@liteguard/core 0.2.20260314

package/dist/index.js

@@ -0,0 +1,1372 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  BaseLiteguardClient: () => BaseLiteguardClient,
+  LiteguardScope: () => LiteguardScope,
+  evaluateGuard: () => evaluateGuard
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/evaluation.ts
+function evaluateGuard(guard, properties) {
+  for (const rule of guard.rules) {
+    if (!rule.enabled) {
+      continue;
+    }
+    if (matchesRule(rule, properties)) {
+      return rule.result;
+    }
+  }
+  return guard.defaultValue;
+}
+function matchesRule(rule, properties) {
+  const raw = properties[rule.propertyName];
+  if (raw === void 0) {
+    return false;
+  }
+  if (rule.values.length === 0) {
+    return false;
+  }
+  switch (rule.operator) {
+    case "EQUALS":
+      return valuesEqual(raw, rule.values[0]);
+    case "NOT_EQUALS":
+      return !valuesEqual(raw, rule.values[0]);
+    case "IN":
+      return rule.values.some((value) => valuesEqual(raw, value));
+    case "NOT_IN":
+      return rule.values.every((value) => !valuesEqual(raw, value));
+    case "REGEX": {
+      const pattern = String(rule.values[0] ?? "");
+      try {
+        return new RegExp(pattern).test(String(raw));
+      } catch {
+        return false;
+      }
+    }
+    case "GT":
+      return (compareOrdered(raw, rule.values[0]) ?? 0) > 0;
+    case "GTE":
+      return (compareOrdered(raw, rule.values[0]) ?? -1) >= 0;
+    case "LT":
+      return (compareOrdered(raw, rule.values[0]) ?? 0) < 0;
+    case "LTE":
+      return (compareOrdered(raw, rule.values[0]) ?? 1) <= 0;
+    default:
+      return false;
+  }
+}
+function valuesEqual(a, b) {
+  if (b === void 0) {
+    return false;
+  }
+  if (typeof a === "boolean" || typeof b === "boolean") {
+    return typeof a === "boolean" && typeof b === "boolean" && a === b;
+  }
+  if (typeof a === "string" || typeof b === "string") {
+    return typeof a === "string" && typeof b === "string" && a === b;
+  }
+  if (typeof a === "number" && typeof b === "number") {
+    return a === b;
+  }
+  return false;
+}
+function compareOrdered(a, b) {
+  if (b === void 0) {
+    return void 0;
+  }
+  if (typeof a === "string" || typeof b === "string") {
+    if (typeof a !== "string" || typeof b !== "string") {
+      return void 0;
+    }
+    return a.localeCompare(b);
+  }
+  if (typeof a === "number" && typeof b === "number") {
+    return a - b;
+  }
+  return void 0;
+}
+
+// src/client-base.ts
+var DEFAULT_BACKEND_URL = "https://api.liteguard.io";
+var DEFAULT_REFRESH_RATE_S = 30;
+var DEFAULT_FLUSH_RATE_S = 10;
+var DEFAULT_FLUSH_SIZE = 500;
+var DEFAULT_HTTP_TIMEOUT_S = 4;
+var DEFAULT_FLUSH_BUFFER_MULTIPLIER = 4;
+var DEFAULT_QUIET = true;
+var PUBLIC_BUNDLE_KEY = "";
+function positiveNumberOrDefault(value, fallback) {
+  return value !== void 0 && value > 0 ? value : fallback;
+}
+function nonEmptyStringOrDefault(value, fallback) {
+  return value !== void 0 && value.trim() !== "" ? value : fallback;
+}
+function cloneProperties(properties) {
+  return { ...properties };
+}
+function cloneProtectedContext(protectedContext) {
+  if (!protectedContext) {
+    return null;
+  }
+  return {
+    signature: protectedContext.signature,
+    properties: { ...protectedContext.properties ?? {} }
+  };
+}
+function protectedContextCacheKey(protectedContext) {
+  if (!protectedContext) {
+    return PUBLIC_BUNDLE_KEY;
+  }
+  const keys = Object.keys(protectedContext.properties ?? {}).sort();
+  const parts = [protectedContext.signature, ""];
+  for (const key of keys) {
+    parts.push(`${key}=${protectedContext.properties?.[key] ?? ""}`);
+  }
+  return parts.join("\0");
+}
+function isPromiseLike(value) {
+  return typeof value === "object" && value !== null && "then" in value;
+}
+function asyncContextUnsupportedError(operation) {
+  return new Error(
+    `[liteguard] ${operation} cannot cross await boundaries in this runtime. Use an explicit LiteguardScope and call scope methods directly after each await.`
+  );
+}
+var signalCounter = 0;
+var LiteguardScope = class {
+  client;
+  snapshot;
+  /** @internal — use {@link BaseLiteguardClient.createScope} instead. */
+  constructor(client, snapshot) {
+    this.client = client;
+    this.snapshot = {
+      properties: cloneProperties(snapshot.properties),
+      protectedBundleKey: snapshot.protectedBundleKey,
+      protectedContext: cloneProtectedContext(snapshot.protectedContext)
+    };
+  }
+  /**
+   * Derive a new scope with the given properties merged on top of this
+   * scope's existing properties. Does not mutate the current scope.
+   *
+   * @param properties - Key/value pairs to merge into the new scope.
+   * @returns A new {@link LiteguardScope} with the merged properties.
+   */
+  withProperties(properties) {
+    return this.client._deriveScope(this, {
+      properties: {
+        ...this.snapshot.properties,
+        ...properties
+      }
+    });
+  }
+  /**
+   * Alias for {@link withProperties} — derives a new scope with additional properties.
+   *
+   * @param properties - Key/value pairs to add.
+   * @returns A new {@link LiteguardScope} with the merged properties.
+   */
+  addProperties(properties) {
+    return this.withProperties(properties);
+  }
+  /**
+   * Derive a new scope with the specified property keys removed.
+   *
+   * @param names - Property keys to remove.
+   * @returns A new {@link LiteguardScope} without the listed properties.
+   */
+  clearProperties(names) {
+    const next = cloneProperties(this.snapshot.properties);
+    for (const name of names) {
+      delete next[name];
+    }
+    return this.client._deriveScope(this, { properties: next });
+  }
+  /**
+   * Derive a new scope with all properties removed.
+   *
+   * @returns A new {@link LiteguardScope} with an empty property bag.
