@ethlete/query 6.0.0-next.32 → 6.0.0-next.34

package/fesm2022/ethlete-query.mjs

@@ -1,10 +1,10 @@
 import * as i0 from '@angular/core';
-import { inject, computed, DestroyRef, InjectionToken, Injector, EnvironmentInjector, ElementRef, ErrorHandler, createEnvironmentInjector, effect, untracked, signal, linkedSignal, runInInjectionContext, isDevMode, PLATFORM_ID, resource, DOCUMENT, makeEnvironmentProviders, assertInInjectionContext, provideEnvironmentInitializer, ChangeDetectorRef, ViewContainerRef, TemplateRef, Input, Directive, input, Pipe, ViewEncapsulation, Component, NgZone } from '@angular/core';
+import { inject, computed, DestroyRef, InjectionToken, Injector, EnvironmentInjector, ElementRef, ErrorHandler, createEnvironmentInjector, effect, untracked, signal, linkedSignal, runInInjectionContext, isDevMode, PLATFORM_ID, resource, DOCUMENT, VERSION, makeEnvironmentProviders, assertInInjectionContext, provideEnvironmentInitializer, ChangeDetectorRef, ViewContainerRef, TemplateRef, Input, Directive, input, Pipe, ViewEncapsulation, Component, NgZone } from '@angular/core';
 import { toObservable, takeUntilDestroyed, toSignal } from '@angular/core/rxjs-interop';
 import { UrlTree, Router, RedirectCommand, ActivatedRoute } from '@angular/router';
-import { filter, take, map, defer, from, Subject, Subscription, throwError, timer, switchMap, tap, retry, catchError, of, merge, firstValueFrom, fromEvent, throttleTime, interval, combineLatest, Observable, takeUntil, startWith, pairwise, BehaviorSubject, ReplaySubject, shareReplay, skip, takeWhile, EMPTY, withLatestFrom, debounceTime } from 'rxjs';
-import { defineStaticProvider, RuntimeError, clamp, randomId, defineRootProvider, isObject, injectUnsavedChangesCoordinator, injectRoute, getCookie, getDomain, deleteCookie, setCookie, createDestroy, computedTillTruthy, defineProvider, toProvideFn, toInjectFn, nextFrame, injectQueryParams, injectQueryParamChanges, clone, equal, ET_PROPERTY_REMOVED, previousSignalValue } from '@ethlete/core';
-import { HttpClient, HttpEventType, HttpErrorResponse, HttpHeaders, HttpStatusCode } from '@angular/common/http';
+import { filter, take, map, defer, from, Subject, Subscription, throwError, of, timer, switchMap, tap, retry, catchError, merge, EMPTY, takeWhile, firstValueFrom, concatMap, fromEvent, throttleTime, interval, combineLatest, Observable, takeUntil, startWith, pairwise, BehaviorSubject, ReplaySubject, shareReplay, skip, withLatestFrom, debounceTime } from 'rxjs';
+import { defineStaticProvider, RuntimeError, clamp, randomId, defineRootProvider, isObject, injectUnsavedChangesCoordinator, injectRoute, getCookie, getDomain, deleteCookie, setCookie, CORE_VERSION, createDestroy, computedTillTruthy, defineProvider, toProvideFn, toInjectFn, nextFrame, injectQueryParams, injectQueryParamChanges, clone, equal, ET_PROPERTY_REMOVED, previousSignalValue } from '@ethlete/core';
+import { HttpClient, HttpEventType, HttpErrorResponse, HttpResponse, HttpHeaders, HttpStatusCode } from '@angular/common/http';
 import { getActiveConsumer, setActiveConsumer } from '@angular/core/primitives/signals';
 import { isPlatformBrowser, NgClass, AsyncPipe, JsonPipe } from '@angular/common';
 import { validateAsync, form } from '@angular/forms/signals';
@@ -232,6 +232,7 @@ const noteQueryFormRead = (id) => {
     formLinkSink?.add(id);
 };
 let faultResolver = null;
+let mockResolver = null;
 /**
  * Installs the fault resolver. Called by `provideQueryDevtools()`; nothing else may call it.
  * @internal
@@ -240,17 +241,48 @@ const setQueryDevtoolsFaultResolver = (fn) => {
     faultResolver = fn;
 };
 /**
- * Whether fault injection can do anything at all. Checked before building the wrapper that resolves a
- * fault per attempt, so a request in an app without devtools keeps the pipeline it always had.
+ * Installs the mock resolver. Called by `provideQueryDevtools()`; nothing else may call it.
  * @internal
  */
-const isQueryDevtoolsFaultInjectionEnabled = () => faultResolver !== null;
+const setQueryDevtoolsMockResolver = (fn) => {
+    mockResolver = fn;
+};
+/**
+ * Whether the devtools can do anything to a request at all - inject a fault, or serve a mock instead of
+ * sending it. Checked before building the wrapper that resolves both per attempt, so a request in an app
+ * without devtools keeps the pipeline it always had.
+ * @internal
+ */
+const isQueryDevtoolsRequestInterceptionEnabled = () => faultResolver !== null || mockResolver !== null;
+/**
+ * The mock to serve one upcoming attempt instead of sending it, or `null` to let it through.
+ * @internal
+ */
+const resolveQueryDevtoolsMock = (target) => mockResolver?.(target) ?? null;
 /**
  * Resolves the fault to apply to one upcoming attempt, or `null` when nothing is armed. Consumes a
  * `failNext` budget, so call it exactly once per attempt.
  * @internal
  */
 const resolveQueryDevtoolsFault = (target) => faultResolver?.(target) ?? null;
+let tokenPayloadPatcher = null;
+/**
+ * Installs the access-token payload patcher. Called by `provideQueryDevtools()`; nothing else may call it.
+ * @internal
+ */
+const setQueryDevtoolsTokenPayloadPatcher = (fn) => {
+    tokenPayloadPatcher = fn;
+};
+/**
+ * A decoded access token as the devtools want it seen, which today means with an overridden lifetime
+ * applied. Returns the payload as decoded unless `provideQueryDevtools()` installed a patcher.
+ *
+ * Auth code must reach the override through this rather than importing the registry it lives in: a
+ * static import would pin that module into every bundle that builds an auth provider, and a runtime
+ * guard at the call site does not undo that.
+ * @internal
+ */
+const patchQueryDevtoolsTokenPayload = (options) => (tokenPayloadPatcher ? tokenPayloadPatcher(options) : options.payload);
 let suppressStackRegistration = false;
 /**
  * Suppresses devtools registration for the next {@link createQueryStack} call. Used by
@@ -1609,8 +1641,14 @@ const createQueryErrorResponse = (error) => {
 };
 
 const SPEED_BUFFER_TIME_IN_MS = 2000;
+/**
+ * The `statusText` of a response the devtools served instead of sending the request. It is what a log, a
+ * network-less error and a copied report all read, so it has to say where the response came from.
+ */
+const MOCKED_STATUS_TEXT = 'Served by the query devtools';
 const createHttpRequest = (options) => {
     let currentStreamSubscription = Subscription.EMPTY;
+    let lastSentHeaders;
     const { args, clientOptions, dependencies } = options;
     const currentEvent = signal(null, /* @ts-ignore */
     ...(ngDevMode ? [{ debugName: "currentEvent" }] : /* istanbul ignore next */ []));
@@ -1680,6 +1718,36 @@ const createHttpRequest = (options) => {
      * same tick it was started in, and settling synchronously inside `execute()` would let an injected
      * failure land before the caller has finished wiring the request up.
      */
+    /**
+     * The request, or the response a devtools mock has armed for this route instead of it. A mock bypasses
+     * the interceptor chain by construction - nothing is sent - so a mocked secure route never exercises
+     * the token flow, which the panel says on the row.
+     */
+    const sendOrMock = (headers) => {
+        const mock = resolveQueryDevtoolsMock({
+            clientName: options.clientName ?? '',
+            method: options.method,
+            url: options.fullPath,
+        });
+        if (!mock)
+            return send(headers);
+        const settle$ = mock.status >= 400
+            ? throwError(() => new HttpErrorResponse({
+                status: mock.status,
+                statusText: MOCKED_STATUS_TEXT,
+                url: options.fullPath,
+                error: mock.body,
+            }))
+            : of(new HttpResponse({
+                body: mock.body,
+                status: mock.status,
+                statusText: MOCKED_STATUS_TEXT,
+                url: options.fullPath,
+            }));
+        // Through `timer` even at zero latency, for the same reason a faulted attempt is: settling
+        // synchronously inside `execute()` would land the response before the caller has wired the request up.
+        return timer(mock.latencyMs).pipe(switchMap(() => settle$));
+    };
     const sendWithFaults = (headers) => defer(() => {
         const fault = resolveQueryDevtoolsFault({
             clientName: options.clientName ?? '',
@@ -1688,10 +1756,10 @@ const createHttpRequest = (options) => {
         });
         lastAttemptFaulted = !!fault && fault.status !== null;
         if (!fault)
-            return send(headers);
+            return sendOrMock(headers);
         const { status } = fault;
         const attempt$ = status === null
-            ? send(headers)
+            ? sendOrMock(headers)
             : throwError(() => new HttpErrorResponse({
                 status,
                 statusText: 'Injected by the query devtools',
@@ -1702,7 +1770,8 @@ const createHttpRequest = (options) => {
     });
     const createStream = () => {
         const headers = resolveHeaders();
-        const source$ = isQueryDevtoolsFaultInjectionEnabled() ? sendWithFaults(headers) : send(headers);
+        lastSentHeaders = headers;
+        const source$ = isQueryDevtoolsRequestInterceptionEnabled() ? sendWithFaults(headers) : send(headers);
         return source$.pipe(tap((event) => updateState(event)), retry({
             delay: (error, retryCount) => {
                 const retryOptions = { error, retryCount };
@@ -1874,6 +1943,7 @@ const createHttpRequest = (options) => {
             applyPersistedResponse,
             lastPersistedResponseAt: lastPersistedResponseAt.asReadonly(),
             resolveHeaders,
+            lastSentHeaders: () => lastSentHeaders,
             attempts: attempts.asReadonly(),
             retryState: retryState.asReadonly(),
             lastDurationMs: lastDurationMs.asReadonly(),
@@ -3812,6 +3882,9 @@ const createSecureExecuteFactory = (options) => {
     let sessionRestartSubscription = Subscription.EMPTY;
     let hasExecuted = false;
     let lastExecuteArgs;
+    /** The access token the last request went out with - what the 401 retry below compares against. */
+    let lastRequestedWithToken = null;
+    const error$ = toObservable(options.state.error, { injector: options.deps.injector });
     const reset = () => {
         authQuerySubscription.unsubscribe();
         authQuerySubscription = Subscription.EMPTY;
@@ -3874,15 +3947,14 @@ const createSecureExecuteFactory = (options) => {
         if (!accessToken) {
             throw tokensNotAvailableInsideAuthAndExec();
         }
-        const tokens = { accessToken, refreshToken: options.authProvider.refreshToken() ?? '' };
-        const headers = headerProvider();
+        lastRequestedWithToken = accessToken;
         options.transformAuthAndExec({
             ...executeArgs,
             args: {
                 ...(args ?? {}),
-                headers: headerProvider, // Pass header provider instead of static headers
+                headers: headerProvider,
             },
-        }, tokens, headers, executeState);
+        }, executeState);
     };
     // The auth query completing and the access token being populated happen on two
     // different reactive timelines: the token is set by a separate token-extraction
@@ -3919,10 +3991,20 @@ const createSecureExecuteFactory = (options) => {
         tokenWaitSubscription = Subscription.EMPTY;
         sessionRestartSubscription.unsubscribe();
         sessionRestartSubscription = Subscription.EMPTY;
-        tokenRefreshSubscription = options.authProvider.afterTokenRefresh$
+        // Retrying with the token that just produced the 401 would 401 again, and that 401 asks for
+        // another refresh - an endless refresh/retry loop for as long as the server keeps handing out
+        // tokens it rejects. A refresh that did not change the access token is therefore not a reason to
+        // retry; the subscription stays open, so a later one that does change it still is.
+        //
+        // The error landing is a trigger of its own: a refresh can complete before this query's 401 has
+        // even come back (which is also why that 401 must not start another refresh - see
+        // withRefreshQuery's 401 handling), and the refresh emission alone would find no error to act
+        // on. Emissions of the error this execution armed with are not landings, only replays.
+        const errorAtArm = options.state.error();
+        tokenRefreshSubscription = merge(options.authProvider.afterTokenRefresh$, error$.pipe(filter((landedError) => landedError !== errorAtArm)))
             .pipe(filter(() => {
             const currentError = options.state.error();
-            return currentError?.code === 401;
+            return currentError?.code === 401 && options.authProvider.accessToken() !== lastRequestedWithToken;
         }), take(1), tap(() => exec(execArgsWithDefaults)))
             .subscribe();
         // `setTokens()` seeds an auth session from outside the query registry (an SSO/OIDC callback, a
@@ -3943,19 +4025,23 @@ const createSecureExecuteFactory = (options) => {
                 injector: options.deps.injector,
             }).pipe(switchMap((latestQuery) => {
                 if (!latestQuery)
-                    return of(null);
+                    return EMPTY;
                 const query = latestQuery.snapshot;
-                return toObservable(query.isAlive, { injector: options.deps.injector }).pipe(tap((isAlive) => {
-                    if (isAlive)
-                        return;
-                    if (query.error()) {
-                        error(query);
-                    }
-                    else if (query.response()) {
-                        authAndExecWhenTokenReady(execArgsWithDefaults);
-                    }
-                }));
-            }));
+                return toObservable(query.isAlive, { injector: options.deps.injector }).pipe(filter((isAlive) => !isAlive), filter(() => !!query.error() || !!query.response()), map(() => query));
+            }), tap((query) => {
+                if (query.error()) {
+                    error(query);
+                }
+                else {
+                    authAndExecWhenTokenReady(execArgsWithDefaults);
+                }
+            }), 
+            // Stop at the first auth query that hands a session over. Every later one is a token refresh,
+            // which settles before its tokens are applied - re-running here would send the token that just
+            // expired; `afterTokenRefresh$` above is what re-runs a query after a refresh. A *failed* auth
+            // query keeps the wait open, so a query that mounted during a failed auto-login still runs
+            // once the user logs in for real.
+            takeWhile((query) => !!query.error()));
             // A `setTokens()` call that lands while this is already waiting (e.g. the SSO redirect
             // resolves after this secure query mounted) never touches `latestExecutedQuery` either -
             // wake up on `executionState` becoming a token seed too.
