@securitydept/basic-auth-context-client 0.2.0 → 0.3.0-beta.10

package/dist/index.mjs

@@ -1,3 +1,778 @@
-import { n as readBasicAuthBoundaryKind, r as BasicAuthContextClientConfigSchema, t as BasicAuthContextClient } from "./client-D_0eAARH.mjs";
-import { n as AuthGuardResultKind, r as BasicAuthBoundaryKind, t as AuthGuardRedirectStatus } from "./types-2IoKrgnl.mjs";
-export { AuthGuardRedirectStatus, AuthGuardResultKind, BasicAuthBoundaryKind, BasicAuthContextClient, BasicAuthContextClientConfigSchema, readBasicAuthBoundaryKind };
+import { ClientError, ClientErrorKind, ENVIRONMENT_TOKEN, INJECTOR_TOKEN, ResourceSnapshotUpdateKind, ResourceStatus, RouterNavigationIntent, RouterNavigationMode, SYMBOL_DISPOSE, SecuritydeptDestroyRef, SecuritydeptInjectionToken, SpanSharedAttributeName, UriReferenceString, createCancellationTokenSource, createLinkedCancellationToken, createOnceAsyncLockCallable, createSignal, defineInstrumentMethodDecorator, encodeUint8ArrayToBase64, injectDisposableStackFrom, mapResource, readonlySignal, reduceResourceSnapshot, resourceFromSnapshots, throwValidationClientError, validateTraitInput, withDisposableStack } from "@securitydept/client";
+import { RxEventSubject, RxStateSignal, commandResponseData, concatCommand, dispatchCommandLocallyToStream } from "@securitydept/client/rx";
+import { filter, from, lastValueFrom, take, takeUntil } from "rxjs";
+import { v7 } from "uuid";
+import { type } from "arktype";
+//#region src/authorization-header.ts
+function createBasicAuthorizationHeaderValue(options) {
+	if (options.username.includes(":")) throw new ClientError({
+		kind: ClientErrorKind.Configuration,
+		code: "basic_auth.authorization_header.username_contains_colon",
+		message: "A Basic authentication username cannot contain a colon.",
+		source: "basic_auth"
+	});
+	return `Basic ${encodeUint8ArrayToBase64(new TextEncoder().encode(`${options.username}:${options.password}`))}`;
+}
+//#endregion
+//#region src/error.ts
+const BasicAuthContextErrorCode = {
+	OperationFailed: "basic_auth.operation_failed",
+	InvalidConfig: "basic_auth.invalid_config",
+	ClientDisposed: "basic_auth.client_disposed",
+	RouterUnavailable: "basic_auth.router_unavailable",
+	ProbePathRequired: "basic_auth.probe_path_required",
+	ZoneNotFound: "basic_auth.zone_not_found",
+	ZoneRequired: "basic_auth.zone_required"
+};
+const BasicAuthContextSource = { BasicAuthContext: "basic-auth-context" };
+function clientErrorFromBasicAuthError(error, options) {
+	return ClientError.fromUnknown(error, {
+		code: BasicAuthContextErrorCode.OperationFailed,
+		message: "The Basic Auth operation failed unexpectedly",
+		source: BasicAuthContextSource.BasicAuthContext,
+		span: options.span
+	});
+}
+//#endregion
+//#region src/schemas.ts
+const BasicAuthZoneConfigSchema = type({
+	zonePrefix: "string > 0",
+	"loginSubpath?": "string"
+});
+const BasicAuthContextClientConfigSchema = type({
+	"id?": "string > 0",
+	baseUrl: "string > 0",
+	zones: BasicAuthZoneConfigSchema.array().atLeastLength(1),
+	"probePath?": "string > 0",
+	"autoStart?": "boolean",
+	"tracing?": {
+		"target?": "string > 0",
+		"prefix?": "string > 0"
+	}
+});
+//#endregion
+//#region src/tokens.ts
+const BASIC_AUTH_CONTEXT_CLIENT = new SecuritydeptInjectionToken("BASIC_AUTH_CONTEXT_CLIENT");
+const BASIC_AUTH_CONTEXT_CLIENT_CONFIG = new SecuritydeptInjectionToken("BASIC_AUTH_CONTEXT_CLIENT_CONFIG");
+//#endregion
+//#region src/types.ts
+const BasicAuthBoundaryKind = {
+	Authenticated: "authenticated",
+	Challenge: "challenge",
