Merge origin/WorkflowChange into logestic_chnage

Resolves conflicts:
- LicenseReviewPage: dropped a duplicated schedule-issuance ActionIcon,
  keeping the Tooltip-wrapped one and adding scheduledPeriod (required
  by the scheduleIssuance mutation) to it.
- portal i18n (en.ts/am.ts): both sides added distinct keys under
  licensing.card (reportDamaged/reissueFailed vs status/statusReason) —
  kept both, additive.
- licensing.helpers.ts: kept sectionAppliesToKind (this branch) and
  switched to the centralized BASE_API_URL import from
  base-api/base-query-with-reauth (WorkflowChange), dropping the local
  duplicate constant.

libs/api/src/lib/base-api/base-query-with-reauth.ts

@@ -2,10 +2,15 @@ import { fetchBaseQuery, type BaseQueryFn } from "@reduxjs/toolkit/query/react";
 import type { FetchArgs, FetchBaseQueryError } from "@reduxjs/toolkit/query";
 import { resolveSessionContext } from "../session";
 
+/**
+ * The one place the backend URL is resolved: VITE_BASE_API_URL from the env,
+ * falling back to the local dev API (3001 — the portal itself owns 3000 for
+ * the Fayda redirect). Import this; do not re-derive it.
+ */
 export const BASE_API_URL =
   (import.meta as { env?: Record<string, string> }).env?.[
     "VITE_BASE_API_URL"
-  ] ?? "http://localhost:3000/api";
+  ]?.trim() || "http://localhost:3001/api";
 
 let _onTokenExpired: (() => Promise<string>) | null = null;
 let _onAuthFailure: (() => void) | null = null;

libs/api/src/lib/features/biometric-enrollment/biometric-enrollment-api.ts

@@ -0,0 +1,67 @@
+import { baseApi } from '../../base-api';
+import type { BiometricEnrollment, EnrollBiometric } from './biometric-enrollment.types';
+
+const TAG = 'BiometricEnrollment' as const;
+const forProfile = (profileId: string) => ({ type: TAG, id: profileId }) as const;
+
+/**
+ * Scanner capture (fingerprint, face) stored per profile. No applicant-facing
+ * endpoint — enrollment happens at a counter with a scanner.
+ */
+export const biometricEnrollmentApi = baseApi
+  .enhanceEndpoints({ addTagTypes: [TAG] })
+  .injectEndpoints({
+    endpoints: (builder) => ({
+      enrollBiometric: builder.mutation<BiometricEnrollment, EnrollBiometric>({
+        query: (body) => ({ url: '/biometric-enrollments', method: 'POST', body }),
+        invalidatesTags: (r, error) => (error || !r ? [] : [forProfile(r.profileId)]),
+      }),
+
+      getBiometricEnrollments: builder.query<BiometricEnrollment[], string>({
+        query: (profileId) => ({ url: `/biometric-enrollments/profile/${profileId}` }),
+        providesTags: (_r, _e, profileId) => [forProfile(profileId)],
+      }),
+
+      /** Self-service, view-only: the caller's own live enrollments. */
+      getMyBiometricEnrollments: builder.query<BiometricEnrollment[], void>({
+        query: () => ({ url: '/biometric-enrollments/mine' }),
+        providesTags: [{ type: TAG, id: 'MINE' }],
+      }),
+
+      /** Dev/test only — the API reports false in production. */
+      getBiometricSimulateCapabilities: builder.query<{ simulateEnabled: boolean }, void>({
+        query: () => ({ url: '/biometric-enrollments/simulate/capabilities' }),
+      }),
+
+      revokeBiometricEnrollment: builder.mutation<
+        BiometricEnrollment,
+        { id: string; profileId: string; reason: string }
+      >({
+        query: ({ id, reason }) => ({
+          url: `/biometric-enrollments/${id}/revoke`,
+          method: 'POST',
+          body: { reason },
+        }),
+        invalidatesTags: (_r, error, { profileId }) => (error ? [] : [forProfile(profileId)]),
+      }),
+
+      /** Stamps the profile's BSID once enrollment is confirmed. Requires an active enrollment. */
+      generateBsid: builder.mutation<{ id: string; bsid: string | null }, string>({
+        query: (profileId) => ({
+          url: `/biometric-enrollments/profile/${profileId}/generate-bsid`,
+          method: 'POST',
+        }),
+        invalidatesTags: (_r, error, profileId) => (error ? [] : [forProfile(profileId)]),
+      }),
+    }),
+    overrideExisting: false,
+  });
+
+export const {
+  useEnrollBiometricMutation,
+  useGetBiometricEnrollmentsQuery,
+  useGetMyBiometricEnrollmentsQuery,
+  useGetBiometricSimulateCapabilitiesQuery,
+  useRevokeBiometricEnrollmentMutation,
+  useGenerateBsidMutation,
+} = biometricEnrollmentApi;