@@ -3986,13 +4072,12 @@ const createSecureExecuteFn = (executeOptions) => {
         deps: executeOptions.deps,
         state: executeOptions.state,
         autoExecutes: shouldAutoExecuteQuery(executeOptions.creatorInternals.method) && !executeOptions.queryConfig.onlyManualExecution,
-        transformAuthAndExec: (executeArgs, _tokens, headers, executeState) => {
+        transformAuthAndExec: (executeArgs, executeState) => {
             const { options: runOptions } = executeArgs ?? {};
-            const updatedArgs = { ...(executeArgs?.args ?? {}), headers };
             queryExecute({
                 executeOptions: executeOptions,
                 executeState,
-                args: updatedArgs,
+                args: executeArgs?.args ?? {},
                 options: runOptions,
                 isSecure: true,
             });
@@ -4598,7 +4683,12 @@ const createBearerAuthProviderImpl = (config) => {
         if (!token)
             return null;
         try {
-            return config.bearerDecryptFn?.(token) ?? decryptBearer(token);
+            const decoded = config.bearerDecryptFn?.(token) ?? decryptBearer(token);
+            return patchQueryDevtoolsTokenPayload({
+                payload: decoded,
+                providerName: config.name,
+                expiresInPropertyName: 'exp',
+            });
         }
         catch (error) {
             if (isDevMode()) {
@@ -4668,8 +4758,10 @@ const createBearerAuthProviderImpl = (config) => {
         name: config.name,
         applyTokens,
         logout,
+        sessionEndCause: sessionEndCause.asReadonly(),
     });
     const querySetupContext = {
+        name: config.name,
         accessToken,
         refreshToken,
         bearerDecryptFn: config.bearerDecryptFn,
@@ -4743,6 +4835,19 @@ const createBearerAuthProviderImpl = (config) => {
 };
 const createBearerAuthProvider = (config) => defineRootProvider(() => createBearerAuthProviderImpl(config), { name: `BearerAuthProvider_${config.name}` });
 
+/** How long a scheduled refresh waits before retrying an attempt that could not run yet. */
+const rescheduleDelayMs = 5000;
+/**
+ * How often a scheduled refresh may re-arm before it waits for a new token pair. A tab that keeps
+ * declining is either not the leader or busy issuing tokens; either way a 401 still forces a refresh.
+ */
+const maxRescheduleAttempts = 5;
+/**
+ * How many 401-driven refreshes may run back to back before they fall back to `minRefreshInterval`.
+ * Every refresh in such a streak means the token the previous one issued was rejected too, so an
+ * unbounded streak is a refresh loop, not recovery. A secure request succeeding ends the streak.
+ */
+const maxUnauthorizedRefreshStreak = 3;
 const withAuthenticationQuery = (key, config, setup) => ({
     _type: 'authQuery',
     key,
@@ -4785,30 +4890,60 @@ const withRefreshQuery = (key, config) => {
         const minRefreshInterval = config.minRefreshInterval ?? 30000; // 30 seconds default
         const refreshIfExpired = config.refreshIfExpired ?? true;
         let lastRefreshTime = 0;
+        let lastUnauthorizedRefreshTime = 0;
+        let unauthorizedRefreshStreak = 0;
         // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
         const refreshQuery = () => context.queries[key];
         const executeRefresh = (reason) => {
             const currentRefreshToken = context.refreshToken();
             if (!currentRefreshToken)
-                return;
+                return 'noToken';
             if (!context.isLeader()) {
                 // Only the leader may spend a single-use refresh token, but the event is still real - hand it
                 // over instead of dropping it, or this tab waits out the leader's timer with a dead token.
                 context.refreshCoordination?.request();
-                return;
+                return 'delegated';
             }
             // Any token-issuing execution, not just another refresh: a login already in flight is about to
             // issue a token pair of its own, and the refresh token this would spend belongs to the session
             // that login is replacing.
             if (context.hasTokenIssuingExecutionInFlight())
-                return;
+                return 'busy';
             if (reason === 'scheduled') {
                 const now = Date.now();
                 if (now - lastRefreshTime < minRefreshInterval)
-                    return;
+                    return 'throttled';
                 lastRefreshTime = now;
             }
+            else {
+                const now = Date.now();
+                if (unauthorizedRefreshStreak >= maxUnauthorizedRefreshStreak &&
+                    now - lastUnauthorizedRefreshTime < minRefreshInterval) {
+                    return 'throttled';
+                }
+                unauthorizedRefreshStreak++;
+                lastUnauthorizedRefreshTime = now;
+            }
             refreshQuery().execute(buildArgs(currentRefreshToken), { triggeredBy: 'token-refresh' });
+            return 'executed';
+        };
+        /**
+         * How long a scheduled refresh that did not spend the refresh token waits before trying again.
+         * `null` re-arms nothing, because only a new token pair can change the outcome - and that restarts
+         * the schedule anyway.
+         */
+        const retryScheduledIn = (attempt) => {
+            switch (attempt) {
+                case 'executed':
+                case 'noToken':
+                    return null;
+                case 'throttled':
+                    return Math.max(minRefreshInterval - (Date.now() - lastRefreshTime), rescheduleDelayMs);
+                case 'busy':
+                    return rescheduleDelayMs;
+                case 'delegated':
+                    return minRefreshInterval;
+            }
         };
         const calculateRefreshBuffer = (tokenLifetimeMs) => {
             if (typeof config.refreshStrategy === 'number') {
@@ -4820,48 +4955,58 @@ const withRefreshQuery = (key, config) => {
             const calculatedBuffer = tokenLifetimeMs * (1 - percentage);
             return Math.max(minBufferMs, Math.min(maxBufferMs, calculatedBuffer));
         };
-        // Auto-refresh based on token expiration
-        toObservable(context.accessToken)
-            .pipe(switchMap((token) => {
-            if (!token)
-                return of(null);
+        /** When this access token is due to be refreshed, or `null` if it cannot be scheduled at all. */
+        const scheduledRefreshDelay = (token) => {
             try {
-                const bearerDataValue = context.bearerDecryptFn ? context.bearerDecryptFn(token) : decryptBearer(token);
+                const decoded = context.bearerDecryptFn ? context.bearerDecryptFn(token) : decryptBearer(token);
+                const bearerDataValue = patchQueryDevtoolsTokenPayload({
+                    payload: decoded,
+                    providerName: context.name,
+                    expiresInPropertyName,
+                });
                 const expiresIn = bearerDataValue?.[expiresInPropertyName];
                 if (typeof expiresIn !== 'number') {
                     if (isDevMode()) {
                         console.warn(`Token does not contain valid ${expiresInPropertyName} property for auto-refresh`);
                     }
-                    return of(null);
+                    return null;
                 }
-                const expiresAtMs = expiresIn * 1000;
-                const now = Date.now();
-                const tokenLifetimeMs = expiresAtMs - now;
+                const tokenLifetimeMs = expiresIn * 1000 - Date.now();
                 if (tokenLifetimeMs <= 0) {
-                    if (refreshIfExpired) {
-                        if (isDevMode()) {
-                            console.warn('Token is already expired, triggering immediate refresh');
-                        }
-                        return of(true);
+                    if (!refreshIfExpired)
+                        return null;
+                    if (isDevMode()) {
+                        console.warn('Token is already expired, triggering immediate refresh');
                     }
-                    return of(null);
-                }
-                const refreshBufferMs = calculateRefreshBuffer(tokenLifetimeMs);
-                const timeUntilRefresh = tokenLifetimeMs - refreshBufferMs;
-                if (timeUntilRefresh <= 0) {
-                    return of(true);
+                    return 0;
                 }
-                return timer(timeUntilRefresh).pipe(tap(() => true));
+                return Math.max(tokenLifetimeMs - calculateRefreshBuffer(tokenLifetimeMs), 0);
             }
             catch {
-                return of(null);
-            }
-        }), takeUntilDestroyed())
-            .subscribe((shouldRefresh) => {
-            if (shouldRefresh) {
-                executeRefresh('scheduled');
+                return null;
             }
-        });
+        };
+        /**
+         * The scheduled refresh, re-armed for as long as it keeps declining to spend the refresh token.
+         * Without the re-arm a single declined attempt strands the session on a token nothing renews until
+         * a request fails with a 401 - by which time the refresh token may be gone too.
+         */
+        const scheduledRefresh = (dueInMs, attemptsLeft) => (dueInMs <= 0 ? of(0) : timer(dueInMs)).pipe(concatMap(() => {
+            const retryInMs = retryScheduledIn(executeRefresh('scheduled'));
+            return retryInMs === null || attemptsLeft <= 0 ? EMPTY : scheduledRefresh(retryInMs, attemptsLeft - 1);
+        }));
+        // The delay is read in a computed rather than in the `switchMap` so that a devtools-armed token
+        // lifetime re-arms the schedule: the override is a signal, and only a reactive read of it moves the
+        // timer before the next token arrives. The wrapper object keeps every recomputation an emission, so
+        // two tokens that happen to be due at the same moment still restart the timer.
+        const nextScheduledRefresh = computed(() => {
+            const token = context.accessToken();
+            return { dueInMs: token ? scheduledRefreshDelay(token) : null };
+        }, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "nextScheduledRefresh" }] : /* istanbul ignore next */ []));
+        toObservable(nextScheduledRefresh)
+            .pipe(switchMap(({ dueInMs }) => (dueInMs === null ? EMPTY : scheduledRefresh(dueInMs, maxRescheduleAttempts))), takeUntilDestroyed())
+            .subscribe();
         context.refreshCoordination?.requests$.pipe(takeUntilDestroyed()).subscribe(() => executeRefresh('unauthorized'));
         const onRefreshFailure = config.onRefreshFailure ??
             (({ error, logout }) => {
@@ -4880,18 +5025,22 @@ const withRefreshQuery = (key, config) => {
         // Auto-retry on 401: Listen to repository events and trigger refresh on 401 errors
         const autoRetryOn401 = config.autoRetryOn401 ?? true;
         if (autoRetryOn401) {
-            context.repository.events$
-                .pipe(filter((event) => {
-                // Only handle 401 errors for secure queries
-                if (event.type !== 'request-error')
-                    return false;
-                if (!event.isSecure)
-                    return false;
-                if (event.error?.status !== 401)
-                    return false;
-                return true;
-            }), takeUntilDestroyed())
-                .subscribe(() => {
+            context.repository.events$.pipe(takeUntilDestroyed()).subscribe((event) => {
+                if (event.type === 'request-success' && event.isSecure) {
+                    unauthorizedRefreshStreak = 0;
+                    return;
+                }
+                if (event.type !== 'request-error' || !event.isSecure || event.error?.status !== 401)
+                    return;
+                // A 401 from a request that went out with an older access token asks for a refresh that
+                // already happened - the query re-runs itself with the current token (see
+                // createSecureExecuteFactory). Refreshing again here would spend the refresh token that
+                // pair came with, invalidating the tokens every other in-flight request is using; their
+                // 401s would each do the same, keeping the loop alive for as long as queries are in flight.
+                const sentAuthorization = event.request.subtle.lastSentHeaders()?.get('Authorization');
+                const currentToken = context.accessToken();
+                if (sentAuthorization && currentToken && sentAuthorization !== `Bearer ${currentToken}`)
+                    return;
                 executeRefresh('unauthorized');
             });
         }
@@ -5176,6 +5325,12 @@ const resetEncryptionKey = () => {
     }
 };
 
+/**
+ * How an incoming logout reads in the receiving tab: a deliberate logout elsewhere is this tab's
+ * `otherTab`, while a session that ended on its own ended for every tab, so that cause is carried
+ * through. A message without one comes from a tab running an older version.
+ */
+const incomingCause = (cause) => !cause || cause === 'user' ? 'otherTab' : cause;
 /**
  * The channel a provider syncs on unless the consumer names one. Carries the provider's name, so two
  * providers reachable from the same origin do not push each other's tokens around.
@@ -5210,7 +5365,7 @@ const setupMultiTabSync = (config, context) => {
         if (message.type === 'logout' && syncLogout) {
             lastSyncedState = LOGGED_OUT;
             hadTokens = false;
-            context.logout('otherTab');
+            context.logout(incomingCause(message.cause));
             return;
         }
         if (message.type !== 'tokens-updated' || !syncTokens)
@@ -5258,7 +5413,7 @@ const setupMultiTabSync = (config, context) => {
             if (lastSyncedState === LOGGED_OUT)
                 return;
             lastSyncedState = LOGGED_OUT;
-            const message = { type: 'logout' };
+            const message = { type: 'logout', cause: untracked(context.sessionEndCause) ?? undefined };
             channel.postMessage(message);
         });
     }
@@ -5314,6 +5469,7 @@ const withBearerAuthMultiTabSync = (config = {}) => {
         setupMultiTabSync({ channelName, syncTokens: config.syncTokens, syncLogout: config.syncLogout }, {
             accessToken: context.accessToken,
             refreshToken: context.refreshToken,
+            sessionEndCause: context.sessionEndCause,
             name: context.name,
             applyTokens: context.applyTokens,
             logout: context.logout,
@@ -5350,6 +5506,7 @@ const withPersistentAuth = (config) => {
                 ...(config.autoLogin.excludeRoutes?.length
                     ? [{ label: 'excluded routes', value: config.autoLogin.excludeRoutes.join(', ') }]
                     : []),
+                ...(config.autoLogin.shouldAutoLogin ? [{ label: 'auto login predicate', value: 'custom' }] : []),
             ],
         };
     };
@@ -5410,6 +5567,9 @@ const createPersistentAuthFeature = (config, context) => {
         if (shouldExclude) {
             return;
         }
+        if (config.autoLogin.shouldAutoLogin && !config.autoLogin.shouldAutoLogin(currentRoute)) {
+            return;
+        }
         const storedToken = getCookie(cookieName);
         if (storedToken) {
             const decryptedToken = decryptToken(storedToken);
@@ -5681,6 +5841,179 @@ const createTrackingFeature = (context, config) => {
     };
 };
 
+const ethlete = {};
+let app = null;
+/** What `window.ethlete` exposes - the same object {@link queryDevtoolsAbout} returns. */
+const publish = () => {
+    if (typeof window === 'undefined')
+        return;
+    window['ethlete'] = queryDevtoolsAbout();
+};
+/**
+ * Records that an `@ethlete/*` package is loaded, and at which version. Each lib passes its own
+ * generated constant; a package that is never imported never reports one, which is what makes the
+ * list "what is actually loaded" rather than "what is declared as a peer dependency".
+ */
+const registerEthleteVersion = (name, version) => {
+    ethlete[name] = version;
+    publish();
+};
+const setQueryDevtoolsAppInfo = (info) => {
+    app = info ?? null;
+    publish();
+};
+/**
+ * Everything the devtools know about what is running: the loaded `@ethlete/*` versions, the Angular
+ * version, and whatever the application handed to `provideQueryDevtools({ about })`.
+ *
+ * Also mirrored onto `window.ethlete` - the same idea as Angular's `window.ng`, so the versions behind
+ * a bug report can be read straight from the console without opening the panel.
+ */
+const queryDevtoolsAbout = () => ({
+    ethlete: { ...ethlete },
+    angular: VERSION.full,
+    app,
+});
+
+const DEFAULTS = {
+    viewState: 'session',
+    pins: 'local',
+    overrides: 'none',
+    mocks: 'local',
+    armedMocks: 'none',
+    armedFaults: 'none',
+    maxEvents: 100,
+    maxDroppedCacheEntries: 20,
+    responseHistory: null,
+};
+/**
+ * `localStorage`, whatever the scopes below say - a scope of `none` still has to be remembered, or the
+ * choice would erase itself on the first reload it applies to.
