valtech-components 2.0.795 → 2.0.796

package/lib/services/auth/handoff.service.d.ts

@@ -0,0 +1,159 @@
+import { HttpClient } from '@angular/common/http';
+import { Router } from '@angular/router';
+import { Observable } from 'rxjs';
+import { AuthService } from './auth.service';
+import { ValtechAuthConfig } from './types';
+import * as i0 from "@angular/core";
+/**
+ * Name of the query param that carries the handoff token. Apps may override
+ * via `detectAndExchangeHandoff({ tokenParam })` but the default keeps the
+ * convention consistent across the factory.
+ */
+export declare const HANDOFF_TOKEN_PARAM = "handoff";
+/**
+ * Name of the query param that carries the post-exchange route.
+ */
+export declare const HANDOFF_ROUTE_PARAM = "route";
+/**
+ * Options for `HandoffService.detectAndExchangeHandoff`.
+ */
+export interface DetectAndExchangeOptions {
+    /** Override the query param name. Default: `'handoff'`. */
+    tokenParam?: string;
+    /** Override the route param name. Default: `'route'`. */
+    routeParam?: string;
+    /** Where to navigate if no route param is present. Default: `'/'`. */
+    defaultRoute?: string;
+    /** Where to navigate on exchange error. Default: app's configured `loginRoute`. */
+    errorRoute?: string;
+}
+/**
+ * Request body for `POST /v2/auth/handoff`.
+ *
+ * Both fields are optional and stored for audit only — the exchange step
+ * does not enforce that the redeeming app matches `targetAppId`.
+ */
+export interface HandoffCreateRequest {
+    /** Target app the handoff is intended for (e.g. `"myvaltech"`). Audit-only. */
+    targetAppId?: string;
+    /** Route the target app should navigate to after exchange. Echoed back. */
+    route?: string;
+}
+/**
+ * Response body from `POST /v2/auth/handoff`.
+ */
+export interface HandoffCreateResponse {
+    operationId: string;
+    /** Raw token to embed in the redirect URL as `?handoff=<token>`. 30s TTL, single-use. */
+    token: string;
+    /** RFC3339 expiration timestamp. */
+    expiresAt: string;
+    /** Echoed `route` from the request, when provided. */
+    route?: string;
+    /**
+     * Absolute base URL of the target app (e.g. `"https://sigify.com"`).
+     *
+     * When present, callers should use this as the destination for the redirect.
+     * Backend resolves it from the `app-config` table (single source of truth).
+     *
+     * Optional for backward compatibility — when missing, callers may fall back
+     * to a client-side `appUrls` mapping.
+     */
+    targetBaseUrl?: string;
+}
+/**
+ * Response body from `POST /v2/auth/handoff/exchange`.
+ *
+ * Same shape as `SigninResponse` — installable via `AuthService.setExternalAuth`.
+ */
+export interface HandoffExchangeResponse {
+    operationId: string;
+    accessToken: string;
+    refreshToken: string;
+    firebaseToken?: string;
+    expiresIn: number;
+    tokenType: string;
+    userId: string;
+}
+/**
+ * HandoffService — cross-app session transfer.
+ *
+ * Implements the OAuth Authorization Code pattern, applied internally between
+ * apps that share the same backend.
+ *
+ * **Origin app (user is authenticated):**
+ *
+ * ```typescript
+ * const { token, route } = await firstValueFrom(
