@securitydept/basic-auth-context-client 0.2.0-beta.1

package/dist/client-DU98lpa_.d.mts

@@ -0,0 +1,91 @@
+//#region src/types.d.ts
+/** Configuration for a single Basic Auth zone. */
+interface BasicAuthZoneConfig {
+  /** URL path prefix for this zone (e.g. "/basic"). */
+  zonePrefix: string;
+  /** Login subpath relative to zone prefix (default: "/login"). */
+  loginSubpath?: string;
+  /** Logout subpath relative to zone prefix (default: "/logout"). */
+  logoutSubpath?: string;
+}
+/** Configuration for the Basic Auth Context Client. */
+interface BasicAuthContextClientConfig {
+  /** Base URL of the SecurityDept server. */
+  baseUrl: string;
+  /** One or more Basic Auth zones to manage. */
+  zones: BasicAuthZoneConfig[];
+  /** Name of the query parameter for post-auth redirect (default: "post_auth_redirect_uri"). */
+  postAuthRedirectParam?: string;
+}
+declare const BasicAuthBoundaryKind: {
+  readonly Authenticated: "authenticated";
+  readonly Challenge: "challenge";
+  readonly Unauthorized: "unauthorized";
+  readonly LogoutPoison: "logout_poison";
+};
+type BasicAuthBoundaryKind = (typeof BasicAuthBoundaryKind)[keyof typeof BasicAuthBoundaryKind];
+interface BasicAuthBoundaryObservation {
+  status: number;
+  challengeHeader?: string | null;
+  requestPath?: string;
+}
+declare const AuthGuardResultKind: {
+  readonly Ok: "ok";
+  readonly Redirect: "redirect";
+};
+type AuthGuardResultKind = (typeof AuthGuardResultKind)[keyof typeof AuthGuardResultKind];
+declare const AuthGuardRedirectStatus: {
+  readonly Found: 302;
+  readonly SeeOther: 303;
+  readonly TemporaryRedirect: 307;
+};
+type AuthGuardRedirectStatus = (typeof AuthGuardRedirectStatus)[keyof typeof AuthGuardRedirectStatus];
+/** Redirect instruction — framework-neutral result. */
+type AuthGuardResult<T> = {
+  kind: typeof AuthGuardResultKind.Ok;
+  value: T;
+} | {
+  kind: typeof AuthGuardResultKind.Redirect;
+  status: AuthGuardRedirectStatus;
+  location: string;
+};
+/** Resolved zone with computed paths. */
+interface ResolvedBasicAuthZone {
+  zonePrefix: string;
+  loginPath: string;
+  logoutPath: string;
+}
+//#endregion
+//#region src/client.d.ts
+declare function readBasicAuthBoundaryKind(options: BasicAuthBoundaryObservation): BasicAuthBoundaryKind;
+/**
+ * Basic Auth Context Client.
+ *
+ * Thin client that manages zone boundary awareness and redirect instructions.
+ * It does NOT manage credentials or HTTP auth headers — those are handled
+ * by the browser's native Basic Auth UI triggered by 401 + WWW-Authenticate.
+ */
+declare class BasicAuthContextClient {
+  readonly zones: readonly ResolvedBasicAuthZone[];
+  private readonly _baseUrl;
+  private readonly _postAuthRedirectParam;
+  constructor(config: BasicAuthContextClientConfig);
+  /** Find the zone that contains the given path. */
+  zoneForPath(path: string): ResolvedBasicAuthZone | undefined;
+  zoneForPrefix(zonePrefix: string): ResolvedBasicAuthZone | undefined;
+  /** Check whether a path falls inside any configured zone. */
+  isInZone(path: string): boolean;
+  /** Build the full login URL for a zone, optionally with a post-auth redirect. */
+  loginUrl(zone: ResolvedBasicAuthZone, postAuthRedirectUri?: string): string;
+  loginUrlForZonePrefix(zonePrefix: string, postAuthRedirectUri?: string): string | null;
+  /** Build the full logout URL for a zone. */
+  logoutUrl(zone: ResolvedBasicAuthZone): string;
+  /**
+   * Handle a 401 response: if the current path is inside a zone,
+   * return a redirect instruction to the zone's login URL.
+   */
+  handleUnauthorized(currentPath: string, responseStatus: number): AuthGuardResult<null>;
+}
+//#endregion
+export { AuthGuardResultKind as a, BasicAuthContextClientConfig as c, AuthGuardResult as i, BasicAuthZoneConfig as l, readBasicAuthBoundaryKind as n, BasicAuthBoundaryKind as o, AuthGuardRedirectStatus as r, BasicAuthBoundaryObservation as s, BasicAuthContextClient as t, ResolvedBasicAuthZone as u };
+//# sourceMappingURL=client-DU98lpa_.d.mts.map