+ */
+const SETTINGS_KEY = 'ethlete:query:devtools:settings:v1';
+const LIMITS = {
+    maxEvents: { min: 10, max: 1000 },
+    maxDroppedCacheEntries: { min: 0, max: 200 },
+    responseHistory: { min: 1, max: 50 },
+};
+const settings = /* @__PURE__ */ signal(DEFAULTS, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "settings" }] : /* istanbul ignore next */ []));
+/**
+ * How the devtools are configured. Every consumer reads the live value rather than a copy, so a change
+ * in the panel's Settings takes effect without a reload.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const queryDevtoolsSettings = /* @__PURE__ */ settings.asReadonly();
+/**
+ * The `Storage` a scope names, or `null` for `none` and for a browser that refuses one (private mode,
+ * storage disabled, server-side rendering). Callers treat "no storage" and "not persisted" alike.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const queryDevtoolsStorage = (scope) => {
+    if (scope === 'none' || typeof window === 'undefined')
+        return null;
+    try {
+        return scope === 'session' ? window.sessionStorage : window.localStorage;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Reads one JSON-encoded devtools key from the store a scope names, or `null`.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const readQueryDevtoolsStore = (scope, key) => {
+    try {
+        const raw = queryDevtoolsStorage(scope)?.getItem(key);
+        return raw ? JSON.parse(raw) : null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Writes one devtools key into the store a scope names. A scope of `none` writes nothing.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const writeQueryDevtoolsStore = (scope, key, value) => {
+    try {
+        queryDevtoolsStorage(scope)?.setItem(key, JSON.stringify(value));
+    }
+    catch {
+        // ignore (private mode / disabled storage / quota)
+    }
+};
+/**
+ * Removes one devtools key from **both** stores, whatever the scope currently is - so a scope that
+ * changed cannot leave a stale copy behind for the next load to read.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const clearQueryDevtoolsStore = (key) => {
+    for (const scope of ['session', 'local']) {
+        try {
+            queryDevtoolsStorage(scope)?.removeItem(key);
+        }
+        catch {
+            // ignore (private mode / disabled storage)
+        }
+    }
+};
+const asScope = (value, fallback) => value === 'none' || value === 'session' || value === 'local' ? value : fallback;
+const asCount = (value, limits, fallback) => {
+    const count = Math.floor(Number(value));
+    if (!Number.isFinite(count))
+        return fallback;
+    return Math.min(Math.max(count, limits.min), limits.max);
+};
+/** A count that may be absent, where absent means "leave the application's own value alone". */
+const asOptionalCount = (value, limits) => {
+    if (value === null || value === undefined)
+        return null;
+    const count = Math.floor(Number(value));
+    return Number.isFinite(count) ? Math.min(Math.max(count, limits.min), limits.max) : null;
+};
+/** Both a hand-edited store and a number typed into the panel come through here. */
+const sanitize = (value) => ({
+    viewState: asScope(value?.viewState, DEFAULTS.viewState),
+    pins: asScope(value?.pins, DEFAULTS.pins),
+    overrides: asScope(value?.overrides, DEFAULTS.overrides),
+    mocks: asScope(value?.mocks, DEFAULTS.mocks),
+    armedMocks: asScope(value?.armedMocks, DEFAULTS.armedMocks),
+    armedFaults: asScope(value?.armedFaults, DEFAULTS.armedFaults),
+    maxEvents: asCount(value?.maxEvents, LIMITS.maxEvents, DEFAULTS.maxEvents),
+    maxDroppedCacheEntries: asCount(value?.maxDroppedCacheEntries, LIMITS.maxDroppedCacheEntries, DEFAULTS.maxDroppedCacheEntries),
+    responseHistory: asOptionalCount(value?.responseHistory, LIMITS.responseHistory),
+});
+/**
+ * Reads the stored settings. Called by `provideQueryDevtools()` **before** the override store is read
+ * and the response-history default is set - both take their configuration from here - and by nothing
+ * else.
+ * @internal
+ */
+const initQueryDevtoolsSettings = () => {
+    settings.set(sanitize(readQueryDevtoolsStore('local', SETTINGS_KEY)));
+};
+/**
+ * Changes part of the devtools configuration and stores it. Values outside the range a field allows are
+ * clamped rather than rejected.
+ *
+ * Overrides are the one field not to set here: their scope moves an existing store, so it goes through
+ * `setQueryDevtoolsOverridesScope()` instead.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const setQueryDevtoolsSettings = (patch) => {
+    const next = sanitize({ ...settings(), ...patch });
+    settings.set(next);
+    writeQueryDevtoolsStore('local', SETTINGS_KEY, next);
+};
+
 /** The neutral fault: nothing armed. */
 const EMPTY_QUERY_DEVTOOLS_FAULT = {
     latencyMs: 0,
@@ -5705,23 +6038,73 @@ const QUERY_DEVTOOLS_FAULT_STATUSES = [
     { status: 502, label: 'Bad Gateway', retryable: true },
     { status: 503, label: 'Service Unavailable', retryable: true },
 ];
+const STORAGE_KEY$2 = 'ethlete:query:devtools:faults:v1';
 const faults = /* @__PURE__ */ signal({}, /* @ts-ignore */
 ...(ngDevMode ? [{ debugName: "faults" }] : /* istanbul ignore next */ []));
+const restored$1 = /* @__PURE__ */ signal(false, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "restored" }] : /* istanbul ignore next */ []));
+const scope$2 = () => queryDevtoolsSettings().armedFaults;
 /**
  * The faults armed per client name, consumed by the `<et-query-devtools>` UI. Clients with nothing armed
  * are absent rather than present with an {@link EMPTY_QUERY_DEVTOOLS_FAULT}.
  */
 const queryDevtoolsFaults = /* @__PURE__ */ faults.asReadonly();
-/** Whether anything at all is armed on a fault. */
-const isQueryDevtoolsFaultArmed = (fault) => fault.latencyMs > 0 || fault.failNext > 0 || fault.failRate > 0;
 /**
- * Arms (or updates) the fault of one client. Only the given fields change; the rest keep their current
- * value. A client whose resulting fault has nothing armed is dropped from {@link queryDevtoolsFaults}.
- *
- * Part of the devtools contract consumed by `<et-query-devtools>`; a fault is a debugging tool, not
- * something an application should arm on itself.
+ * Whether what is armed right now came back from a previous page load rather than being armed by hand.
+ * The panel's armed bar says so, because injected failures nobody remembers arming look exactly like a
+ * broken API.
  */
-const setQueryDevtoolsFault = (options) => {
+const queryDevtoolsFaultsRestored = /* @__PURE__ */ restored$1.asReadonly();
+const write$1 = () => {
+    if (scope$2() === 'none') {
+        clearQueryDevtoolsStore(STORAGE_KEY$2);
+        return;
+    }
+    writeQueryDevtoolsStore(scope$2(), STORAGE_KEY$2, faults());
+};
+const asFault = (value) => {
+    const fault = value;
+    if (!fault || typeof fault !== 'object')
+        return null;
+    const next = {
+        latencyMs: Number(fault.latencyMs) || 0,
+        failNext: Number(fault.failNext) || 0,
+        failRate: Number(fault.failRate) || 0,
+        status: Number.isFinite(Number(fault.status)) ? Number(fault.status) : EMPTY_QUERY_DEVTOOLS_FAULT.status,
+    };
+    return isQueryDevtoolsFaultArmed(next) ? next : null;
+};
+/**
+ * Reads the armed faults back, when the `armedFaults` setting asks for them. Called by
+ * `provideQueryDevtools()` after the settings it takes its scope from; nothing else may call it.
+ * @internal
+ */
+const initQueryDevtoolsFaults = () => {
+    const stored = readQueryDevtoolsStore(scope$2(), STORAGE_KEY$2);
+    const inherited = {};
+    for (const [clientName, value] of Object.entries(stored ?? {})) {
+        const fault = asFault(value);
+        if (fault)
+            inherited[clientName] = fault;
+    }
+    faults.set(inherited);
+    restored$1.set(Object.keys(inherited).length > 0);
+};
+/**
+ * Where the armed faults are kept. Switching to a scope that keeps them stores whatever is armed right
+ * now; switching to `none` empties the store and leaves this page's faults exactly where they are.
+ */
+const setQueryDevtoolsFaultsScope = (next) => {
+    if (next === scope$2())
+        return;
+    // Off both stores first: whichever the previous scope was, its copy must not outlive the change.
+    clearQueryDevtoolsStore(STORAGE_KEY$2);
+    setQueryDevtoolsSettings({ armedFaults: next });
+    write$1();
+};
+/** Whether anything at all is armed on a fault. */
+const isQueryDevtoolsFaultArmed = (fault) => fault.latencyMs > 0 || fault.failNext > 0 || fault.failRate > 0;
+const patchFault = (options) => {
     const { clientName, patch } = options;
     faults.update((current) => {
         const next = { ...(current[clientName] ?? EMPTY_QUERY_DEVTOOLS_FAULT), ...patch };
@@ -5731,18 +6114,34 @@ const setQueryDevtoolsFault = (options) => {
         }
         return { ...current, [clientName]: next };
     });
+    write$1();
+};
+/**
+ * Arms (or updates) the fault of one client. Only the given fields change; the rest keep their current
+ * value. A client whose resulting fault has nothing armed is dropped from {@link queryDevtoolsFaults}.
+ *
+ * Part of the devtools contract consumed by `<et-query-devtools>`; a fault is a debugging tool, not
+ * something an application should arm on itself.
+ */
+const setQueryDevtoolsFault = (options) => {
+    patchFault(options);
+    restored$1.set(false);
 };
 /**
  * Disarms every fault of one client, or of all clients when no name is given.
  *
  * @see setQueryDevtoolsFault
  */
-const clearQueryDevtoolsFaults = (clientName) => faults.update((current) => {
-    if (clientName === undefined)
-        return {};
-    const { [clientName]: _removed, ...rest } = current;
-    return rest;
-});
+const clearQueryDevtoolsFaults = (clientName) => {
+    faults.update((current) => {
+        if (clientName === undefined)
+            return {};
+        const { [clientName]: _removed, ...rest } = current;
+        return rest;
+    });
+    restored$1.set(false);
+    write$1();
+};
 /**
  * Resolves what to do with one upcoming attempt, consuming a `failNext` budget in the process - so this
  * must be called once per attempt and never speculatively.
@@ -5757,7 +6156,9 @@ const resolveQueryDevtoolsFaultForAttempt = (target) => {
     let shouldFail = false;
     if (fault.failNext > 0) {
         shouldFail = true;
-        setQueryDevtoolsFault({ clientName: target.clientName, patch: { failNext: fault.failNext - 1 } });
+        // Not the public setter: spending the budget is the armed fault doing its job, not someone re-arming
+        // it, so it must not clear what the panel's bar says about where the fault came from.
+        patchFault({ clientName: target.clientName, patch: { failNext: fault.failNext - 1 } });
     }
     else if (fault.failRate > 0) {
         shouldFail = Math.random() * 100 < fault.failRate;
@@ -5794,6 +6195,392 @@ const createQueryDevtoolsFormLinks = () => {
     };
 };
 
+/**
+ * The designed library. Which of them is **armed** is a separate store under a separate scope - see
+ * {@link queryDevtoolsArmedMocks}.
+ */
+const STORAGE_KEY$1 = 'ethlete:query:devtools:mocks:v1';
+const ARMED_STORAGE_KEY = 'ethlete:query:devtools:mocks:armed:v1';
+const mocks = /* @__PURE__ */ signal([], /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "mocks" }] : /* istanbul ignore next */ []));
+const armed = /* @__PURE__ */ signal(/* @__PURE__ */ new Set(), /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "armed" }] : /* istanbul ignore next */ []));
+const armedRestored = /* @__PURE__ */ signal(false, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "armedRestored" }] : /* istanbul ignore next */ []));
+const scope$1 = () => queryDevtoolsSettings().mocks;
+const armedScope = () => queryDevtoolsSettings().armedMocks;
+/** The designed mocks, armed or not. Persisted, because losing an hour of authoring is unacceptable. */
+const queryDevtoolsMocks = /* @__PURE__ */ mocks.asReadonly();
+/**
+ * The ids currently being served. Not kept across page loads unless the `armedMocks` setting asks for it -
+ * an app that silently serves designed data tomorrow morning is worse than losing which mocks were armed.
+ */
+const queryDevtoolsArmedMocks = /* @__PURE__ */ armed.asReadonly();
+/**
+ * Whether what is armed right now came back from a previous page load rather than being armed by hand.
+ * The panel's armed bar says so, because mocks nobody remembers arming look exactly like a broken API.
+ */
+const queryDevtoolsArmedMocksRestored = /* @__PURE__ */ armedRestored.asReadonly();
+/**
+ * The identity of a designed mock: one per client, method, route **and** declared query. The query is part
+ * of it so `/posts?page=1` and `/posts?page=2` can hold different bodies.
+ */
+const queryDevtoolsMockId = (parts) => `${parts.clientName}|${parts.method}|${parts.pattern}${parts.query ? `?${parts.query}` : ''}`;
+const write = () => {
+    if (scope$1() === 'none') {
+        clearQueryDevtoolsStore(STORAGE_KEY$1);
+        return;
+    }
+    writeQueryDevtoolsStore(scope$1(), STORAGE_KEY$1, mocks());
+};
+const writeArmed = () => {
+    if (armedScope() === 'none') {
+        clearQueryDevtoolsStore(ARMED_STORAGE_KEY);
+        return;
+    }
+    writeQueryDevtoolsStore(armedScope(), ARMED_STORAGE_KEY, [...armed()]);
+};
+/** Every change made by hand goes through here, so none of them can leave the store or the bar behind. */
+const setArmed = (next) => {
+    armed.set(next);
+    armedRestored.set(false);
+    writeArmed();
+};
+const isMock = (value) => {
+    const mock = value;
+    return (!!mock &&
+        typeof mock.id === 'string' &&
+        typeof mock.clientName === 'string' &&
+        typeof mock.method === 'string' &&
+        typeof mock.pattern === 'string' &&
+        typeof mock.status === 'number');
+};
+/**
+ * Reads the designed library, so a mock can be armed without authoring it again. Called by
+ * `provideQueryDevtools()` after the settings it takes its scope from; nothing else may call it.
+ * @internal
+ */
+const initQueryDevtoolsMocks = () => {
+    const stored = readQueryDevtoolsStore(scope$1(), STORAGE_KEY$1);
+    // `query` was added after the first version of the store, so an entry written before it still loads.
+    mocks.set(Array.isArray(stored) ? stored.filter(isMock).map((mock) => ({ ...mock, query: mock.query ?? '' })) : []);
+    const kept = readQueryDevtoolsStore(armedScope(), ARMED_STORAGE_KEY);
+    const library = new Set(mocks().map((mock) => mock.id));
+    // An id the library no longer holds would arm nothing, so it is dropped rather than kept waiting for a
+    // mock that may never be designed again.