+ *   handoff.createHandoff({ targetAppId: 'myvaltech', route: '/app/dashboard' })
+ * );
+ * window.location.href = `https://myvaltech.app/?handoff=${token}&route=${encodeURIComponent(route ?? '/')}`;
+ * ```
+ *
+ * **Target app (boot):** call `exchangeHandoff(token)`. On success, the session
+ * is installed (`AuthService.setExternalAuth`) and the user is authenticated.
+ * See `detectAndExchangeHandoff` helper for the typical bootstrap pattern.
+ *
+ * Security notes:
+ * - Token is single-use and short-lived (30s) — enforced server-side.
+ * - Token in URL must be removed from history after exchange to avoid log leakage.
+ * - The exchange endpoint is public; do NOT add auth header. The
+ *   `HttpClient` request below avoids triggering the auth interceptor since the
+ *   user isn't logged in yet on the target app.
+ */
+export declare class HandoffService {
+    private config;
+    private http;
+    private auth;
+    private router;
+    private detected;
+    constructor(config: ValtechAuthConfig, http: HttpClient, auth: AuthService, router: Router);
+    /**
+     * Create a handoff token. Caller must be authenticated.
+     *
+     * @param request Optional metadata: target app id and intended route.
+     * @returns Observable emitting `{ token, expiresAt, route? }`.
+     */
+    createHandoff(request?: HandoffCreateRequest): Observable<HandoffCreateResponse>;
+    /**
+     * Exchange a handoff token for a session and install it.
+     *
+     * On success, the response is piped through `AuthService.setExternalAuth`
+     * so the user becomes authenticated. Subsequent navigation can proceed.
+     *
+     * On failure, the observable errors. The caller is responsible for
+     * showing an error and routing to `/login`.
+     *
+     * @param token Raw handoff token read from the URL.
+     */
+    exchangeHandoff(token: string): Observable<HandoffExchangeResponse>;
+    /**
+     * Bootstrap helper — reads the handoff token from the current URL, exchanges
+     * it for a session, and navigates to the intended route with the token
+     * stripped from history.
+     *
+     * Idempotent: subsequent calls are no-ops. Wire from an
+     * `APP_INITIALIZER`/`provideAppInitializer` factory in `main.ts`.
+     *
+     * ```typescript
+     * // main.ts
+     * provideAppInitializer(() => inject(HandoffService).detectAndExchangeHandoff())
+     * ```
+     *
+     * On error (expired/used/invalid token), redirects to `errorRoute` (default:
+     * the app's configured `loginRoute`). The URL is always cleaned, even on
+     * error, so the token cannot be retried by refreshing the page.
+     *
+     * @returns `true` if a handoff was detected and processed (success or fail).
+     *          `false` if no token was present (cold boot, normal flow).
+     */
+    detectAndExchangeHandoff(options?: DetectAndExchangeOptions): Promise<boolean>;
+    /**
+     * Persist the session in `AuthService`. Mirrors the install flow used by
+     * the normal signin path so timers, Firebase, and tab-sync all kick in.
+     */
+    private installSession;
+    private get baseUrl();
+    static ɵfac: i0.ɵɵFactoryDeclaration<HandoffService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<HandoffService>;
+}