package/dist/client-D_0eAARH.mjs

@@ -0,0 +1,136 @@
+import { n as AuthGuardResultKind, r as BasicAuthBoundaryKind, t as AuthGuardRedirectStatus } from "./types-2IoKrgnl.mjs";
+import { createSchema, validateWithSchemaSync } from "@securitydept/client";
+//#region src/schemas.ts
+function isNonEmptyString(v) {
+	return typeof v === "string" && v.length > 0;
+}
+function isObject(v) {
+	return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function validateZoneConfig(input, index) {
+	const issues = [];
+	if (!isObject(input)) {
+		issues.push({ message: `zones[${index}]: expected an object` });
+		return { issues };
+	}
+	if (!isNonEmptyString(input.zonePrefix)) issues.push({ message: `zones[${index}].zonePrefix: expected a non-empty string` });
+	if (input.loginSubpath !== void 0 && typeof input.loginSubpath !== "string") issues.push({ message: `zones[${index}].loginSubpath: expected a string if provided` });
+	if (input.logoutSubpath !== void 0 && typeof input.logoutSubpath !== "string") issues.push({ message: `zones[${index}].logoutSubpath: expected a string if provided` });
+	return issues.length > 0 ? { issues } : null;
+}
+/**
+* Schema for validating BasicAuthContextClientConfig.
+*
+* Validates:
+*   - `baseUrl` is a non-empty string
+*   - `zones` is a non-empty array of valid zone configs
+*   - each zone has a non-empty `zonePrefix`
+*   - optional fields have correct types when provided
+*/
+const BasicAuthContextClientConfigSchema = createSchema({ validate(input) {
+	const issues = [];
+	if (!isObject(input)) return { issues: [{ message: "Expected an object" }] };
+	if (!isNonEmptyString(input.baseUrl)) issues.push({ message: "baseUrl: expected a non-empty string" });
+	if (!Array.isArray(input.zones) || input.zones.length === 0) issues.push({ message: "zones: expected a non-empty array of zone configs" });
+	else for (let i = 0; i < input.zones.length; i++) {
+		const zoneResult = validateZoneConfig(input.zones[i], i);
+		if (zoneResult) issues.push(...zoneResult.issues);
+	}
+	if (input.postAuthRedirectParam !== void 0 && typeof input.postAuthRedirectParam !== "string") issues.push({ message: "postAuthRedirectParam: expected a string if provided" });
+	if (issues.length > 0) return { issues };
+	return { value: input };
+} });
+//#endregion
+//#region src/client.ts
+const DEFAULT_LOGIN_SUBPATH = "/login";
+const DEFAULT_LOGOUT_SUBPATH = "/logout";
+const DEFAULT_POST_AUTH_REDIRECT_PARAM = "post_auth_redirect_uri";
+function resolveZone(config) {
+	const prefix = config.zonePrefix.replace(/\/+$/, "");
+	const loginSub = config.loginSubpath ?? DEFAULT_LOGIN_SUBPATH;
+	const logoutSub = config.logoutSubpath ?? DEFAULT_LOGOUT_SUBPATH;
+	return {
+		zonePrefix: prefix,
+		loginPath: prefix + loginSub,
+		logoutPath: prefix + logoutSub
+	};
+}
+function readBasicAuthBoundaryKind(options) {
+	if (options.status < 400) return BasicAuthBoundaryKind.Authenticated;
+	if (options.challengeHeader) return BasicAuthBoundaryKind.Challenge;
+	if (options.status === 401 && options.requestPath === "/basic/logout") return BasicAuthBoundaryKind.LogoutPoison;
+	return BasicAuthBoundaryKind.Unauthorized;
+}
+/**
+* Basic Auth Context Client.
+*
+* Thin client that manages zone boundary awareness and redirect instructions.
+* It does NOT manage credentials or HTTP auth headers — those are handled
+* by the browser's native Basic Auth UI triggered by 401 + WWW-Authenticate.
+*/
+var BasicAuthContextClient = class {
+	zones;
+	_baseUrl;
+	_postAuthRedirectParam;
+	constructor(config) {
+		const result = validateWithSchemaSync(BasicAuthContextClientConfigSchema, config);
+		if (!result.success) console.warn(`[BasicAuthContextClient] Deprecated config shape detected (will become an error in a future release): ${result.issues.map((i) => i.message).join("; ")}`);
+		this._baseUrl = (config.baseUrl ?? "").replace(/\/+$/, "");
+		this._postAuthRedirectParam = config.postAuthRedirectParam ?? DEFAULT_POST_AUTH_REDIRECT_PARAM;
+		this.zones = (config.zones ?? []).map(resolveZone);
+	}
+	/** Find the zone that contains the given path. */
+	zoneForPath(path) {
+		let matchedZone;
+		for (const zone of this.zones) {
+			if (!(path === zone.zonePrefix || path.startsWith(`${zone.zonePrefix}/`))) continue;
+			if (!matchedZone || zone.zonePrefix.length > matchedZone.zonePrefix.length) matchedZone = zone;
+		}
+		return matchedZone;
+	}
+	zoneForPrefix(zonePrefix) {
+		return this.zones.find((zone) => zone.zonePrefix === zonePrefix);
+	}
+	/** Check whether a path falls inside any configured zone. */
+	isInZone(path) {
+		return this.zoneForPath(path) !== void 0;
+	}
+	/** Build the full login URL for a zone, optionally with a post-auth redirect. */
+	loginUrl(zone, postAuthRedirectUri) {
+		const base = this._baseUrl + zone.loginPath;
+		if (postAuthRedirectUri) return `${base}?${new URLSearchParams({ [this._postAuthRedirectParam]: postAuthRedirectUri }).toString()}`;
+		return base;
+	}
+	loginUrlForZonePrefix(zonePrefix, postAuthRedirectUri) {
+		const zone = this.zoneForPrefix(zonePrefix);
+		return zone ? this.loginUrl(zone, postAuthRedirectUri) : null;
+	}
+	/** Build the full logout URL for a zone. */
+	logoutUrl(zone) {
+		return this._baseUrl + zone.logoutPath;
+	}
+	/**
+	* Handle a 401 response: if the current path is inside a zone,
+	* return a redirect instruction to the zone's login URL.
+	*/
+	handleUnauthorized(currentPath, responseStatus) {
+		if (responseStatus !== 401) return {
+			kind: AuthGuardResultKind.Ok,
+			value: null
+		};
+		const zone = this.zoneForPath(currentPath);
+		if (!zone) return {
+			kind: AuthGuardResultKind.Ok,
+			value: null
+		};
+		return {
+			kind: AuthGuardResultKind.Redirect,
+			status: AuthGuardRedirectStatus.Found,
+			location: this.loginUrl(zone, currentPath)
+		};
+	}
+};
+//#endregion
+export { readBasicAuthBoundaryKind as n, BasicAuthContextClientConfigSchema as r, BasicAuthContextClient as t };
+
+//# sourceMappingURL=client-D_0eAARH.mjs.map

