uapp-communication-sdk 1.0.0-dev.54

package/types/features/auth/infrastructure/dto/token-response.dto.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+/**
+ * Wire contract for the OpenIddict token endpoint (`POST /connect/token`). Fields are snake_case
+ * per OAuth 2.0 / OpenID Connect. We validate every response at this boundary with Zod so a
+ * malformed/unexpected payload is caught here — the domain only ever sees data it expects.
+ */
+export declare const TokenResponseSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    token_type: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    expires_in: z.ZodNumber;
+    refresh_token: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string | null | undefined;
+}, {
+    access_token: string;
+    expires_in: number;
+    token_type?: string | undefined;
+    refresh_token?: string | null | undefined;
+}>;
+export type TokenResponse = z.infer<typeof TokenResponseSchema>;
+/**
+ * OAuth error body the token endpoint returns on a 4xx (e.g. an invalid/expired SSO secret yields
+ * `{ error: "invalid_grant", error_description: "..." }`). Used only to log the upstream reason;
+ * the user-facing message stays generic.
+ */
+export declare const TokenErrorSchema: z.ZodObject<{
+    error: z.ZodOptional<z.ZodString>;
+    error_description: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    error?: string | undefined;
+    error_description?: string | undefined;
+}, {
+    error?: string | undefined;
+    error_description?: string | undefined;
+}>;
+export type TokenError = z.infer<typeof TokenErrorSchema>;
+//# sourceMappingURL=token-response.dto.d.ts.map

package/types/features/auth/infrastructure/dto/token-response.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-response.dto.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/auth/infrastructure/dto/token-response.dto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;EAG3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/types/features/auth/infrastructure/index.d.ts

@@ -0,0 +1,7 @@
+export * from './dto/token-response.dto';
+export * from './jwt-claims';
+export * from './sso-session-mapper';
+export * from './uapp-sso-protocol';
+export * from './uapp-sso-auth-gateway';
+export * from './local-session-store';
+//# sourceMappingURL=index.d.ts.map

package/types/features/auth/infrastructure/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/infrastructure/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC"}

package/types/features/auth/infrastructure/jwt-claims.d.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+import { type Result } from '@core/result';
+import { type AuthError } from '../domain';
+/**
+ * The identity claims we read from the access token. The backend's principal factory sets these
+ * with OpenIddict's standard claim names (`sub`, `email`, `name`, `role`), so reading them is
+ * reliable. The tenant rides inside the token too and is enforced server-side on every request, so
+ * the client does not need to read or send it. We do NOT verify the signature here — that is the
+ * server's job on each API call; the client only reads the (untrusted-for-authz) display claims.
+ */
+declare const JwtClaimsSchema: z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    sub: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    sub: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+}, z.ZodTypeAny, "passthrough">>;
+export type JwtClaims = z.infer<typeof JwtClaimsSchema>;
+/** Roles normalized to an array regardless of how the claim was serialized. */
+export declare const rolesFromClaims: (claims: JwtClaims) => readonly string[];
+/**
+ * Decodes (does not verify) the payload of a JWT access token and validates the identity claims we
+ * rely on. A token that is not a well-formed JWT, or whose payload is missing `sub`, is treated as
+ * a service fault rather than crashing — the caller maps it to a failed sign-in.
+ */
+export declare const decodeJwtClaims: (accessToken: string) => Result<JwtClaims, AuthError>;
+export {};
+//# sourceMappingURL=jwt-claims.d.ts.map

package/types/features/auth/infrastructure/jwt-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-claims.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/infrastructure/jwt-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,MAAM,EAAW,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,KAAK,SAAS,EAA+B,MAAM,WAAW,CAAC;AAExE;;;;;;GAMG;AACH,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;gCAQL,CAAC;AAEjB,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,+EAA+E;AAC/E,eAAO,MAAM,eAAe,GAAI,QAAQ,SAAS,KAAG,SAAS,MAAM,EAKlE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,aAAa,MAAM,KAAG,MAAM,CAAC,SAAS,EAAE,SAAS,CAyBhF,CAAC"}