package/lib/services/auth/index.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Valtech Auth Service
+ *
+ * Servicio de autenticación reutilizable para aplicaciones Angular.
+ * Proporciona autenticación con AuthV2, MFA, sincronización entre pestañas,
+ * refresh proactivo de tokens, y registro automático de dispositivos para
+ * push notifications.
+ *
+ * @example
+ * ```typescript
+ * // En main.ts
+ * import { bootstrapApplication } from '@angular/platform-browser';
+ * import { provideValtechAuth, provideValtechFirebase } from 'valtech-components';
+ * import { environment } from './environments/environment';
+ *
+ * bootstrapApplication(AppComponent, {
+ *   providers: [
+ *     provideValtechFirebase(environment.firebase),
+ *     provideValtechAuth({
+ *       apiUrl: environment.apiUrl,
+ *       enableFirebaseIntegration: true,
+ *       enableDeviceRegistration: true, // Auto-registra dispositivos para push
+ *     }),
+ *   ],
+ * });
+ *
+ * // En app.routes.ts
+ * import { authGuard, guestGuard, permissionGuard } from 'valtech-components';
+ *
+ * const routes: Routes = [
+ *   { path: 'login', canActivate: [guestGuard], loadComponent: () => import('./login.page') },
+ *   { path: 'dashboard', canActivate: [authGuard], loadComponent: () => import('./dashboard.page') },
+ *   { path: 'admin', canActivate: [authGuard, permissionGuard('admin:*')], loadComponent: () => import('./admin.page') },
+ * ];
+ *
+ * // En componentes
+ * import { AuthService } from 'valtech-components';
+ *
+ * @Component({...})
+ * export class LoginComponent {
+ *   private auth = inject(AuthService);
+ *
+ *   async login() {
+ *     await firstValueFrom(this.auth.signin({ email, password }));
+ *     if (this.auth.mfaPending().required) {
+ *       // Mostrar UI de MFA
+ *     } else {
+ *       this.router.navigate(['/dashboard']);
+ *     }
+ *   }
+ *
+ *   // Habilitar notificaciones push (solicita permisos + registra dispositivo)
+ *   async enableNotifications() {
+ *     const result = await this.auth.enableNotifications();
+ *     if (result.granted) {
+ *       console.log('Notificaciones habilitadas');
+ *     }
+ *   }
+ *
+ *   // Verificar estado de permisos
+ *   get canReceiveNotifications(): boolean {
+ *     return this.auth.getNotificationPermissionState() === 'granted';
+ *   }
+ *
+ *   // En template: usar signals directamente
+ *   // {{ auth.user()?.email }}
+ *   // @if (auth.hasPermission('templates:edit')) { ... }
+ * }
+ * ```
+ */
+export * from './types';
+export { VALTECH_AUTH_CONFIG, provideValtechAuth, provideValtechAuthInterceptor, DEFAULT_AUTH_CONFIG, } from './config';
+export { AuthService } from './auth.service';
+export { authGuard, guestGuard, permissionGuard, permissionGuardFromRoute, superAdminGuard, roleGuard, } from './guards';
+export { authInterceptor } from './interceptor';
+export { AuthStateService } from './auth-state.service';
+export { TokenService } from './token.service';
+export { AuthStorageService } from './storage.service';
+export { AuthSyncService } from './sync.service';
+export { DeviceService } from './device.service';
+export { SessionService } from './session.service';
+export { OAuthService } from './oauth.service';
+export { OAuthCallbackComponent } from './oauth-callback.component';
+export { HandoffService, HANDOFF_TOKEN_PARAM, HANDOFF_ROUTE_PARAM } from './handoff.service';
+export type { HandoffCreateRequest, HandoffCreateResponse, HandoffExchangeResponse, DetectAndExchangeOptions, } from './handoff.service';
+export { OrgSwitchService } from './org-switch.service';
+export type { OrgChangedEvent, SwitchOrgOptions } from './org-switch.service';
+export { NotificationActionService } from './notification-action.service';
+export type { NotificationOpenResult } from './notification-action.service';