+   */
+  resetProperties() {
+    return this.client._deriveScope(this, { properties: {} });
+  }
+  /**
+   * Derive a new scope bound to the supplied protected context. The client
+   * will fetch (or reuse) a guard bundle specific to this context.
+   *
+   * @param protectedContext - Signed context bundle from your auth backend.
+   * @returns A new {@link LiteguardScope} bound to the protected context.
+   */
+  async bindProtectedContext(protectedContext) {
+    return await this.client._bindProtectedContextToScope(this, protectedContext);
+  }
+  /**
+   * Derive a new scope with protected context cleared, reverting to the
+   * public guard bundle.
+   *
+   * @returns A new {@link LiteguardScope} using the public guard bundle.
+   */
+  clearProtectedContext() {
+    return this.client._deriveScope(this, {
+      protectedBundleKey: PUBLIC_BUNDLE_KEY,
+      protectedContext: null
+    });
+  }
+  /**
+   * Check whether the named guard is open within this scope. Buffers a
+   * `guard_check` telemetry signal.
+   *
+   * @param name - Guard name (e.g. `"payments.checkout"`).
+   * @param options - Optional per-call overrides (extra properties, fallback).
+   * @returns `true` if the guard is open, `false` otherwise.
+   */
+  isOpen(name, options = {}) {
+    return this.client.isOpen(name, { ...options, scope: this });
+  }
+  /**
+   * Check whether the named guard is open without emitting a telemetry
+   * signal or consuming a rate-limit slot. Useful in hot paths or render
+   * loops where you only need the boolean result.
+   *
+   * @param name - Guard name to evaluate.
+   * @param options - Optional per-call overrides.
+   * @returns `true` if the guard is open, `false` otherwise.
+   */
+  peekIsOpen(name, options = {}) {
+    return this.client.peekIsOpen(name, { ...options, scope: this });
+  }
+  /**
+   * Evaluate the guard and, if open, call `fn` within a correlated execution
+   * scope. Returns `fn`'s result when open, or `undefined` when closed.
+   *
+   * Emits both a `guard_check` and a `guard_execution` telemetry signal so
+   * you can measure the guarded code path.
+   *
+   * @param name - Guard name to evaluate.
+   * @param fn - Synchronous function to invoke when the guard is open.
+   * @param options - Optional per-call overrides.
+   * @returns The return value of `fn`, or `undefined` if the guard is closed.
+   */
+  executeIfOpen(name, fn, options = {}) {
+    return this.client.executeIfOpen(name, fn, { ...options, scope: this });
+  }
+  /**
+   * Async variant of {@link executeIfOpen}. Evaluates the guard and, if open,
+   * awaits `fn` within a correlated execution scope.
+   *
+   * @param name - Guard name to evaluate.
+   * @param fn - Async function to invoke when the guard is open.
+   * @param options - Optional per-call overrides.
+   * @returns The resolved value of `fn`, or `undefined` if the guard is closed.
+   */
+  async executeIfOpenAsync(name, fn, options = {}) {
+    return await this.client.executeIfOpenAsync(name, fn, { ...options, scope: this });
+  }
+  /**
+   * Run `fn` with this scope as the active scope for all guard checks made
+   * during its execution.
+   *
+   * @param fn - Callback to execute within this scope.
+   * @returns The return value of `fn`.
+   */
+  run(fn) {
+    return this.client.runWithScope(this, fn);
+  }
+  /**
+   * Run `fn` with this scope active **and** inside a Liteguard execution
+   * context so that all guard signals share a common execution ID.
+   *
+   * @param fn - Callback to execute.
+   * @returns The return value of `fn`.
+   */
+  withExecution(fn) {
+    return this.client.runWithScope(this, () => this.client.withExecution(fn));
+  }
+  /**
+   * Return a shallow copy of this scope's properties.
+   *
+   * @returns A plain object of property key/value pairs.
+   */
+  getProperties() {
+    return cloneProperties(this.snapshot.properties);
+  }
+  /**
+   * Return the protected context bound to this scope, or `null` if none.
+   *
+   * @returns A copy of the protected context, or `null`.
+   */
+  getProtectedContext() {
+    return cloneProtectedContext(this.snapshot.protectedContext);
+  }
+  _getBundleKey() {
+    return this.snapshot.protectedBundleKey;
+  }
+  _getSnapshot() {
+    return {
+      properties: cloneProperties(this.snapshot.properties),
+      protectedBundleKey: this.snapshot.protectedBundleKey,
+      protectedContext: cloneProtectedContext(this.snapshot.protectedContext)
+    };
+  }
+  _belongsTo(client) {
+    return this.client === client;
+  }
+};
+var BaseLiteguardClient = class {
+  projectClientKeyId;
+  runtime;
+  options;
+  bundles = /* @__PURE__ */ new Map();
+  defaultScope;
+  signalBuffer = [];
+  droppedSignalsPending = 0;
+  reportedUnadoptedGuards = /* @__PURE__ */ new Set();
+  pendingUnadoptedGuards = /* @__PURE__ */ new Set();
+  refreshTimer = null;
+  flushTimer = null;
+  lifecycleCleanup = null;
+  currentRefreshRateSeconds;
+  rateLimitState = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  /**
+   * Create a new Liteguard client.
+   *
+   * Call {@link start} after construction to fetch the initial guard bundle
+   * and begin background timers.
+   *
+   * @param runtime - Platform adapter providing timers, fetch, and context storage.
+   * @param projectClientKeyId - Your project client key ID from the Liteguard dashboard.
+   * @param options - Optional SDK configuration overrides.
