/features/auth/application/use-cases/refresh-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-session.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/application/use-cases/refresh-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EAElB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,yBAAyB;IAMrC,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;CAoBpF"}

package/types/features/auth/application/use-cases/restore-session.d.ts

@@ -0,0 +1,24 @@
+import { type Result } from '@core/result';
+import type { Clock } from '@core/time';
+import type { Logger } from '@core/logger';
+import type { AuthError, AuthGateway, AuthSession, SessionStore } from '../../domain';
+export interface RestoreSessionUseCaseDeps {
+    readonly authGateway: AuthGateway;
+    readonly sessionStore: SessionStore;
+    readonly clock: Clock;
+    readonly logger: Logger;
+}
+/**
+ * Re-establish a session on app start: load the persisted one, and silently refresh it if the
+ * access token has expired but a refresh token is available. Any unrecoverable state resolves to
+ * "no session" (the app then shows sign-in) rather than surfacing an error to the user.
+ */
+export declare class RestoreSessionUseCase {
+    private readonly authGateway;
+    private readonly sessionStore;
+    private readonly clock;
+    private readonly logger;
+    constructor(deps: RestoreSessionUseCaseDeps);
+    execute(): Promise<Result<AuthSession | null, AuthError>>;
+}
+//# sourceMappingURL=restore-session.d.ts.map

package/types/features/auth/application/use-cases/restore-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore-session.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/application/use-cases/restore-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEtF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,yBAAyB;IAOrC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;CA4BvE"}

package/types/features/auth/auth-module.d.ts

@@ -0,0 +1,24 @@
+import type { HttpClient } from '@core/http';
+import type { Logger } from '@core/logger';
+import type { Clock } from '@core/time';
+import { type KeyValueStorage } from './infrastructure';
+import { type AuthStore } from './store';
+export interface AuthModuleDeps {
+    readonly httpClient: HttpClient;
+    readonly clock: Clock;
+    readonly logger: Logger;
+    readonly storage: KeyValueStorage;
+    /** Key prefix isolating this session from any other session sharing the same `storage`. */
+    readonly storageNamespace: string;
+    /** Bridges the active token into the HTTP layer (set by the composition root). */
+    readonly setAccessToken: (token: string | null) => void;
+    /** Pre-built, origin-aware UAPP SSO authorize URL (built by the app composition root). */
+    readonly loginUrl: string;
+}
+/**
+ * Composition root *for the auth feature*. Wires the UAPP SSO gateway to the use cases and returns
+ * a ready-to-use store. This is the only place inside the feature where layers are joined;
+ * everything else depends on abstractions.
+ */
+export declare const createAuthModule: (deps: AuthModuleDeps) => AuthStore;
+//# sourceMappingURL=auth-module.d.ts.map

package/types/features/auth/auth-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-module.d.ts","sourceRoot":"","sources":["../../../../../src/features/auth/auth-module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAOxC,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,kFAAkF;IAClF,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACxD,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,cAAc,KAAG,SA8CvD,CAAC"}

package/types/features/auth/domain/entities/auth-session.d.ts

@@ -0,0 +1,44 @@
+import { type Result } from '@core/result';
+import { type InvalidEmailError } from '@core/domain';
+import { AuthenticatedUser } from './authenticated-user';
+export interface AuthSessionProps {
+    readonly user: AuthenticatedUser;
+    readonly accessToken: string;
+    readonly refreshToken: string | null;
+    readonly tokenType: string;
+    readonly expiresAt: Date;
+}
+/** Plain, serializable form used to persist/restore a session across reloads. */
+export interface AuthSessionSnapshot {
+    readonly user: {
+        readonly id: string;
+        readonly email: string;
+        readonly fullName: string;
+        readonly roles: readonly string[];
+        readonly userType: string | null;
+    };
+    readonly accessToken: string;
+    readonly refreshToken: string | null;
+    readonly tokenType: string;
+    readonly expiresAtIso: string;
+}
+/**
+ * Aggregate root of the auth feature: an authenticated session and everything it knows about its
+ * own validity. Token lifetime logic lives here so no component or store re-implements "is this
+ * token still good?".
+ */
+export declare class AuthSession {
+    readonly user: AuthenticatedUser;
+    readonly accessToken: string;
+    readonly refreshToken: string | null;
+    readonly tokenType: string;
+    readonly expiresAt: Date;
+    constructor(props: AuthSessionProps);
+    isExpired(now: Date): boolean;
+    isValid(now: Date): boolean;
+    get canRefresh(): boolean;
+    authorizationHeader(): string;
+    snapshot(): AuthSessionSnapshot;
+    static restore(snapshot: AuthSessionSnapshot): Result<AuthSession, InvalidEmailError>;
+}
+//# sourceMappingURL=auth-session.d.ts.map