+	Unauthorized: "unauthorized"
+};
+const BasicAuthContextEventType = {
+	BoundaryRefreshStarted: "basic_auth.boundary.refresh.started",
+	BoundaryRefreshSucceeded: "basic_auth.boundary.refresh.succeeded",
+	BoundaryRefreshFailed: "basic_auth.boundary.refresh.failed",
+	/** These logout events describe local boundary-projection clearing only. */ LogoutStarted: "basic_auth.logout.started",
+	LogoutSucceeded: "basic_auth.logout.succeeded",
+	LogoutFailed: "basic_auth.logout.failed",
+	LoginRedirectStarted: "basic_auth.login.redirect.started",
+	LoginRedirectSucceeded: "basic_auth.login.redirect.succeeded",
+	LoginRedirectFailed: "basic_auth.login.redirect.failed"
+};
+const AuthGuardResultKind = {
+	Ok: "ok",
+	Redirect: "redirect"
+};
+const AuthGuardRedirectStatus = {
+	Found: 302,
+	SeeOther: 303,
+	TemporaryRedirect: 307
+};
+//#endregion
+//#region src/client.ts
+function toPrimitive(input, hint) {
+	if (typeof input !== "object" || input === null) return input;
+	var prim = input[Symbol.toPrimitive];
+	if (prim !== void 0) {
+		var res = prim.call(input, hint || "default");
+		if (typeof res !== "object") return res;
+		throw new TypeError("@@toPrimitive must return a primitive value.");
+	}
+	return (hint === "string" ? String : Number)(input);
+}
+function toPropertyKey(arg) {
+	var key = toPrimitive(arg, "string");
+	return typeof key === "symbol" ? key : String(key);
+}
+function checkInRHS(value) {
+	if (Object(value) !== value) throw TypeError("right-hand side of 'in' should be an object, got " + (value !== null ? typeof value : "null"));
+	return value;
+}
+function setFunctionName(fn, name, prefix) {
+	if (typeof name === "symbol") {
+		name = name.description;
+		name = name ? "[" + name + "]" : "";
+	}
+	try {
+		Object.defineProperty(fn, "name", {
+			configurable: true,
+			value: prefix ? prefix + " " + name : name
+		});
+	} catch (_) {}
+	return fn;
+}
+function _apply_decs_2311(targetClass, classDecs, memberDecs, classDecsHaveThis, instanceBrand, parentClass) {
+	var symbolMetadata = Symbol.metadata || Symbol.for("Symbol.metadata");
+	var defineProperty = Object.defineProperty;
+	var create = Object.create;
+	var metadata;
+	var existingNonFields = [create(null), create(null)];
+	var hasClassDecs = classDecs.length;
+	var _;
+	function createRunInitializers(initializers, useStaticThis, hasValue) {
+		return function(thisArg, value) {
+			if (useStaticThis) {
+				value = thisArg;
+				thisArg = targetClass;
+			}
+			for (var i = 0; i < initializers.length; i++) value = initializers[i].apply(thisArg, hasValue ? [value] : []);
+			return hasValue ? value : thisArg;
+		};
+	}
+	function assertCallable(fn, hint1, hint2, throwUndefined) {
+		if (typeof fn !== "function") {
+			if (throwUndefined || fn !== void 0) throw new TypeError(hint1 + " must " + (hint2 || "be") + " a function" + (throwUndefined ? "" : " or undefined"));
+		}
+		return fn;
+	}
+	function applyDec(Class, decInfo, decoratorsHaveThis, name, kind, initializers, ret, isStatic, isPrivate, isField, hasPrivateBrand) {
+		function assertInstanceIfPrivate(target) {
+			if (!hasPrivateBrand(target)) throw new TypeError("Attempted to access private element on non-instance");
+		}
+		var decs = [].concat(decInfo[0]);
+		var decVal = decInfo[3];
+		var isClass = !ret;
+		var isAccessor = kind === 1;
+		var isGetter = kind === 3;
+		var isSetter = kind === 4;
+		var isMethod = kind === 2;
+		function bindPropCall(name, useStaticThis, before) {
+			return function(_this, value) {
+				if (useStaticThis) {