+   */
+  constructor(runtime, projectClientKeyId, options = {}) {
+    this.runtime = runtime;
+    this.projectClientKeyId = projectClientKeyId;
+    this.options = {
+      environment: options.environment ?? "",
+      fallback: options.fallback ?? false,
+      refreshRateSeconds: positiveNumberOrDefault(options.refreshRateSeconds, DEFAULT_REFRESH_RATE_S),
+      flushRateSeconds: positiveNumberOrDefault(options.flushRateSeconds, DEFAULT_FLUSH_RATE_S),
+      flushSize: positiveNumberOrDefault(options.flushSize, DEFAULT_FLUSH_SIZE),
+      httpTimeoutSeconds: positiveNumberOrDefault(options.httpTimeoutSeconds, DEFAULT_HTTP_TIMEOUT_S),
+      flushBufferMultiplier: positiveNumberOrDefault(
+        options.flushBufferMultiplier,
+        DEFAULT_FLUSH_BUFFER_MULTIPLIER
+      ),
+      disableMeasurement: options.disableMeasurement ?? false,
+      backendUrl: nonEmptyStringOrDefault(options.backendUrl, DEFAULT_BACKEND_URL),
+      quiet: options.quiet ?? DEFAULT_QUIET
+    };
+    this.currentRefreshRateSeconds = this.options.refreshRateSeconds;
+    this.bundles.set(PUBLIC_BUNDLE_KEY, this.createEmptyBundle(PUBLIC_BUNDLE_KEY, null));
+    this.defaultScope = new LiteguardScope(this, {
+      properties: {},
+      protectedBundleKey: PUBLIC_BUNDLE_KEY,
+      protectedContext: null
+    });
+  }
+  /**
+   * Fetch the initial public guard bundle and start background refresh and
+   * flush timers. Must be called once after construction before using the
+   * client in production.
+   */
+  async start() {
+    await this.fetchGuardsForBundle(PUBLIC_BUNDLE_KEY);
+    this.scheduleNextRefresh();
+    this.flushTimer = this.runtime.setInterval(() => {
+      void this.flushSignals();
+    }, this.options.flushRateSeconds * 1e3);
+    this.runtime.detachTimer?.(this.flushTimer);
+    this.lifecycleCleanup = this.runtime.installLifecycleHooks?.({
+      flushKeepalive: () => {
+        void this.flushSignals({ keepalive: true });
+      }
+    }) ?? null;
+  }
+  /**
+   * Stop all background timers and flush remaining buffered signals.
+   * After calling `shutdown` the client should not be used further.
+   */
+  async shutdown() {
+    if (this.refreshTimer !== null) {
+      this.runtime.clearTimeout(this.refreshTimer);
+      this.refreshTimer = null;
+    }
+    if (this.flushTimer !== null) {
+      this.runtime.clearInterval(this.flushTimer);
+      this.flushTimer = null;
+    }
+    this.lifecycleCleanup?.();
+    this.lifecycleCleanup = null;
+    await this.flushSignals();
+  }
+  /**
+   * Returns `true` once the initial public guard bundle has been fetched.
+   */
+  isReady() {
+    return this.getBundle(PUBLIC_BUNDLE_KEY)?.ready ?? false;
+  }
+  /**
+   * Register a listener that is called whenever the guard bundle is refreshed.
+   *
+   * @param listener - Callback invoked on each guard bundle update.
+   * @returns An unsubscribe function — call it to remove the listener.
+   *
+   * @example
+   * ```ts
+   * const unsubscribe = client.subscribe(() => {
+   *   console.log('Guards refreshed');
+   * });
+   * // later…
+   * unsubscribe();
+   * ```
+   */
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  /**
+   * Create a new request scope with optional initial properties. The scope
+   * uses the public guard bundle by default; call
+   * {@link LiteguardScope.bindProtectedContext} on the returned scope to
+   * attach signed user context.
+   *
+   * @param properties - Initial property key/value pairs for the scope.
+   * @returns A new {@link LiteguardScope}.
+   *
+   * @example
+   * ```ts
+   * const scope = client.createScope({ plan: 'enterprise' });
+   * scope.isOpen('feature.beta'); // evaluates with plan=enterprise
+   * ```
+   */
+  createScope(properties = {}) {
+    return new LiteguardScope(this, {
+      properties: cloneProperties(properties),
+      protectedBundleKey: PUBLIC_BUNDLE_KEY,
+      protectedContext: null
+    });
+  }
+  /**
+   * Return the currently active request scope, or the shared default scope
+   * when no request-local scope is active.
+   *
+   * On Node.js, the active scope is resolved from `AsyncLocalStorage` so
+   * each concurrent request can carry its own context automatically.
+   *
+   * @returns The active {@link LiteguardScope}.
+   */
+  getActiveScope() {
+    const active = this.getRuntimeScope();
+    return active ?? this.defaultScope;
+  }
+  /**
+   * Run `fn` inside the given request scope. All guard checks performed
+   * during `fn` will use the properties and protected context of `scope`.
+   *
+   * @param scope - The scope to activate.
+   * @param fn - Callback to execute within the scope.
+   * @returns The return value of `fn`.
+   */
+  runWithScope(scope, fn) {
+    const resolvedScope = this.resolveScope(scope);
+    const adapter = this.runtime.requestScope;
+    if (adapter) {
+      const result = adapter.run({ currentScope: resolvedScope }, fn);
+      if (isPromiseLike(result) && !this.runtime.supportsAsyncContextPropagation) {
+        throw asyncContextUnsupportedError("scope.run(), client.runWithScope(), and property-scoped callbacks");
+      }
+      return result;
+    }
+    const previousScope = this.defaultScope;
+    this.defaultScope = resolvedScope;
+    try {
+      const result = fn();
+      if (isPromiseLike(result)) {
+        if (!this.runtime.supportsAsyncContextPropagation) {
+          throw asyncContextUnsupportedError("scope.run(), client.runWithScope(), and property-scoped callbacks");
+        }
+        return Promise.resolve(result).finally(() => {
+          this.defaultScope = previousScope;
+        });
+      }
+      this.defaultScope = previousScope;
+      return result;
+    } catch (error) {
+      this.defaultScope = previousScope;
+      throw error;
+    }
+  }
+  /**
+   * Convenience helper that derives a scope from the current active scope,
+   * merges in the supplied properties, and runs `fn` inside it.
+   *
+   * @param properties - Key/value pairs to add for the duration of `fn`.
+   * @param fn - Callback to execute within the scoped context.
+   * @returns The return value of `fn`.
+   *
+   * @example
+   * ```ts
+   * const result = client.withProperties({ userId: '42' }, () => {
+   *   return client.isOpen('feature.beta');
+   * });
+   * ```
+   */
+  withProperties(properties, fn) {
+    const scope = this.getActiveScope().withProperties(properties);
+    return this.runWithScope(scope, fn);
+  }
+  /**
+   * Bind protected context to a derived scope and run `fn` inside it.
+   * Fetches (or reuses) a guard bundle specific to this context before
+   * executing `fn`.
+   *
+   * @param protectedContext - Signed context bundle from your auth backend.
+   * @param fn - Callback to execute within the protected scope.
+   * @returns The (awaited) return value of `fn`.