package/lib/services/auth/interceptor.d.ts

@@ -0,0 +1,22 @@
+import { HttpInterceptorFn } from '@angular/common/http';
+/**
+ * Interceptor HTTP que:
+ * 1. Agrega header Authorization con Bearer token a requests API
+ * 2. Maneja errores 401 refrescando el token automáticamente
+ * 3. Encola requests durante el refresco para evitar múltiples refresh
+ *
+ * @example
+ * ```typescript
+ * // Incluido automáticamente por provideValtechAuth()
+ * // Para uso manual:
+ * import { provideHttpClient, withInterceptors } from '@angular/common/http';
+ * import { authInterceptor } from 'valtech-components';
+ *
+ * bootstrapApplication(AppComponent, {
+ *   providers: [
+ *     provideHttpClient(withInterceptors([authInterceptor])),
+ *   ],
+ * });
+ * ```
+ */
+export declare const authInterceptor: HttpInterceptorFn;

package/lib/services/auth/notification-action.service.d.ts

@@ -0,0 +1,34 @@
+import { Router } from '@angular/router';
+import { AuthService } from './auth.service';
+import { HandoffService } from './handoff.service';
+import { OrgSwitchService } from './org-switch.service';
+import { ValtechAuthConfig } from './types';
+import { NotificationDocument, NotificationsService } from '../firebase/notifications.service';
+import * as i0 from "@angular/core";
+/** Resultado descriptivo del open() — útil para tests y telemetría. */
+export type NotificationOpenResult = 'navigated' | 'navigated-after-switch-org' | 'redirected-cross-app' | 'no-action-route' | 'cross-app-unconfigured' | 'handoff-failed';
+export declare class NotificationActionService {
+    private config;
+    private auth;
+    private orgSwitch;
+    private handoff;
+    private notifications;
+    private router;
+    constructor(config: ValtechAuthConfig, auth: AuthService, orgSwitch: OrgSwitchService, handoff: HandoffService, notifications: NotificationsService, router: Router);
+    /**
+     * Abre la notificación: marca como leída, switch-org si toca, navegación local o
+     * redirect cross-app vía handoff.
+     *
+     * No lanza errores hacia la UI — devuelve un resultado descriptivo. Errores
+     * técnicos quedan en console.warn.
+     */
+    open(notif: NotificationDocument): Promise<NotificationOpenResult>;
+    private activeOrg;
+    /**
+     * Construye URL absoluta para handoff cross-app preservando pathname y otros
+     * params existentes de la baseUrl.
+     */
+    private buildHandoffUrl;
+    static ɵfac: i0.ɵɵFactoryDeclaration<NotificationActionService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<NotificationActionService>;
+}

package/lib/services/auth/oauth-callback.component.d.ts

@@ -0,0 +1,34 @@
+import { OnInit } from '@angular/core';
+import * as i0 from "@angular/core";
+/**
+ * Componente de callback para OAuth.
+ *
+ * Este componente procesa la respuesta del servidor OAuth y envía
+ * los tokens a la ventana padre via postMessage.
+ *
+ * Debe agregarse a las rutas de la aplicación:
+ * ```typescript
+ * // app.routes.ts
+ * import { OAuthCallbackComponent } from 'valtech-components';
+ *
+ * export const routes: Routes = [
+ *   { path: 'auth/oauth/callback', component: OAuthCallbackComponent },
+ *   // ... otras rutas
+ * ];
+ * ```
+ *
+ * El backend redirige a esta ruta con los tokens en query params:
+ * `/auth/oauth/callback?access_token=xxx&refresh_token=xxx&expires_in=900`
+ *
+ * O con error:
+ * `/auth/oauth/callback?error=INVALID_CODE&error_description=...`
+ */
+export declare class OAuthCallbackComponent implements OnInit {
+    message: string;
+    ngOnInit(): void;
+    private processCallback;
+    private sendToParent;
+    private closeAfterDelay;
+    static ɵfac: i0.ɵɵFactoryDeclaration<OAuthCallbackComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<OAuthCallbackComponent, "val-oauth-callback", never, {}, {}, never, never, true, never>;
+}