+					value = _this;
+					_this = Class;
+				}
+				if (before) before(_this);
+				return desc[name].call(_this, value);
+			};
+		}
+		var desc1 = {};
+		var init = [];
+		var key = isGetter ? "get" : isSetter || isAccessor ? "set" : "value";
+		if (!isClass) {
+			if (isPrivate) {
+				if (isField || isAccessor) desc1 = {
+					get: setFunctionName(function() {
+						return decVal(this);
+					}, name, "get"),
+					set: function(value) {
+						decInfo[4](this, value);
+					}
+				};
+				else desc1[key] = decVal;
+				if (!isField) setFunctionName(desc1[key], name, isMethod ? "" : key);
+			} else if (!isField) desc1 = Object.getOwnPropertyDescriptor(Class, name);
+			if (!isField && !isPrivate) {
+				_ = existingNonFields[+isStatic][name];
+				if (_ && (_ ^ kind) !== 7) throw new Error("Decorating two elements with the same name (" + desc1[key].name + ") is not supported yet");
+				existingNonFields[+isStatic][name] = kind < 3 ? 1 : kind;
+			}
+		}
+		var newValue = Class;
+		for (var i = decs.length - 1; i >= 0; i -= decoratorsHaveThis ? 2 : 1) {
+			var dec = assertCallable(decs[i], "A decorator", "be", true);
+			var decThis = decoratorsHaveThis ? decs[i - 1] : void 0;
+			var decoratorFinishedRef = {};
+			var ctx = {
+				kind: [
+					"field",
+					"accessor",
+					"method",
+					"getter",
+					"setter",
+					"class"
+				][kind],
+				name,
+				metadata,
+				addInitializer: (function(decoratorFinishedRef, initializer) {
+					if (decoratorFinishedRef.v) throw new TypeError("attempted to call addInitializer after decoration was finished");
+					assertCallable(initializer, "An initializer", "be", true);
+					initializers.push(initializer);
+				}).bind(null, decoratorFinishedRef)
+			};
+			if (isClass) {
+				_ = dec.call(decThis, newValue, ctx);
+				decoratorFinishedRef.v = 1;
+				if (assertCallable(_, "class decorators", "return")) newValue = _;
+				continue;
+			}
+			ctx.static = isStatic;
+			ctx.private = isPrivate;
+			_ = ctx.access = { has: isPrivate ? hasPrivateBrand.bind() : function(target) {
+				return name in target;
+			} };
+			if (!isSetter) _.get = isPrivate ? isMethod ? function(_this) {
+				assertInstanceIfPrivate(_this);
+				return desc1.value;
+			} : bindPropCall("get", 0, assertInstanceIfPrivate) : function(target) {
+				return target[name];
+			};
+			if (!isMethod && !isGetter) _.set = isPrivate ? bindPropCall("set", 0, assertInstanceIfPrivate) : function(target, value) {
+				target[name] = value;
+			};
+			newValue = dec.call(decThis, isAccessor ? {
+				get: desc1.get,
+				set: desc1.set
+			} : desc1[key], ctx);
+			decoratorFinishedRef.v = 1;
+			if (isAccessor) {
+				if (typeof newValue === "object" && newValue) {
+					if (_ = assertCallable(newValue.get, "accessor.get")) desc1.get = _;
+					if (_ = assertCallable(newValue.set, "accessor.set")) desc1.set = _;
+					if (_ = assertCallable(newValue.init, "accessor.init")) init.unshift(_);
+				} else if (newValue !== void 0) throw new TypeError("accessor decorators must return an object with get, set, or init properties or undefined");
+			} else if (assertCallable(newValue, (isField ? "field" : "method") + " decorators", "return")) if (isField) init.unshift(newValue);
+			else desc1[key] = newValue;
+		}
+		if (kind < 2) ret.push(createRunInitializers(init, isStatic, 1), createRunInitializers(initializers, isStatic, 0));
+		if (!isField && !isClass) if (isPrivate) if (isAccessor) ret.splice(-1, 0, bindPropCall("get", isStatic), bindPropCall("set", isStatic));