+   */
+  async withProtectedContext(protectedContext, fn) {
+    const scope = await this.getActiveScope().bindProtectedContext(protectedContext);
+    return await Promise.resolve(this.runWithScope(scope, fn));
+  }
+  /**
+   * Run `fn` inside a Liteguard execution scope so that all guard signals
+   * emitted during `fn` share a common execution ID for correlated
+   * telemetry. If an execution scope is already active, `fn` is called
+   * directly without creating a new one.
+   *
+   * @param fn - Callback to execute within the execution scope.
+   * @returns The return value of `fn`.
+   */
+  withExecution(fn) {
+    const existing = this.runtime.execution.getStore();
+    if (existing) {
+      const result2 = fn();
+      if (isPromiseLike(result2) && !this.runtime.supportsAsyncContextPropagation) {
+        throw asyncContextUnsupportedError("withExecution()");
+      }
+      return result2;
+    }
+    const result = this.runtime.execution.run({ executionId: nextSignalId(), sequenceNumber: 0 }, fn);
+    if (isPromiseLike(result) && !this.runtime.supportsAsyncContextPropagation) {
+      throw asyncContextUnsupportedError("withExecution()");
+    }
+    return result;
+  }
+  /**
+   * Return `true` if the named guard is open for the resolved request scope.
+   * Buffers a `guard_check` telemetry signal and consumes a rate-limit slot
+   * when applicable.
+   *
+   * Guards that have not yet been adopted on the Liteguard dashboard always
+   * return `true`, allowing you to instrument code before enabling the guard.
+   *
+   * @param name - Guard name (e.g. `"payments.checkout"`).
+   * @param callOptions - Optional per-call overrides (extra properties, fallback, scope).
+   * @returns `true` if the guard is open, `false` otherwise.
+   */
+  isOpen(name, callOptions = {}) {
+    return this.evaluateIsOpen(name, callOptions, true);
+  }
+  /**
+   * Signal-free variant of {@link isOpen}. Returns the same boolean result
+   * but does **not** emit a telemetry signal or consume a rate-limit slot.
+   * Ideal for render loops or other hot paths where you only need the
+   * boolean value.
+   *
+   * @param name - Guard name to evaluate.
+   * @param callOptions - Optional per-call overrides.
+   * @returns `true` if the guard is open, `false` otherwise.
+   */
+  peekIsOpen(name, callOptions = {}) {
+    return this.evaluateIsOpen(name, callOptions, false);
+  }
+  evaluateIsOpen(name, callOptions, emitSignal) {
+    const scope = this.resolveScope(callOptions.scope);
+    const options = {
+      disableMeasurement: false,
+      ...callOptions
+    };
+    const fallback = options.fallback ?? this.options.fallback;
+    const bundle = this.bundleForScope(scope);
+    if (!bundle.ready) {
+      return fallback;
+    }
+    const guard = bundle.guards.get(name);
+    if (!guard) {
+      this.recordUnadoptedGuard(name);
+      return true;
+    }
+    if (!guard.adopted) {
+      this.recordUnadoptedGuard(name);
+      return true;
+    }
+    const props = {
+      ...scope.getProperties(),
+      ...options.properties ?? {}
+    };
+    let result = evaluateGuard(guard, props);
+    if (result && guard.rateLimitPerMinute > 0) {
+      result = emitSignal ? this.checkRateLimit(name, guard.rateLimitPerMinute, guard.rateLimitProperties, props) : this.wouldPassRateLimit(name, guard.rateLimitPerMinute, guard.rateLimitProperties, props);
+    }
+    if (emitSignal) {
+      this.bufferSignal({
+        guardName: name,
+        result,
+        properties: props,
+        callsiteId: this.captureCallsiteId(),
+        kind: "guard_check",
+        measurement: this.isMeasurementEnabled(guard, options) ? this.runtime.measurement.captureGuardCheck() : void 0
+      });
+    }
+    return result;
+  }
+  /**
+   * Evaluate the guard and, if open, call `fn` inside a correlated execution
+   * scope. Returns `fn`'s result when the guard is open, or `undefined` when
+   * closed. Emits correlated `guard_check` and `guard_execution` signals.
+   *
+   * @param name - Guard name to evaluate.
+   * @param fn - Synchronous function to invoke when the guard is open.
+   * @param callOptions - Optional per-call overrides.
+   * @returns The return value of `fn`, or `undefined` if the guard is closed.
+   *
+   * @example
+   * ```ts
+   * const banner = client.executeIfOpen('promo.banner', () => {
+   *   return renderPromoBanner();
+   * });
+   * ```
+   */
+  executeIfOpen(name, fn, callOptions = {}) {
+    const scope = this.resolveScope(callOptions.scope);
+    return this.runWithScope(
+      scope,
+      () => this.withExecution(() => {
+        const options = {
+          disableMeasurement: false,
+          ...callOptions
+        };
+        const bundle = this.bundleForScope(scope);
+        const guard = bundle.guards.get(name);
+        const props = {
+          ...scope.getProperties(),
+          ...options.properties ?? {}
+        };
+        if (!this.isOpen(name, { ...options, scope })) {
+          return void 0;
+        }
+        if (!guard?.adopted) {
+          return fn();
+        }
+        const guardCheckSignalId = this.runtime.execution.getStore()?.lastSignalId;
+        const measurementEnabled = this.isMeasurementEnabled(guard, options);
+        const start = measurementEnabled ? this.runtime.measurement.beginGuardExecution() : void 0;
+        try {
+          const value = fn();
+          this.bufferSignal({
+            guardName: name,
+            result: true,
+            properties: props,
+            callsiteId: this.captureCallsiteId(),
+            kind: "guard_execution",
+            measurement: measurementEnabled ? this.runtime.measurement.captureGuardExecution(start, true) : void 0,
+            parentSignalIdOverride: guardCheckSignalId
+          });
+          return value;
+        } catch (error) {
+          this.bufferSignal({
+            guardName: name,
+            result: true,
+            properties: props,
+            callsiteId: this.captureCallsiteId(),
+            kind: "guard_execution",
+            measurement: measurementEnabled ? this.runtime.measurement.captureGuardExecution(start, false, error) : void 0,
+            parentSignalIdOverride: guardCheckSignalId
+          });
+          throw error;
+        }
+      })
+    );
+  }
+  /**
+   * Async variant of {@link executeIfOpen}. Evaluates the guard and, if
+   * open, awaits `fn` inside a correlated execution scope.
+   *
+   * @param name - Guard name to evaluate.
+   * @param fn - Async function to invoke when the guard is open.
+   * @param callOptions - Optional per-call overrides.
+   * @returns The resolved value of `fn`, or `undefined` if the guard is closed.
+   */
+  async executeIfOpenAsync(name, fn, callOptions = {}) {
+    const scope = this.resolveScope(callOptions.scope);
+    if (!this.runtime.supportsAsyncContextPropagation) {
+      return await this.executeIfOpenAsyncWithoutAsyncContext(name, scope, fn, callOptions);
+    }
+    return await this.runWithScope(
+      scope,
+      () => this.withExecution(async () => {
+        const options = {
+          disableMeasurement: false,
+          ...callOptions
+        };
+        const bundle = this.bundleForScope(scope);
+        const guard = bundle.guards.get(name);
+        const props = {
+          ...scope.getProperties(),
+          ...options.properties ?? {}
+        };
+        if (!this.isOpen(name, { ...options, scope })) {
+          return void 0;
+        }
+        if (!guard?.adopted) {
+          return await fn();
+        }
+        const guardCheckSignalId = this.runtime.execution.getStore()?.lastSignalId;
+        const measurementEnabled = this.isMeasurementEnabled(guard, options);
+        const start = measurementEnabled ? this.runtime.measurement.beginGuardExecution() : void 0;
+        try {
+          const value = await fn();
+          this.bufferSignal({
+            guardName: name,
+            result: true,
+            properties: props,
+            callsiteId: this.captureCallsiteId(),
+            kind: "guard_execution",
+            measurement: measurementEnabled ? this.runtime.measurement.captureGuardExecution(start, true) : void 0,
+            parentSignalIdOverride: guardCheckSignalId
+          });
+          return value;
+        } catch (error) {
+          this.bufferSignal({
+            guardName: name,
+            result: true,
+            properties: props,
+            callsiteId: this.captureCallsiteId(),
+            kind: "guard_execution",
+            measurement: measurementEnabled ? this.runtime.measurement.captureGuardExecution(start, false, error) : void 0,
+            parentSignalIdOverride: guardCheckSignalId
+          });
+          throw error;
+        }
+      })
+    );
+  }
+  async executeIfOpenAsyncWithoutAsyncContext(name, scope, fn, callOptions) {
+    const options = {
+      disableMeasurement: false,
+      ...callOptions
+    };
+    const bundle = this.bundleForScope(scope);
+    const guard = bundle.guards.get(name);
+    const props = {
+      ...scope.getProperties(),
+      ...options.properties ?? {}
+    };
+    const executionState = this.runtime.execution.getStore() ?? { executionId: nextSignalId(), sequenceNumber: 0 };
+    const isOpen = this.runWithExplicitExecutionState(executionState, () => this.isOpen(name, { ...options, scope }));
+    if (!isOpen) {
+      return void 0;
+    }
+    if (!guard?.adopted) {
+      return await fn();
+    }
+    const guardCheckSignalId = executionState.lastSignalId;
+    const measurementEnabled = this.isMeasurementEnabled(guard, options);
+    const start = measurementEnabled ? this.runtime.measurement.beginGuardExecution() : void 0;
+    try {
+      const value = await fn();
+      this.runWithExplicitExecutionState(executionState, () => {
+        this.bufferSignal({
+          guardName: name,
+          result: true,
+          properties: props,
+          callsiteId: this.captureCallsiteId(),
+          kind: "guard_execution",
+          measurement: measurementEnabled ? this.runtime.measurement.captureGuardExecution(start, true) : void 0,
+          parentSignalIdOverride: guardCheckSignalId
+        });
+      });
+      return value;
+    } catch (error) {
+      this.runWithExplicitExecutionState(executionState, () => {
+        this.bufferSignal({
+          guardName: name,
+          result: true,
+          properties: props,
+          callsiteId: this.captureCallsiteId(),
+          kind: "guard_execution",
+          measurement: measurementEnabled ? this.runtime.measurement.captureGuardExecution(start, false, error) : void 0,
+          parentSignalIdOverride: guardCheckSignalId
+        });
+      });
+      throw error;
+    }
+  }
+  /**
+   * Merge `properties` into the active scope's property bag and persist
+   * the derived scope as the new active scope. Subsequent {@link isOpen}
+   * calls will include these properties unless overridden per-call.
+   *
+   * @param properties - Key/value pairs to add.
+   * @returns The new active {@link LiteguardScope}.
+   */
+  addProperties(properties) {
+    const nextScope = this.getActiveScope().withProperties(properties);
+    return this.replaceCurrentScope(nextScope);
+  }
+  /**
+   * Remove the given property keys from the active scope and persist the
+   * resulting scope.
+   *
+   * @param names - Property keys to remove.
+   * @returns The new active {@link LiteguardScope}.
+   */
+  clearProperties(names) {
+    const nextScope = this.getActiveScope().clearProperties(names);
+    return this.replaceCurrentScope(nextScope);
+  }
+  /**
+   * Remove all properties from the active scope and persist the resulting
+   * scope.
+   *
+   * @returns The new active {@link LiteguardScope} with an empty property bag.
+   */
+  resetProperties() {
+    const nextScope = this.getActiveScope().resetProperties();
+    return this.replaceCurrentScope(nextScope);
+  }
+  /**
+   * Bind protected context to the active scope and persist the derived
+   * scope. Fetches (or reuses) a guard bundle specific to this context.
+   *
+   * @param protectedContext - Signed context bundle from your auth backend.
+   * @returns The new active {@link LiteguardScope}.
+   */
+  async bindProtectedContext(protectedContext) {
+    const nextScope = await this.getActiveScope().bindProtectedContext(protectedContext);
+    return this.replaceCurrentScope(nextScope);
+  }
+  /**
+   * Clear protected context from the active scope and revert to the
+   * public guard bundle.
+   *
+   * @returns The new active {@link LiteguardScope}.
+   */
+  clearProtectedContext() {
+    const nextScope = this.getActiveScope().clearProtectedContext();
+    return this.replaceCurrentScope(nextScope);
+  }
+  /**
+   * Immediately transmit all buffered telemetry signals to the backend. Also
+   * flushes any pending unadopted-guard reports.
+   *
+   * Call this before process exit or page unload to avoid losing signals.
+   *
+   * @param options - Flush options (e.g. `{ keepalive: true }` for page unload).
+   */
+  async flushSignals(options = {}) {
+    const signalBatch = this.signalBuffer.splice(0);
+    const unadoptedGuardNames = [...this.pendingUnadoptedGuards];
+    this.pendingUnadoptedGuards.clear();
+    if (signalBatch.length > 0) {
+      try {
+        const url = new URL("/api/v1/signals", this.options.backendUrl);
+        const body = JSON.stringify({
+          projectClientKeyId: this.projectClientKeyId,
+          environment: this.options.environment,
+          signals: signalBatch
+        });
+        await this.post(url, body, options.keepalive);
+      } catch (error) {
+        this.log("[liteguard] Signal flush failed", error);
+        this.signalBuffer.unshift(...signalBatch);
+        const maxBuf = this.options.flushSize * this.options.flushBufferMultiplier;
+        if (this.signalBuffer.length > maxBuf) {
+          this.droppedSignalsPending += this.signalBuffer.length - maxBuf;
+          this.signalBuffer.length = maxBuf;
+        }
+      }
+    }
+    if (unadoptedGuardNames.length > 0) {
+      try {
+        const url = new URL("/api/v1/unadopted-guards", this.options.backendUrl);
+        const requestBody = {
+          projectClientKeyId: this.projectClientKeyId,
+          environment: this.options.environment,
+          guardNames: unadoptedGuardNames
+        };
+        await this.post(url, JSON.stringify(requestBody), options.keepalive);
+      } catch (error) {
+        this.log("[liteguard] Unadopted guard flush failed", error);
+        for (const guardName of unadoptedGuardNames) {
+          this.pendingUnadoptedGuards.add(guardName);
+        }
+      }
+    }
+  }
+  /** Notify subscribers that client-visible state has changed. */
+  emitChange() {
+    for (const listener of this.listeners) {
+      listener();
+    }
+  }
+  /** @internal Derive a new immutable scope from an existing scope snapshot. */
+  _deriveScope(scope, patch) {
+    const resolved = this.resolveScope(scope);
+    const snapshot = resolved._getSnapshot();
+    return new LiteguardScope(this, {
+      properties: patch.properties ? cloneProperties(patch.properties) : snapshot.properties,
+      protectedBundleKey: patch.protectedBundleKey ?? snapshot.protectedBundleKey,
+      protectedContext: patch.protectedContext === void 0 ? snapshot.protectedContext : cloneProtectedContext(patch.protectedContext)
+    });
+  }
+  /** @internal Bind protected context to a scope and ensure its bundle is loaded. */
+  async _bindProtectedContextToScope(scope, protectedContext) {
+    this.resolveScope(scope);
+    const clonedProtectedContext = cloneProtectedContext(protectedContext);
+    const bundleKey = await this.ensureBundleForProtectedContext(clonedProtectedContext);
+    return new LiteguardScope(this, {
+      properties: scope.getProperties(),
+      protectedBundleKey: bundleKey,
+      protectedContext: clonedProtectedContext
+    });
+  }
+  /** Persist a derived scope into the current request-local or default scope slot. */
+  replaceCurrentScope(nextScope) {
+    const resolved = this.resolveScope(nextScope);
+    const store = this.runtime.requestScope?.getStore();
+    if (store) {
+      store.currentScope = resolved;
+      return resolved;
+    }
+    this.defaultScope = resolved;
+    this.emitChange();
+    return resolved;
+  }
+  /** Resolve the active runtime scope store into a client-owned scope instance. */
+  getRuntimeScope() {
+    const store = this.runtime.requestScope?.getStore();
+    if (!store) {
+      return null;
+    }
+    const scope = store.currentScope;
+    if (scope instanceof LiteguardScope && scope._belongsTo(this)) {
+      return scope;
+    }
+    return null;
+  }
+  /** Validate and resolve the scope used for a client operation. */
+  resolveScope(scope) {
+    const resolved = scope ?? this.getRuntimeScope() ?? this.defaultScope;
+    if (!resolved._belongsTo(this)) {
+      throw new Error("[liteguard] Scope belongs to a different Liteguard client.");
+    }
+    return resolved;
+  }
+  /** Queue a one-time report for a guard that exists only in application code. */
+  recordUnadoptedGuard(name) {
+    if (!this.reportedUnadoptedGuards.has(name)) {
+      this.reportedUnadoptedGuards.add(name);
+      this.pendingUnadoptedGuards.add(name);
+    }
+  }
+  /** Schedule the next periodic guard refresh using the current refresh interval. */
+  scheduleNextRefresh() {
+    if (this.refreshTimer !== null) {
+      this.runtime.clearTimeout(this.refreshTimer);
+    }
+    this.refreshTimer = this.runtime.setTimeout(() => {
+      void this.runRefreshCycle();
+    }, this.currentRefreshRateSeconds * 1e3);
+    this.runtime.detachTimer?.(this.refreshTimer);
+  }
+  /** Refresh every cached bundle once, then reschedule the next cycle. */
+  async runRefreshCycle() {
+    if (this.refreshTimer === null) {
+      return;
+    }
+    const bundleKeys = [...this.bundles.keys()].sort();
+    for (const bundleKey of bundleKeys) {
+      await this.fetchGuardsForBundle(bundleKey);
+    }
+    if (this.refreshTimer !== null) {
+      this.scheduleNextRefresh();
+    }
+  }
+  /** Create an empty bundle placeholder before the first successful fetch. */
+  createEmptyBundle(bundleKey, protectedContext) {
+    return {
+      key: bundleKey,
+      guards: /* @__PURE__ */ new Map(),
+      ready: false,
+      etag: "",
+      protectedContext: cloneProtectedContext(protectedContext),
+      refreshRateSeconds: this.options.refreshRateSeconds
+    };
+  }
+  /** Return a cached bundle by key, if present. */
+  getBundle(bundleKey) {
+    return this.bundles.get(bundleKey);
+  }
+  /** Resolve the bundle used for a scope, falling back to the public bundle. */
+  bundleForScope(scope) {
+    return this.getBundle(scope._getBundleKey()) ?? this.getBundle(PUBLIC_BUNDLE_KEY) ?? this.createEmptyBundle(PUBLIC_BUNDLE_KEY, null);
+  }
+  /** Ensure the bundle for a protected context exists locally and is ready. */
+  async ensureBundleForProtectedContext(protectedContext) {
+    const bundleKey = protectedContextCacheKey(protectedContext);
+    const existing = this.getBundle(bundleKey);
+    if (existing?.ready) {
+      return bundleKey;
+    }
+    if (!existing) {
+      this.bundles.set(bundleKey, this.createEmptyBundle(bundleKey, protectedContext));
+    }
+    await this.fetchGuardsForBundle(bundleKey);
+    return bundleKey;
+  }
+  /** Use the shortest bundle refresh rate so all cached bundles stay current. */
+  recomputeRefreshInterval() {
+    let next = 0;
+    for (const bundle of this.bundles.values()) {
+      if (bundle.refreshRateSeconds <= 0) {
+        continue;
+      }
+      if (next === 0 || bundle.refreshRateSeconds < next) {
+        next = bundle.refreshRateSeconds;
+      }
+    }
+    if (next <= 0) {
+      next = this.options.refreshRateSeconds;
+    }
+    if (next <= 0) {
+      next = DEFAULT_REFRESH_RATE_S;
+    }
+    this.currentRefreshRateSeconds = next;
+  }
+  /** Fetch the latest guard bundle for a bundle key, respecting ETags and timeouts. */
+  async fetchGuardsForBundle(bundleKey) {
+    const bundle = this.getBundle(bundleKey) ?? this.getBundle(PUBLIC_BUNDLE_KEY);
+    const etag = bundle?.etag ?? "";
+    const protectedContext = cloneProtectedContext(bundle?.protectedContext ?? null);
+    const { signal, cleanup } = this.createTimeoutSignal(this.options.httpTimeoutSeconds * 1e3);
+    try {
+      const url = new URL("/api/v1/guards", this.options.backendUrl);
+      const headers = {
+        Authorization: `Bearer ${this.projectClientKeyId}`,
+        "Content-Type": "application/json"
+      };
+      if (etag) {
+        headers["If-None-Match"] = etag;
+      }
+      const requestBody = {
+        projectClientKeyId: this.projectClientKeyId,
+        environment: this.options.environment,
+        ...protectedContext ? { protectedContext } : {}
+      };
+      const res = await this.runtime.fetch(url.toString(), {
+        method: "POST",
+        headers,
+        body: JSON.stringify(requestBody),
+        signal
+      });
+      if (res.status === 304) {
+        return;
+      }
+      if (!res.ok) {
+        await res.text();
+        this.log(`[liteguard] Guard fetch failed: ${res.status} ${res.statusText}`);
+        return;
+      }
+      const body = await res.json();
+      const guards = /* @__PURE__ */ new Map();
+      for (const guard of body.guards) {
+        guards.set(guard.name, guard);
+      }
+      const nextBundle = this.getBundle(bundleKey) ?? this.createEmptyBundle(bundleKey, protectedContext);
+      nextBundle.guards = guards;
+      nextBundle.ready = true;
+      nextBundle.etag = body.etag ?? "";
+      nextBundle.protectedContext = cloneProtectedContext(protectedContext);
+      const previousRefreshRateSeconds = this.currentRefreshRateSeconds;
+      nextBundle.refreshRateSeconds = positiveNumberOrDefault(
+        body.refreshRateSeconds,
+        this.options.refreshRateSeconds
+      );
+      this.bundles.set(bundleKey, nextBundle);
+      this.recomputeRefreshInterval();
+      if (this.refreshTimer !== null && this.currentRefreshRateSeconds !== previousRefreshRateSeconds) {
+        this.scheduleNextRefresh();
+      }
+      this.emitChange();
+    } catch (error) {
+      this.log("[liteguard] Guard fetch error:", error);
+    } finally {
+      cleanup();
+    }
+  }
+  /** Create an `AbortSignal` that cancels an HTTP request after `timeoutMs`. */
+  createTimeoutSignal(timeoutMs) {
+    const controller = new AbortController();
+    const handle = this.runtime.setTimeout(() => {
+      controller.abort();
+    }, timeoutMs);
+    this.runtime.detachTimer?.(handle);
+    return {
+      signal: controller.signal,
+      cleanup: () => {
+        this.runtime.clearTimeout(handle);
+      }
+    };
+  }
+  /** Send a JSON POST request to the Liteguard backend with the SDK defaults applied. */
+  async post(url, body, keepalive = false) {
+    const { signal, cleanup } = this.createTimeoutSignal(this.options.httpTimeoutSeconds * 1e3);
+    try {
+      const res = await this.runtime.fetch(url.toString(), {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.projectClientKeyId}`,
+          "Content-Type": "application/json",
+          ...this.options.environment && { "X-Liteguard-Environment": this.options.environment }
+        },
+        body,
+        signal,
+        keepalive
+      });
+      if (!res.ok) {
+        throw new Error(`${res.status} ${res.statusText}`);
+      }
+    } finally {
+      cleanup();
+    }
+  }
+  /** Buffer a telemetry signal and trigger an eager flush when the batch is full. */
+  bufferSignal(input) {
+    const metadata = this.nextSignalMetadata(input.parentSignalIdOverride);
+    const signal = {
+      guardName: input.guardName,
+      result: input.result,
+      properties: { ...input.properties },
+      timestampMs: this.runtime.now(),
+      signalId: metadata.signalId,
+      executionId: metadata.executionId,
+      ...metadata.parentSignalId ? { parentSignalId: metadata.parentSignalId } : {},
+      sequenceNumber: metadata.sequenceNumber,
+      callsiteId: input.callsiteId,
+      kind: input.kind,
+      droppedSignalsSinceLast: this.takeDroppedSignals(),
+      ...input.measurement ? { measurement: input.measurement } : {}
+    };
+    if (this.signalBuffer.length >= this.maxBufferSize()) {
+      this.signalBuffer.shift();
+      this.droppedSignalsPending += 1;
+    }
+    this.signalBuffer.push(signal);
+    if (this.signalBuffer.length >= this.options.flushSize) {
+      void this.flushSignals();
+    }
+    return signal;
+  }
+  /** Allocate signal correlation metadata for the current execution context. */
+  nextSignalMetadata(parentSignalIdOverride) {
+    const state = this.runtime.execution.getStore();
+    const signalId = nextSignalId();
+    if (!state) {
+      return {
+        signalId,
+        executionId: nextSignalId(),
+        sequenceNumber: 1
+      };
+    }
+    state.sequenceNumber += 1;
+    const parentSignalId = parentSignalIdOverride ?? state.lastSignalId;
+    state.lastSignalId = signalId;
+    return {
+      signalId,
+      executionId: state.executionId,
+      ...parentSignalId ? { parentSignalId } : {},
+      sequenceNumber: state.sequenceNumber
+    };
+  }
+  runWithExplicitExecutionState(state, fn) {
+    const existing = this.runtime.execution.getStore();
+    if (existing === state) {
+      return fn();
+    }
+    return this.runtime.execution.run(state, fn);
+  }
+  /** Capture the first external stack frame so telemetry can identify the call site. */
+  captureCallsiteId() {
+    const err = new Error();
+    const stack = err.stack?.split("\n").slice(1) ?? [];
+    const frame = stack.find((line) => {
+      if (line.includes("node:internal")) return false;
+      return !this.runtime.internalStackMarkers.some((marker) => line.includes(marker));
+    });
+    return frame?.trim().replace(/^at\s+/, "") || "unknown";
+  }
+  /** Build the in-memory rate-limit bucket key for a guard and property set. */
+  rateLimitBucketKey(name, rateLimitProperties, props) {
+    if (rateLimitProperties.length === 0) return name;
+    const parts = rateLimitProperties.map((property) => `${property}=${String(props[property] ?? "")}`);
+    return `${name}\0${parts.join("\0")}`;
+  }
+  checkRateLimit(name, limitPerMinute, rateLimitProperties, props) {
+    const now = this.runtime.monotonicNow();
+    const key = this.rateLimitBucketKey(name, rateLimitProperties, props);
+    const state = this.rateLimitState.get(key) ?? { windowStart: now, count: 0 };
+    if (now - state.windowStart >= 6e4) {
+      state.windowStart = now;
+      state.count = 0;
+    }
+    if (state.count >= limitPerMinute) {
+      this.rateLimitState.set(key, state);
+      return false;
+    }
+    state.count += 1;
+    this.rateLimitState.set(key, state);
+    return true;
+  }
+  /** Check whether a guard would pass the current rate-limit window without consuming a slot. */
+  wouldPassRateLimit(name, limitPerMinute, rateLimitProperties, props) {
+    const now = this.runtime.monotonicNow();
+    const key = this.rateLimitBucketKey(name, rateLimitProperties, props);
+    const state = this.rateLimitState.get(key);
+    if (!state) {
+      return true;
+    }
+    if (now - state.windowStart >= 6e4) {
+      return true;
+    }
+    return state.count < limitPerMinute;
+  }
+  /** Decide whether performance measurement should be captured for this guard call. */
+  isMeasurementEnabled(guard, options) {
+    if (this.options.disableMeasurement) {
+      return false;
+    }
+    if (options.disableMeasurement) {
+      return false;
+    }
+    if (guard.disableMeasurement === true) {
+      return false;
+    }
+    return true;
+  }
+  /** Return the hard cap for the in-memory signal buffer after flush failures. */
+  maxBufferSize() {
+    return this.options.flushSize * this.options.flushBufferMultiplier;
+  }
+  /** Drain and reset the count of dropped signals to attach to the next emitted signal. */
+  takeDroppedSignals() {
+    const dropped = this.droppedSignalsPending;
+    this.droppedSignalsPending = 0;
+    return dropped;
+  }
+  /** Write a warning only when quiet mode is disabled. */
+  log(...args) {
+    if (!this.options.quiet) {
+      console.warn(...args);
+    }
+  }
+  /** @internal Test helper for swapping the public guard bundle in memory. */
+  _setGuards(guards) {
+    const bundle = this.getBundle(PUBLIC_BUNDLE_KEY) ?? this.createEmptyBundle(PUBLIC_BUNDLE_KEY, null);
+    bundle.guards = new Map(guards.map((guard) => [guard.name, guard]));
+    bundle.ready = true;
+    bundle.etag = "";
+    this.bundles.set(PUBLIC_BUNDLE_KEY, bundle);
+    this.emitChange();
+  }
+  /** @internal Test helper for swapping a protected-context bundle in memory. */
+  _setProtectedGuards(protectedContext, guards) {
+    const key = protectedContextCacheKey(protectedContext);
+    const bundle = this.getBundle(key) ?? this.createEmptyBundle(key, protectedContext);
+    bundle.guards = new Map(guards.map((guard) => [guard.name, guard]));
+    bundle.ready = true;
+    bundle.etag = "";
+    bundle.protectedContext = cloneProtectedContext(protectedContext);
+    this.bundles.set(key, bundle);
+    this.recomputeRefreshInterval();
+    this.emitChange();
+  }
+  /** @internal Clear all rate-limit counters, or only those for a specific guard. */
+  _resetRateLimitState(name) {
+    if (name !== void 0) {
+      this.rateLimitState.delete(name);
+      const prefix = name + "\0";
+      for (const key of this.rateLimitState.keys()) {
+        if (key.startsWith(prefix)) {
+          this.rateLimitState.delete(key);
+        }
+      }
+      return;
+    }
+    this.rateLimitState.clear();
+  }
+  /** @internal Return the default scope properties for tests and diagnostics. */
+  _getContext() {
+    return this.defaultScope.getProperties();
+  }
+  /** @internal Return the default scope protected context for tests and diagnostics. */
+  _getProtectedContext() {
+    return this.defaultScope.getProtectedContext();
+  }
+  /** @internal Return the active refresh cadence for tests and diagnostics. */
+  _getRefreshRateSeconds() {
+    return this.currentRefreshRateSeconds;
+  }
+  /** @internal Return a cloned view of the buffered signals for tests and diagnostics. */
+  _getSignalBuffer() {
+    return this.signalBuffer.map((signal) => ({
+      ...signal,
+      ...signal.properties ? { properties: { ...signal.properties } } : {}
+    }));
+  }
+  /** @internal Return the sorted set of queued unadopted guards. */
+  _getPendingUnadoptedGuards() {
+    return [...this.pendingUnadoptedGuards].sort();
+  }
+  /** @internal Return the currently cached bundle keys. */
+  _getBundleKeys() {
+    return [...this.bundles.keys()].sort();
+  }
+  /** @internal Expose the request-scope store for tests. */
+  _getRequestScopeStore() {
+    return this.runtime.requestScope?.getStore();
+  }
+};
+function nextSignalId() {
+  signalCounter += 1;
+  return `${Date.now().toString(36)}-${signalCounter.toString(36)}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BaseLiteguardClient,
+  LiteguardScope,
+  evaluateGuard
+});
+//# sourceMappingURL=index.js.map