+    const inherited = Array.isArray(kept)
+        ? kept.filter((id) => typeof id === 'string' && library.has(id))
+        : [];
+    armed.set(new Set(inherited));
+    armedRestored.set(inherited.length > 0);
+};
+/** The path of a request URL, without its origin or query string - what a pattern is matched against. */
+const queryDevtoolsRequestPath = (url) => {
+    const withoutQuery = url.split('?')[0] ?? '';
+    const schemeEnd = withoutQuery.indexOf('://');
+    if (schemeEnd === -1)
+        return withoutQuery;
+    const pathStart = withoutQuery.indexOf('/', schemeEnd + 3);
+    return pathStart === -1 ? '/' : withoutQuery.slice(pathStart);
+};
+const segmentsOf$1 = (path) => path.split('/').filter(Boolean);
+/** The query string of a request URL, without the `?`. */
+const queryOf = (url) => url.split('?')[1] ?? '';
+/**
+ * Whether a request carries every query parameter a mock declares. Extra parameters are ignored - a mock
+ * says what the request must ask for, not everything it may.
+ */
+const matchesQueryDevtoolsMockQuery = (declared, url) => {
+    if (!declared)
+        return true;
+    const asked = new URLSearchParams(queryOf(url));
+    return [...new URLSearchParams(declared)].every(([key, value]) => asked.get(key) === value);
+};
+/**
+ * Whether a request path is the route a pattern describes. A `:param` segment matches any single
+ * non-empty segment, which is the whole point: a mock is armed for a route, not for the one URL a query
+ * happened to build.
+ */
+const matchesQueryDevtoolsMockPattern = (pattern, path) => {
+    const patternSegments = segmentsOf$1(pattern);
+    const pathSegments = segmentsOf$1(path);
+    if (patternSegments.length !== pathSegments.length)
+        return false;
+    return patternSegments.every((segment, index) => segment.startsWith(':') || segment === pathSegments[index]);
+};
+/**
+ * Adds a designed mock, or replaces the one already under its id. Arming is untouched: re-designing a
+ * body while it is being served changes what the next request gets.
+ */
+const saveQueryDevtoolsMock = (mock) => {
+    mocks.update((current) => {
+        const index = current.findIndex((entry) => entry.id === mock.id);
+        if (index === -1)
+            return [...current, mock];
+        return current.map((entry) => (entry.id === mock.id ? mock : entry));
+    });
+    write();
+};
+/** Removes a designed mock, disarming it on the way out. */
+const deleteQueryDevtoolsMock = (id) => {
+    mocks.update((current) => current.filter((entry) => entry.id !== id));
+    armQueryDevtoolsMock(id, false);
+    write();
+};
+/** Starts or stops serving one designed mock. Arming a mock that is not in the library does nothing. */
+const armQueryDevtoolsMock = (id, isArmed) => {
+    if (isArmed && !mocks().some((mock) => mock.id === id))
+        return;
+    const next = new Set(armed());
+    if (isArmed)
+        next.add(id);
+    else
+        next.delete(id);
+    setArmed(next);
+};
+/** Starts serving every mock in the library - the counterpart of {@link clearQueryDevtoolsArmedMocks}. */
+const armAllQueryDevtoolsMocks = () => setArmed(new Set(mocks().map((mock) => mock.id)));
+/** Stops serving every mock, leaving the library alone - the armed bar's one-click way out. */
+const clearQueryDevtoolsArmedMocks = () => setArmed(new Set());
+/**
+ * Where the armed set is kept. Switching to a scope that keeps it stores whatever is armed right now, so
+ * the choice reads as "keep these"; switching to `none` empties the store and leaves this page serving
+ * exactly what it was already serving.
+ */
+const setQueryDevtoolsArmedMocksScope = (next) => {
+    if (next === armedScope())
+        return;
+    // Off both stores first: whichever the previous scope was, its copy must not outlive the change.
+    clearQueryDevtoolsStore(ARMED_STORAGE_KEY);
+    setQueryDevtoolsSettings({ armedMocks: next });
+    writeArmed();
+};
+/** Empties the designed library and disarms everything - the panel's "Reset devtools". */
+const clearQueryDevtoolsMockStore = () => {
+    mocks.set([]);
+    armed.set(new Set());
+    armedRestored.set(false);
+    clearQueryDevtoolsStore(STORAGE_KEY$1);
+    clearQueryDevtoolsStore(ARMED_STORAGE_KEY);
+};
+const declaredParamCount = (mock) => (mock.query ? [...new URLSearchParams(mock.query)].length : 0);
+/**
+ * The mock to serve one upcoming attempt, or `null` to let it reach the network. The armed mock declaring
+ * the most query parameters wins, so a special case armed on top of a general one is what answers.
+ *
+ * Installed as the mock resolver by `provideQueryDevtools()`; nothing else may call it.
+ * @internal
+ */
+const resolveQueryDevtoolsMockForAttempt = (target) => {
+    const ids = armed();
+    if (!ids.size)
+        return null;
+    const path = queryDevtoolsRequestPath(target.url);
+    const mock = mocks()
+        .filter((candidate) => ids.has(candidate.id) &&
+        candidate.clientName === target.clientName &&
+        candidate.method === target.method &&
+        matchesQueryDevtoolsMockPattern(candidate.pattern, path) &&
+        matchesQueryDevtoolsMockQuery(candidate.query, target.url))
+        // The most specific armed mock answers: one that names `page=2` beats one that takes any query, so
+        // arming a general mock does not shadow the special case someone armed on top of it.
+        .sort((a, b) => declaredParamCount(b) - declaredParamCount(a))[0];
+    if (!mock)
+        return null;
+    return { status: mock.status, body: mock.body, latencyMs: mock.latencyMs };
+};
+
+/**
+ * Not persisted at all unless asked for, and then in `sessionStorage`: "survives a reload" and "survives
+ * until I notice" are different promises, and an app that stays tampered with across days is hours of
+ * debugging the wrong thing. `local` is offered in Settings for the dev who has a reason, and the
+ * restored-overrides bar names the scope whatever it is.
+ */
+const STORAGE_KEY = 'ethlete:query:devtools:overrides:v1';
+const restored = /* @__PURE__ */ signal([], /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "restored" }] : /* istanbul ignore next */ []));
+const restoredScope = /* @__PURE__ */ signal(null, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "restoredScope" }] : /* istanbul ignore next */ []));
+const scope = () => queryDevtoolsSettings().overrides;
+/** Where "Keep across reloads" puts them back when it is switched on again. */
+let lastPersistentScope = 'session';
+/** Every recorder that currently holds at least one op, so switching persistence on can capture them. */
+const armedRecorders = /* @__PURE__ */ new Map();
+/** What the store held when this page loaded, per id - the banner's subject, not the live registry. */
+const carriedOver = /* @__PURE__ */ new Map();
+/** Of those, the ids a registering query actually took. */
+const replayed = /* @__PURE__ */ new Set();
+let ops = {};
+const readStore = () => {
+    const parsed = readQueryDevtoolsStore(scope(), STORAGE_KEY);
+    const stored = parsed?.ops;
+    const usable = !!stored && typeof stored === 'object' && !Array.isArray(stored);
+    return { enabled: parsed?.enabled === true, ops: usable ? stored : {} };
+};
+const writeStore = () => {
+    if (scope() === 'none') {
+        clearQueryDevtoolsStore(STORAGE_KEY);
+        return;
+    }
+    writeQueryDevtoolsStore(scope(), STORAGE_KEY, { enabled: true, ops });
+};
+const publishRestored = () => restored.set([...carriedOver].map(([id, count]) => ({ id, count, armed: replayed.has(id) })));
+const forgetCarriedOver = () => {
+    carriedOver.clear();
+    replayed.clear();
+    restoredScope.set(null);
+    publishRestored();
+};
+const writeOps = (id, list) => {
+    if (list.length)
+        ops = { ...ops, [id]: list };
+    else {
+        const { [id]: _dropped, ...rest } = ops;
+        ops = rest;
+    }
+    writeStore();
+};
+/**
+ * Reads the store, so entries can replay from it as they register. Called by `provideQueryDevtools()`,
+ * which is what keeps an app without devtools from ever touching storage.
+ * @internal
+ */
+const initQueryDevtoolsOverridePersistence = () => {
+    const store = readStore();
+    ops = store.enabled ? store.ops : {};
+    armedRecorders.clear();
+    carriedOver.clear();
+    replayed.clear();
+    for (const [id, list] of Object.entries(ops)) {
+        if (list.length)
+            carriedOver.set(id, list.length);
+    }
+    const current = scope();
+    if (current !== 'none')
+        lastPersistentScope = current;
+    restoredScope.set(carriedOver.size ? current : null);
+    publishRestored();
+};
+/**
+ * Whether armed response overrides are stored and replayed on the next page load - that is, whether
+ * their scope is anything other than `none`. Off by default.
+ */
+const queryDevtoolsOverridePersistence = /* @__PURE__ */ computed(() => scope() !== 'none', /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "queryDevtoolsOverridePersistence" }] : /* istanbul ignore next */ []));
+/**
+ * Where armed response overrides are kept. Switching to a scope that keeps them captures whatever is
+ * armed right now, so the choice reads as "keep these" rather than "keep the next ones"; switching
+ * between `session` and `local` moves the store; switching to `none` empties it and leaves every armed
+ * op exactly where it is for the rest of this page.
+ */
+const setQueryDevtoolsOverridesScope = (next) => {
+    const previous = scope();
+    if (next === previous)
+        return;
+    // Off both stores first: whichever the previous scope was, its copy must not outlive the change.
+    clearQueryDevtoolsStore(STORAGE_KEY);
+    setQueryDevtoolsSettings({ overrides: next });
+    if (next === 'none') {
+        ops = {};
+        forgetCarriedOver();
+        return;
+    }
+    lastPersistentScope = next;
+    if (previous === 'none') {
+        ops = {};
+        for (const [id, recorder] of armedRecorders) {
+            const list = recorder.list().map((entry) => entry.op);
+            if (list.length)
+                ops[id] = list;
+        }
+    }
+    writeStore();
+};
+/**
+ * Turns persistence on or off - the panel's "Keep across reloads" toggle. On restores the last scope
+ * that kept them (`session` unless Settings picked `local`).
+ */
+const setQueryDevtoolsOverridePersistence = (value) => {
+    setQueryDevtoolsOverridesScope(value ? lastPersistentScope : 'none');
+};
+/**
+ * Empties the override store in both browser stores and disarms everything a reload brought back,
+ * without changing where overrides are kept - the panel's "Reset devtools".
+ */
+const clearQueryDevtoolsOverrideStore = () => {
+    clearRestoredQueryDevtoolsOverrides();
+    ops = {};
+    clearQueryDevtoolsStore(STORAGE_KEY);
+};
+/**
+ * The ops this page load inherited from the previous one, and for each id whether a live query has taken
+ * it. Overrides that outlive the page that armed them have to announce themselves, because an app being
+ * lied to looks exactly like an app that is broken.
+ */
+const restoredQueryDevtoolsOverrides = 
+/* @__PURE__ */ restored.asReadonly();
+/**
+ * The scope those ops came back from, or `null` when this page inherited none. `local` is the one worth
+ * naming in the banner: it means they outlived closing the tab, not just a reload.
+ */
+const queryDevtoolsRestoredOverridesScope = 
+/* @__PURE__ */ restoredScope.asReadonly();
+/** Disarms every op this page load inherited and empties the store - the banner's one-click way out. */
+const clearRestoredQueryDevtoolsOverrides = () => {
+    for (const id of replayed) {
+        armedRecorders.get(id)?.clearAll();
+        armedRecorders.delete(id);
+    }
+    for (const id of carriedOver.keys())
+        writeOps(id, []);
+    forgetCarriedOver();
+};
+/**
+ * Wraps a query's overrides recorder so its armed ops are stored and replayed. Replay happens here, at
+ * registration, rather than in the panel - a query can run long before the panel is ever opened.
+ *
+ * Ids are reload-deterministic (descriptor + per-descriptor counter), so the same queries created in the
+ * same order re-arm correctly; an id the store holds that nobody claims is reported by
+ * {@link restoredQueryDevtoolsOverrides} rather than guessed at.
+ * @internal
+ */
+const withQueryDevtoolsOverridePersistence = (id, recorder) => {
+    const inherited = ops[id];
+    if (scope() !== 'none' && inherited?.length) {
+        for (const op of inherited)
+            recorder.arm(op);
+        armedRecorders.set(id, recorder);
+        replayed.add(id);
+        publishRestored();
+    }
+    const sync = () => {
+        const list = recorder.list().map((entry) => entry.op);
+        if (list.length)
+            armedRecorders.set(id, recorder);
+        else
+            armedRecorders.delete(id);
+        if (scope() !== 'none')
+            writeOps(id, list);
+    };
+    return {
+        ...recorder,
+        arm: (op) => {
+            recorder.arm(op);
+            sync();
+        },
+        clear: (opId) => {
+            recorder.clear(opId);
+            sync();
+        },
+        clearAll: () => {
+            recorder.clearAll();
+            if (replayed.delete(id))
+                publishRestored();
+            sync();
+        },
+    };
+};
+
 const isPathAtOrBelow = (path, root) => path.length >= root.length && root.every((step, index) => step === path[index]);
 /**
  * Whether any of `entries` is armed at `path` or anywhere below it - what the panel's menu asks before
@@ -5841,6 +6628,30 @@ const withValueAtPath = (root, path, value) => {
     const container = root && typeof root === 'object' ? root : {};
     return { ...container, [head]: withValueAtPath(container[head], rest, value) };
 };
+/**
+ * Returns a copy of `root` with the value at `path` removed from its parent, cloning only the containers
+ * along the way. An array parent splices, so the elements after it shift down instead of the slot
+ * becoming a hole that serializes back as `null`.
+ */
+const withoutValueAtPath = (root, path) => {
+    const [head, ...rest] = path;
+    if (rest.length === 0) {
+        if (Array.isArray(root)) {
+            const next = [...root];
+            next.splice(head, 1);
+            return next;
+        }
+        const { [head]: _dropped, ...remaining } = root;
+        return remaining;
+    }
+    if (Array.isArray(root)) {
+        const next = [...root];
+        next[head] = withoutValueAtPath(root[head], rest);
+        return next;
+    }
+    const container = root;
+    return { ...container, [head]: withoutValueAtPath(container[head], rest) };
+};
 const IDENTITY_KEY_PATTERNS = [/^id$/i, /(^|[a-z])Id$/, /^uuid$/i, /^key$/i];
 const isIdentityKey = (key) => IDENTITY_KEY_PATTERNS.some((pattern) => pattern.test(key));
 /** Whether every sibling in `array` that has `key` holds a distinct string/number value for it. */
@@ -6133,6 +6944,19 @@ const applyOp = (root, op) => {
                 return { root, ok: false };
             }
             return { root: withValueAtPath(root, op.path, duplicateOneArrayItem(resolution.value, op.index)), ok: true };
+        case 'pasteArrayItem': {
+            if (!Array.isArray(resolution.value))
+                return { root, ok: false };
+            const next = [...resolution.value];
+            const at = op.index === undefined ? next.length : Math.min(Math.max(0, op.index), next.length);
+            next.splice(at, 0, op.value);
+            return { root: withValueAtPath(root, op.path, next), ok: true };
+        }
+        case 'deleteAt':
+            // The response root has no parent to be removed from, and a key that is already gone stays gone.