+		else ret.push(isMethod ? desc1[key] : assertCallable.call.bind(desc1[key]));
+		else defineProperty(Class, name, desc1);
+		return newValue;
+	}
+	function applyMemberDecs() {
+		var ret = [];
+		var protoInitializers;
+		var staticInitializers;
+		var pushInitializers = function(initializers) {
+			if (initializers) ret.push(createRunInitializers(initializers));
+		};
+		var applyMemberDecsOfKind = function(isStatic, isField) {
+			for (var i = 0; i < memberDecs.length; i++) {
+				var decInfo = memberDecs[i];
+				var kind = decInfo[1];
+				var kindOnly = kind & 7;
+				if ((kind & 8) == isStatic && !kindOnly == isField) {
+					var name = decInfo[2];
+					var isPrivate = !!decInfo[3];
+					var decoratorsHaveThis = kind & 16;
+					applyDec(isStatic ? targetClass : targetClass.prototype, decInfo, decoratorsHaveThis, isPrivate ? "#" + name : toPropertyKey(name), kindOnly, kindOnly < 2 ? [] : isStatic ? staticInitializers = staticInitializers || [] : protoInitializers = protoInitializers || [], ret, !!isStatic, isPrivate, isField, isStatic && isPrivate ? function(_) {
+						return checkInRHS(_) === targetClass;
+					} : instanceBrand);
+				}
+			}
+		};
+		applyMemberDecsOfKind(8, 0);
+		applyMemberDecsOfKind(0, 0);
+		applyMemberDecsOfKind(8, 1);
+		applyMemberDecsOfKind(0, 1);
+		pushInitializers(protoInitializers);
+		pushInitializers(staticInitializers);
+		return ret;
+	}
+	function defineMetadata(Class) {
+		return defineProperty(Class, symbolMetadata, {
+			configurable: true,
+			enumerable: true,
+			value: metadata
+		});
+	}
+	if (parentClass !== void 0) metadata = parentClass[symbolMetadata];
+	metadata = create(metadata == null ? null : metadata);
+	_ = applyMemberDecs();
+	if (!hasClassDecs) defineMetadata(targetClass);
+	return {
+		e: _,
+		get c() {
+			var initializers = [];
+			return hasClassDecs && [defineMetadata(targetClass = applyDec(targetClass, [classDecs], classDecsHaveThis, targetClass.name, 5, initializers)), createRunInitializers(initializers, 1)];
+		}
+	};
+}
+let _dec;
+let _dec1;
+let _dec2;
+let _dec3;
+let _dec4;
+let _dec5;
+let _dec6;
+let _initProto;
+const DEFAULT_LOGIN_SUBPATH = "/login";
+const POST_AUTH_REDIRECT_PARAM = "post_auth_redirect_uri";
+const instrumentBasicAuthMethod = defineInstrumentMethodDecorator(({ factoryArgs: [operation] }) => function() {
+	return {
+		environment: this.environment,
+		span: this.span,
+		name: `${this.config.tracing.prefix}.${operation}`,
+		target: this.config.tracing.target,
+		traceAttributes: { operation },
+		clientErrorFromUnknown: (error, options) => clientErrorFromBasicAuthError(error, options)
+	};
+});
+function resolveZone(config) {
+	const prefix = config.zonePrefix.replace(/\/+$/, "");
+	return {
+		zonePrefix: prefix,
+		loginPath: prefix + (config.loginSubpath ?? DEFAULT_LOGIN_SUBPATH)
+	};
+}
+function readBasicAuthBoundaryKind(options) {
+	if (options.status < 400) return BasicAuthBoundaryKind.Authenticated;
+	if (options.challengeHeader) return BasicAuthBoundaryKind.Challenge;
+	return BasicAuthBoundaryKind.Unauthorized;
+}
+_dec = instrumentBasicAuthMethod("start"), _dec1 = withDisposableStack(0, true), _dec2 = instrumentBasicAuthMethod("refresh"), _dec3 = withDisposableStack(0, true), _dec4 = instrumentBasicAuthMethod("logout"), _dec5 = withDisposableStack(0, true), _dec6 = instrumentBasicAuthMethod("login.redirect");
+/**
+* Basic Auth Context Client.
+*
+* Owns zone-aware Basic Auth boundary observations and login navigation.
+* It does not manage browser credentials or principal data.
+*/ var BasicAuthContextClient = class BasicAuthContextClient {
+	static {
+		({e: [_initProto]} = _apply_decs_2311(this, [], [
+			[
+				_dec,
+				2,
+				"_start"
+			],
+			[
+				_dec1,
+				2,
+				"refresh"
+			],
+			[
+				_dec2,
+				2,
+				"_refresh"
+			],
+			[
+				_dec3,
+				2,
+				"logout"
+			],
+			[
+				_dec4,
+				2,
+				"_logout"
+			],
+			[
+				_dec5,
+				2,
+				"loginWithRedirect"
+			],
+			[
+				_dec6,
+				2,
+				"_loginWithRedirect"
+			]
+		]));
+	}
+	static defaultOptions = {
+		loginSubpath: DEFAULT_LOGIN_SUBPATH,
+		tracing: {
+			target: "basic-auth-context-client",
+			prefix: "basic_auth_context"
+		}
+	};
+	_environment;
+	_config;
+	_span;
+	_rootCancellation = (_initProto(this), createCancellationTokenSource());
+	_destroyed = RxStateSignal.fromInitialValue(false);
+	destroyed$ = from(this._destroyed).pipe(filter((value) => value), take(1));
+	_boundarySnapshotSignal = RxStateSignal.fromInitialValue({ status: ResourceStatus.Idle });
+	_operationSignals = {
+		startPending: createSignal(false),
+		refreshPending: createSignal(false),
+		logoutPending: createSignal(false),
+		loginRedirectPending: createSignal(false)
+	};
+	_eventSubject = new RxEventSubject();
+	_refreshCommandSubject = new RxEventSubject();
+	_refreshResponseSubject = new RxEventSubject();
+	_startOnce = createOnceAsyncLockCallable(async (cancellationToken, operationSpan) => {
+		cancellationToken.throwIfCancellationRequested();
+		this._operationSignals.startPending.set(true);
+		try {
+			return await this._dispatchRefresh(this._resolveRefreshOptions({}), cancellationToken, operationSpan);
+		} finally {
+			this._operationSignals.startPending.set(false);
+		}
+	});
+	id;
+	zones;
+	boundarySnapshot;
+	boundaryResource;
+	isAuthenticated;
+	operations;
+	events;
+	get environment() {
+		return this._environment;
+	}
+	get span() {
+		return this._span;
+	}
+	get config() {
+		return this._config;
+	}
+	static fromEnvironmentConfig(options) {
+		return new BasicAuthContextClient(options.config, options.environment);
+	}
+	static fromInjector(injector) {
+		const client = BasicAuthContextClient.fromEnvironmentConfig({
+			config: injector.get(BASIC_AUTH_CONTEXT_CLIENT_CONFIG),
+			environment: injector.get(ENVIRONMENT_TOKEN)
+		});
+		injector.get(SecuritydeptDestroyRef, null)?.onDestroy(() => client.dispose());
+		return client;
+	}
+	constructor(config, environment) {
+		validateTraitInput({
+			value: config,
+			bundledSchema: BasicAuthContextClientConfigSchema,
+			onInvalid: (failure) => throwValidationClientError({
+				code: BasicAuthContextErrorCode.InvalidConfig,
+				source: BasicAuthContextSource.BasicAuthContext,
+				messagePrefix: "BasicAuthContextClient could not validate config",
+				failure
+			})
+		});
+		const resolvedConfig = {
+			id: config.id ?? v7(),
+			baseUrl: (config.baseUrl ?? "").replace(/\/+$/, ""),
+			zones: (config.zones ?? []).map(resolveZone),
+			probePath: config.probePath,
+			tracing: {
+				target: config.tracing?.target ?? BasicAuthContextClient.defaultOptions.tracing.target,
+				prefix: config.tracing?.prefix ?? BasicAuthContextClient.defaultOptions.tracing.prefix
+			}
+		};
+		this._environment = environment;
+		this._config = resolvedConfig;
+		this.id = resolvedConfig.id;
+		this.zones = resolvedConfig.zones;
+		this._span = environment.span.fork({ attributes: {
+			[SpanSharedAttributeName.ClientName]: this.constructor.name,
+			[SpanSharedAttributeName.ClientId]: this.id
+		} });
+		this.boundarySnapshot = readonlySignal(this._boundarySnapshotSignal);
+		this.boundaryResource = resourceFromSnapshots(() => this._boundarySnapshotSignal.get());
+		this.isAuthenticated = mapResource(this.boundaryResource, (snapshot) => snapshot?.authenticated === true);
+		this.operations = {
+			startPending: readonlySignal(this._operationSignals.startPending),
+			refreshPending: readonlySignal(this._operationSignals.refreshPending),
+			logoutPending: readonlySignal(this._operationSignals.logoutPending),
+			loginRedirectPending: readonlySignal(this._operationSignals.loginRedirectPending)
+		};
+		this.events = this._eventSubject;
+		this.destroyed$.subscribe(() => {
+			this._rootCancellation.cancel(new ClientError({
+				kind: ClientErrorKind.Cancelled,
+				code: BasicAuthContextErrorCode.ClientDisposed,
+				message: "BasicAuthContextClient has been disposed.",
+				source: BasicAuthContextSource.BasicAuthContext
+			}));
+			this.isAuthenticated.dispose();
+			this.boundaryResource.dispose();
+		});
+		from(this._refreshCommandSubject).pipe(takeUntil(this.destroyed$), concatCommand((command) => this._executeRefresh(command.payload, command.cancellationToken, command.operationSpan))).subscribe(this._refreshResponseSubject);
+		if (config.autoStart === true) this.start().catch(() => {});
+	}
+	async start() {
+		const cancellationToken = this._rootCancellation.token;
+		return await this._start(cancellationToken);
+	}
+	async _start(cancellationToken, operationSpan) {
+		return await this._startOnce(cancellationToken, operationSpan);
+	}
+	async refresh(options = {}) {
+		const disposableStack = injectDisposableStackFrom(options, true);
+		const cancellationToken = createLinkedCancellationToken(this._rootCancellation.token, options.cancellationToken);
+		disposableStack?.use(cancellationToken);
+		return await this._refresh(options, cancellationToken);
+	}
+	async _refresh(options, cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		return await this._dispatchRefresh(this._resolveRefreshOptions(options), cancellationToken, operationSpan);
+	}
+	/**
+	* Clears only this client's in-memory Basic Auth boundary projection.
+	*
+	* Browsers own HTTP Basic credentials. This method cannot revoke or clear
+	* those credentials, and a later probe may observe an authenticated state
+	* again when the browser continues sending them.
+	*/ async logout(options = {}) {
+		const disposableStack = injectDisposableStackFrom(options, true);
+		const cancellationToken = createLinkedCancellationToken(this._rootCancellation.token, options.cancellationToken);
+		disposableStack?.use(cancellationToken);
+		return await this._logout(options, cancellationToken);
+	}
+	async _logout(_options, cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		this._operationSignals.logoutPending.set(true);
+		this._emitEvent({
+			type: BasicAuthContextEventType.LogoutStarted,
+			snapshot: this._readCurrentSnapshot()
+		});
+		try {
+			cancellationToken.throwIfCancellationRequested();
+			this._boundarySnapshotSignal.set({
+				status: ResourceStatus.Resolved,
+				value: null
+			});
+			operationSpan?.setTraceAttributes({ localProjectionCleared: true });
+			this._emitEvent({
+				type: BasicAuthContextEventType.LogoutSucceeded,
+				snapshot: null
+			});
+		} catch (error) {
+			const clientError = clientErrorFromBasicAuthError(error, { span: operationSpan?.span });
+			this._emitEvent({
+				type: BasicAuthContextEventType.LogoutFailed,
+				snapshot: this._readCurrentSnapshot(),
+				error: clientError
+			});
+			throw clientError;
+		} finally {
+			this._operationSignals.logoutPending.set(false);
+		}
+	}
+	async loginWithRedirect(options) {
+		const disposableStack = injectDisposableStackFrom(options, true);
+		const cancellationToken = createLinkedCancellationToken(this._rootCancellation.token, options.cancellationToken);
+		disposableStack?.use(cancellationToken);
+		await this._loginWithRedirect(options, cancellationToken);
+	}
+	async _loginWithRedirect(options, cancellationToken, _operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		const router = this._environment.router;
+		if (!router) throw new ClientError({
+			kind: ClientErrorKind.Configuration,
+			code: BasicAuthContextErrorCode.RouterUnavailable,
+			message: "loginWithRedirect() requires environment.router.",
+			source: BasicAuthContextSource.BasicAuthContext
+		});
+		const zone = this._resolveZoneForAction(options, "login redirect");
+		const postAuthRedirectUri = options.postAuthRedirectUri ?? options.currentPath;