package/lib/services/auth/oauth.service.d.ts

@@ -0,0 +1,99 @@
+import { NgZone } from '@angular/core';
+import { Observable } from 'rxjs';
+import { ValtechAuthConfig, OAuthProvider, OAuthResult, LinkedProvider, HasPasswordResponse } from './types';
+import { HttpClient } from '@angular/common/http';
+import * as i0 from "@angular/core";
+/**
+ * Servicio de OAuth para login social.
+ *
+ * Implementa flujo OAuth server-side con popup:
+ * 1. Frontend abre popup hacia backend
+ * 2. Backend redirige a provider (Google, Apple, Microsoft)
+ * 3. Usuario autoriza
+ * 4. Backend intercambia code, genera JWT, redirige con tokens
+ * 5. Popup envía tokens a ventana padre via postMessage
+ *
+ * @example
+ * ```typescript
+ * import { OAuthService, AuthService } from 'valtech-components';
+ *
+ * @Component({...})
+ * export class LoginComponent {
+ *   private oauth = inject(OAuthService);
+ *   private auth = inject(AuthService);
+ *
+ *   async loginWithGoogle() {
+ *     this.oauth.startFlow('google').subscribe({
+ *       next: (result) => {
+ *         // Tokens recibidos, guardar en auth state
+ *         this.auth.handleOAuthSuccess(result);
+ *         this.router.navigate(['/']);
+ *       },
+ *       error: (error) => {
+ *         console.error('OAuth failed:', error);
+ *       }
+ *     });
+ *   }
+ * }
+ * ```
+ */
+export declare class OAuthService {
+    private config;
+    private http;
+    private ngZone;
+    private popup;
+    private messageHandler;
+    private checkClosedInterval;
+    constructor(config: ValtechAuthConfig, http: HttpClient, ngZone: NgZone);
+    /**
+     * Inicia flujo OAuth en popup.
+     * Retorna Observable que emite cuando el usuario completa el flujo.
+     *
+     * @param provider - Proveedor OAuth ('google', 'apple', 'microsoft')
+     * @returns Observable que emite OAuthResult o error
+     */
+    startFlow(provider: OAuthProvider): Observable<OAuthResult>;
+    /**
+     * Inicia flujo de linking para vincular un proveedor adicional.
+     * Requiere que el usuario esté autenticado.
+     *
+     * @param provider - Proveedor OAuth a vincular
+     * @returns Observable que emite cuando se completa el linking
+     */
+    startLinkFlow(provider: OAuthProvider): Observable<OAuthResult>;
+    /**
+     * Obtiene los proveedores OAuth vinculados al usuario.
+     */
+    getLinkedProviders(): Observable<LinkedProvider[]>;
+    /**
+     * Desvincula un proveedor OAuth.
+     */
+    unlinkProvider(provider: OAuthProvider): Observable<{
+        success: boolean;
+    }>;
+    /**
+     * Establece contraseña para usuarios que solo tienen OAuth.
+     */
+    setPassword(password: string): Observable<{
+        success: boolean;
+    }>;
+    /**
+     * Verifica si el usuario tiene contraseña establecida.
+     */
+    hasPassword(): Observable<HasPasswordResponse>;
+    /**
+     * Revisa localStorage por datos de callback OAuth (fallback para COOP).
+     * Solo acepta datos recientes (últimos 30 segundos).
+     */
+    private checkLocalStorageFallback;
+    /**
+     * Limpia datos de fallback de localStorage.
+     */
+    private clearLocalStorageFallback;
+    /**
+     * Limpia recursos del popup.
+     */
+    private cleanup;
+    static ɵfac: i0.ɵɵFactoryDeclaration<OAuthService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<OAuthService>;
+}