package/dist/client-D_0eAARH.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-D_0eAARH.mjs","names":["BasicAuthBoundaryKindValues"],"sources":["../src/schemas.ts","../src/client.ts"],"sourcesContent":["// basic-auth-context-client — config validation schema\n//\n// Uses @standard-schema via the foundation createSchema helper to validate\n// BasicAuthContextClientConfig at the cross-boundary entry point.\n\nimport { createSchema } from \"@securitydept/client\";\nimport type { BasicAuthContextClientConfig } from \"./types\";\n\nfunction isNonEmptyString(v: unknown): v is string {\n\treturn typeof v === \"string\" && v.length > 0;\n}\n\nfunction isObject(v: unknown): v is Record<string, unknown> {\n\treturn typeof v === \"object\" && v !== null && !Array.isArray(v);\n}\n\nfunction validateZoneConfig(input: unknown, index: number) {\n\tconst issues: Array<{ message: string }> = [];\n\tif (!isObject(input)) {\n\t\tissues.push({ message: `zones[${index}]: expected an object` });\n\t\treturn { issues };\n\t}\n\tif (!isNonEmptyString(input.zonePrefix)) {\n\t\tissues.push({\n\t\t\tmessage: `zones[${index}].zonePrefix: expected a non-empty string`,\n\t\t});\n\t}\n\tif (\n\t\tinput.loginSubpath !== undefined &&\n\t\ttypeof input.loginSubpath !== \"string\"\n\t) {\n\t\tissues.push({\n\t\t\tmessage: `zones[${index}].loginSubpath: expected a string if provided`,\n\t\t});\n\t}\n\tif (\n\t\tinput.logoutSubpath !== undefined &&\n\t\ttypeof input.logoutSubpath !== \"string\"\n\t) {\n\t\tissues.push({\n\t\t\tmessage: `zones[${index}].logoutSubpath: expected a string if provided`,\n\t\t});\n\t}\n\treturn issues.length > 0 ? { issues } : null;\n}\n\n/**\n * Schema for validating BasicAuthContextClientConfig.\n *\n * Validates:\n *   - `baseUrl` is a non-empty string\n *   - `zones` is a non-empty array of valid zone configs\n *   - each zone has a non-empty `zonePrefix`\n *   - optional fields have correct types when provided\n */\nexport const BasicAuthContextClientConfigSchema =\n\tcreateSchema<BasicAuthContextClientConfig>({\n\t\tvalidate(input) {\n\t\t\tconst issues: Array<{ message: string }> = [];\n\n\t\t\tif (!isObject(input)) {\n\t\t\t\treturn { issues: [{ message: \"Expected an object\" }] };\n\t\t\t}\n\n\t\t\tif (!isNonEmptyString(input.baseUrl)) {\n\t\t\t\tissues.push({ message: \"baseUrl: expected a non-empty string\" });\n\t\t\t}\n\n\t\t\tif (!Array.isArray(input.zones) || input.zones.length === 0) {\n\t\t\t\tissues.push({\n\t\t\t\t\tmessage: \"zones: expected a non-empty array of zone configs\",\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\tfor (let i = 0; i < input.zones.length; i++) {\n\t\t\t\t\tconst zoneResult = validateZoneConfig(input.zones[i], i);\n\t\t\t\t\tif (zoneResult) {\n\t\t\t\t\t\tissues.push(...zoneResult.issues);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\tinput.postAuthRedirectParam !== undefined &&\n\t\t\t\ttypeof input.postAuthRedirectParam !== \"string\"\n\t\t\t) {\n\t\t\t\tissues.push({\n\t\t\t\t\tmessage: \"postAuthRedirectParam: expected a string if provided\",\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (issues.length > 0) {\n\t\t\t\treturn { issues };\n\t\t\t}\n\n\t\t\treturn { value: input as unknown as BasicAuthContextClientConfig };\n\t\t},\n\t});\n","import { validateWithSchemaSync } from \"@securitydept/client\";\nimport { BasicAuthContextClientConfigSchema } from \"./schemas\";\nimport type {\n\tAuthGuardResult,\n\tBasicAuthBoundaryKind,\n\tBasicAuthBoundaryObservation,\n\tBasicAuthContextClientConfig,\n\tBasicAuthZoneConfig,\n\tResolvedBasicAuthZone,\n} from \"./types\";\nimport {\n\tAuthGuardRedirectStatus,\n\tAuthGuardResultKind,\n\tBasicAuthBoundaryKind as BasicAuthBoundaryKindValues,\n} from \"./types\";\n\nconst DEFAULT_LOGIN_SUBPATH = \"/login\";\nconst DEFAULT_LOGOUT_SUBPATH = \"/logout\";\nconst DEFAULT_POST_AUTH_REDIRECT_PARAM = \"post_auth_redirect_uri\";\n\nfunction resolveZone(config: BasicAuthZoneConfig): ResolvedBasicAuthZone {\n\tconst prefix = config.zonePrefix.replace(/\\/+$/, \"\");\n\tconst loginSub = config.loginSubpath ?? DEFAULT_LOGIN_SUBPATH;\n\tconst logoutSub = config.logoutSubpath ?? DEFAULT_LOGOUT_SUBPATH;\n\n\treturn {\n\t\tzonePrefix: prefix,\n\t\tloginPath: prefix + loginSub,\n\t\tlogoutPath: prefix + logoutSub,\n\t};\n}\n\nexport function readBasicAuthBoundaryKind(\n\toptions: BasicAuthBoundaryObservation,\n): BasicAuthBoundaryKind {\n\tif (options.status < 400) {\n\t\treturn BasicAuthBoundaryKindValues.Authenticated;\n\t}\n\n\tif (options.challengeHeader) {\n\t\treturn BasicAuthBoundaryKindValues.Challenge;\n\t}\n\n\tif (options.status === 401 && options.requestPath === \"/basic/logout\") {\n\t\treturn BasicAuthBoundaryKindValues.LogoutPoison;\n\t}\n\n\treturn BasicAuthBoundaryKindValues.Unauthorized;\n}\n\n/**\n * Basic Auth Context Client.\n *\n * Thin client that manages zone boundary awareness and redirect instructions.\n * It does NOT manage credentials or HTTP auth headers — those are handled\n * by the browser's native Basic Auth UI triggered by 401 + WWW-Authenticate.\n */\nexport class BasicAuthContextClient {\n\treadonly zones: readonly ResolvedBasicAuthZone[];\n\tprivate readonly _baseUrl: string;\n\tprivate readonly _postAuthRedirectParam: string;\n\n\tconstructor(config: BasicAuthContextClientConfig) {\n\t\t// Deprecation-phase validation: warn on invalid config but do not throw.\n\t\t// A future minor release will escalate this to a hard error.\n\t\t// See 110-TS_SDK_MIGRATIONS.md for the full deprecation note.