libs/api/src/lib/features/biometric-enrollment/biometric-enrollment.types.ts

@@ -0,0 +1,32 @@
+export type BiometricModality = 'FINGERPRINT' | 'FACE';
+export type BiometricEnrollmentStatus = 'ACTIVE' | 'REVOKED';
+
+export interface BiometricEnrollment {
+  id: string;
+  profileId: string;
+  modality: BiometricModality;
+  templateFormat: string;
+  qualityScore: number | null;
+  deviceId: string | null;
+  status: BiometricEnrollmentStatus;
+  enrolledById: string;
+  enrolledAt: string;
+  consentAt: string;
+  revokedReason: string | null;
+  revokedById: string | null;
+  revokedAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface EnrollBiometric {
+  profileId: string;
+  modality: BiometricModality;
+  /** Vendor SDK template, base64. Never the raw scan image. */
+  template: string;
+  templateFormat: string;
+  qualityScore?: number;
+  deviceId?: string;
+  /** ISO 8601 — when the subject consented to capture. */
+  consentAt: string;
+}

libs/api/src/lib/features/biometric-enrollment/index.ts

@@ -0,0 +1,2 @@
+export * from './biometric-enrollment.types';
+export * from './biometric-enrollment-api';

libs/api/src/lib/features/licensing/licensing-api.ts

@@ -866,19 +866,6 @@ export const licensingApi = baseApi
        * flight; these two *start* a stage, because under the push model
        * assignment is how work begins — nothing is claimed from a queue.
        */
-      assignReviewer: builder.mutation<
-        LicenseApplication,
-        { id: string; officerId: string; remark?: string }
-      >({
-        query: ({ id, ...body }) => ({
-          url: `/license-application-review/${id}/assign-reviewer`,
-          method: 'POST',
-          body,
-        }),
-        invalidatesTags: (_r, error, { id }) =>
-          error ? [] : [itemTag('LicenseApplication', id), listTag('ApplicationQueue')],
-      }),
-
       assignInspector: builder.mutation<
         LicenseApplication,
         { id: string; inspectorId: string; remark?: string }
@@ -1132,6 +1119,30 @@ export const licensingApi = baseApi
           error ? [] : [itemTag('LicenseApplication', applicationId), listTag('Inspection')],
       }),
 
+      /** Moves a booked visit: another day, slot, inspector or place. */
+      rescheduleInspection: builder.mutation<
+        Inspection,
+        {
+          inspectionId: string;
+          applicationId: string;
+          scheduledDate: string;
+          timeSlot: 'MORNING' | 'AFTERNOON';
+          inspectorId?: string;
+          location?: string;
+          reason?: string;
+        }
+      >({
+        query: ({ inspectionId, scheduledDate, timeSlot, inspectorId, location, reason }) => ({
+          url: `/inspections/${inspectionId}/schedule`,
+          method: 'PATCH',
+          // applicationId is for cache invalidation only; the visit knows its
+          // own application.
+          body: { scheduledDate, timeSlot, inspectorId, location, reason },
+        }),
+        invalidatesTags: (_r, error, { applicationId }) =>
+          error ? [] : [itemTag('LicenseApplication', applicationId), listTag('Inspection')],
+      }),
+
       getInspections: builder.query<Inspection[], string>({
         query: (applicationId) => ({ url: `/inspections/application/${applicationId}` }),
         providesTags: () => [listTag('Inspection')],
@@ -1280,6 +1291,7 @@ export const {
   useCreatePickupOfficeMutation,
   useUpdatePickupOfficeMutation,
   useScheduleInspectionMutation,
+  useRescheduleInspectionMutation,
   useGetInspectionsQuery,
   useRecordInspectionResultMutation,
   useGetNotificationsQuery,

libs/api/src/lib/features/licensing/licensing.helpers.ts

@@ -1,5 +1,6 @@
 import { isValidPhoneNumber } from 'libphonenumber-js';
 import { resolveTokenFromStorage } from '../../session';
+import { BASE_API_URL } from '../../base-api/base-query-with-reauth';
 import type {
   ApplicationKind,
   Bilingual,
@@ -17,10 +18,6 @@ function sectionAppliesToKind(section: FormSectionConfig, kind: ApplicationKind)
   return !section.applicationKinds?.length || section.applicationKinds.includes(kind);
 }
 
-const BASE_API_URL =
-  (import.meta as { env?: Record<string, string> }).env?.['VITE_BASE_API_URL'] ??
-  'http://localhost:3000/api';
-
 /**
  * Uploads a document straight to the API.
  *
@@ -69,6 +66,7 @@ export const STATUS_LABELS: Record<LicenseStatus, string> = {
   DRAFT: 'Draft',
   SUBMITTED: 'Submitted',
   UNDER_REVIEW: 'Under Review',
+  AWAITING_BIOMETRICS: 'Awaiting Biometrics',
   UNDER_EVALUATION: 'Under Evaluation',
   RESUBMIT_REQUIRED: 'Resubmit Required',
   INSPECTION_PENDING: 'Inspection Pending',
@@ -99,6 +97,7 @@ export const STATUS_COLORS: Record<LicenseStatus, string> = {
   DRAFT: 'gray',
   SUBMITTED: 'blue',
   UNDER_REVIEW: 'indigo',
+  AWAITING_BIOMETRICS: 'indigo',
   UNDER_EVALUATION: 'indigo',
   RESUBMIT_REQUIRED: 'orange',
   INSPECTION_PENDING: 'cyan',
@@ -138,6 +137,7 @@ export const STATUS_PROGRESS: Record<LicenseStatus, number> = {
   DRAFT: 5,
   SUBMITTED: 15,
   UNDER_REVIEW: 30,
+  AWAITING_BIOMETRICS: 30,
   UNDER_EVALUATION: 45,
   RESUBMIT_REQUIRED: 30,
   INSPECTION_PENDING: 55,
@@ -619,6 +619,49 @@ interface ConditionLike {
   anyOf?: ConditionLike[];
 }
 