+		this._operationSignals.loginRedirectPending.set(true);
+		this._emitEvent({
+			type: BasicAuthContextEventType.LoginRedirectStarted,
+			zone
+		});
+		try {
+			await router.navigate({
+				url: UriReferenceString.parse(this.loginUrl(zone, postAuthRedirectUri)),
+				intent: RouterNavigationIntent.AuthRedirect,
+				mode: RouterNavigationMode.External
+			});
+			cancellationToken.throwIfCancellationRequested();
+			this._emitEvent({
+				type: BasicAuthContextEventType.LoginRedirectSucceeded,
+				zone
+			});
+		} catch (error) {
+			const clientError = clientErrorFromBasicAuthError(error, { span: _operationSpan?.span });
+			this._emitEvent({
+				type: BasicAuthContextEventType.LoginRedirectFailed,
+				zone,
+				error: clientError
+			});
+			throw clientError;
+		} finally {
+			this._operationSignals.loginRedirectPending.set(false);
+		}
+	}
+	/** Find the zone that contains the given path. */ zoneForPath(path) {
+		let matchedZone;
+		for (const zone of this.zones) {
+			if (!(path === zone.zonePrefix || path.startsWith(`${zone.zonePrefix}/`))) continue;
+			if (!matchedZone || zone.zonePrefix.length > matchedZone.zonePrefix.length) matchedZone = zone;
+		}
+		return matchedZone;
+	}
+	zoneForPrefix(zonePrefix) {
+		return this.zones.find((zone) => zone.zonePrefix === zonePrefix);
+	}
+	/** Check whether a path falls inside any configured zone. */ isInZone(path) {
+		return this.zoneForPath(path) !== void 0;
+	}
+	/** Build the full login URL for a zone, optionally with a post-auth redirect. */ loginUrl(zone, postAuthRedirectUri) {
+		const base = this._config.baseUrl + zone.loginPath;
+		if (postAuthRedirectUri) return `${base}?${new URLSearchParams({ [POST_AUTH_REDIRECT_PARAM]: postAuthRedirectUri }).toString()}`;
+		return base;
+	}
+	loginUrlForZonePrefix(zonePrefix, postAuthRedirectUri) {
+		const zone = this.zoneForPrefix(zonePrefix);
+		return zone ? this.loginUrl(zone, postAuthRedirectUri) : null;
+	}
+	/**
+	* Handle a 401 response: if the current path is inside a zone,
+	* return a redirect instruction to the zone's login URL.
+	*/ handleUnauthorized(currentPath, responseStatus) {
+		if (responseStatus !== 401) return {
+			kind: AuthGuardResultKind.Ok,
+			value: null
+		};
+		const zone = this.zoneForPath(currentPath);
+		if (!zone) return {
+			kind: AuthGuardResultKind.Ok,
+			value: null
+		};
+		return {
+			kind: AuthGuardResultKind.Redirect,
+			status: AuthGuardRedirectStatus.Found,
+			location: this.loginUrl(zone, currentPath)
+		};
+	}
+	dispose() {
+		this._destroyed.set(true);
+		this._eventSubject.complete();
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+	_resolveRefreshOptions(options) {
+		const path = options.path ?? this._config.probePath;
+		if (!path) throw new ClientError({
+			kind: ClientErrorKind.Configuration,
+			code: BasicAuthContextErrorCode.ProbePathRequired,
+			message: "BasicAuthContextClient.refresh() requires options.path or config.probePath.",
+			source: BasicAuthContextSource.BasicAuthContext
+		});
+		return { path };
+	}
+	_resolveZoneForAction(options, action) {
+		if (options.zonePrefix) {
+			const zone = this.zoneForPrefix(options.zonePrefix);
+			if (zone) return zone;
+			throw new ClientError({
+				kind: ClientErrorKind.Configuration,
+				code: BasicAuthContextErrorCode.ZoneNotFound,
+				message: `BasicAuthContextClient ${action} could not find zone "${options.zonePrefix}".`,
+				source: BasicAuthContextSource.BasicAuthContext
+			});
+		}
+		const zone = typeof options.currentPath === "string" ? this.zoneForPath(options.currentPath) : void 0;
+		if (zone) return zone;
+		throw new ClientError({
+			kind: ClientErrorKind.Configuration,
+			code: BasicAuthContextErrorCode.ZoneRequired,
+			message: `BasicAuthContextClient ${action} requires options.currentPath inside a configured zone or options.zonePrefix.`,
+			source: BasicAuthContextSource.BasicAuthContext
+		});
+	}
+	async _dispatchRefresh(payload, cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		const snapshot = await lastValueFrom(dispatchCommandLocallyToStream({