\n\t\tconst result = validateWithSchemaSync(\n\t\t\tBasicAuthContextClientConfigSchema,\n\t\t\tconfig,\n\t\t);\n\t\tif (!result.success) {\n\t\t\tconsole.warn(\n\t\t\t\t`[BasicAuthContextClient] Deprecated config shape detected (will become an error in a future release): ${result.issues.map((i) => i.message).join(\"; \")}`,\n\t\t\t);\n\t\t}\n\n\t\tthis._baseUrl = (config.baseUrl ?? \"\").replace(/\\/+$/, \"\");\n\t\tthis._postAuthRedirectParam =\n\t\t\tconfig.postAuthRedirectParam ?? DEFAULT_POST_AUTH_REDIRECT_PARAM;\n\t\tthis.zones = (config.zones ?? []).map(resolveZone);\n\t}\n\n\t/** Find the zone that contains the given path. */\n\tzoneForPath(path: string): ResolvedBasicAuthZone | undefined {\n\t\tlet matchedZone: ResolvedBasicAuthZone | undefined;\n\n\t\tfor (const zone of this.zones) {\n\t\t\tconst matches =\n\t\t\t\tpath === zone.zonePrefix || path.startsWith(`${zone.zonePrefix}/`);\n\t\t\tif (!matches) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\t!matchedZone ||\n\t\t\t\tzone.zonePrefix.length > matchedZone.zonePrefix.length\n\t\t\t) {\n\t\t\t\tmatchedZone = zone;\n\t\t\t}\n\t\t}\n\n\t\treturn matchedZone;\n\t}\n\n\tzoneForPrefix(zonePrefix: string): ResolvedBasicAuthZone | undefined {\n\t\treturn this.zones.find((zone) => zone.zonePrefix === zonePrefix);\n\t}\n\n\t/** Check whether a path falls inside any configured zone. */\n\tisInZone(path: string): boolean {\n\t\treturn this.zoneForPath(path) !== undefined;\n\t}\n\n\t/** Build the full login URL for a zone, optionally with a post-auth redirect. */\n\tloginUrl(zone: ResolvedBasicAuthZone, postAuthRedirectUri?: string): string {\n\t\tconst base = this._baseUrl + zone.loginPath;\n\t\tif (postAuthRedirectUri) {\n\t\t\tconst params = new URLSearchParams({\n\t\t\t\t[this._postAuthRedirectParam]: postAuthRedirectUri,\n\t\t\t});\n\t\t\treturn `${base}?${params.toString()}`;\n\t\t}\n\t\treturn base;\n\t}\n\n\tloginUrlForZonePrefix(\n\t\tzonePrefix: string,\n\t\tpostAuthRedirectUri?: string,\n\t): string | null {\n\t\tconst zone = this.zoneForPrefix(zonePrefix);\n\t\treturn zone ? this.loginUrl(zone, postAuthRedirectUri) : null;\n\t}\n\n\t/** Build the full logout URL for a zone. */\n\tlogoutUrl(zone: ResolvedBasicAuthZone): string {\n\t\treturn this._baseUrl + zone.logoutPath;\n\t}\n\n\t/**\n\t * Handle a 401 response: if the current path is inside a zone,\n\t * return a redirect instruction to the zone's login URL.\n\t */\n\thandleUnauthorized(\n\t\tcurrentPath: string,\n\t\tresponseStatus: number,\n\t): AuthGuardResult<null> {\n\t\tif (responseStatus !== 401) {\n\t\t\treturn { kind: AuthGuardResultKind.Ok, value: null };\n\t\t}\n\n\t\tconst zone = this.zoneForPath(currentPath);\n\t\tif (!zone) {\n\t\t\treturn { kind: AuthGuardResultKind.Ok, value: null };\n\t\t}\n\n\t\treturn {\n\t\t\tkind: AuthGuardResultKind.Redirect,\n\t\t\tstatus: AuthGuardRedirectStatus.Found,\n\t\t\tlocation: this.loginUrl(zone, currentPath),\n\t\t};\n\t}\n}\n"],"mappings":";;;AAQA,SAAS,iBAAiB,GAAyB;AAClD,QAAO,OAAO,MAAM,YAAY,EAAE,SAAS;;AAG5C,SAAS,SAAS,GAA0C;AAC3D,QAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,EAAE;;AAGhE,SAAS,mBAAmB,OAAgB,OAAe;CAC1D,MAAM,SAAqC,EAAE;AAC7C,KAAI,CAAC,SAAS,MAAM,EAAE;AACrB,SAAO,KAAK,EAAE,SAAS,SAAS,MAAM,wBAAwB,CAAC;AAC/D,SAAO,EAAE,QAAQ;;AAElB,KAAI,CAAC,iBAAiB,MAAM,WAAW,CACtC,QAAO,KAAK,EACX,SAAS,SAAS,MAAM,4CACxB,CAAC;AAEH,KACC,MAAM,iBAAiB,KAAA,KACvB,OAAO,MAAM,iBAAiB,SAE9B,QAAO,KAAK,EACX,SAAS,SAAS,MAAM,gDACxB,CAAC;AAEH,KACC,MAAM,kBAAkB,KAAA,KACxB,OAAO,MAAM,kBAAkB,SAE/B,QAAO,KAAK,EACX,SAAS,SAAS,MAAM,iDACxB,CAAC;AAEH,QAAO,OAAO,SAAS,IAAI,EAAE,QAAQ,GAAG;;;;;;;;;;;AAYzC,MAAa,qCACZ,aAA2C,EAC1C,SAAS,OAAO;CACf,MAAM,SAAqC,EAAE;AAE7C,KAAI,CAAC,SAAS,MAAM,CACnB,QAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,sBAAsB,CAAC,EAAE;AAGvD,KAAI,CAAC,iBAAiB,MAAM,QAAQ,CACnC,QAAO,KAAK,EAAE,SAAS,wCAAwC,CAAC;AAGjE,KAAI,CAAC,MAAM,QAAQ,MAAM,MAAM,IAAI,MAAM,MAAM,WAAW,EACzD,QAAO,KAAK,EACX,SAAS,qDACT,CAAC;KAEF,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,MAAM,QAAQ,KAAK;EAC5C,MAAM,aAAa,mBAAmB,MAAM,MAAM,IAAI,EAAE;AACxD,MAAI,WACH,QAAO,KAAK,GAAG,WAAW,OAAO;;AAKpC,KACC,MAAM,0BAA0B,KAAA,KAChC,OAAO,MAAM,0BAA0B,SAEvC,QAAO,KAAK,EACX,SAAS,wDACT,CAAC;AAGH,KAAI,OAAO,SAAS,EACnB,QAAO,EAAE,QAAQ;AAGlB,QAAO,EAAE,OAAO,OAAkD;GAEnE,CAAC;;;AChFH,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AAEzC,SAAS,YAAY,QAAoD;CACxE,MAAM,SAAS,OAAO,WAAW,QAAQ,QAAQ,GAAG;CACpD,MAAM,WAAW,OAAO,gBAAgB;CACxC,MAAM,YAAY,OAAO,iBAAiB;AAE1C,QAAO;EACN,YAAY;EACZ,WAAW,SAAS;EACpB,YAAY,SAAS;EACrB;;AAGF,SAAgB,0BACf,SACwB;AACxB,KAAI,QAAQ,SAAS,IACpB,QAAOA,sBAA4B;AAGpC,KAAI,QAAQ,gBACX,QAAOA,sBAA4B;AAGpC,KAAI,QAAQ,WAAW,OAAO,QAAQ,gBAAgB,gBACrD,QAAOA,sBAA4B;AAGpC,QAAOA,sBAA4B;;;;;;;;;AAUpC,IAAa,yBAAb,MAAoC;CACnC;CACA;CACA;CAEA,YAAY,QAAsC;EAIjD,MAAM,SAAS,uBACd,oCACA,OACA;AACD,MAAI,CAAC,OAAO,QACX,SAAQ,KACP,yGAAyG,OAAO,OAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK,GACvJ;AAGF,OAAK,YAAY,OAAO,WAAW,IAAI,QAAQ,QAAQ,GAAG;AAC1D,OAAK,yBACJ,OAAO,yBAAyB;AACjC,OAAK,SAAS,OAAO,SAAS,EAAE,EAAE,IAAI,YAAY;;;CAInD,YAAY,MAAiD;EAC5D,IAAI;AAEJ,OAAK,MAAM,QAAQ,KAAK,OAAO;AAG9B,OAAI,EADH,SAAS,KAAK,cAAc,KAAK,WAAW,GAAG,KAAK,WAAW,GAAG,EAElE;AAGD,OACC,CAAC,eACD,KAAK,WAAW,SAAS,YAAY,WAAW,OAEhD,eAAc;;AAIhB,SAAO;;CAGR,cAAc,YAAuD;AACpE,SAAO,KAAK,MAAM,MAAM,SAAS,KAAK,eAAe,WAAW;;;CAIjE,SAAS,MAAuB;AAC/B,SAAO,KAAK,YAAY,KAAK,KAAK,KAAA;;;CAInC,SAAS,MAA6B,qBAAsC;EAC3E,MAAM,OAAO,KAAK,WAAW,KAAK;AAClC,MAAI,oBAIH,QAAO,GAAG,KAAK,GAHA,IAAI,gBAAgB,GACjC,KAAK,yBAAyB,qBAC/B,CAAC,CACuB,UAAU;AAEpC,SAAO;;CAGR,sBACC,YACA,qBACgB;EAChB,MAAM,OAAO,KAAK,cAAc,WAAW;AAC3C,SAAO,OAAO,KAAK,SAAS,MAAM,oBAAoB,GAAG;;;CAI1D,UAAU,MAAqC;AAC9C,SAAO,KAAK,WAAW,KAAK;;;;;;CAO7B,mBACC,aACA,gBACwB;AACxB,MAAI,mBAAmB,IACtB,QAAO;GAAE,MAAM,oBAAoB;GAAI,OAAO;GAAM;EAGrD,MAAM,OAAO,KAAK,YAAY,YAAY;AAC1C,MAAI,CAAC,KACJ,QAAO;GAAE,MAAM,oBAAoB;GAAI,OAAO;GAAM;AAGrD,SAAO;GACN,MAAM,oBAAoB;GAC1B,QAAQ,wBAAwB;GAChC,UAAU,KAAK,SAAS,MAAM,YAAY;GAC1C"}