+            if (!op.path.length || !resolution.exists)
+                return { root, ok: false };
+            return { root: withoutValueAtPath(root, op.path), ok: true };
         case 'duplicateArray':
             if (!Array.isArray(resolution.value))
                 return { root, ok: false };
@@ -6165,10 +6989,14 @@ const applyQueryDevtoolsOverrides = (entries, raw) => {
     return { value: root, staleIds };
 };
 /**
- * Accumulates the response overrides armed on one query, for the devtools panel. Only ever created
- * while {@link provideQueryDevtools} is installed - like {@link createQueryDevtoolsStats}, an app
- * without devtools pays nothing for it.
- * @internal
+ * Accumulates the response overrides armed on one query, for the devtools panel. Instrumentation only
+ * creates one while {@link provideQueryDevtools} is installed - like {@link createQueryDevtoolsStats},
+ * an app without devtools pays nothing for it.
+ *
+ * The panel also creates one that belongs to no query at all, to record the edits made to a mock's draft
+ * body: the ops are flattened with {@link applyQueryDevtoolsOverrides} and thrown away on save.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
  */
 const createQueryDevtoolsOverrides = () => {
     const list = signal([], /* @ts-ignore */
@@ -6187,6 +7015,636 @@ const createQueryDevtoolsOverrides = () => {
     return { list: list.asReadonly(), arm, clear, clearAll, apply };
 };
 
+const TRANSFER_KIND = 'ethlete-query-overrides';
+const TRANSFER_VERSION = 1;
+const OP_TYPES = /* @__PURE__ */ new Set([
+    'set',
+    'stringPreset',
+    'numberPreset',
+    'booleanFlip',
+    'datePreset',
+    'duplicateArrayItem',
+    'pasteArrayItem',
+    'deleteAt',
+    'duplicateArray',
+    'paginationResize',
+    'reset',
+]);
+const isJsonPath = (value) => Array.isArray(value) && value.every((step) => typeof step === 'string' || typeof step === 'number');
+const isOverrideOp = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const op = value;
+    return typeof op.type === 'string' && OP_TYPES.has(op.type) && isJsonPath(op.path);
+};
+/**
+ * Serializes the ops armed on one query into clipboard text. `reset` never reaches a recorder's list, so
+ * what comes out is exactly what a paste can put back.
+ */
+const serializeQueryDevtoolsOverrideTransfer = (entries, source) => {
+    const payload = {
+        kind: TRANSFER_KIND,
+        version: TRANSFER_VERSION,
+        ...(source ? { source } : {}),
+        ops: entries.map((entry) => entry.op),
+    };
+    return JSON.stringify(payload, null, 2);
+};
+/**
+ * Reads clipboard text back into ops. A bare array of ops is accepted alongside the full envelope, so a
+ * set pasted out of a ticket and trimmed by hand still lands; an op whose `type` this build doesn't know
+ * is counted in `skipped` rather than failing the whole paste, so an older panel can take a newer one's
+ * set minus the parts it cannot replay.
+ */
+const parseQueryDevtoolsOverrideTransfer = (text) => {
+    if (!text.trim())
+        return { ok: false, reason: 'The clipboard is empty' };
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, reason: 'The clipboard does not hold valid JSON' };
+    }
+    const envelope = !Array.isArray(parsed) && parsed && typeof parsed === 'object' ? parsed : null;
+    const raw = Array.isArray(parsed) ? parsed : envelope?.['ops'];
+    if (!Array.isArray(raw))
+        return { ok: false, reason: 'The clipboard does not hold a copied override set' };
+    const ops = raw.filter(isOverrideOp);
+    const skipped = raw.length - ops.length;
+    if (!ops.length) {
+        return { ok: false, reason: skipped ? 'None of those ops can be replayed by this build' : 'That set is empty' };
+    }
+    const source = envelope?.['source'];
+    return {
+        ok: true,
+        ops,
+        skipped,
+        ...(source && typeof source === 'object' && !Array.isArray(source) ? { source: source } : {}),
+    };
+};
+/**
+ * How many of `ops` would not resolve against `raw` - what a paste onto a differently-shaped query
+ * reports, so ops sitting on nothing say so instead of looking armed. Replays them the same way the
+ * pipeline will, since an earlier op can be what makes a later one's path exist.
+ */
+const countUnresolvedQueryDevtoolsOverrides = (ops, raw) => applyQueryDevtoolsOverrides(ops.map((op, index) => ({ id: `${index}`, op })), raw).staleIds.length;
+/** Arms every op of a parsed set onto a query, on top of whatever it already has armed. */
+const armQueryDevtoolsOverrideTransfer = (recorder, ops) => {
+    for (const op of ops)
+        recorder.arm(op);
+};
+
+// Generated from package.json by tools/scripts/generate-version.js - do not edit.
+/** The version of `@ethlete/query` this build was cut from. */
+const QUERY_VERSION = '6.0.0-next.34';
+
+/** How deep a schema is expanded before a nested branch is given up on. */
+const MAX_DEPTH = 12;
+/** How many elements are generated for an array, whatever its `minItems` says. */
+const MAX_ITEMS = 3;
+const HTTP_METHODS = ['get', 'put', 'post', 'delete', 'options', 'head', 'patch', 'trace'];
+const loader = /* @__PURE__ */ signal(null, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "loader" }] : /* istanbul ignore next */ []));
+const state = /* @__PURE__ */ signal({ status: 'unavailable' }, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "state" }] : /* istanbul ignore next */ []));
+const schemaDocument = /* @__PURE__ */ signal(null, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "schemaDocument" }] : /* istanbul ignore next */ []));
+const isRecord = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+/**
+ * Where the API description stands, for the panel's seeding controls.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const queryDevtoolsSchemaState = /* @__PURE__ */ state.asReadonly();
+/**
+ * Installs the application's schema loader. Called by `provideQueryDevtools()`; nothing else may call it.
+ * @internal
+ */
+const setQueryDevtoolsSchemaLoader = (next) => {
+    loader.set(next ?? null);
+    state.set({ status: next ? 'idle' : 'unavailable' });
+    schemaDocument.set(null);
+};
+/** A `() => import('./openapi.json')` loader hands back the module rather than the document inside it. */
+const unwrapModule = (value) => {
+    if (!isRecord(value))
+        return value;
+    if ('paths' in value || 'components' in value || 'definitions' in value || '$defs' in value)
+        return value;
+    return 'default' in value ? value['default'] : value;
+};
+const messageOf = (error) => (error instanceof Error ? error.message : String(error));
+/**
+ * Loads the API description, once. Calling it while it is loading or after it has loaded does nothing;
+ * calling it after a failure retries.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const loadQueryDevtoolsSchema = () => {
+    const load = loader();
+    const status = state().status;
+    if (!load || status === 'loading' || status === 'ready')
+        return;
+    state.set({ status: 'loading' });
+    Promise.resolve()
+        .then(() => load())
+        .then((value) => {
+        const parsed = unwrapModule(value);
+        if (!isRecord(parsed))
+            throw new Error('The schema loader did not return an object.');
+        schemaDocument.set(parsed);
+        state.set({ status: 'ready' });
+    })
+        .catch((error) => {
+        schemaDocument.set(null);
+        state.set({ status: 'error', message: messageOf(error) });
+    });
+};
+const namedSchemas = /* @__PURE__ */ computed(() => {
+    const doc = schemaDocument();
+    if (!doc)
+        return {};
+    const components = doc['components'];
+    return {
+        ...(isRecord(doc['$defs']) ? doc['$defs'] : null),
+        ...(isRecord(doc['definitions']) ? doc['definitions'] : null),
+        ...(isRecord(components) && isRecord(components['schemas']) ? components['schemas'] : null),
+    };
+}, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "namedSchemas" }] : /* istanbul ignore next */ []));
+/**
+ * Every schema the description names, sorted - the designer's "seed from a type" list.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const queryDevtoolsSchemaNames = /* @__PURE__ */ computed(() => Object.keys(namedSchemas()).sort(), /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "queryDevtoolsSchemaNames" }] : /* istanbul ignore next */ []));
+const decodePointer = (step) => decodeURIComponent(step.replace(/~1/g, '/').replace(/~0/g, '~'));
+/** The last segment of a `$ref` - `#/components/schemas/MatchId` is what a field's type is called. */
+const refLabel = (ref) => decodePointer(ref.split('/').pop() ?? ref);
+/** Resolves a local JSON pointer against the loaded document. A remote `$ref` cannot be followed. */
+const resolveRef = (ref) => {
+    if (!ref.startsWith('#/'))
+        return undefined;
+    let current = schemaDocument();
+    for (const step of ref.slice(2).split('/')) {
+        if (!isRecord(current))
+            return undefined;
+        current = current[decodePointer(step)];
+    }
+    return current;
+};
+const at = (path) => path || 'the root';
+/** The declared `type`, tolerating the `['string', 'null']` form JSON Schema and OpenAPI 3.1 both allow. */
+const typeOf = (schema) => {
+    const type = schema['type'];
+    if (typeof type === 'string')
+        return type;
+    if (Array.isArray(type))
+        return type.find((entry) => typeof entry === 'string' && entry !== 'null');
+    return undefined;
+};
+const isNullable = (schema) => {
+    const type = schema['type'];
+    return schema['nullable'] === true || (Array.isArray(type) && type.includes('null'));
+};
+const branchesOf = (schema) => {
+    for (const keyword of ['oneOf', 'anyOf']) {
+        const branches = schema[keyword];
+        if (Array.isArray(branches) && branches.length)
+            return { keyword, branches };
+    }
+    return null;
+};
+/**
+ * A short label for what a field is declared as: the name of the type it `$ref`s (which is the point -
+ * `MatchId` says more than `string`), a union of its branches, or its primitive type and format.
+ */
+const describeSchema = (schema, depth = 0) => {
+    if (!isRecord(schema) || depth > 4)
+        return 'unknown';
+    const ref = schema['$ref'];
+    if (typeof ref === 'string')
+        return refLabel(ref);
+    const nullSuffix = isNullable(schema) ? ' | null' : '';
+    const branches = branchesOf(schema);
+    if (branches) {
+        const labels = [...new Set(branches.branches.slice(0, 3).map((branch) => describeSchema(branch, depth + 1)))];
+        return `${labels.join(' | ')}${branches.branches.length > 3 ? ' | …' : ''}${nullSuffix}`;
+    }
+    const allOf = schema['allOf'];
+    if (Array.isArray(allOf) && allOf.length) {
+        const named = allOf.find((entry) => isRecord(entry) && typeof entry['$ref'] === 'string');
+        return `${describeSchema(named ?? allOf[0], depth + 1)}${nullSuffix}`;
+    }
+    const enumValues = schema['enum'];
+    if (Array.isArray(enumValues) && enumValues.length) {
+        const labels = enumValues.slice(0, 3).map((value) => JSON.stringify(value));
+        return `${labels.join(' | ')}${enumValues.length > 3 ? ' | …' : ''}${nullSuffix}`;
+    }
+    const type = typeOf(schema);
+    if (type === 'array')
+        return `${describeSchema(schema['items'], depth + 1)}[]${nullSuffix}`;
+    if (type === 'string') {
+        const format = schema['format'];
+        return `${typeof format === 'string' ? `string (${format})` : 'string'}${nullSuffix}`;
+    }
+    return `${type ?? 'unknown'}${nullSuffix}`;
+};
+const FORMAT_SAMPLES = {
+    'date-time': '2026-01-01T00:00:00.000Z',
+    date: '2026-01-01',
+    time: '00:00:00',
+    duration: 'P1D',
+    uuid: '00000000-0000-4000-8000-000000000000',
+    email: 'user@example.com',
+    hostname: 'example.com',
+    ipv4: '127.0.0.1',
+    ipv6: '::1',
+    uri: 'https://example.com',
+    'uri-reference': '/example',
+    url: 'https://example.com',
+    password: '',
+    byte: '',
+    binary: '',
+};
+/**
+ * A placeholder string: the declared format's shape where there is one, otherwise the field's own name -
+ * which reads as obviously unreal while still saying which field you are looking at.
+ */
+const stringSample = (node, schema) => {
+    const format = schema['format'];
+    if (typeof format === 'string' && format in FORMAT_SAMPLES)
+        return FORMAT_SAMPLES[format];
+    const title = schema['title'];
+    if (typeof title === 'string' && title)
+        return title;
+    return node.key ?? 'string';
+};
+const numberSample = (schema) => {
+    for (const keyword of ['minimum', 'exclusiveMinimum', 'default']) {
+        const value = schema[keyword];
+        if (typeof value === 'number' && Number.isFinite(value))
+            return keyword === 'exclusiveMinimum' ? value + 1 : value;
+    }
+    return 0;
+};
+const childNode = (parent, child) => ({
+    schema: child.schema,
+    path: parent.path ? `${parent.path}.${child.key}` : child.key,
+    depth: parent.depth + 1,
+    key: child.key,
+});
+const requiredOf = (schema) => {
+    const required = schema['required'];
+    return new Set(Array.isArray(required) ? required.filter((entry) => typeof entry === 'string') : []);
+};
+const generateObject = (node, ctx) => {
+    const schema = node.schema;
+    const properties = schema['properties'];
+    if (!isRecord(properties)) {
+        if (isRecord(schema['additionalProperties'])) {
+            ctx.notes.add(`${at(node.path)} is a free-form map - generated as an empty object.`);
+        }
+        return {};
+    }
+    const required = requiredOf(schema);
+    const result = {};
+    for (const [key, child] of Object.entries(properties)) {
+        const target = childNode(node, { schema: child, key });
+        ctx.types.set(target.path, `${describeSchema(child)}${required.has(key) ? '' : '?'}`);
+        result[key] = generate(target, ctx);
+    }
+    return result;
+};
+const generateArray = (node, ctx) => {
+    const schema = node.schema;
+    const items = schema['items'];
+    if (!isRecord(items))
+        return [];
+    const minItems = typeof schema['minItems'] === 'number' ? schema['minItems'] : 1;
+    const count = Math.min(Math.max(1, minItems), MAX_ITEMS);
+    const target = { schema: items, path: `${node.path ? `${node.path}.` : ''}*`, depth: node.depth + 1, key: node.key };
+    ctx.types.set(target.path, describeSchema(items));
+    const element = generate(target, ctx);
+    return Array.from({ length: count }, () => structuredCopy(element));
+};
+/** Each generated element is its own value, so editing one in the designer does not edit the others. */
+const structuredCopy = (value) => {
+    if (Array.isArray(value))
+        return value.map(structuredCopy);
+    if (isRecord(value))
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, structuredCopy(entry)]));
+    return value;
+};
+/** Merges what every `allOf` member generates, so a composed schema seeds as one object. */
+const generateAllOf = (node, ctx) => {
+    const members = node.schema['allOf'];
+    const generated = members.map((member) => generate({ ...node, schema: member }, ctx));
+    const objects = generated.filter(isRecord);
+    if (objects.length !== generated.length)
+        return generated.find((value) => !isRecord(value)) ?? null;
+    return Object.assign({}, ...objects);
+};
+const generate = (node, ctx) => {
+    if (node.depth > MAX_DEPTH) {
+        ctx.notes.add(`${at(node.path)} is nested deeper than ${MAX_DEPTH} levels - generated as null.`);
+        return null;
+    }
+    if (!isRecord(node.schema))
+        return null;
+    const schema = node.schema;
+    const ref = schema['$ref'];
+    if (typeof ref === 'string') {
+        const name = refLabel(ref);
+        if (ctx.refs.includes(name)) {
+            ctx.notes.add(`${name} contains itself - the recursion was cut at ${at(node.path)} with null.`);
+            return null;
+        }
+        const resolved = resolveRef(ref);
+        if (resolved === undefined) {
+            ctx.notes.add(`${ref} could not be resolved - generated as null at ${at(node.path)}.`);
+            return null;
+        }
+        ctx.refs.push(name);
+        const value = generate({ ...node, schema: resolved }, ctx);
+        ctx.refs.pop();
+        return value;
+    }
+    for (const keyword of ['example', 'default', 'const']) {
+        if (keyword in schema)
+            return schema[keyword];
+    }
+    const examples = schema['examples'];
+    if (Array.isArray(examples) && examples.length)
+        return examples[0];
+    const enumValues = schema['enum'];
+    if (Array.isArray(enumValues) && enumValues.length)
+        return enumValues[0];
+    const branches = branchesOf(schema);
+    if (branches) {
+        if (branches.branches.length > 1) {
+            ctx.notes.add(`${at(node.path)} is a ${branches.keyword} - the first branch was taken.`);
+        }
+        return generate({ ...node, schema: branches.branches[0] }, ctx);
+    }
+    if (Array.isArray(schema['allOf']) && schema['allOf'].length)
+        return generateAllOf(node, ctx);
+    switch (typeOf(schema)) {
+        case 'object':
+            return generateObject(node, ctx);
+        case 'array':
+            return generateArray(node, ctx);
+        case 'string':
+            return stringSample(node, schema);
+        case 'integer':
+        case 'number':
+            return numberSample(schema);
+        case 'boolean':
+            return false;
+        case 'null':
+            return null;
+        default:
+            break;
+    }
+    if (isRecord(schema['properties']))
+        return generateObject(node, ctx);
+    ctx.notes.add(`${at(node.path)} declares no type - generated as null.`);
+    return null;
+};
+const seedFrom = (schema, name) => {
+    const ctx = { types: new Map(), notes: new Set(), refs: name ? [name] : [] };
+    const body = generate({ schema, path: '', depth: 0, key: null }, ctx);
+    return { body, schemaName: name, types: ctx.types, notes: [...ctx.notes] };
+};
+/**
+ * Generates a body from one named schema (`MatchView`), or `null` when the description does not name it.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const seedQueryDevtoolsSchemaBody = (name) => {
+    const schema = namedSchemas()[name];
+    if (schema === undefined)
+        return null;
+    return seedFrom(schema, name);
+};
+/** Where a schema was collected from, so the same name arriving from two pointers is caught. */
+const originOf = (label, pointer) => pointer ?? `named:${label}`;
+/**
+ * Copies a schema, pointing every local `$ref` at `#/components/schemas/<name>` and queueing that name -
+ * so a document assembled from these resolves against its own `components`, whether the description kept
+ * its schemas under `components.schemas`, `definitions` or `$defs`.