+/**
+ * Section keys a condition reads, recursing `anyOf`.
+ *
+ * `FieldCondition.field` is a `sectionKey.fieldKey` path, so the prefix names
+ * the section whose answer decides the condition.
+ */
+export function conditionSections(
+  condition: FieldCondition | undefined | null,
+): string[] {
+  if (!condition) return [];
+  if (condition.anyOf) return condition.anyOf.flatMap(conditionSections);
+  if (!condition.field) return [];
+  const [sectionKey] = condition.field.split('.');
+  return sectionKey ? [sectionKey] : [];
+}
+
+/**
+ * Sections whose visibility hangs on an answer in one of `flagged`.
+ *
+ * Mirrors the server's `sectionsDependingOn`: an officer flagging the section
+ * that holds the vessel category is asking for an answer that decides which
+ * fields in other sections are required, so those sections have to open too —
+ * otherwise the applicant sees newly-required fields they cannot edit and
+ * cannot resubmit.
+ */
+export function sectionsDependingOn(
+  sections: FormSectionConfig[],
+  flagged: Set<string>,
+): Set<string> {
+  const dependent = new Set<string>();
+  if (flagged.size === 0) return dependent;
+
+  for (const section of sections) {
+    if (flagged.has(section.key)) continue;
+    const reads = [
+      section.showWhen,
+      ...(section.fields ?? []).map((field) => field.showWhen),
+    ].flatMap(conditionSections);
+    if (reads.some((key) => flagged.has(key))) dependent.add(section.key);
+  }
+  return dependent;
+}
+
 export function conditionHolds(
   condition: FieldCondition | undefined | null,
   formData: Record<string, Record<string, unknown>>,

libs/api/src/lib/features/licensing/licensing.types.ts

@@ -25,6 +25,9 @@ export type LicenseStatus =
   | "DRAFT"
   | "SUBMITTED"
   | "UNDER_REVIEW"
+  // Seafarer registration only: same slot UNDER_REVIEW occupies elsewhere,
+  // but approval is blocked until the applicant's profile has a BSID.
+  | "AWAITING_BIOMETRICS"
   | "UNDER_EVALUATION"
   // Employee filed their review; parked with the team leader for a decision.
   | "REVIEW_REPORTED"

libs/api/src/lib/features/seafarer-registration/seafarer-registration-api.ts

@@ -10,9 +10,17 @@ const TAG = 'SeafarerRegistration' as const;
 const LIST = { type: TAG, id: 'LIST' } as const;
 const item = (id: string) => ({ type: TAG, id }) as const;
 
+export type SeafarerRegistrationSortField =
+  | 'submittedAt'
+  | 'registrationNumber'
+  | 'lastName'
+  | 'status';
+
 export interface SeafarerRegistrationListFilter {
   status?: SeafarerRegistrationStatus;
   search?: string;
+  sortBy?: SeafarerRegistrationSortField;
+  sortDir?: 'ASC' | 'DESC';
   take?: number;
   skip?: number;
 }

libs/api/src/lib/session/index.ts

@@ -1,17 +1,17 @@
-import Cookies from 'js-cookie';
+import Cookies from "js-cookie";
 
 export const SESSION_HEADER_KEYS = {
-  tenantId: 'x-tenant-id',
-  organizationUnitId: 'x-organization-unit-id',
-  currentPositionId: 'x-current-position-id',
-  currentProjectId: 'x-current-project-id',
+  tenantId: "x-tenant-id",
+  organizationUnitId: "x-organization-unit-id",
+  currentPositionId: "x-current-position-id",
+  currentProjectId: "x-current-project-id",
 } as const;
 
 /**
  * Which app this bundle is, so it reads its own session and no one else's.
  *
  * Set by each app's store via `configureSessionScope`. Cookies ignore the
- * port, so `localhost:4200` and `localhost:4201` share one jar: without a
+ * port, so `localhost:3001` and `localhost:4201` share one jar: without a
  * scope the backoffice would happily authenticate as whoever last signed into
  * the portal, and render a staff console with an applicant's permissions.
  */
@@ -22,7 +22,7 @@ export function configureSessionScope(prefix: string): void {
 }
 
 /** Legacy, pre-prefix sessions. Read only when the scoped key is empty. */
-const LEGACY_TOKEN_KEY = 'auth-token';
+const LEGACY_TOKEN_KEY = "auth-token";
 
 export function resolveTokenFromStorage(): string | undefined {
   // Only this app's key, then the legacy unprefixed one. Never another app's: