@securitydept/basic-auth-context-client 0.3.0-beta.6 → 0.3.0-beta.8

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { CancellationTokenOptions, DisposableTrait, ErrorSummary, EventStreamTrait, FoundationEnvironment, ReadableSignalTrait, ResourceSnapshot, ResourceTrait, SYMBOL_DISPOSE, SecuritydeptInjectorTrait, SecuritydeptProvider, SpanTrait } from "@securitydept/client";
+import { CancellationTokenOptions, ClientError, DisposableTrait, EventStreamTrait, FoundationEnvironment, ReadableSignalTrait, ResourceSnapshot, ResourceTrait, SYMBOL_DISPOSE, SecuritydeptInjectorTrait, SecuritydeptProvider, SpanTrait } from "@securitydept/client";
 //#region src/authorization-header.d.ts
 interface CreateBasicAuthorizationHeaderValueOptions {
   readonly username: string;
@@ -7,17 +7,6 @@ interface CreateBasicAuthorizationHeaderValueOptions {
 declare function createBasicAuthorizationHeaderValue(options: CreateBasicAuthorizationHeaderValueOptions): string;
 //#endregion
 //#region src/types.d.ts
-/** Configuration for a single Basic Auth zone. */
-declare const BasicAuthContextErrorCode: {
-  readonly OperationFailed: "basic_auth.operation_failed";
-  readonly InvalidConfig: "basic_auth.invalid_config";
-  readonly ClientDisposed: "basic_auth.client_disposed";
-  readonly RouterUnavailable: "basic_auth.router_unavailable";
-  readonly ProbePathRequired: "basic_auth.probe_path_required";
-  readonly ZoneNotFound: "basic_auth.zone_not_found";
-  readonly ZoneRequired: "basic_auth.zone_required";
-};
-type BasicAuthContextErrorCode = (typeof BasicAuthContextErrorCode)[keyof typeof BasicAuthContextErrorCode];
 interface BasicAuthZoneConfig {
   /** URL path prefix for this zone (e.g. "/basic"). */
   zonePrefix: string;
@@ -66,10 +55,6 @@ interface BasicAuthBoundarySnapshot {
   challengeHeader: string | null;
   zone?: ResolvedBasicAuthZone;
 }
-declare const BasicAuthContextSource: {
-  readonly BasicAuthContext: "basic-auth-context";
-};
-type BasicAuthContextSource = (typeof BasicAuthContextSource)[keyof typeof BasicAuthContextSource];
 declare const BasicAuthContextEventType: {
   readonly BoundaryRefreshStarted: "basic_auth.boundary.refresh.started";
   readonly BoundaryRefreshSucceeded: "basic_auth.boundary.refresh.succeeded";
@@ -83,16 +68,42 @@ declare const BasicAuthContextEventType: {
   readonly LoginRedirectFailed: "basic_auth.login.redirect.failed";
 };
 type BasicAuthContextEventType = (typeof BasicAuthContextEventType)[keyof typeof BasicAuthContextEventType];
-interface BasicAuthContextEvent {
-  type: BasicAuthContextEventType;
-  at: number;
-  client: {
-    id: string;
+interface BasicAuthContextEventBase {
+  readonly at: number;
+  readonly client: {
+    readonly id: string;
   };
-  snapshot?: BasicAuthBoundarySnapshot | null;
-  zone?: ResolvedBasicAuthZone;
-  errorSummary?: ErrorSummary;
 }
+type BasicAuthContextEventData = {
+  readonly type: typeof BasicAuthContextEventType.BoundaryRefreshStarted;
+  readonly snapshot: BasicAuthBoundarySnapshot | null;
+} | {
+  readonly type: typeof BasicAuthContextEventType.BoundaryRefreshSucceeded;
+  readonly snapshot: BasicAuthBoundarySnapshot;
+  readonly zone?: ResolvedBasicAuthZone;
+} | {
+  readonly type: typeof BasicAuthContextEventType.BoundaryRefreshFailed;
+  readonly snapshot: BasicAuthBoundarySnapshot | null;
+  readonly error: ClientError;
+} | {
+  readonly type: typeof BasicAuthContextEventType.LogoutStarted;
+  readonly snapshot: BasicAuthBoundarySnapshot | null;
+} | {
+  readonly type: typeof BasicAuthContextEventType.LogoutSucceeded;
+  readonly snapshot: null;
+} | {
+  readonly type: typeof BasicAuthContextEventType.LogoutFailed;
+  readonly snapshot: BasicAuthBoundarySnapshot | null;
+  readonly error: ClientError;
+} | {
+  readonly type: typeof BasicAuthContextEventType.LoginRedirectStarted | typeof BasicAuthContextEventType.LoginRedirectSucceeded;
+  readonly zone: ResolvedBasicAuthZone;
+} | {
+  readonly type: typeof BasicAuthContextEventType.LoginRedirectFailed;
+  readonly zone: ResolvedBasicAuthZone;
+  readonly error: ClientError;
+};
+type BasicAuthContextEvent = BasicAuthContextEventBase & BasicAuthContextEventData;
 interface BasicAuthContextOperationSignals {
   readonly startPending: ReadableSignalTrait<boolean>;
   readonly refreshPending: ReadableSignalTrait<boolean>;
@@ -228,6 +239,22 @@ declare class BasicAuthContextClient implements DisposableTrait {
   private _emitEvent;
 }
 //#endregion
+//#region src/error.d.ts
+declare const BasicAuthContextErrorCode: {
+  readonly OperationFailed: "basic_auth.operation_failed";
+  readonly InvalidConfig: "basic_auth.invalid_config";
+  readonly ClientDisposed: "basic_auth.client_disposed";
+  readonly RouterUnavailable: "basic_auth.router_unavailable";
+  readonly ProbePathRequired: "basic_auth.probe_path_required";
+  readonly ZoneNotFound: "basic_auth.zone_not_found";
+  readonly ZoneRequired: "basic_auth.zone_required";
+};
+type BasicAuthContextErrorCode = (typeof BasicAuthContextErrorCode)[keyof typeof BasicAuthContextErrorCode];
+declare const BasicAuthContextSource: {
+  readonly BasicAuthContext: "basic-auth-context";
+};
+type BasicAuthContextSource = (typeof BasicAuthContextSource)[keyof typeof BasicAuthContextSource];
+//#endregion
 //#region src/providers.d.ts
 interface ProvideBasicAuthContextOptions {
   readonly config: BasicAuthContextClientConfig;

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { ClientError, ClientErrorKind, ENVIRONMENT_TOKEN, INJECTOR_TOKEN, ResourceSnapshotUpdateKind, ResourceStatus, RouterNavigationIntent, RouterNavigationMode, SYMBOL_DISPOSE, SecuritydeptDestroyRef, SecuritydeptInjectionToken, UriReferenceString, createCancellationTokenSource, createLinkedCancellationToken, createOnceAsyncLockCallable, createSignal, defineInstrumentMethodDecorator, describeError, encodeUint8ArrayToBase64, injectDisposableStackFrom, mapResource, readonlySignal, reduceResourceSnapshot, resourceFromSnapshots, throwValidationClientError, validateTraitInput, withDisposableStack } from "@securitydept/client";
-import { RxEventReplaySubject, RxEventSubject, RxStateSignal, commandResponseData, concatCommand, dispatchCommandLocallyToStream } from "@securitydept/client/rx";
+import { ClientError, ClientErrorKind, ENVIRONMENT_TOKEN, INJECTOR_TOKEN, ResourceSnapshotUpdateKind, ResourceStatus, RouterNavigationIntent, RouterNavigationMode, SYMBOL_DISPOSE, SecuritydeptDestroyRef, SecuritydeptInjectionToken, SpanSharedAttributeName, UriReferenceString, createCancellationTokenSource, createLinkedCancellationToken, createOnceAsyncLockCallable, createSignal, defineInstrumentMethodDecorator, encodeUint8ArrayToBase64, injectDisposableStackFrom, mapResource, readonlySignal, reduceResourceSnapshot, resourceFromSnapshots, throwValidationClientError, validateTraitInput, withDisposableStack } from "@securitydept/client";
+import { RxEventSubject, RxStateSignal, commandResponseData, concatCommand, dispatchCommandLocallyToStream } from "@securitydept/client/rx";
 import { filter, from, lastValueFrom, take, takeUntil } from "rxjs";
 import { v7 } from "uuid";
 import { type } from "arktype";
@@ -14,6 +14,26 @@ function createBasicAuthorizationHeaderValue(options) {
 	return `Basic ${encodeUint8ArrayToBase64(new TextEncoder().encode(`${options.username}:${options.password}`))}`;
 }
 //#endregion
+//#region src/error.ts
+const BasicAuthContextErrorCode = {
+	OperationFailed: "basic_auth.operation_failed",
+	InvalidConfig: "basic_auth.invalid_config",
+	ClientDisposed: "basic_auth.client_disposed",
+	RouterUnavailable: "basic_auth.router_unavailable",
+	ProbePathRequired: "basic_auth.probe_path_required",
+	ZoneNotFound: "basic_auth.zone_not_found",
+	ZoneRequired: "basic_auth.zone_required"
+};
+const BasicAuthContextSource = { BasicAuthContext: "basic-auth-context" };
+function clientErrorFromBasicAuthError(error, options) {
+	return ClientError.fromUnknown(error, {
+		code: BasicAuthContextErrorCode.OperationFailed,
+		message: "The Basic Auth operation failed unexpectedly",
+		source: BasicAuthContextSource.BasicAuthContext,
+		span: options.span
+	});
+}
+//#endregion
 //#region src/schemas.ts
 const BasicAuthZoneConfigSchema = type({
 	zonePrefix: "string > 0",
@@ -36,21 +56,11 @@ const BASIC_AUTH_CONTEXT_CLIENT = new SecuritydeptInjectionToken("BASIC_AUTH_CON
 const BASIC_AUTH_CONTEXT_CLIENT_CONFIG = new SecuritydeptInjectionToken("BASIC_AUTH_CONTEXT_CLIENT_CONFIG");
 //#endregion
 //#region src/types.ts
-/** Configuration for a single Basic Auth zone. */ const BasicAuthContextErrorCode = {
-	OperationFailed: "basic_auth.operation_failed",
-	InvalidConfig: "basic_auth.invalid_config",
-	ClientDisposed: "basic_auth.client_disposed",
-	RouterUnavailable: "basic_auth.router_unavailable",
-	ProbePathRequired: "basic_auth.probe_path_required",
-	ZoneNotFound: "basic_auth.zone_not_found",
-	ZoneRequired: "basic_auth.zone_required"
-};
 const BasicAuthBoundaryKind = {
 	Authenticated: "authenticated",
 	Challenge: "challenge",
 	Unauthorized: "unauthorized"
 };
-const BasicAuthContextSource = { BasicAuthContext: "basic-auth-context" };
 const BasicAuthContextEventType = {
 	BoundaryRefreshStarted: "basic_auth.boundary.refresh.started",
 	BoundaryRefreshSucceeded: "basic_auth.boundary.refresh.succeeded",
@@ -298,12 +308,8 @@ const instrumentBasicAuthMethod = defineInstrumentMethodDecorator(({ factoryArgs
 		span: this.span,
 		name: `${this.config.tracing.prefix}.${operation}`,
 		target: this.config.tracing.target,
-		fields: { operation },
-		normalizeError: (error) => ClientError.fromUnknown(error, {
-			code: BasicAuthContextErrorCode.OperationFailed,
-			message: "The Basic Auth operation failed unexpectedly",
-			source: BasicAuthContextSource.BasicAuthContext