package/types/features/auth/infrastructure/local-session-store.d.ts

@@ -0,0 +1,44 @@
+import type { Logger } from '@core/logger';
+import { AuthSession, type SessionStore } from '../domain';
+/**
+ * Builds the storage key for a namespace. The namespace is what keeps two independently configured
+ * sessions (the SPA, and one embedded SDK instance per client key) from overwriting each other in a
+ * shared storage area.
+ */
+export declare const sessionStorageKey: (namespace: string) => string;
+/** Abstraction over Web Storage so the store is unit-testable without a DOM. */
+export interface KeyValueStorage {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+export interface LocalSessionStoreDeps {
+    readonly storage: KeyValueStorage;
+    readonly logger: Logger;
+    /**
+     * Key prefix isolating this store's session from every other store sharing the same `storage`.
+     * Required — a shared constant key silently makes two instances clobber each other.
+     */
+    readonly namespace: string;
+}
+/**
+ * Persists the session in the injected {@link KeyValueStorage} so a reload keeps the user signed in.
+ *
+ * Trade-off: tokens in `localStorage` are readable by any script in this origin, so XSS hygiene
+ * (strict CSP, no `dangerouslySetInnerHTML` with untrusted input) is the mitigation. An
+ * httpOnly-cookie BFF would be stronger; this implementation can be swapped without touching the
+ * domain because callers depend on the `SessionStore` port, not on this class. The embeddable SDK
+ * does exactly that: it injects an in-memory storage, because on a third-party page we control
+ * neither the CSP nor the markup.
+ */
+export declare class LocalSessionStore implements SessionStore {
+    private readonly storage;
+    private readonly logger;
+    private readonly key;
+    constructor(deps: LocalSessionStoreDeps);
+    load(): AuthSession | null;
+    save(session: AuthSession): void;
+    clear(): void;
+    private tryParseJson;
+}
+//# sourceMappingURL=local-session-store.d.ts.map

package/types/features/auth/infrastructure/local-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-session-store.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/infrastructure/local-session-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAK3D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,MAChB,CAAC;AAgBvC,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,qBAAa,iBAAkB,YAAW,YAAY;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEV,IAAI,EAAE,qBAAqB;IAMvC,IAAI,IAAI,WAAW,GAAG,IAAI;IAuB1B,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAIhC,KAAK,IAAI,IAAI;IAIpB,OAAO,CAAC,YAAY;CAOrB"}

package/types/features/auth/infrastructure/sso-session-mapper.d.ts

@@ -0,0 +1,14 @@
+import { type Result } from '@core/result';
+import { type AuthError, AuthSession } from '../domain';
+import type { TokenResponse } from './dto/token-response.dto';
+/**
+ * Translates a successful token response into the domain `AuthSession`. The tokens come from the
+ * OAuth response; the user's identity comes from the access token's claims. All knowledge of "how
+ * the API encodes a session" lives here, so the domain and application layers stay free of JWT/JSON
+ * concerns.
+ *
+ * Expiry is derived from the response's `expires_in` (relative to `now`) rather than the token's
+ * `exp`, keeping the session's clock aligned with the rest of the app's `Clock`.
+ */
+export declare const toAuthSession: (token: TokenResponse, now: Date) => Result<AuthSession, AuthError>;
+//# sourceMappingURL=sso-session-mapper.d.ts.map

package/types/features/auth/infrastructure/sso-session-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-session-mapper.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/infrastructure/sso-session-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAkB,MAAM,cAAc,CAAC;AAE3D,OAAO,EACL,KAAK,SAAS,EAGd,WAAW,EACZ,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG9D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GACxB,OAAO,aAAa,EACpB,KAAK,IAAI,KACR,MAAM,CAAC,WAAW,EAAE,SAAS,CAqC/B,CAAC"}