package/dist/index.d.mts

@@ -0,0 +1,94 @@
+import { a as AuthGuardResultKind, c as BasicAuthContextClientConfig, i as AuthGuardResult, l as BasicAuthZoneConfig, n as readBasicAuthBoundaryKind, o as BasicAuthBoundaryKind, r as AuthGuardRedirectStatus, s as BasicAuthBoundaryObservation, t as BasicAuthContextClient, u as ResolvedBasicAuthZone } from "./client-DU98lpa_.mjs";
+
+//#region ../../../../node_modules/.pnpm/@standard-schema+spec@1.1.0/node_modules/@standard-schema/spec/dist/index.d.ts
+/** The Standard Typed interface. This is a base type extended by other specs. */
+interface StandardTypedV1<Input = unknown, Output = Input> {
+  /** The Standard properties. */
+  readonly "~standard": StandardTypedV1.Props<Input, Output>;
+}
+declare namespace StandardTypedV1 {
+  /** The Standard Typed properties interface. */
+  interface Props<Input = unknown, Output = Input> {
+    /** The version number of the standard. */
+    readonly version: 1;
+    /** The vendor name of the schema library. */
+    readonly vendor: string;
+    /** Inferred types associated with the schema. */
+    readonly types?: Types<Input, Output> | undefined;
+  }
+  /** The Standard Typed types interface. */
+  interface Types<Input = unknown, Output = Input> {
+    /** The input type of the schema. */
+    readonly input: Input;
+    /** The output type of the schema. */
+    readonly output: Output;
+  }
+  /** Infers the input type of a Standard Typed. */
+  type InferInput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["input"];
+  /** Infers the output type of a Standard Typed. */
+  type InferOutput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["output"];
+}
+/** The Standard Schema interface. */
+interface StandardSchemaV1<Input = unknown, Output = Input> {
+  /** The Standard Schema properties. */
+  readonly "~standard": StandardSchemaV1.Props<Input, Output>;
+}
+declare namespace StandardSchemaV1 {
+  /** The Standard Schema properties interface. */
+  interface Props<Input = unknown, Output = Input> extends StandardTypedV1.Props<Input, Output> {
+    /** Validates unknown input values. */
+    readonly validate: (value: unknown, options?: StandardSchemaV1.Options | undefined) => Result<Output> | Promise<Result<Output>>;
+  }
+  /** The result interface of the validate function. */
+  type Result<Output> = SuccessResult<Output> | FailureResult;
+  /** The result interface if validation succeeds. */
+  interface SuccessResult<Output> {
+    /** The typed output value. */
+    readonly value: Output;
+    /** A falsy value for `issues` indicates success. */
+    readonly issues?: undefined;
+  }
+  interface Options {
+    /** Explicit support for additional vendor-specific parameters, if needed. */
+    readonly libraryOptions?: Record<string, unknown> | undefined;
+  }
+  /** The result interface if validation fails. */
+  interface FailureResult {
+    /** The issues of failed validation. */
+    readonly issues: ReadonlyArray<Issue>;
+  }
+  /** The issue interface of the failure output. */
+  interface Issue {
+    /** The error message of the issue. */
+    readonly message: string;
+    /** The path of the issue, if any. */
+    readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
+  }
+  /** The path segment interface of the issue. */
+  interface PathSegment {
+    /** The key representing a path segment. */
+    readonly key: PropertyKey;
+  }
+  /** The Standard types interface. */
+  interface Types<Input = unknown, Output = Input> extends StandardTypedV1.Types<Input, Output> {}
+  /** Infers the input type of a Standard. */
+  type InferInput<Schema extends StandardTypedV1> = StandardTypedV1.InferInput<Schema>;
+  /** Infers the output type of a Standard. */
+  type InferOutput<Schema extends StandardTypedV1> = StandardTypedV1.InferOutput<Schema>;
+}
+/** The Standard JSON Schema interface. */
+//#endregion
+//#region src/schemas.d.ts
+/**
+ * Schema for validating BasicAuthContextClientConfig.
+ *
+ * Validates:
+ *   - `baseUrl` is a non-empty string
+ *   - `zones` is a non-empty array of valid zone configs
+ *   - each zone has a non-empty `zonePrefix`
+ *   - optional fields have correct types when provided
+ */
+declare const BasicAuthContextClientConfigSchema: StandardSchemaV1<unknown, BasicAuthContextClientConfig>;
+//#endregion
+export { AuthGuardRedirectStatus, type AuthGuardResult, AuthGuardResultKind, BasicAuthBoundaryKind, type BasicAuthBoundaryObservation, BasicAuthContextClient, type BasicAuthContextClientConfig, BasicAuthContextClientConfigSchema, type BasicAuthZoneConfig, type ResolvedBasicAuthZone, readBasicAuthBoundaryKind };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -0,0 +1,3 @@
+import { n as readBasicAuthBoundaryKind, r as BasicAuthContextClientConfigSchema, t as BasicAuthContextClient } from "./client-D_0eAARH.mjs";
+import { n as AuthGuardResultKind, r as BasicAuthBoundaryKind, t as AuthGuardRedirectStatus } from "./types-2IoKrgnl.mjs";
+export { AuthGuardRedirectStatus, AuthGuardResultKind, BasicAuthBoundaryKind, BasicAuthContextClient, BasicAuthContextClientConfigSchema, readBasicAuthBoundaryKind };

package/dist/server/index.d.mts

@@ -0,0 +1,73 @@
+import { c as BasicAuthContextClientConfig, t as BasicAuthContextClient } from "../client-DU98lpa_.mjs";
+
+//#region src/server/helpers.d.ts
+/** Minimal server request context — host-neutral. */
+interface ServerRequestContext {
+  /** The request path (e.g. "/api/protected"). */
+  path: string;
+}
+/**
+ * Server-side redirect instruction for the host to act on.
+ *
+ * The host translates this into its framework-specific response:
+ * - Next.js: `{ redirect: { destination, statusCode } }`
+ * - Express: `res.redirect(statusCode, destination)`
+ * - etc.
+ */
+interface ServerRedirectInstruction {
+  /** HTTP redirect status code. */
+  statusCode: number;
+  /** Redirect target URL. */
+  destination: string;
+}
+/** Options for {@link createBasicAuthServerHelper}. */
+interface CreateBasicAuthServerHelperOptions {
+  /** BasicAuthContextClient config — same shape as the browser client. */
+  config: BasicAuthContextClientConfig;
+}
+/** Server-host helper for basic-auth zone-based redirect logic. */
+interface BasicAuthServerHelper {
+  /** The underlying BasicAuthContextClient instance. */
+  readonly client: BasicAuthContextClient;
+  /**
+   * Handle a 401 response from the backend in a server context.
+   *
+   * If the request path falls inside a configured zone, returns a
+   * redirect instruction. Otherwise returns `null`.
+   */
+  handleUnauthorized(context: ServerRequestContext): ServerRedirectInstruction | null;
+  /**
+   * Build the login URL for a specific path.
+   *
+   * Returns the login URL for the zone containing the path,
+   * or `null` if the path isn't in any zone.
+   */
+  loginUrlForPath(path: string): string | null;
+  /**
+   * Build the logout URL for a specific path.
+   *
+   * Returns the logout URL for the zone containing the path,
+   * or `null` if the path isn't in any zone.
+   */
+  logoutUrlForPath(path: string): string | null;
+}
+/**
+ * Create a server-host helper for basic-auth zone management.
+ *
+ * @example
+ * ```ts
+ * const helper = createBasicAuthServerHelper({
+ *   config: { baseUrl: "https://auth.example.com", zones: [{ zonePrefix: "/api" }] },
+ * });
+ *
+ * // In a server request handler:
+ * const redirect = helper.handleUnauthorized({ path: "/api/data" });
+ * if (redirect) {
+ *   return Response.redirect(redirect.destination, redirect.statusCode);
+ * }
+ * ```
+ */
+declare function createBasicAuthServerHelper(options: CreateBasicAuthServerHelperOptions): BasicAuthServerHelper;
+//#endregion
+export { type BasicAuthServerHelper, type CreateBasicAuthServerHelperOptions, type ServerRedirectInstruction, type ServerRequestContext, createBasicAuthServerHelper };
+//# sourceMappingURL=index.d.mts.map

package/dist/server/index.mjs

@@ -0,0 +1,47 @@
+import { t as BasicAuthContextClient } from "../client-D_0eAARH.mjs";
+import { n as AuthGuardResultKind } from "../types-2IoKrgnl.mjs";
+//#region src/server/helpers.ts
+/**
+* Create a server-host helper for basic-auth zone management.
+*
+* @example
+* ```ts
+* const helper = createBasicAuthServerHelper({
+*   config: { baseUrl: "https://auth.example.com", zones: [{ zonePrefix: "/api" }] },
+* });
+*
+* // In a server request handler:
+* const redirect = helper.handleUnauthorized({ path: "/api/data" });
+* if (redirect) {
+*   return Response.redirect(redirect.destination, redirect.statusCode);
+* }
+* ```
+*/
+function createBasicAuthServerHelper(options) {
+	const client = new BasicAuthContextClient(options.config);
+	return {
+		client,
+		handleUnauthorized(context) {
+			const result = client.handleUnauthorized(context.path, 401);
+			if (result.kind === AuthGuardResultKind.Redirect) return {
+				statusCode: result.status,
+				destination: result.location
+			};
+			return null;
+		},
+		loginUrlForPath(path) {
+			const zone = client.zoneForPath(path);
+			if (!zone) return null;
+			return client.loginUrl(zone, path);
+		},
+		logoutUrlForPath(path) {
+			const zone = client.zoneForPath(path);
+			if (!zone) return null;
+			return client.logoutUrl(zone);
+		}
+	};
+}
+//#endregion
+export { createBasicAuthServerHelper };
+
+//# sourceMappingURL=index.mjs.map

package/dist/server/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/server/helpers.ts"],"sourcesContent":["// Server-host helpers for basic-auth-context-client\n//\n// Provides host-neutral server helpers that wrap BasicAuthContextClient\n// for SSR / server-render-host scenarios (Next.js, Remix, Astro,\n// plain Node request handlers, etc.).\n//\n// The host owns HTTP response construction (302 headers, response body).\n// These helpers produce redirect instructions the host can act on.\n\nimport { BasicAuthContextClient } from \"../client\";\nimport type { AuthGuardResult, BasicAuthContextClientConfig } from \"../types\";\nimport { AuthGuardResultKind } from \"../types\";\n\n// ---------------------------------------------------------------------------\n// Server request context\n// ---------------------------------------------------------------------------\n\n/** Minimal server request context — host-neutral. */\nexport interface ServerRequestContext {\n\t/** The request path (e.g. \"/api/protected\"). */\n\tpath: string;\n}\n\n// ---------------------------------------------------------------------------\n// Redirect instruction\n// ---------------------------------------------------------------------------\n\n/**\n * Server-side redirect instruction for the host to act on.\n *\n * The host translates this into its framework-specific response:\n * - Next.js: `{ redirect: { destination, statusCode } }`\n * - Express: `res.redirect(statusCode, destination)`\n * - etc.\n */\nexport interface ServerRedirectInstruction {\n\t/** HTTP redirect status code. */\n\tstatusCode: number;\n\t/** Redirect target URL. */\n\tdestination: string;\n}\n\n// ---------------------------------------------------------------------------\n// Helper options\n// ---------------------------------------------------------------------------\n\n/** Options for {@link createBasicAuthServerHelper}. */\nexport interface CreateBasicAuthServerHelperOptions {\n\t/** BasicAuthContextClient config — same shape as the browser client. */\n\tconfig: BasicAuthContextClientConfig;\n}\n\n// ---------------------------------------------------------------------------\n// Helper interface\n// ---------------------------------------------------------------------------\n\n/** Server-host helper for basic-auth zone-based redirect logic. */\nexport interface BasicAuthServerHelper {\n\t/** The underlying BasicAuthContextClient instance. */\n\treadonly client: BasicAuthContextClient;\n\n\t/**\n\t * Handle a 401 response from the backend in a server context.\n\t *\n\t * If the request path falls inside a configured zone, returns a\n\t * redirect instruction. Otherwise returns `null`.\n\t */\n\thandleUnauthorized(\n\t\tcontext: ServerRequestContext,\n\t): ServerRedirectInstruction | null;\n\n\t/**\n\t * Build the login URL for a specific path.\n\t *\n\t * Returns the login URL for the zone containing the path,\n\t * or `null` if the path isn't in any zone.\n\t */\n\tloginUrlForPath(path: string): string | null;\n\n\t/**\n\t * Build the logout URL for a specific path.\n\t *\n\t * Returns the logout URL for the zone containing the path,\n\t * or `null` if the path isn't in any zone.\n\t */\n\tlogoutUrlForPath(path: string): string | null;\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Create a server-host helper for basic-auth zone management.\n *\n * @example\n * ```ts\n * const helper = createBasicAuthServerHelper({\n *   config: { baseUrl: \"https://auth.example.com\", zones: [{ zonePrefix: \"/api\" }] },\n * });\n *\n * // In a server request handler:\n * const redirect = helper.handleUnauthorized({ path: \"/api/data\" });\n * if (redirect) {\n *   return Response.redirect(redirect.destination, redirect.statusCode);\n * }\n * ```\n */\nexport function createBasicAuthServerHelper(\n\toptions: CreateBasicAuthServerHelperOptions,\n): BasicAuthServerHelper {\n\tconst client = new BasicAuthContextClient(options.config);\n\n\treturn {\n\t\tclient,\n\n\t\thandleUnauthorized(\n\t\t\tcontext: ServerRequestContext,\n\t\t): ServerRedirectInstruction | null {\n\t\t\tconst result: AuthGuardResult<null> = client.handleUnauthorized(\n\t\t\t\tcontext.path,\n\t\t\t\t401,\n\t\t\t);\n\n\t\t\tif (result.kind === AuthGuardResultKind.Redirect) {\n\t\t\t\treturn {\n\t\t\t\t\tstatusCode: result.status,\n\t\t\t\t\tdestination: result.location,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\treturn null;\n\t\t},\n\n\t\tloginUrlForPath(path: string): string | null {\n\t\t\tconst zone = client.zoneForPath(path);\n\t\t\tif (!zone) return null;\n\t\t\treturn client.loginUrl(zone, path);\n\t\t},\n\n\t\tlogoutUrlForPath(path: string): string | null {\n\t\t\tconst zone = client.zoneForPath(path);\n\t\t\tif (!zone) return null;\n\t\t\treturn client.logoutUrl(zone);\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA4GA,SAAgB,4BACf,SACwB;CACxB,MAAM,SAAS,IAAI,uBAAuB,QAAQ,OAAO;AAEzD,QAAO;EACN;EAEA,mBACC,SACmC;GACnC,MAAM,SAAgC,OAAO,mBAC5C,QAAQ,MACR,IACA;AAED,OAAI,OAAO,SAAS,oBAAoB,SACvC,QAAO;IACN,YAAY,OAAO;IACnB,aAAa,OAAO;IACpB;AAGF,UAAO;;EAGR,gBAAgB,MAA6B;GAC5C,MAAM,OAAO,OAAO,YAAY,KAAK;AACrC,OAAI,CAAC,KAAM,QAAO;AAClB,UAAO,OAAO,SAAS,MAAM,KAAK;;EAGnC,iBAAiB,MAA6B;GAC7C,MAAM,OAAO,OAAO,YAAY,KAAK;AACrC,OAAI,CAAC,KAAM,QAAO;AAClB,UAAO,OAAO,UAAU,KAAK;;EAE9B"}