package/types/features/auth/domain/entities/auth-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/domain/entities/auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,cAAc,CAAC;AACtD,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,iFAAiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAKD;;;;GAIG;AACH,qBAAa,WAAW;IACtB,SAAgB,IAAI,EAAE,iBAAiB,CAAC;IACxC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,SAAS,EAAE,IAAI,CAAC;gBAEb,KAAK,EAAE,gBAAgB;IAQnC,SAAS,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO;IAI7B,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO;IAIlC,IAAW,UAAU,IAAI,OAAO,CAE/B;IAEM,mBAAmB,IAAI,MAAM;IAI7B,QAAQ,IAAI,mBAAmB;WAgBxB,OAAO,CACnB,QAAQ,EAAE,mBAAmB,GAC5B,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC;CAwB1C"}

package/types/features/auth/domain/entities/authenticated-user.d.ts

@@ -0,0 +1,24 @@
+import type { Email } from '@core/domain';
+export interface AuthenticatedUserProps {
+    readonly id: string;
+    readonly email: Email;
+    readonly fullName: string;
+    readonly roles: readonly string[];
+    readonly userType: string | null;
+}
+/**
+ * The signed-in user. An entity (identity = `id`) that owns the rules about *what this user can
+ * do* — role checks live here, not sprinkled across components as `user.roles.includes('admin')`.
+ */
+export declare class AuthenticatedUser {
+    readonly id: string;
+    readonly email: Email;
+    readonly fullName: string;
+    readonly userType: string | null;
+    private readonly roles;
+    constructor(props: AuthenticatedUserProps);
+    hasRole(role: string): boolean;
+    hasAnyRole(roles: readonly string[]): boolean;
+    get roleNames(): readonly string[];
+}
+//# sourceMappingURL=authenticated-user.d.ts.map

package/types/features/auth/domain/entities/authenticated-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-user.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/domain/entities/authenticated-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,KAAK,EAAE,KAAK,CAAC;IAC7B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;gBAEzB,KAAK,EAAE,sBAAsB;IAWzC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIpD,IAAW,SAAS,IAAI,SAAS,MAAM,EAAE,CAExC;CACF"}

package/types/features/auth/domain/errors/auth-errors.d.ts

@@ -0,0 +1,24 @@
+import { DomainError } from '@core/errors';
+/** Base type for every authentication-domain failure. Lets callers `catch`/`switch` on intent. */
+export declare abstract class AuthError extends DomainError {
+}
+/**
+ * Sign-in was rejected by the authentication service: the one-time SSO secret was missing, invalid,
+ * or expired, or the refresh token is no longer valid. Deliberately generic — we never disclose
+ * which of those it was at the sign-in boundary.
+ */
+export declare class InvalidCredentialsError extends AuthError {
+    readonly code = "AUTH_INVALID_CREDENTIALS";
+    constructor();
+}
+/** The user authenticated but their account is not allowed to use this app. */
+export declare class AccountInactiveError extends AuthError {
+    readonly code = "AUTH_ACCOUNT_INACTIVE";
+    constructor();
+}
+/** The authority could not be reached or returned an unexpected error. */
+export declare class AuthServiceUnavailableError extends AuthError {
+    readonly code = "AUTH_SERVICE_UNAVAILABLE";
+    constructor(cause?: unknown);
+}
+//# sourceMappingURL=auth-errors.d.ts.map

package/types/features/auth/domain/errors/auth-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/domain/errors/auth-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,kGAAkG;AAClG,8BAAsB,SAAU,SAAQ,WAAW;CAAG;AAEtD;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;IACpD,SAAgB,IAAI,8BAA8B;;CAOnD;AAED,+EAA+E;AAC/E,qBAAa,oBAAqB,SAAQ,SAAS;IACjD,SAAgB,IAAI,2BAA2B;;CAKhD;AAED,0EAA0E;AAC1E,qBAAa,2BAA4B,SAAQ,SAAS;IACxD,SAAgB,IAAI,8BAA8B;gBAE/B,KAAK,CAAC,EAAE,OAAO;CAKnC"}

package/types/features/auth/domain/index.d.ts

@@ -0,0 +1,6 @@
+export * from './errors/auth-errors';
+export * from './entities/authenticated-user';
+export * from './entities/auth-session';
+export type { AuthGateway } from './ports/auth-gateway';
+export type { SessionStore } from './ports/session-store';
+//# sourceMappingURL=index.d.ts.map

package/types/features/auth/domain/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/domain/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC"}

package/types/features/auth/domain/ports/auth-gateway.d.ts

@@ -0,0 +1,21 @@
+import type { Result } from '@core/result';
+import type { AuthError } from '../errors/auth-errors';
+import type { AuthSession } from '../entities/auth-session';
+/**
+ * Port to the authentication service. Sign-in is UAPP SSO only: the user authenticates upstream and
+ * returns with a one-time `secret`, which we exchange for a session. The domain defines the contract
+ * in its own terms (a secret in, an `AuthSession` out); the OAuth/HTTP details live in the
+ * infrastructure implementation. This is the Dependency Inversion seam.
+ *
+ * The SSO secret and the refresh token are opaque, structureless tokens, so they stay raw `string`s
+ * — wrapping them in a value object would be ceremony without an invariant to enforce.
+ */
+export interface AuthGateway {
+    /** Exchange a one-time UAPP SSO secret (from the login callback) for an authenticated session. */
+    exchangeSsoSecret(secret: string): Promise<Result<AuthSession, AuthError>>;
+    /** Exchange a refresh token for a fresh session. */
+    refresh(refreshToken: string): Promise<Result<AuthSession, AuthError>>;
+    /** Best-effort token revocation. Never throws; failures are the caller's gain to ignore. */
+    signOut(session: AuthSession): Promise<void>;
+}
+//# sourceMappingURL=auth-gateway.d.ts.map

package/types/features/auth/domain/ports/auth-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-gateway.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/domain/ports/auth-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,kGAAkG;IAClG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IAE3E,oDAAoD;IACpD,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IAEvE,4FAA4F;IAC5F,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C"}

package/types/features/auth/domain/ports/session-store.d.ts

@@ -0,0 +1,12 @@
+import type { AuthSession } from '../entities/auth-session';
+/**
+ * Port for persisting the active session across reloads. The domain only cares that a session can
+ * be saved, loaded and cleared — *where* (localStorage, cookie, memory) is an infrastructure
+ * decision. Implementations must return `null` (never throw) for missing or corrupt data.
+ */
+export interface SessionStore {
+    load(): AuthSession | null;
+    save(session: AuthSession): void;
+    clear(): void;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/types/features/auth/domain/ports/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/domain/ports/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,WAAW,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,KAAK,IAAI,IAAI,CAAC;CACf"}

package/types/features/auth/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Public API of the `auth` feature. Other features and the app shell import ONLY from here —
+ * never from deep internal paths. This barrel is the feature's contract; its internals stay free
+ * to change.
+ */
+export { createAuthModule, type AuthModuleDeps } from './auth-module';
+export { buildSsoLoginUrl, buildSsoLogoutUrl, SSO_CALLBACK_PATH, type KeyValueStorage, } from './infrastructure';
+export type { AuthStore, AuthState, AuthStatus } from './store';
+export { AuthStoreProvider, useAuth, ProtectedRoute, LoginPage, SsoCallbackPage, SsoBootstrap, SentryUserBridge, useProactiveTokenRefresh, type UseAuthResult, } from './presentation';
+export type { AuthenticatedUser, AuthSession } from './domain';
+//# sourceMappingURL=index.d.ts.map

package/types/features/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,SAAS,EACT,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC"}