package/types/features/auth/infrastructure/uapp-sso-auth-gateway.d.ts

@@ -0,0 +1,28 @@
+import { type HttpClient } from '@core/http';
+import type { Logger } from '@core/logger';
+import type { Clock } from '@core/time';
+import { type Result } from '@core/result';
+import { type AuthError, type AuthGateway, type AuthSession } from '../domain';
+export interface UappSsoAuthGatewayDeps {
+    readonly httpClient: HttpClient;
+    readonly clock: Clock;
+    readonly logger: Logger;
+}
+/**
+ * {@link AuthGateway} backed by the backend's OpenIddict token endpoint and the `uapp_sso` custom
+ * grant. Sign-in exchanges the one-time SSO secret for tokens; the session's user identity is read
+ * from the access token's claims. The `uapp` tenant is resolved server-side from the secret, so no
+ * tenant hint is sent — and once signed in, the access token itself carries the tenant.
+ */
+export declare class UappSsoAuthGateway implements AuthGateway {
+    private readonly httpClient;
+    private readonly clock;
+    private readonly logger;
+    constructor(deps: UappSsoAuthGatewayDeps);
+    exchangeSsoSecret(secret: string): Promise<Result<AuthSession, AuthError>>;
+    refresh(refreshToken: string): Promise<Result<AuthSession, AuthError>>;
+    signOut(_session: AuthSession): Promise<void>;
+    private requestToken;
+    private mapError;
+}
+//# sourceMappingURL=uapp-sso-auth-gateway.d.ts.map

package/types/features/auth/infrastructure/uapp-sso-auth-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uapp-sso-auth-gateway.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/infrastructure/uapp-sso-auth-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAa,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAGjB,MAAM,WAAW,CAAC;AAYnB,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,sBAAsB;IAMxC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAY1E,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAStE,OAAO,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;YAQtC,YAAY;IAoB1B,OAAO,CAAC,QAAQ;CAcjB"}