+ */
+const rewriteRefs = (value, queue) => {
+    if (Array.isArray(value))
+        return value.map((entry) => rewriteRefs(entry, queue));
+    if (!isRecord(value))
+        return value;
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (key === '$ref' && typeof entry === 'string') {
+            if (!entry.startsWith('#/')) {
+                result[key] = entry;
+                continue;
+            }
+            const label = refLabel(entry);
+            queue({ label, pointer: entry });
+            result[key] = `#/components/schemas/${label}`;
+            continue;
+        }
+        result[key] = rewriteRefs(entry, queue);
+    }
+    return result;
+};
+/**
+ * Collects the named schemas a set of routes was designed against, ready to be handed back as the
+ * `components.schemas` of an exported document - so a route seeded from `MatchView` can reference
+ * `MatchView` instead of an anonymous shape inferred from one body.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const collectQueryDevtoolsSchemaComponents = (names) => {
+    const declared = namedSchemas();
+    const schemas = {};
+    const notes = new Set();
+    const origins = new Map();
+    const pending = names.map((label) => ({ label, pointer: null }));
+    while (pending.length) {
+        const request = pending.shift();
+        const origin = originOf(request.label, request.pointer);
+        const seen = origins.get(request.label);
+        if (seen !== undefined) {
+            if (seen !== origin) {
+                notes.add(`Two different schemas are both called ${request.label} - only the one from ${seen} was kept.`);
+            }
+            continue;
+        }
+        const schema = request.pointer === null ? declared[request.label] : resolveRef(request.pointer);
+        if (schema === undefined) {
+            if (request.pointer !== null) {
+                notes.add(`${request.pointer} could not be resolved, so ${request.label} is missing from the export.`);
+            }
+            continue;
+        }
+        origins.set(request.label, origin);
+        schemas[request.label] = rewriteRefs(schema, (next) => pending.push(next));
+    }
+    for (const schema of Object.values(schemas)) {
+        collectRemoteRefs(schema, notes);
+    }
+    return { schemas, notes: [...notes] };
+};
+/** A `$ref` to another file is left as it was written, so a document says where it stops resolving. */
+const collectRemoteRefs = (value, notes) => {
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            collectRemoteRefs(entry, notes);
+        return;
+    }
+    if (!isRecord(value))
+        return;
+    for (const [key, entry] of Object.entries(value)) {
+        if (key === '$ref' && typeof entry === 'string' && !entry.startsWith('#/')) {
+            notes.add(`${entry} points outside the description - it was exported unchanged and will not resolve.`);
+            continue;
+        }
+        collectRemoteRefs(entry, notes);
+    }
+};
+const segmentsOf = (pattern) => pattern.split('/').filter(Boolean);
+/** `/matches/{id}` and `/matches/:id` describe the same route; a mock's pattern is written the second way. */
+const toColonPattern = (path) => path.replace(/\{([^}]+)\}/g, ':$1');
+const isParam = (segment) => segment.startsWith(':');
+/** Whether two patterns describe the same route, allowing their path params to be named differently. */
+const patternsMatch = (a, b) => {
+    const left = segmentsOf(a);
+    const right = segmentsOf(b);
+    if (left.length !== right.length)
+        return false;
+    return left.every((segment, index) => {
+        const other = right[index];
+        return isParam(segment) || isParam(other) ? isParam(segment) && isParam(other) : segment === other;
+    });
+};
+/**
+ * Every route the description declares, as the designer offers them - including the ones no query has
+ * ever called, which is the case a mock exists for.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const queryDevtoolsSchemaRoutes = /* @__PURE__ */ computed(() => {
+    const paths = schemaDocument()?.['paths'];
+    if (!isRecord(paths))
+        return [];
+    const routes = [];
+    for (const [path, item] of Object.entries(paths)) {
+        if (!isRecord(item))
+            continue;
+        for (const method of HTTP_METHODS) {
+            const operation = item[method];
+            if (!isRecord(operation))
+                continue;
+            const summary = operation['summary'] ?? operation['operationId'];
+            routes.push({
+                method: method.toUpperCase(),
+                pattern: toColonPattern(path),
+                summary: typeof summary === 'string' ? summary : '',
+            });
+        }
+    }
+    return routes;
+}, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "queryDevtoolsSchemaRoutes" }] : /* istanbul ignore next */ []));
+const findOperation = (target) => {
+    const paths = schemaDocument()?.['paths'];
+    if (!isRecord(paths))
+        return null;
+    const method = target.method.toLowerCase();
+    const segments = segmentsOf(target.pattern);
+    // A client's base path (`/api/v2`) is part of the request but not of the document, so a pattern that
+    // does not match is retried without its leading segments before giving up.
+    for (let skip = 0; skip < segments.length; skip++) {
+        const candidate = `/${segments.slice(skip).join('/')}`;
+        for (const [path, item] of Object.entries(paths)) {
+            if (!isRecord(item) || !isRecord(item[method]))
+                continue;
+            if (!patternsMatch(toColonPattern(path), candidate))
+                continue;
+            return {
+                operation: item[method],
+                path,
+                droppedPrefix: skip ? `/${segments.slice(0, skip).join('/')}` : '',
+            };
+        }
+    }
+    return null;
+};
+/** The success response of an operation: the lowest 2xx the document declares, else its `default`. */
+const successResponse = (operation) => {
+    const responses = operation['responses'];
+    if (!isRecord(responses))
+        return null;
+    const status = Object.keys(responses)
+        .filter((key) => /^2\d\d$/.test(key))
+        .sort()[0];
+    const key = status ?? (('default' in responses && 'default') || null);
+    if (!key)
+        return null;
+    const response = responses[key];
+    return isRecord(response) ? { response, status: key } : null;
+};
+/** The JSON media type of a response, tolerating `application/vnd.x+json` and Swagger 2's flat `schema`. */
+const jsonSchemaOf = (response) => {
+    const content = response['content'];
+    if (!isRecord(content))
+        return isRecord(response['schema']) ? { schema: response['schema'], example: undefined } : null;
+    const key = Object.keys(content).find((type) => type.includes('json')) ?? Object.keys(content)[0];
+    if (!key)
+        return null;
+    const media = content[key];
+    if (!isRecord(media))
+        return null;
+    return { schema: media['schema'], example: media['example'] };
+};
+/**
+ * Generates a body for one route from the description's own success response - the seed that makes a
+ * designed mock a real view model rather than a guess. `null` when the document does not declare the
+ * route, or declares no JSON response for it.
+ *
+ * Part of the devtools contract. **Not part of the general public contract.**
+ */
+const seedQueryDevtoolsSchemaRoute = (target) => {
+    const match = findOperation(target);
+    if (!match)
+        return null;
+    const success = successResponse(match.operation);
+    if (!success)
+        return null;
+    const json = jsonSchemaOf(success.response);
+    if (!json)
+        return null;
+    // A top-level `$ref` is resolved here rather than by the walk, so `seedFrom` always receives the
+    // schema its `name` stands for - otherwise the walk reads the name as one it is already expanding and
+    // cuts the whole body as a cycle.
+    const ref = isRecord(json.schema) ? json.schema['$ref'] : null;
+    const named = typeof ref === 'string' ? { schema: resolveRef(ref), name: refLabel(ref) } : null;
+    if (named && named.schema === undefined)
+        return null;
+    const seed = json.example === undefined
+        ? seedFrom(named ? named.schema : json.schema, named ? named.name : null)
+        : {
+            body: json.example,
+            schemaName: null,
+            types: new Map(),
+            notes: ['The document ships an example for this route - it was used as-is.'],
+        };
+    const notes = [...seed.notes, `Generated from ${match.path} ${target.method.toUpperCase()} ${success.status}.`];
+    if (match.droppedPrefix)
+        notes.push(`The document has no ${match.droppedPrefix} prefix - it was ignored when matching.`);
+    return { ...seed, notes };
+};
+
 const EMPTY_STATS = {
     executions: 0,
     requests: 0,
@@ -6233,21 +7691,22 @@ const RUN_HISTORY = 25;
  * decision the app has to make for itself.
  */
 const DEFAULT_RESPONSE_HISTORY = 5;
-let responseHistory = DEFAULT_RESPONSE_HISTORY;
+let providedResponseHistory = DEFAULT_RESPONSE_HISTORY;
 /**
- * How many bodies each query retains - {@link QueryDevtoolsOptions.responseHistory}, or `5`. Only a run
- * that still holds one can be an end of a response diff, so the panel reads this to say why an older run
- * can no longer be picked.
+ * How many bodies each query retains: what the panel's Settings tab asks for, or
+ * {@link QueryDevtoolsOptions.responseHistory}, or `5`. Only a run that still holds one can be an end of
+ * a response diff, so the panel reads this to say why an older run can no longer be picked.
  *
  * Part of the devtools contract. **Not part of the general public contract.**
  */
-const queryDevtoolsResponseHistory = () => responseHistory;
+const queryDevtoolsResponseHistory = () => queryDevtoolsSettings().responseHistory ?? providedResponseHistory;
 /**
- * Sets how many bodies each query retains. Called by `provideQueryDevtools()`; nothing else may call it.
+ * Sets the application's own retention, which the panel's Settings tab can raise for the rest of the
+ * page. Called by `provideQueryDevtools()`; nothing else may call it.
  * @internal
  */
 const setQueryDevtoolsResponseHistory = (count) => {
-    responseHistory = count === undefined ? DEFAULT_RESPONSE_HISTORY : Math.max(1, Math.floor(count));
+    providedResponseHistory = count === undefined ? DEFAULT_RESPONSE_HISTORY : Math.max(1, Math.floor(count));
 };
 /** The index of the newest run still in flight, or -1 when none is. */
 const lastPendingRunIndex = (runs) => {
@@ -6263,7 +7722,9 @@ const lastPendingRunIndex = (runs) => {
  * two. Mutates the array it is given, which is always one this module just built.
  */
 const trimRetainedBodies = (runs) => {
-    const budget = responseHistory;
+    // Untracked: a run is recorded from whatever context the query is running in, and reading the setting
+    // there would make that context re-run every time the setting changes.
+    const budget = untracked(queryDevtoolsResponseHistory);
     let kept = 0;
     for (let index = runs.length - 1; index >= 0; index--) {
         const run = runs[index];
@@ -6465,6 +7926,90 @@ const sumQueryDevtoolsStats = (handles) => {
     return total;
 };
 
+/**
+ * The longest lifetime an armed override may claim, in seconds (7 days). Anything beyond it is never
+ * refreshed at all, which is what arming nothing already does.
+ */
+const QUERY_DEVTOOLS_TOKEN_TTL_LIMIT = 604800;
+/** The claims an overridden lifetime is measured from, in the order they are tried. */
+const ANCHOR_CLAIMS = ['iat', 'nbf'];
+const ttls = /* @__PURE__ */ signal({}, /* @ts-ignore */
+...(ngDevMode ? [{ debugName: "ttls" }] : /* istanbul ignore next */ []));
+/**
+ * The access-token lifetime armed per auth provider name, in seconds, consumed by the
+ * `<et-query-devtools>` panel. A provider on its token's real lifetime is absent rather than present
+ * with it.
+ */
+const queryDevtoolsTokenTtls = /* @__PURE__ */ ttls.asReadonly();
+const tokenTtlAnchor = (options) => {
+    const { payload, expiresInPropertyName } = options;
+    if (!payload || typeof payload[expiresInPropertyName] !== 'number')
+        return null;
+    for (const claim of ANCHOR_CLAIMS) {
+        const value = payload[claim];
+        if (typeof value === 'number')
+            return value;
+    }
+    return null;
+};
+/**
+ * Whether an overridden lifetime can be applied to a decoded access token at all. It needs the claim
+ * carrying the expiry - so a lifetime is never invented for a token that declares none - plus `iat` or
+ * `nbf` to measure the new lifetime from.