+			payload,
+			requestStream: this._refreshCommandSubject,
+			responseStream: this._refreshResponseSubject,
+			createCommandExtra: () => ({
+				cancellationToken,
+				operationSpan
+			})
+		}).pipe(commandResponseData()));
+		cancellationToken.throwIfCancellationRequested();
+		return snapshot;
+	}
+	async _executeRefresh(options, cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		this._operationSignals.refreshPending.set(true);
+		const previous = this._boundarySnapshotSignal.get();
+		const loadingSnapshot = reduceResourceSnapshot(previous, { kind: ResourceSnapshotUpdateKind.Load });
+		this._boundarySnapshotSignal.set(loadingSnapshot);
+		this._emitEvent({
+			type: BasicAuthContextEventType.BoundaryRefreshStarted,
+			snapshot: this._readCurrentSnapshot()
+		});
+		try {
+			const response = await this._environment.transport.execute({
+				url: this._config.baseUrl + options.path,
+				method: "GET",
+				headers: { accept: "application/json" },
+				cancellationToken
+			});
+			if (response.status >= 400 && response.status !== 401 && response.status !== 403) throw ClientError.fromHttpResponse({
+				status: response.status,
+				body: response.body
+			});
+			cancellationToken.throwIfCancellationRequested();
+			const snapshot = this._snapshotFromResponse(options.path, response);
+			this._boundarySnapshotSignal.set(reduceResourceSnapshot(loadingSnapshot, {
+				kind: ResourceSnapshotUpdateKind.Resolve,
+				value: snapshot
+			}));
+			operationSpan?.setTraceAttributes({
+				authenticated: snapshot.authenticated,
+				boundaryKind: snapshot.boundaryKind
+			});
+			this._emitEvent({
+				type: BasicAuthContextEventType.BoundaryRefreshSucceeded,
+				snapshot,
+				zone: snapshot.zone
+			});
+			return snapshot;
+		} catch (error) {
+			const clientError = clientErrorFromBasicAuthError(error, { span: operationSpan?.span });
+			this._boundarySnapshotSignal.set(reduceResourceSnapshot(loadingSnapshot, {
+				kind: ResourceSnapshotUpdateKind.Fail,
+				error: clientError
+			}));
+			this._emitEvent({
+				type: BasicAuthContextEventType.BoundaryRefreshFailed,
+				snapshot: this._readCurrentSnapshot(),
+				error: clientError
+			});
+			throw clientError;
+		} finally {
+			this._operationSignals.refreshPending.set(false);
+		}
+	}
+	_snapshotFromResponse(path, response) {
+		const challengeHeader = response.headers["WWW-Authenticate"] ?? response.headers["www-authenticate"] ?? null;
+		const zone = this.zoneForPath(path);
+		const boundaryKind = readBasicAuthBoundaryKind({
+			status: response.status,
+			challengeHeader,
+			requestPath: path
+		});
+		return {
+			authenticated: boundaryKind === BasicAuthBoundaryKind.Authenticated,
+			boundaryKind,
+			status: response.status,
+			path,
+			challengeHeader,
+			zone
+		};
+	}
+	_readCurrentSnapshot() {
+		const snapshot = this._boundarySnapshotSignal.get();
+		return snapshot.status === ResourceStatus.Reloading || snapshot.status === ResourceStatus.Resolved || snapshot.status === ResourceStatus.Error ? snapshot.value : null;
+	}
+	_emitEvent(input) {
+		this._eventSubject.next({
+			...input,
+			at: this._environment.time.now(),
+			client: { id: this.id }
+		});
+	}
+};
+//#endregion
+//#region src/providers.ts
+function provideBasicAuthContext(options) {
+	return [{
+		provide: BASIC_AUTH_CONTEXT_CLIENT_CONFIG,
+		useValue: options.config
+	}, {
+		provide: BASIC_AUTH_CONTEXT_CLIENT,
+		useFactory: (injector) => BasicAuthContextClient.fromInjector(injector),
+		deps: [INJECTOR_TOKEN]
+	}];
+}
+//#endregion
+export { AuthGuardRedirectStatus, AuthGuardResultKind, BASIC_AUTH_CONTEXT_CLIENT, BASIC_AUTH_CONTEXT_CLIENT_CONFIG, BasicAuthBoundaryKind, BasicAuthContextClient, BasicAuthContextClientConfigSchema, BasicAuthContextErrorCode, BasicAuthContextEventType, BasicAuthContextSource, createBasicAuthorizationHeaderValue, provideBasicAuthContext, readBasicAuthBoundaryKind };
+
+//# sourceMappingURL=index.mjs.map