package/types/features/auth/infrastructure/uapp-sso-protocol.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The fixed wire contract for UAPP SSO, kept in one place so no endpoint, grant type, or parameter
+ * name is a magic string scattered across the gateway. These mirror the backend
+ * (`UappSsoConsts` / the OpenIddict client seed) and only change if that contract changes — they
+ * are NOT environment config (the per-environment bits, login URL + client key, come from config).
+ */
+/** OpenIddict token endpoint (root path, behind the dev proxy / API origin). */
+export declare const TOKEN_ENDPOINT = "/connect/token";
+/** This SPA's registered OpenIddict public client id. */
+export declare const OAUTH_CLIENT_ID = "CommunicationHub_App";
+/** Scopes requested at sign-in; `offline_access` is what yields a refresh token. */
+export declare const OAUTH_SCOPE = "CommunicationHub offline_access";
+/** Custom grant that swaps a one-time UAPP SSO secret for tokens (backend `UappSsoConsts.GrantType`). */
+export declare const GRANT_TYPE_UAPP_SSO = "uapp_sso";
+/** Standard OAuth grant for exchanging a refresh token for a fresh access token. */
+export declare const GRANT_TYPE_REFRESH = "refresh_token";
+/** Token-request field carrying the one-time secret (backend `UappSsoConsts.SecretParameterName`). */
+export declare const SECRET_PARAM = "secret";
+/** Frontend route UAPP SSO redirects back to; the secret arrives in its `?token=` query param. */
+export declare const SSO_CALLBACK_PATH = "/auth/callback";
+/** Query-param name UAPP SSO uses to return the one-time secret to the callback. */
+export declare const SSO_CALLBACK_SECRET_PARAM = "token";
+/**
+ * Extracts the one-time SSO secret from the callback query string.
+ *
+ * Parses the RAW query rather than using `URLSearchParams`, because the form-urlencoded parser turns
+ * a literal `+` into a space — which would silently corrupt a base64 secret and make the backend
+ * exchange fail. We percent-decode with `decodeURIComponent` (which leaves `+` intact) and tolerate
+ * the common param-name variants. Returns the secret plus the param name it was found under (for
+ * diagnostics), or `null`s when no recognizable secret is present.
+ */
+export declare const readSsoCallbackSecret: (search: string) => {
+    readonly secret: string | null;
+    readonly param: string | null;
+};
+export interface SsoLoginUrlInput {
+    /** UAPP SSO login UI entry point (from config). */
+    readonly loginUrl: string;
+    /** This app's public client key at UAPP SSO (from config). */
+    readonly clientKey: string;
+    /** The app's own origin, e.g. `https://app.example.com` or `http://localhost:5173`. */
+    readonly origin: string;
+}
+/**
+ * Builds the URL the browser is sent to so the user can authenticate with UAPP SSO. The portal takes
+ * the app's registered `redirect` ORIGIN, a `pathname` to return to, the `logout` flag and the client
+ * `key`; on success it redirects back to `{origin}?{SSO_CALLBACK_SECRET_PARAM}=<secret>&pathname=...`.
+ * `SsoBootstrap` then catches the secret on the origin and exchanges it.
+ */
+export declare const buildSsoLoginUrl: ({ loginUrl, clientKey, origin, }: SsoLoginUrlInput) => string;
+/**
+ * Turns the built SSO LOGIN url into the SSO LOGOUT url by flipping `logout=true` (mirrors the
+ * reference flow: clear the local session, then send the browser here so the PORTAL session is ended
+ * too — otherwise the next sign-in would silently re-authenticate). Same `redirect` origin, so the
+ * portal returns to the app (which, now signed out, shows the login screen). Falls back to the input
+ * if it isn't a parseable URL.
+ */
+export declare const buildSsoLogoutUrl: (loginUrl: string) => string;
+//# sourceMappingURL=uapp-sso-protocol.d.ts.map

package/types/features/auth/infrastructure/uapp-sso-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uapp-sso-protocol.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/infrastructure/uapp-sso-protocol.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,gFAAgF;AAChF,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,yDAAyD;AACzD,eAAO,MAAM,eAAe,yBAAyB,CAAC;AAEtD,oFAAoF;AACpF,eAAO,MAAM,WAAW,oCAAoC,CAAC;AAE7D,yGAAyG;AACzG,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAE9C,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD,sGAAsG;AACtG,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,UAAU,CAAC;AAiBjD;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GAChC,QAAQ,MAAM,KACb;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAYjE,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,kCAI9B,gBAAgB,KAAG,MAWrB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,KAAG,MAQpD,CAAC"}

package/types/features/auth/presentation/AuthStoreProvider.d.ts

@@ -0,0 +1,12 @@
+import { type ReactElement, type ReactNode } from 'react';
+import type { AuthStore } from '../store';
+export interface AuthStoreProviderProps {
+    readonly store: AuthStore;
+    readonly children: ReactNode;
+}
+/**
+ * Provides the injected auth store to the React tree and kicks off session restoration once.
+ * The store itself is built by the composition root, so this component stays free of wiring.
+ */
+export declare const AuthStoreProvider: ({ store, children, }: AuthStoreProviderProps) => ReactElement;
+//# sourceMappingURL=AuthStoreProvider.d.ts.map

package/types/features/auth/presentation/AuthStoreProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthStoreProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/AuthStoreProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,sBAG/B,sBAAsB,KAAG,YAM3B,CAAC"}

package/types/features/auth/presentation/LoginPage.d.ts

@@ -0,0 +1,7 @@
+import { type ReactElement } from 'react';
+/**
+ * Sign-in screen. Sign-in is UAPP SSO only: the button sends the browser to the UAPP login page,
+ * which returns to SsoCallbackPage with a one-time secret.
+ */
+export declare const LoginPage: () => ReactElement;
+//# sourceMappingURL=LoginPage.d.ts.map

package/types/features/auth/presentation/LoginPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginPage.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/LoginPage.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAQ1C;;;GAGG;AACH,eAAO,MAAM,SAAS,QAAO,YAkE5B,CAAC"}

package/types/features/auth/presentation/ProtectedRoute.d.ts

@@ -0,0 +1,13 @@
+import type { ReactElement } from 'react';
+export interface ProtectedRouteProps {
+    /** Optional role gate — user must hold at least one of these roles. */
+    readonly anyOf?: readonly string[];
+    readonly redirectTo?: string;
+}
+/**
+ * Route guard. Renders the matched child route only for an authenticated (and, optionally,
+ * suitably-authorized) user; otherwise redirects to sign-in. Keeping this in one place means no
+ * page re-implements the "am I allowed here?" check.
+ */
+export declare const ProtectedRoute: ({ anyOf, redirectTo, }: ProtectedRouteProps) => ReactElement;
+//# sourceMappingURL=ProtectedRoute.d.ts.map

package/types/features/auth/presentation/ProtectedRoute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProtectedRoute.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/ProtectedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAK1C,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,wBAG5B,mBAAmB,KAAG,YAoBxB,CAAC"}

package/types/features/auth/presentation/SsoBootstrap.d.ts

@@ -0,0 +1,15 @@
+import { type ReactElement, type ReactNode } from 'react';
+export interface SsoBootstrapProps {
+    readonly children: ReactNode;
+}
+/**
+ * Catches the UAPP SSO secret wherever the portal lands it. The portal redirects back to the app's
+ * registered ORIGIN with `?token=<secret>` (and an echoed `pathname`), so the secret can arrive on
+ * ANY route — not just a dedicated callback. On load this gate runs once: when a secret is present
+ * (and we are not already on the dedicated {@link SSO_CALLBACK_PATH} route, which has its own
+ * handler) it shows a "completing sign-in" screen, exchanges the secret for a session, then routes to
+ * the target path (dropping the one-time SSO query). With no secret it renders the app immediately —
+ * zero overhead for normal navigation. Mirrors the working Uapp-Lead-Frontend `auth-bootstrap`.
+ */
+export declare const SsoBootstrap: ({ children }: SsoBootstrapProps) => ReactElement;
+//# sourceMappingURL=SsoBootstrap.d.ts.map

package/types/features/auth/presentation/SsoBootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SsoBootstrap.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/SsoBootstrap.tsx"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAYvF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAI,cAAc,iBAAiB,KAAG,YAwC9D,CAAC"}

package/types/features/auth/presentation/SsoCallbackPage.d.ts

@@ -0,0 +1,9 @@
+import { type ReactElement } from 'react';
+/**
+ * Lands the UAPP SSO redirect. UAPP returns here with a one-time secret in the query string; we
+ * exchange it for a session and go to the app, or fall back to the sign-in screen (which then shows
+ * the error the store recorded). The exchange runs exactly once even under React Strict Mode's
+ * double-invoked effects — a one-time secret cannot be redeemed twice.
+ */
+export declare const SsoCallbackPage: () => ReactElement;
+//# sourceMappingURL=SsoCallbackPage.d.ts.map

package/types/features/auth/presentation/SsoCallbackPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SsoCallbackPage.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/SsoCallbackPage.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAO7D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,QAAO,YAqDlC,CAAC"}

package/types/features/auth/presentation/auth-store-context.d.ts

@@ -0,0 +1,4 @@
+import type { AuthStore } from '../store';
+/** Holds the DI-built auth store. Populated by `AuthStoreProvider` at the composition root. */
+export declare const AuthStoreContext: import("react").Context<AuthStore | null>;
+//# sourceMappingURL=auth-store-context.d.ts.map

package/types/features/auth/presentation/auth-store-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-store-context.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/auth-store-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB,2CAAwC,CAAC"}

package/types/features/auth/presentation/index.d.ts

@@ -0,0 +1,9 @@
+export * from './AuthStoreProvider';
+export * from './use-auth';
+export * from './ProtectedRoute';
+export * from './LoginPage';
+export * from './SsoCallbackPage';
+export * from './SsoBootstrap';
+export * from './sentry-user-bridge';
+export * from './use-proactive-token-refresh';
+//# sourceMappingURL=index.d.ts.map

package/types/features/auth/presentation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC"}

package/types/features/auth/presentation/sentry-user-bridge.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Mirrors the authenticated user into Sentry (`setUser` on sign-in, `setUser(null)` on sign-out).
+ * Mount once near the app root, inside `AuthStoreProvider`.
+ */
+export declare const SentryUserBridge: () => null;
+//# sourceMappingURL=sentry-user-bridge.d.ts.map

package/types/features/auth/presentation/sentry-user-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry-user-bridge.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/sentry-user-bridge.tsx"],"names":[],"mappings":"AAIA;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAO,IAkBnC,CAAC"}

package/types/features/auth/presentation/use-auth.d.ts

@@ -0,0 +1,22 @@
+import type { AuthenticatedUser } from '../domain';
+import type { AuthState } from '../store';
+export interface UseAuthResult {
+    readonly status: AuthState['status'];
+    readonly user: AuthenticatedUser | null;
+    readonly error: string | null;
+    readonly isAuthenticated: boolean;
+    readonly isInitializing: boolean;
+    readonly isBusy: boolean;
+    /** URL to send the browser to in order to start a UAPP SSO sign-in. */
+    readonly loginUrl: string;
+    /** Finish a sign-in with the one-time secret returned to the SSO callback. */
+    readonly completeLogin: (secret: string) => Promise<boolean>;
+    readonly logout: () => Promise<void>;
+    readonly clearError: () => void;
+}
+/**
+ * The single entry point components use to read auth state and trigger auth actions. Selecting
+ * primitives (not a fresh object) keeps re-renders minimal without extra equality helpers.
+ */
+export declare const useAuth: () => UseAuthResult;
+//# sourceMappingURL=use-auth.d.ts.map

package/types/features/auth/presentation/use-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-auth.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/use-auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAW1C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;CACjC;AAED;;;GAGG;AACH,eAAO,MAAM,OAAO,QAAO,aA2B1B,CAAC"}

package/types/features/auth/presentation/use-proactive-token-refresh.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Proactively refresh the session one minute before the access token expires so long-lived tabs
+ * (chat, meetings) do not hit a 401 mid-action.
+ */
+export declare const useProactiveTokenRefresh: () => void;
+//# sourceMappingURL=use-proactive-token-refresh.d.ts.map

package/types/features/auth/presentation/use-proactive-token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-proactive-token-refresh.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/presentation/use-proactive-token-refresh.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAO,IA8C3C,CAAC"}