+ */
+const canOverrideQueryDevtoolsTokenTtl = (options) => tokenTtlAnchor({ payload: options.payload, expiresInPropertyName: options.expiresInPropertyName ?? 'exp' }) !== null;
+/**
+ * Presents one auth provider's access token as living `seconds` from the moment it was issued, rather
+ * than as long as it says it does. Everything that reads the expiry sees the shortened lifetime - the
+ * proactive refresh schedule, `withBearerAuthTokenExpirationWarning`, and the panel's own countdown -
+ * so arming 60 seconds makes a real refresh happen a minute after each token is issued, and keeps
+ * happening for every token that refresh brings back.
+ *
+ * It is a lifetime, not a remaining time: `0` presents the current token as long expired, which is what
+ * makes a refresh happen at once. Nothing is persisted, so a reload leaves every provider on its real
+ * lifetime.
+ *
+ * Part of the devtools contract consumed by `<et-query-devtools>`; a token's lifetime is not something
+ * an application should override on itself.
+ */
+const setQueryDevtoolsTokenTtl = (options) => {
+    const { providerName, seconds } = options;
+    const clamped = Math.min(Math.max(Math.trunc(seconds) || 0, 0), QUERY_DEVTOOLS_TOKEN_TTL_LIMIT);
+    ttls.update((current) => ({ ...current, [providerName]: clamped }));
+};
+/**
+ * Puts one provider back on its token's real lifetime, or every provider when no name is given.
+ *
+ * @see setQueryDevtoolsTokenTtl
+ */
+const clearQueryDevtoolsTokenTtl = (providerName) => {
+    ttls.update((current) => {
+        if (providerName === undefined)
+            return {};
+        const { [providerName]: _removed, ...rest } = current;
+        return rest;
+    });
+};
+/**
+ * The decoded access token as the devtools want it seen: the claim carrying the expiry rewritten to the
+ * armed lifetime, measured from `iat`. Returns `payload` untouched when nothing is armed for the
+ * provider, or when the token cannot carry the override - see {@link canOverrideQueryDevtoolsTokenTtl}.
+ *
+ * Installed as the token payload patcher by `provideQueryDevtools()`, and called directly by the panel
+ * for its own countdown.
+ */
+const applyQueryDevtoolsTokenTtl = (options) => {
+    const { payload, providerName, expiresInPropertyName = 'exp' } = options;
+    const seconds = ttls()[providerName];
+    if (seconds === undefined || !payload || typeof payload !== 'object')
+        return payload;
+    const record = payload;
+    const anchor = tokenTtlAnchor({ payload: record, expiresInPropertyName });
+    if (anchor === null)
+        return payload;
+    return { ...record, [expiresInPropertyName]: anchor + seconds };
+};
+
 /**
  * How many destroyed queries the registry keeps. A tombstone holds the last response body it captured,
  * so the list is capped for the same reason the repository caps its unused entries.
@@ -6682,7 +8227,7 @@ const registerEntry = (registration) => {
         createdAt: Date.now(),
         stats: registration.stats,
         formLinks: registration.formLinks,
-        overrides: registration.overrides,
+        overrides: registration.overrides && withQueryDevtoolsOverridePersistence(id, registration.overrides),
     };
     // A registration that brings its own id can repeat one a tombstone still holds; the live entry wins.
     entries.update((list) => [...list.filter((e) => !(e.id === id && e.destroyedAt)), fullEntry]);
@@ -6736,12 +8281,24 @@ const clearQueryDevtoolsTombstones = (ids) => {
  * ```
  */
 const provideQueryDevtools = (options) => {
+    // First: the stored settings say where the override store lives and whether the panel has raised the
+    // retention this app asked for, and both are read by the calls below.
+    initQueryDevtoolsSettings();
     setQueryDevtoolsResponseHistory(options?.responseHistory);
+    registerEthleteVersion('core', CORE_VERSION);
+    registerEthleteVersion('query', QUERY_VERSION);
+    setQueryDevtoolsAppInfo(options?.about);
+    initQueryDevtoolsOverridePersistence();
+    initQueryDevtoolsMocks();
+    initQueryDevtoolsFaults();
+    setQueryDevtoolsSchemaLoader(options?.schema);
     setQueryDevtoolsRegistrar(registerEntry);
     setQueryDevtoolsStatsFactory(createQueryDevtoolsStats);
     setQueryDevtoolsFormLinksFactory(createQueryDevtoolsFormLinks);
     setQueryDevtoolsOverridesFactory(createQueryDevtoolsOverrides);
     setQueryDevtoolsFaultResolver(resolveQueryDevtoolsFaultForAttempt);
+    setQueryDevtoolsMockResolver(resolveQueryDevtoolsMockForAttempt);
+    setQueryDevtoolsTokenPayloadPatcher(applyQueryDevtoolsTokenTtl);
     if (!isDevMode()) {
         console.warn('You are using the Query Devtools in production mode. This increases the size of your bundle and should only be used for development purposes.');
     }
@@ -6859,14 +8416,14 @@ const createSecureGqlExecuteFn = (executeOptions) => {
         state: executeOptions.state,
         autoExecutes: shouldAutoExecuteGqlQuery(executeOptions.creatorInternals.method) &&
             !executeOptions.queryConfig.onlyManualExecution,
-        transformAuthAndExec: (executeArgs, _tokens, headers, executeState) => {
+        transformAuthAndExec: (executeArgs, executeState) => {
             const { args, options: runOptions } = executeArgs ?? {};
             const query = transformGql(executeOptions.creatorInternals.query);
             let gqlParams = query(args?.variables);
             if (args?.queryParams && executeOptions.creatorInternals.transport === 'GET') {
                 gqlParams = { ...gqlParams, ...args.queryParams };
             }
-            const computedArgs = { ...(args ?? {}), headers };
+            const computedArgs = { ...(args ?? {}) };
             if (executeOptions.creatorInternals.transport === 'GET') {
                 computedArgs.queryParams = gqlParams;
             }
@@ -12282,5 +13839,5 @@ const createWebSocketClient = (options) => {
  * Generated bundle index. Do not edit.
  */
 
-export { BasicAuthProvider, BearerAuthFeatureType, BooleanArrayQueryField, CLEAR_QUERY_ARGS, CustomHeaderAuthProvider, DEFAULT_KEEP_UNUSED_FOR, DEFAULT_QUERY_PERSISTENCE_MAX_AGE, DEFAULT_QUERY_PERSISTENCE_MAX_ENTRIES, DEFAULT_QUERY_PERSISTENCE_VERSION, DEFAULT_QUERY_PERSISTENCE_WRITE_DELAY, DateArrayQueryField, DateQueryField, EMPTY_QUERY_DEVTOOLS_FAULT, EntityStore, IGNORED_FILTER_COUNT_FIELDS, INFINITY_QUERY_TOKEN, InfinityQuery, InfinityQueryDirective, InfinityQueryTriggerDirective, LegacyQuery, LegacyQueryCreator, MAX_QUERY_DEVTOOLS_TOMBSTONES, MAX_UNUSED_ENTRIES, NumberArrayQueryField, ParseHttpErrorCodeToMessageDePipe, ParseHttpErrorCodeToMessageEnPipe, ParseHttpErrorCodeToTitleDePipe, ParseHttpErrorCodeToTitleEnPipe, QUERY_CLIENT_DEVTOOLS_TOKEN, QUERY_DEVTOOLS_FAULT_STATUSES, QUERY_PERSISTENCE_STORE_VERSION, QUERY_SYNC_PROTOCOL_VERSION, QueryClientFeatureType, QueryDevtoolsComponent, QueryDirective, QueryFeatureType, QueryField, QueryForm, QueryRuntimeErrorCode, QueryShortNamePipe, QueryStore, SERVER_ERROR_KIND, SERVER_VIOLATION_ERROR_KIND, SPEED_BUFFER_TIME_IN_MS, SearchQueryField, SortQueryField, StringArrayQueryField, V2BearerAuthProvider, V2Query, V2QueryClient, V2QueryCreator, addQueryContainerHandling, applyQueryDevtoolsOverrides, applyQueryFeatures, authExtractTokensResponseMissingAccessToken, authExtractTokensResponseMissingRefreshToken, authExtractTokensResponseNotObject, authProviderFeatureUsedMultipleTimes, booleanArrayQueryField, buildQueryCacheKey, buildQueryString, buildRoute, buildTimestampFromSeconds, castQueryCreatorTypes, circularQueryDependency, circularQueryDependencyChecker, clearQueryDevtoolsFaults, clearQueryDevtoolsTombstones, collectLeafPaths, collectQueryFormLinks, computeQueryAuthHeader, computeQueryBody, computeQueryHeaders, computeQueryMethod, computeQueryQueryParams, consumeSuppressQueryStackDevtools, contentfulGqlLikePaginationAdapter, createAuthGuard, createBaseQuery, createBaseQueryCreator, createBearerAuthProvider, createDeleteQuery, createExecuteFn, createGetQuery, createGqlExecuteFn, createGqlMutationViaGet, createGqlMutationViaPost, createGqlQuery, createGqlQueryCreator, createGqlQueryViaGet, createGqlQueryViaPost, createHttpRequest, createIndexedDbQueryPersistenceAdapter, createInfinityQueryConfig, createLegacyQueryCreator, createNoopQueryPersistenceAdapter, createPagedQueryStack, createPatchQuery, createPersistentAuthFeature, createPostQuery, createPutQuery, createQuery, createQueryClient, createQueryCollection, createQueryCollectionSignal, createQueryCollectionSubject, createQueryContext, createQueryCreator, createQueryDevtoolsFormLinks, createQueryDevtoolsFormLinksRecorder, createQueryDevtoolsOverrides, createQueryDevtoolsOverridesRecorder, createQueryDevtoolsStats, createQueryDevtoolsStatsRecorder, createQueryErrorResponse, createQueryFeature, createQueryInvalidationFilter, createQueryKeyLockManager, createQueryObject, createQueryPersistenceEngine, createQueryRepository, createQuerySnapshotFn, createQueryStack, createQuerySyncEngine, createQuerySyncTransport, createSecureDeleteQuery, createSecureExecuteFactory, createSecureExecuteFn, createSecureGetQuery, createSecureGqlExecuteFn, createSecureGqlMutationViaGet, createSecureGqlMutationViaPost, createSecureGqlQuery, createSecureGqlQueryCreator, createSecureGqlQueryViaGet, createSecureGqlQueryViaPost, createSecurePatchQuery, createSecurePostQuery, createSecurePutQuery, createSecureQuery, createSecureQueryCreator, createTrackingFeature, createWebSocketClient, dateArrayQueryField, dateQueryField, decryptBearer, deepFreeze, def, defineQueryForm, describeQueryDevtoolsFeatures, detectContentTypeHeader, detectPaginationShape, dynLikePaginationAdapter, effectComputed, emptyQueryArgs, ethletePaginationAdapter, executeUntilSettled, extractExpiresInSeconds, extractFormViolations, extractHtmlErrorMessage, extractQuery, fakePaginationAdapter, filterFailure, filterNull, filterQueryStates, filterSuccess, forEachHeader, formatQueryDevtoolsDuration, generateQueryDevtoolsNumberPreset, generateQueryDevtoolsStringPreset, getBearerAuthProviderName, getDefaultHeaders, getQueryClientName, getQueryFeatureUsage, getResponseUrl, ggLikePaginationAdapter, gql, gqlDataPropertyMissingInResponse, hasHeader, hasQueryDevtoolsOverridesAtPath, htmlErrorPayload, htmlQueryErrorParser, ignoreAutoRefresh, injectInfinityQueryResponseDelay, injectQueryContext, insertFrom, invalidBaseRouteError, invalidBodyError, invalidRouteError, invalidStateInsideSecureExecuteFactory, isAutoRefresh, isBasicAuthProvider, isBearerAuthProvider, isClassValidatorError, isCreateGqlQueryOptions, isCustomHeaderAuthProvider, isDateShapedLeaf, isEmptyString, isGqlQueryConfig, isHtmlErrorPayload, isLegacyQuery, isNaN$1 as isNaN, isPageOutOfRangeError, isQuery, isQueryCollection, isQueryDevtoolsEnabled, isQueryDevtoolsFaultArmed, isQueryDevtoolsFaultInjectionEnabled, isQueryErrorResponse, isQueryStateCancelled, isQueryStateFailure, isQueryStateLoading, isQueryStatePrepared, isQueryStateSuccess, isRequestError, isSymfonyError, isSymfonyFormViolationListError, isSymfonyListError, isSymfonyPagerfantaOutOfRangeError, isUnderInvalidatedUrl, legacyPrepareFallbackInjector, legacyPrepareWithoutInjectionContext, mapToPaginated, mapViolationsToFormErrors, maybeExecute, measureQueryDevtoolsPayload, mergeHeaders, nestedEffect, noteQueryFormRead, numberArrayQueryField, pagedQueryStackNextPageCalledWithoutPreviousPage, pagedQueryStackPageBiggerThanTotalPages, pagedQueryStackPreviousPageCalledButAlreadyAtFirstPage, paginatedEntityValueUpdater, parseAllXhrResponseHeaders, parseHttpErrorCodeToMessageDe, parseHttpErrorCodeToMessageEn, parseHttpErrorCodeToTitleDe, parseHttpErrorCodeToTitleEn, parseQueryRoute, pathParamsMissingInRouteFunctionError, provideInfinityQueryResponseDelay, provideLegacyPrepareFallback, provideQueryClientForDevtools, provideQueryDevtools, queryArrayComputed, queryClientFeatureUsedMultipleTimes, queryComputed, queryComputedTillTruthy, queryDevtoolsEntries, queryDevtoolsFaults, queryDevtoolsFnDetail, queryDevtoolsResponseHistory, queryErrorMessage, queryErrorMessages, queryExecute, queryFeatureUsedMultipleTimes, queryField, querySequence, querySequenceAlreadyRunning, queryStackTotalQueriesAndExpectedQueriesMismatch, queryStackWithArgsUsed, queryStackWithResponseUpdateUsed, queryStateAlreadyHasKeyError, queryStateCannotTransformError, queryStateDoesNotContainKeyError, queryStateErrorSignal, queryStateLoadingSignal, queryStateResponseSignal, queryStateSignal, registerQueryDevtoolsEntry, registerQueryErrorParser, removeFrom, request, resetExecuteState, resetPageOnError, resolveInvalidationUrl, resolveQueryDevtoolsFault, resolveQueryDevtoolsFaultForAttempt, runDefaultQueryRetry, runQueryErrorParsers, searchQueryField, serializeBody, setDefaultQueryRetryFn, setQueryDevtoolsFault, setQueryDevtoolsFaultResolver, setQueryDevtoolsFormLinksFactory, setQueryDevtoolsOverridesFactory, setQueryDevtoolsRegistrar, setQueryDevtoolsResponseHistory, setQueryDevtoolsStatsFactory, setupQueryDependencies, setupQueryExecuteState, setupQueryState, shouldAutoExecuteGqlQuery, shouldAutoExecuteQuery, shouldCacheQuery, shouldRetryRequest, silenceMissingWithArgsFeatureErrorUsedButWithArgsPresent, skipPaginationPageParamCalculator, smartDuplicateArrayItem, snapshotQueryDevtoolsHandle, sortQueryField, splitQueryConfig, stringArrayQueryField, stringifyQueryRouteParts, sumQueryDevtoolsStats, suppressNextQueryStackDevtools, switchQueryCollectionState, switchQueryState, symfonyQueryErrorParser, takeUntilResponse, toQuerySignal, toQuerySubject, tokensNotAvailableInsideAuthAndExec, tombstoneOf, transformArrayResponse, transformExecStateToQueryState, transformGql, transformMethod, transformPaginatedResponse, transformToBoolean, transformToBooleanArray, transformToDate, transformToDateArray, transformToNumber, transformToNumberArray, transformToSort, transformToSortQueryParam, transformToString, transformToStringArray, uncacheableRequestHasAllowCacheParam, uncacheableRequestHasCacheKeyParam, unwrapQuerySyncMessage, v2BuildQueryCacheKey, v2ExtractExpiresInSeconds, v2ShouldCacheQuery, v2ShouldRetryRequest, validateWithQuery, validateWithV2Query, withArgs, withArgsQueryFeatureMissingButRouteIsFunction, withAuthenticationQuery, withAutoRefresh, withAutoRefreshUsedInManualQuery, withAutoRefreshUsedOnUnsupportedHttpMethod, withBearerAuthMultiTabSync, withDefaultRetry, withErrorHandling, withEthleteApiErrors, withHtmlErrorParsing, withInactivityLogout, withLogging, withMultiTabSync, withPageResetOnError, withPersistentAuth, withPolling, withPollingUsedOnUnsupportedHttpMethod, withQueryPersistence, withRefreshQuery, withResponseUpdate, withSuccessHandling, withSymfonyErrors, withTokenExpirationWarning, withTokenRevocation, withTracking, wrapAsObservableSignal, wrapQuerySyncMessage };
+export { BasicAuthProvider, BearerAuthFeatureType, BooleanArrayQueryField, CLEAR_QUERY_ARGS, CustomHeaderAuthProvider, DEFAULT_KEEP_UNUSED_FOR, DEFAULT_QUERY_PERSISTENCE_MAX_AGE, DEFAULT_QUERY_PERSISTENCE_MAX_ENTRIES, DEFAULT_QUERY_PERSISTENCE_VERSION, DEFAULT_QUERY_PERSISTENCE_WRITE_DELAY, DateArrayQueryField, DateQueryField, EMPTY_QUERY_DEVTOOLS_FAULT, EntityStore, IGNORED_FILTER_COUNT_FIELDS, INFINITY_QUERY_TOKEN, InfinityQuery, InfinityQueryDirective, InfinityQueryTriggerDirective, LegacyQuery, LegacyQueryCreator, MAX_QUERY_DEVTOOLS_TOMBSTONES, MAX_UNUSED_ENTRIES, NumberArrayQueryField, ParseHttpErrorCodeToMessageDePipe, ParseHttpErrorCodeToMessageEnPipe, ParseHttpErrorCodeToTitleDePipe, ParseHttpErrorCodeToTitleEnPipe, QUERY_CLIENT_DEVTOOLS_TOKEN, QUERY_DEVTOOLS_FAULT_STATUSES, QUERY_DEVTOOLS_TOKEN_TTL_LIMIT, QUERY_PERSISTENCE_STORE_VERSION, QUERY_SYNC_PROTOCOL_VERSION, QUERY_VERSION, QueryClientFeatureType, QueryDevtoolsComponent, QueryDirective, QueryFeatureType, QueryField, QueryForm, QueryRuntimeErrorCode, QueryShortNamePipe, QueryStore, SERVER_ERROR_KIND, SERVER_VIOLATION_ERROR_KIND, SPEED_BUFFER_TIME_IN_MS, SearchQueryField, SortQueryField, StringArrayQueryField, V2BearerAuthProvider, V2Query, V2QueryClient, V2QueryCreator, addQueryContainerHandling, applyQueryDevtoolsOverrides, applyQueryDevtoolsTokenTtl, applyQueryFeatures, armAllQueryDevtoolsMocks, armQueryDevtoolsMock, armQueryDevtoolsOverrideTransfer, authExtractTokensResponseMissingAccessToken, authExtractTokensResponseMissingRefreshToken, authExtractTokensResponseNotObject, authProviderFeatureUsedMultipleTimes, booleanArrayQueryField, buildQueryCacheKey, buildQueryString, buildRoute, buildTimestampFromSeconds, canOverrideQueryDevtoolsTokenTtl, castQueryCreatorTypes, circularQueryDependency, circularQueryDependencyChecker, clearQueryDevtoolsArmedMocks, clearQueryDevtoolsFaults, clearQueryDevtoolsMockStore, clearQueryDevtoolsOverrideStore, clearQueryDevtoolsStore, clearQueryDevtoolsTokenTtl, clearQueryDevtoolsTombstones, clearRestoredQueryDevtoolsOverrides, collectLeafPaths, collectQueryDevtoolsSchemaComponents, collectQueryFormLinks, computeQueryAuthHeader, computeQueryBody, computeQueryHeaders, computeQueryMethod, computeQueryQueryParams, consumeSuppressQueryStackDevtools, contentfulGqlLikePaginationAdapter, countUnresolvedQueryDevtoolsOverrides, createAuthGuard, createBaseQuery, createBaseQueryCreator, createBearerAuthProvider, createDeleteQuery, createExecuteFn, createGetQuery, createGqlExecuteFn, createGqlMutationViaGet, createGqlMutationViaPost, createGqlQuery, createGqlQueryCreator, createGqlQueryViaGet, createGqlQueryViaPost, createHttpRequest, createIndexedDbQueryPersistenceAdapter, createInfinityQueryConfig, createLegacyQueryCreator, createNoopQueryPersistenceAdapter, createPagedQueryStack, createPatchQuery, createPersistentAuthFeature, createPostQuery, createPutQuery, createQuery, createQueryClient, createQueryCollection, createQueryCollectionSignal, createQueryCollectionSubject, createQueryContext, createQueryCreator, createQueryDevtoolsFormLinks, createQueryDevtoolsFormLinksRecorder, createQueryDevtoolsOverrides, createQueryDevtoolsOverridesRecorder, createQueryDevtoolsStats, createQueryDevtoolsStatsRecorder, createQueryErrorResponse, createQueryFeature, createQueryInvalidationFilter, createQueryKeyLockManager, createQueryObject, createQueryPersistenceEngine, createQueryRepository, createQuerySnapshotFn, createQueryStack, createQuerySyncEngine, createQuerySyncTransport, createSecureDeleteQuery, createSecureExecuteFactory, createSecureExecuteFn, createSecureGetQuery, createSecureGqlExecuteFn, createSecureGqlMutationViaGet, createSecureGqlMutationViaPost, createSecureGqlQuery, createSecureGqlQueryCreator, createSecureGqlQueryViaGet, createSecureGqlQueryViaPost, createSecurePatchQuery, createSecurePostQuery, createSecurePutQuery, createSecureQuery, createSecureQueryCreator, createTrackingFeature, createWebSocketClient, dateArrayQueryField, dateQueryField, decryptBearer, deepFreeze, def, defineQueryForm, deleteQueryDevtoolsMock, describeQueryDevtoolsFeatures, detectContentTypeHeader, detectPaginationShape, dynLikePaginationAdapter, effectComputed, emptyQueryArgs, ethletePaginationAdapter, executeUntilSettled, extractExpiresInSeconds, extractFormViolations, extractHtmlErrorMessage, extractQuery, fakePaginationAdapter, filterFailure, filterNull, filterQueryStates, filterSuccess, forEachHeader, formatQueryDevtoolsDuration, generateQueryDevtoolsNumberPreset, generateQueryDevtoolsStringPreset, getBearerAuthProviderName, getDefaultHeaders, getQueryClientName, getQueryFeatureUsage, getResponseUrl, ggLikePaginationAdapter, gql, gqlDataPropertyMissingInResponse, hasHeader, hasQueryDevtoolsOverridesAtPath, htmlErrorPayload, htmlQueryErrorParser, ignoreAutoRefresh, initQueryDevtoolsFaults, initQueryDevtoolsMocks, initQueryDevtoolsOverridePersistence, initQueryDevtoolsSettings, injectInfinityQueryResponseDelay, injectQueryContext, insertFrom, invalidBaseRouteError, invalidBodyError, invalidRouteError, invalidStateInsideSecureExecuteFactory, isAutoRefresh, isBasicAuthProvider, isBearerAuthProvider, isClassValidatorError, isCreateGqlQueryOptions, isCustomHeaderAuthProvider, isDateShapedLeaf, isEmptyString, isGqlQueryConfig, isHtmlErrorPayload, isLegacyQuery, isNaN$1 as isNaN, isPageOutOfRangeError, isQuery, isQueryCollection, isQueryDevtoolsEnabled, isQueryDevtoolsFaultArmed, isQueryDevtoolsRequestInterceptionEnabled, isQueryErrorResponse, isQueryStateCancelled, isQueryStateFailure, isQueryStateLoading, isQueryStatePrepared, isQueryStateSuccess, isRequestError, isSymfonyError, isSymfonyFormViolationListError, isSymfonyListError, isSymfonyPagerfantaOutOfRangeError, isUnderInvalidatedUrl, legacyPrepareFallbackInjector, legacyPrepareWithoutInjectionContext, loadQueryDevtoolsSchema, mapToPaginated, mapViolationsToFormErrors, matchesQueryDevtoolsMockPattern, matchesQueryDevtoolsMockQuery, maybeExecute, measureQueryDevtoolsPayload, mergeHeaders, nestedEffect, noteQueryFormRead, numberArrayQueryField, pagedQueryStackNextPageCalledWithoutPreviousPage, pagedQueryStackPageBiggerThanTotalPages, pagedQueryStackPreviousPageCalledButAlreadyAtFirstPage, paginatedEntityValueUpdater, parseAllXhrResponseHeaders, parseHttpErrorCodeToMessageDe, parseHttpErrorCodeToMessageEn, parseHttpErrorCodeToTitleDe, parseHttpErrorCodeToTitleEn, parseQueryDevtoolsOverrideTransfer, parseQueryRoute, patchQueryDevtoolsTokenPayload, pathParamsMissingInRouteFunctionError, provideInfinityQueryResponseDelay, provideLegacyPrepareFallback, provideQueryClientForDevtools, provideQueryDevtools, queryArrayComputed, queryClientFeatureUsedMultipleTimes, queryComputed, queryComputedTillTruthy, queryDevtoolsAbout, queryDevtoolsArmedMocks, queryDevtoolsArmedMocksRestored, queryDevtoolsEntries, queryDevtoolsFaults, queryDevtoolsFaultsRestored, queryDevtoolsFnDetail, queryDevtoolsMockId, queryDevtoolsMocks, queryDevtoolsOverridePersistence, queryDevtoolsRequestPath, queryDevtoolsResponseHistory, queryDevtoolsRestoredOverridesScope, queryDevtoolsSchemaNames, queryDevtoolsSchemaRoutes, queryDevtoolsSchemaState, queryDevtoolsSettings, queryDevtoolsStorage, queryDevtoolsTokenTtls, queryErrorMessage, queryErrorMessages, queryExecute, queryFeatureUsedMultipleTimes, queryField, querySequence, querySequenceAlreadyRunning, queryStackTotalQueriesAndExpectedQueriesMismatch, queryStackWithArgsUsed, queryStackWithResponseUpdateUsed, queryStateAlreadyHasKeyError, queryStateCannotTransformError, queryStateDoesNotContainKeyError, queryStateErrorSignal, queryStateLoadingSignal, queryStateResponseSignal, queryStateSignal, readQueryDevtoolsStore, registerEthleteVersion, registerQueryDevtoolsEntry, registerQueryErrorParser, removeFrom, request, resetExecuteState, resetPageOnError, resolveInvalidationUrl, resolveQueryDevtoolsFault, resolveQueryDevtoolsFaultForAttempt, resolveQueryDevtoolsMock, resolveQueryDevtoolsMockForAttempt, restoredQueryDevtoolsOverrides, runDefaultQueryRetry, runQueryErrorParsers, saveQueryDevtoolsMock, searchQueryField, seedQueryDevtoolsSchemaBody, seedQueryDevtoolsSchemaRoute, serializeBody, serializeQueryDevtoolsOverrideTransfer, setDefaultQueryRetryFn, setQueryDevtoolsAppInfo, setQueryDevtoolsArmedMocksScope, setQueryDevtoolsFault, setQueryDevtoolsFaultResolver, setQueryDevtoolsFaultsScope, setQueryDevtoolsFormLinksFactory, setQueryDevtoolsMockResolver, setQueryDevtoolsOverridePersistence, setQueryDevtoolsOverridesFactory, setQueryDevtoolsOverridesScope, setQueryDevtoolsRegistrar, setQueryDevtoolsResponseHistory, setQueryDevtoolsSchemaLoader, setQueryDevtoolsSettings, setQueryDevtoolsStatsFactory, setQueryDevtoolsTokenPayloadPatcher, setQueryDevtoolsTokenTtl, setupQueryDependencies, setupQueryExecuteState, setupQueryState, shouldAutoExecuteGqlQuery, shouldAutoExecuteQuery, shouldCacheQuery, shouldRetryRequest, silenceMissingWithArgsFeatureErrorUsedButWithArgsPresent, skipPaginationPageParamCalculator, smartDuplicateArrayItem, snapshotQueryDevtoolsHandle, sortQueryField, splitQueryConfig, stringArrayQueryField, stringifyQueryRouteParts, sumQueryDevtoolsStats, suppressNextQueryStackDevtools, switchQueryCollectionState, switchQueryState, symfonyQueryErrorParser, takeUntilResponse, toQuerySignal, toQuerySubject, tokensNotAvailableInsideAuthAndExec, tombstoneOf, transformArrayResponse, transformExecStateToQueryState, transformGql, transformMethod, transformPaginatedResponse, transformToBoolean, transformToBooleanArray, transformToDate, transformToDateArray, transformToNumber, transformToNumberArray, transformToSort, transformToSortQueryParam, transformToString, transformToStringArray, uncacheableRequestHasAllowCacheParam, uncacheableRequestHasCacheKeyParam, unwrapQuerySyncMessage, v2BuildQueryCacheKey, v2ExtractExpiresInSeconds, v2ShouldCacheQuery, v2ShouldRetryRequest, validateWithQuery, validateWithV2Query, withArgs, withArgsQueryFeatureMissingButRouteIsFunction, withAuthenticationQuery, withAutoRefresh, withAutoRefreshUsedInManualQuery, withAutoRefreshUsedOnUnsupportedHttpMethod, withBearerAuthMultiTabSync, withDefaultRetry, withErrorHandling, withEthleteApiErrors, withHtmlErrorParsing, withInactivityLogout, withLogging, withMultiTabSync, withPageResetOnError, withPersistentAuth, withPolling, withPollingUsedOnUnsupportedHttpMethod, withQueryDevtoolsOverridePersistence, withQueryPersistence, withRefreshQuery, withResponseUpdate, withSuccessHandling, withSymfonyErrors, withTokenExpirationWarning, withTokenRevocation, withTracking, wrapAsObservableSignal, wrapQuerySyncMessage, writeQueryDevtoolsStore };
 //# sourceMappingURL=ethlete-query.mjs.map