package/lib/services/auth/org-switch.service.d.ts

@@ -0,0 +1,127 @@
+import { Observable } from 'rxjs';
+import { AuthService } from './auth.service';
+import * as i0 from "@angular/core";
+/**
+ * Event emitted when the active organization changes.
+ */
+export interface OrgChangedEvent {
+    /** Org the user was on before the switch. May be empty on first sign-in. */
+    previousOrg: string;
+    /** Org the user just switched to. */
+    newOrg: string;
+}
+/**
+ * Options for `OrgSwitchService.switchTo`.
+ */
+export interface SwitchOrgOptions {
+    /**
+     * If `true`, after the switch succeeds the page is fully reloaded via
+     * `window.location.reload()`. Useful for apps with significant in-memory
+     * state tied to the previous org that's hard to invalidate piece by piece.
+     *
+     * Trade-off: reload loses all in-memory state (forms, scroll position).
+     * Default: `false` — relies on `orgChanged$` and `auth.user()` signal
+     * propagation for components to react.
+     */
+    reload?: boolean;
+}
+/**
+ * OrgSwitchService — orchestrates active organization changes across the app.
+ *
+ * Built on top of `AuthService.switchOrg`, which already:
+ * - Hits `POST /v2/auth/switch-org` and receives a new Firebase custom token.
+ * - Re-authenticates Firebase Auth with the new token (RBAC claims update).
+ * - Broadcasts `ORG_SWITCH` to other tabs via `AuthSyncService` (multi-tab sync).
+ *
+ * What this service adds on top:
+ * - A `switching` signal so the UI can show a loading indicator (1-2s switch).
+ * - An `orgChanged$` Observable that components subscribe to in order to
+ *   invalidate their org-scoped caches (e.g. drop old query results, reset
+ *   page state) without a full page reload.
+ * - Optional `reload: true` for apps where invalidating in-memory state piece
+ *   by piece is impractical.
+ *
+ * **What this service does NOT do automatically:**
+ *
+ * 1. **Teardown Firestore listeners.** Listeners are owned by their subscribing
+ *    components (typically via `takeUntilDestroyed` or async pipe). When the
+ *    component re-renders or unsubscribes, the listener disposes. If a
+ *    component does NOT unsubscribe on org change, its listener will keep
+ *    pointing at the previous org's path and may start failing rules. The fix
+ *    is component-level: subscribe to `orgChanged$` and reset state, or use
+ *    the `reload: true` option.
+ *
+ * 2. **Re-instantiate routed components.** Angular keeps mounted components
+ *    alive across navigations. If you need fresh state, either subscribe to
+ *    `orgChanged$` in the component, or use `reload: true`.
+ *
+ * @example Basic switch with loading state
+ * ```typescript
+ * private orgSwitch = inject(OrgSwitchService);
+ *
+ * async onSwitchOrg(orgId: string) {
+ *   await this.orgSwitch.switchTo(orgId);
+ *   // Components subscribed to orgChanged$ have already reset their state.
+ * }
+ *
+ * // In template:
+ * @if (orgSwitch.switching()) { <val-loading /> }
+ * ```
+ *
+ * @example Component reacting to org change
+ * ```typescript
+ * private orgSwitch = inject(OrgSwitchService);
+ *
+ * constructor() {
+ *   this.orgSwitch.orgChanged$
+ *     .pipe(takeUntilDestroyed())
+ *     .subscribe(() => this.resetState());
+ * }
+ * ```
+ *
+ * @example Brutal reload mode
+ * ```typescript
+ * await this.orgSwitch.switchTo(orgId, { reload: true });
+ * // window.location.reload() — clean slate, loses scroll position
+ * ```
+ */
+export declare class OrgSwitchService {
+    private auth;
+    private readonly _switching;
+    private readonly _orgChanged;
+    /**
+     * `true` while a switch is in flight. UI should disable interactions
+     * with org-scoped data and show a loading indicator.
+     */
+    readonly switching: import("@angular/core").Signal<boolean>;
+    /**
+     * Fires after a successful switch, with the previous and new org ids.
+     * Components subscribe to invalidate caches / reset state.
+     *
+     * Fires AFTER the Firebase re-auth completes — listeners attached here
+     * see the updated Firebase user / activeOrg claim.
+     */
+    readonly orgChanged$: Observable<OrgChangedEvent>;
+    constructor(auth: AuthService);
+    /**
+     * Switch the user's active organization.
+     *
+     * Re-entrant safe: while a switch is in flight, additional calls are
+     * rejected silently (returns immediately). Inspect `switching()` to gate UI.
+     *
+     * @param orgId Target organization id. Must be one the user has a role in
+     *              — backend rejects otherwise with `PERMISSION_DENIED`.
+     * @param options See `SwitchOrgOptions`.
+     *
+     * @throws The error from `auth.switchOrg` if the backend call fails.
+     *         `switching` returns to `false` before the error propagates.
+     */
+    switchTo(orgId: string, options?: SwitchOrgOptions): Promise<void>;
+    /**
+     * Read the current `activeOrg` from the auth user signal.
+     * Falls back to empty string if the user isn't loaded yet.
+     */
+    private currentActiveOrg;
+    static ɵfac: i0.ɵɵFactoryDeclaration<OrgSwitchService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<OrgSwitchService>;
+}