package/types/features/auth/store/auth-store.d.ts

@@ -0,0 +1,40 @@
+import { type StoreApi } from 'zustand/vanilla';
+import type { AuthSession } from '../domain';
+import type { CompleteSsoLoginUseCase, LogoutUseCase, RefreshSessionUseCase, RestoreSessionUseCase } from '../application';
+export type AuthStatus = 'initializing' | 'authenticating' | 'authenticated' | 'unauthenticated';
+export interface AuthState {
+    readonly status: AuthStatus;
+    readonly session: AuthSession | null;
+    readonly error: string | null;
+    /** Where to send the browser to start a UAPP SSO sign-in (built once at composition). */
+    readonly loginUrl: string;
+    /** Restore a persisted session on app start. Safe to call once. */
+    initialize: () => Promise<void>;
+    /**
+     * Finish a UAPP SSO sign-in with the one-time secret returned to the callback. Returns true on
+     * success so the callback page can navigate without subscribing to state.
+     */
+    completeLogin: (secret: string) => Promise<boolean>;
+    logout: () => Promise<void>;
+    /** Silently refresh the active session. Returns true if a fresh token is now available. */
+    refreshSession: () => Promise<boolean>;
+    clearError: () => void;
+}
+/**
+ * Dependencies the store delegates to. The store holds NO business logic — it owns UI state and
+ * forwards intent to use cases. This keeps it thin (no "fat store" smell) and makes it trivial to
+ * test with fake use cases.
+ */
+export interface AuthStoreDeps {
+    readonly completeSsoLoginUseCase: CompleteSsoLoginUseCase;
+    readonly logoutUseCase: LogoutUseCase;
+    readonly restoreSessionUseCase: RestoreSessionUseCase;
+    readonly refreshSessionUseCase: RefreshSessionUseCase;
+    /** Bridge to the HTTP layer so authorized requests carry the current bearer token. */
+    readonly setAccessToken: (token: string | null) => void;
+    /** Pre-built UAPP SSO authorize URL (origin-aware), exposed to the login screen. */
+    readonly loginUrl: string;
+}
+export type AuthStore = StoreApi<AuthState>;
+export declare const createAuthStore: (deps: AuthStoreDeps) => AuthStore;
+//# sourceMappingURL=auth-store.d.ts.map

package/types/features/auth/store/auth-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/store/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EACV,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,UAAU,GAClB,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC;;;OAGG;IACH,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,2FAA2F;IAC3F,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAC1D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IACtD,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IACtD,sFAAsF;IACtF,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACxD,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;AAE5C,eAAO,MAAM,eAAe,GAAI,MAAM,aAAa,KAAG,SAuDjD,CAAC"}

package/types/features/auth/store/index.d.ts

@@ -0,0 +1,2 @@
+export * from './auth-store';
+//# sourceMappingURL=index.d.ts.map

package/types/features/auth/store/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/features/auth/store/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC"}

package/types/features/calls/application/index.d.ts

@@ -0,0 +1,5 @@
+export { StartCallUseCase, type StartCallUseCaseDeps } from './use-cases/start-call';
+export { AcceptCallUseCase, type AcceptCallUseCaseDeps } from './use-cases/accept-call';
+export { DeclineCallUseCase, CancelCallUseCase, EndCallUseCase, type CallSignalUseCaseDeps, } from './use-cases/respond-call';
+export { GetCallHistoryUseCase, type GetCallHistoryUseCaseDeps, } from './use-cases/get-call-history';
+//# sourceMappingURL=index.d.ts.map

package/types/features/calls/application/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/features/calls/application/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,KAAK,yBAAyB,GAC/B,MAAM,8BAA8B,CAAC"}

package/types/features/calls/application/use-cases/accept-call.d.ts

@@ -0,0 +1,15 @@
+import type { Logger } from '@core/logger';
+import type { Result } from '@core/result';
+import type { CallError, CallGateway, CallJoinTicket } from '../../domain';
+export interface AcceptCallUseCaseDeps {
+    readonly callGateway: CallGateway;
+    readonly logger: Logger;
+}
+/** Answers a ringing call — returns the callee's own join ticket for the media room. */
+export declare class AcceptCallUseCase {
+    private readonly callGateway;
+    private readonly logger;
+    constructor(deps: AcceptCallUseCaseDeps);
+    execute(callId: string): Promise<Result<CallJoinTicket, CallError>>;
+}
+//# sourceMappingURL=accept-call.d.ts.map

package/types/features/calls/application/use-cases/accept-call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accept-call.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/calls/application/use-cases/accept-call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wFAAwF;AACxF,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,qBAAqB;IAKjC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;CAOjF"}