package/dist/types-2IoKrgnl.mjs

@@ -0,0 +1,20 @@
+//#region src/types.ts
+const BasicAuthBoundaryKind = {
+	Authenticated: "authenticated",
+	Challenge: "challenge",
+	Unauthorized: "unauthorized",
+	LogoutPoison: "logout_poison"
+};
+const AuthGuardResultKind = {
+	Ok: "ok",
+	Redirect: "redirect"
+};
+const AuthGuardRedirectStatus = {
+	Found: 302,
+	SeeOther: 303,
+	TemporaryRedirect: 307
+};
+//#endregion
+export { AuthGuardResultKind as n, BasicAuthBoundaryKind as r, AuthGuardRedirectStatus as t };
+
+//# sourceMappingURL=types-2IoKrgnl.mjs.map

package/dist/types-2IoKrgnl.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-2IoKrgnl.mjs","names":[],"sources":["../src/types.ts"],"sourcesContent":["// --- Basic Auth Context Client types ---\n\n/** Configuration for a single Basic Auth zone. */\nexport interface BasicAuthZoneConfig {\n\t/** URL path prefix for this zone (e.g. \"/basic\"). */\n\tzonePrefix: string;\n\t/** Login subpath relative to zone prefix (default: \"/login\"). */\n\tloginSubpath?: string;\n\t/** Logout subpath relative to zone prefix (default: \"/logout\"). */\n\tlogoutSubpath?: string;\n}\n\n/** Configuration for the Basic Auth Context Client. */\nexport interface BasicAuthContextClientConfig {\n\t/** Base URL of the SecurityDept server. */\n\tbaseUrl: string;\n\t/** One or more Basic Auth zones to manage. */\n\tzones: BasicAuthZoneConfig[];\n\t/** Name of the query parameter for post-auth redirect (default: \"post_auth_redirect_uri\"). */\n\tpostAuthRedirectParam?: string;\n}\n\nexport const BasicAuthBoundaryKind = {\n\tAuthenticated: \"authenticated\",\n\tChallenge: \"challenge\",\n\tUnauthorized: \"unauthorized\",\n\tLogoutPoison: \"logout_poison\",\n} as const;\n\nexport type BasicAuthBoundaryKind =\n\t(typeof BasicAuthBoundaryKind)[keyof typeof BasicAuthBoundaryKind];\n\nexport interface BasicAuthBoundaryObservation {\n\tstatus: number;\n\tchallengeHeader?: string | null;\n\trequestPath?: string;\n}\n\nexport const AuthGuardResultKind = {\n\tOk: \"ok\",\n\tRedirect: \"redirect\",\n} as const;\n\nexport type AuthGuardResultKind =\n\t(typeof AuthGuardResultKind)[keyof typeof AuthGuardResultKind];\n\nexport const AuthGuardRedirectStatus = {\n\tFound: 302,\n\tSeeOther: 303,\n\tTemporaryRedirect: 307,\n} as const;\n\nexport type AuthGuardRedirectStatus =\n\t(typeof AuthGuardRedirectStatus)[keyof typeof AuthGuardRedirectStatus];\n\n/** Redirect instruction — framework-neutral result. */\nexport type AuthGuardResult<T> =\n\t| { kind: typeof AuthGuardResultKind.Ok; value: T }\n\t| {\n\t\t\tkind: typeof AuthGuardResultKind.Redirect;\n\t\t\tstatus: AuthGuardRedirectStatus;\n\t\t\tlocation: string;\n\t  };\n\n/** Resolved zone with computed paths. */\nexport interface ResolvedBasicAuthZone {\n\tzonePrefix: string;\n\tloginPath: string;\n\tlogoutPath: string;\n}\n"],"mappings":";AAsBA,MAAa,wBAAwB;CACpC,eAAe;CACf,WAAW;CACX,cAAc;CACd,cAAc;CACd;AAWD,MAAa,sBAAsB;CAClC,IAAI;CACJ,UAAU;CACV;AAKD,MAAa,0BAA0B;CACtC,OAAO;CACP,UAAU;CACV,mBAAmB;CACnB"}