package/lib/services/auth/session.service.d.ts

@@ -0,0 +1,60 @@
+import { HttpClient } from '@angular/common/http';
+import { Observable } from 'rxjs';
+import { ValtechAuthConfig, SessionInfo, RevokeSessionsResponse } from './types';
+import * as i0 from "@angular/core";
+/**
+ * Servicio para gestión de sesiones activas del usuario.
+ * Permite listar y revocar sesiones.
+ *
+ * @example
+ * ```typescript
+ * import { SessionService } from 'valtech-components';
+ *
+ * @Component({...})
+ * export class SessionsPage {
+ *   private sessionService = inject(SessionService);
+ *
+ *   sessions = signal<SessionInfo[]>([]);
+ *
+ *   async ngOnInit() {
+ *     const sessions = await firstValueFrom(this.sessionService.listSessions());
+ *     this.sessions.set(sessions);
+ *   }
+ *
+ *   async revokeSession(sessionId: string) {
+ *     await firstValueFrom(this.sessionService.revokeSession(sessionId));
+ *     // Recargar lista
+ *   }
+ *
+ *   async revokeAllOthers() {
+ *     const result = await firstValueFrom(this.sessionService.revokeAllSessions());
+ *     console.log(`${result.sessionsRevoked} sesiones cerradas`);
+ *   }
+ * }
+ * ```
+ */
+export declare class SessionService {
+    private config;
+    private http;
+    constructor(config: ValtechAuthConfig, http: HttpClient);
+    private get baseUrl();
+    /**
+     * Lista todas las sesiones activas del usuario.
+     * La sesión actual está marcada con isCurrent=true.
+     */
+    listSessions(): Observable<SessionInfo[]>;
+    /**
+     * Revoca una sesión específica.
+     * Fuerza el cierre de sesión en ese dispositivo/navegador.
+     */
+    revokeSession(sessionId: string): Observable<RevokeSessionsResponse>;
+    /**
+     * Revoca todas las sesiones excepto la actual.
+     * Útil para "cerrar sesión en todos los dispositivos".
+     *
+     * @returns Número de sesiones revocadas
+     */
+    revokeAllSessions(): Observable<RevokeSessionsResponse>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<SessionService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<SessionService>;
+}

package/lib/services/auth/storage.service.d.ts

@@ -0,0 +1,52 @@
+import { StoredAuthState, GetPermissionsResponse, ValtechAuthConfig } from './types';
+import * as i0 from "@angular/core";
+/**
+ * Servicio para persistencia de estado de autenticación en localStorage.
+ */
+export declare class AuthStorageService {
+    private config;
+    private keys;
+    constructor(config: ValtechAuthConfig);
+    /**
+     * Guarda el estado completo de autenticación.
+     */
+    saveState(state: StoredAuthState): void;
+    /**
+     * Carga el estado de autenticación desde storage.
+     */
+    loadState(): Partial<StoredAuthState>;
+    /**
+     * Guarda solo el access token.
+     */
+    saveAccessToken(token: string, expiresAt?: number): void;
+    /**
+     * Guarda el refresh token (token rotation).
+     */
+    saveRefreshToken(token: string): void;
+    /**
+     * Guarda los permisos actualizados.
+     */
+    savePermissions(response: GetPermissionsResponse): void;
+    /**
+     * Carga los permisos desde storage.
+     */
+    loadPermissions(): {
+        roles: string[];
+        permissions: string[];
+        isSuperAdmin: boolean;
+    };
+    /**
+     * Obtiene el refresh token.
+     */
+    getRefreshToken(): string | null;
+    /**
+     * Limpia todo el estado de autenticación.
+     */
+    clear(): void;
+    /**
+     * Verifica si hay estado guardado.
+     */
+    hasStoredState(): boolean;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AuthStorageService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<AuthStorageService>;
+}