package/types/features/calls/application/use-cases/get-call-history.d.ts

@@ -0,0 +1,15 @@
+import type { Logger } from '@core/logger';
+import type { Result } from '@core/result';
+import type { CallError, CallGateway, CallHistoryPage } from '../../domain';
+export interface GetCallHistoryUseCaseDeps {
+    readonly callGateway: CallGateway;
+    readonly logger: Logger;
+}
+/** Reads a page of the viewer's call history (newest first). */
+export declare class GetCallHistoryUseCase {
+    private readonly callGateway;
+    private readonly logger;
+    constructor(deps: GetCallHistoryUseCaseDeps);
+    execute(skipCount?: number, maxResultCount?: number): Promise<Result<CallHistoryPage, CallError>>;
+}
+//# sourceMappingURL=get-call-history.d.ts.map

package/types/features/calls/application/use-cases/get-call-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-call-history.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/calls/application/use-cases/get-call-history.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE5E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gEAAgE;AAChE,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,yBAAyB;IAKrC,OAAO,CAClB,SAAS,SAAI,EACb,cAAc,SAAK,GAClB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;CAO/C"}

package/types/features/calls/application/use-cases/respond-call.d.ts

@@ -0,0 +1,29 @@
+import type { Logger } from '@core/logger';
+import type { Result } from '@core/result';
+import type { CallError, CallGateway } from '../../domain';
+export interface CallSignalUseCaseDeps {
+    readonly callGateway: CallGateway;
+    readonly logger: Logger;
+}
+/** Callee rejects a ringing call. */
+export declare class DeclineCallUseCase {
+    private readonly callGateway;
+    private readonly logger;
+    constructor(deps: CallSignalUseCaseDeps);
+    execute(callId: string): Promise<Result<void, CallError>>;
+}
+/** Caller aborts their own still-ringing call. */
+export declare class CancelCallUseCase {
+    private readonly callGateway;
+    private readonly logger;
+    constructor(deps: CallSignalUseCaseDeps);
+    execute(callId: string): Promise<Result<void, CallError>>;
+}
+/** Either party hangs up a connected call. */
+export declare class EndCallUseCase {
+    private readonly callGateway;
+    private readonly logger;
+    constructor(deps: CallSignalUseCaseDeps);
+    execute(callId: string): Promise<Result<void, CallError>>;
+}
+//# sourceMappingURL=respond-call.d.ts.map

package/types/features/calls/application/use-cases/respond-call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"respond-call.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/calls/application/use-cases/respond-call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qCAAqC;AACrC,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,qBAAqB;IAKjC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;CAOvE;AAED,kDAAkD;AAClD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,qBAAqB;IAKjC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;CAOvE;AAED,8CAA8C;AAC9C,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,qBAAqB;IAKjC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;CAOvE"}

package/types/features/calls/application/use-cases/start-call.d.ts

@@ -0,0 +1,15 @@
+import type { Logger } from '@core/logger';
+import type { Result } from '@core/result';
+import type { CallError, CallGateway, CallMediaType, StartCallResult } from '../../domain';
+export interface StartCallUseCaseDeps {
+    readonly callGateway: CallGateway;
+    readonly logger: Logger;
+}
+/** Places a call to a peer. Returns the ringing result (+ caller join ticket) or callee_unavailable. */
+export declare class StartCallUseCase {
+    private readonly callGateway;
+    private readonly logger;
+    constructor(deps: StartCallUseCaseDeps);
+    execute(calleeUserId: string, type?: CallMediaType): Promise<Result<StartCallResult, CallError>>;
+}
+//# sourceMappingURL=start-call.d.ts.map

package/types/features/calls/application/use-cases/start-call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-call.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/calls/application/use-cases/start-call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EACV,SAAS,EACT,WAAW,EACX,aAAa,EACb,eAAe,EAChB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wGAAwG;AACxG,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,oBAAoB;IAKhC,OAAO,CAClB,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE,aAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;CAO/C"}