package/dist/web/index.d.mts

@@ -0,0 +1,45 @@
+import { i as AuthGuardResult, t as BasicAuthContextClient } from "../client-DU98lpa_.mjs";
+
+//#region src/web/login-redirect.d.ts
+/**
+ * Options for {@link loginWithRedirect}.
+ */
+interface LoginWithRedirectOptions {
+  /**
+   * The current request path to resolve the target zone.
+   *
+   * When omitted, `window.location.pathname` is used.
+   */
+  currentPath?: string;
+  /**
+   * Where to redirect the user after successful authentication.
+   *
+   * When omitted, `window.location.href` is used as the return URI.
+   */
+  postAuthRedirectUri?: string;
+}
+/**
+ * One-shot browser redirect to the zone login endpoint for the given path.
+ *
+ * 1. Resolves the zone for the current (or specified) path.
+ * 2. Navigates the current window to the zone's login URL with a
+ *    post-auth redirect parameter.
+ *
+ * Returns `false` if no zone matches the path (no redirect performed).
+ * Returns `true` if the redirect was initiated.
+ *
+ * This is the recommended browser entry point for initiating basic-auth
+ * login. It is intentionally a standalone function (not a method on
+ * `BasicAuthContextClient`) to keep browser-specific side-effects out
+ * of the host-neutral client contract.
+ */
+declare function loginWithRedirect(client: BasicAuthContextClient, options?: LoginWithRedirectOptions): boolean;
+//#endregion
+//#region src/web/redirect.d.ts
+/**
+ * Perform a browser redirect for an `AuthGuardResult` that requires redirection.
+ */
+declare function performRedirect(result: AuthGuardResult<unknown>): void;
+//#endregion
+export { type LoginWithRedirectOptions, loginWithRedirect, performRedirect };
+//# sourceMappingURL=index.d.mts.map

package/dist/web/index.mjs

@@ -0,0 +1,37 @@
+import { n as AuthGuardResultKind } from "../types-2IoKrgnl.mjs";
+//#region src/web/login-redirect.ts
+/**
+* One-shot browser redirect to the zone login endpoint for the given path.
+*
+* 1. Resolves the zone for the current (or specified) path.
+* 2. Navigates the current window to the zone's login URL with a
+*    post-auth redirect parameter.
+*
+* Returns `false` if no zone matches the path (no redirect performed).
+* Returns `true` if the redirect was initiated.
+*
+* This is the recommended browser entry point for initiating basic-auth
+* login. It is intentionally a standalone function (not a method on
+* `BasicAuthContextClient`) to keep browser-specific side-effects out
+* of the host-neutral client contract.
+*/
+function loginWithRedirect(client, options = {}) {
+	const currentPath = options.currentPath ?? window.location.pathname;
+	const zone = client.zoneForPath(currentPath);
+	if (!zone) return false;
+	const postAuthRedirectUri = options.postAuthRedirectUri ?? window.location.href;
+	window.location.href = client.loginUrl(zone, postAuthRedirectUri);
+	return true;
+}
+//#endregion
+//#region src/web/redirect.ts
+/**
+* Perform a browser redirect for an `AuthGuardResult` that requires redirection.
+*/
+function performRedirect(result) {
+	if (result.kind === AuthGuardResultKind.Redirect) globalThis.location.href = result.location;
+}
+//#endregion
+export { loginWithRedirect, performRedirect };
+
+//# sourceMappingURL=index.mjs.map

package/dist/web/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/web/login-redirect.ts","../../src/web/redirect.ts"],"sourcesContent":["// Basic Auth Context Client — Browser login redirect convenience\n//\n// Provides a one-shot browser redirect to a zone's login page, matching the\n// convenience pattern established by session-context-client/web.\n//\n// Unlike session-context where there is a single login URL, basic-auth is\n// zone-based: the adopter must identify which zone to target. This helper\n// resolves the zone from a path and performs the redirect.\n//\n// Stability: provisional\n\nimport type { BasicAuthContextClient } from \"../client\";\n\n/**\n * Options for {@link loginWithRedirect}.\n */\nexport interface LoginWithRedirectOptions {\n\t/**\n\t * The current request path to resolve the target zone.\n\t *\n\t * When omitted, `window.location.pathname` is used.\n\t */\n\tcurrentPath?: string;\n\n\t/**\n\t * Where to redirect the user after successful authentication.\n\t *\n\t * When omitted, `window.location.href` is used as the return URI.\n\t */\n\tpostAuthRedirectUri?: string;\n}\n\n/**\n * One-shot browser redirect to the zone login endpoint for the given path.\n *\n * 1. Resolves the zone for the current (or specified) path.\n * 2. Navigates the current window to the zone's login URL with a\n *    post-auth redirect parameter.\n *\n * Returns `false` if no zone matches the path (no redirect performed).\n * Returns `true` if the redirect was initiated.\n *\n * This is the recommended browser entry point for initiating basic-auth\n * login. It is intentionally a standalone function (not a method on\n * `BasicAuthContextClient`) to keep browser-specific side-effects out\n * of the host-neutral client contract.\n */\nexport function loginWithRedirect(\n\tclient: BasicAuthContextClient,\n\toptions: LoginWithRedirectOptions = {},\n): boolean {\n\tconst currentPath = options.currentPath ?? window.location.pathname;\n\tconst zone = client.zoneForPath(currentPath);\n\tif (!zone) {\n\t\treturn false;\n\t}\n\n\tconst postAuthRedirectUri =\n\t\toptions.postAuthRedirectUri ?? window.location.href;\n\twindow.location.href = client.loginUrl(zone, postAuthRedirectUri);\n\treturn true;\n}\n","import type { AuthGuardResult } from \"../types\";\nimport { AuthGuardResultKind } from \"../types\";\n\n/**\n * Perform a browser redirect for an `AuthGuardResult` that requires redirection.\n */\nexport function performRedirect(result: AuthGuardResult<unknown>): void {\n\tif (result.kind === AuthGuardResultKind.Redirect) {\n\t\t// Accessing location via window to satisfy strict type checks.\n\t\t(globalThis as unknown as { location: { href: string } }).location.href =\n\t\t\tresult.location;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA+CA,SAAgB,kBACf,QACA,UAAoC,EAAE,EAC5B;CACV,MAAM,cAAc,QAAQ,eAAe,OAAO,SAAS;CAC3D,MAAM,OAAO,OAAO,YAAY,YAAY;AAC5C,KAAI,CAAC,KACJ,QAAO;CAGR,MAAM,sBACL,QAAQ,uBAAuB,OAAO,SAAS;AAChD,QAAO,SAAS,OAAO,OAAO,SAAS,MAAM,oBAAoB;AACjE,QAAO;;;;;;;ACtDR,SAAgB,gBAAgB,QAAwC;AACvE,KAAI,OAAO,SAAS,oBAAoB,SAEtC,YAAyD,SAAS,OAClE,OAAO"}

package/package.json

@@ -0,0 +1,33 @@
+{
+	"name": "@securitydept/basic-auth-context-client",
+	"version": "0.2.0-beta.1",
+	"type": "module",
+	"sideEffects": false,
+	"exports": {
+		".": {
+			"monorepo-tsc": "./src/index.ts",
+			"types": "./dist/index.d.mts",
+			"import": "./dist/index.mjs"
+		},
+		"./web": {
+			"monorepo-tsc": "./src/web/index.ts",
+			"types": "./dist/web/index.d.mts",
+			"import": "./dist/web/index.mjs"
+		},
+		"./server": {
+			"monorepo-tsc": "./src/server/index.ts",
+			"types": "./dist/server/index.d.mts",
+			"import": "./dist/server/index.mjs"
+		}
+	},
+	"files": [
+		"dist"
+	],
+	"scripts": {
+		"build": "tsdown",
+		"typecheck": "tsc -b"
+	},
+	"dependencies": {
+		"@securitydept/client": "workspace:*"
+	}
+}