-		})
+		traceAttributes: { operation },
+		clientErrorFromUnknown: (error, options) => clientErrorFromBasicAuthError(error, options)
 	};
 });
 function resolveZone(config) {
@@ -384,7 +390,7 @@ _dec = instrumentBasicAuthMethod("start"), _dec1 = withDisposableStack(0, true),
 		logoutPending: createSignal(false),
 		loginRedirectPending: createSignal(false)
 	};
-	_eventSubject = new RxEventReplaySubject(100);
+	_eventSubject = new RxEventSubject();
 	_refreshCommandSubject = new RxEventSubject();
 	_refreshResponseSubject = new RxEventSubject();
 	_startOnce = createOnceAsyncLockCallable(async (cancellationToken, operationSpan) => {
@@ -449,8 +455,8 @@ _dec = instrumentBasicAuthMethod("start"), _dec1 = withDisposableStack(0, true),
 		this.id = resolvedConfig.id;
 		this.zones = resolvedConfig.zones;
 		this._span = environment.span.fork({ attributes: {
-			clientName: this.constructor.name,
-			id: this.id
+			[SpanSharedAttributeName.ClientName]: this.constructor.name,
+			[SpanSharedAttributeName.ClientId]: this.id
 		} });
 		this.boundarySnapshot = readonlySignal(this._boundarySnapshotSignal);
 		this.boundaryResource = resourceFromSnapshots(() => this._boundarySnapshotSignal.get());
@@ -517,18 +523,19 @@ _dec = instrumentBasicAuthMethod("start"), _dec1 = withDisposableStack(0, true),
 				status: ResourceStatus.Resolved,
 				value: null
 			});
-			operationSpan?.setAttributes({ localProjectionCleared: true });
+			operationSpan?.setTraceAttributes({ localProjectionCleared: true });
 			this._emitEvent({
 				type: BasicAuthContextEventType.LogoutSucceeded,
 				snapshot: null
 			});
 		} catch (error) {
+			const clientError = clientErrorFromBasicAuthError(error, { span: operationSpan?.span });
 			this._emitEvent({
 				type: BasicAuthContextEventType.LogoutFailed,
 				snapshot: this._readCurrentSnapshot(),
-				errorSummary: describeError(error)
+				error: clientError
 			});
-			throw error;
+			throw clientError;
 		} finally {
 			this._operationSignals.logoutPending.set(false);
 		}
@@ -567,12 +574,13 @@ _dec = instrumentBasicAuthMethod("start"), _dec1 = withDisposableStack(0, true),
 				zone
 			});
 		} catch (error) {
+			const clientError = clientErrorFromBasicAuthError(error, { span: _operationSpan?.span });
 			this._emitEvent({
 				type: BasicAuthContextEventType.LoginRedirectFailed,
 				zone,
-				errorSummary: describeError(error)
+				error: clientError
 			});
-			throw error;
+			throw clientError;
 		} finally {
 			this._operationSignals.loginRedirectPending.set(false);
 		}
@@ -621,6 +629,7 @@ _dec = instrumentBasicAuthMethod("start"), _dec1 = withDisposableStack(0, true),
 	}
 	dispose() {
 		this._destroyed.set(true);
+		this._eventSubject.complete();
 	}
 	[SYMBOL_DISPOSE]() {
 		this.dispose();
@@ -696,7 +705,7 @@ _dec = instrumentBasicAuthMethod("start"), _dec1 = withDisposableStack(0, true),
 				kind: ResourceSnapshotUpdateKind.Resolve,
 				value: snapshot
 			}));
-			operationSpan?.setAttributes({
+			operationSpan?.setTraceAttributes({
 				authenticated: snapshot.authenticated,
 				boundaryKind: snapshot.boundaryKind
 			});
@@ -707,16 +716,17 @@ _dec = instrumentBasicAuthMethod("start"), _dec1 = withDisposableStack(0, true),
 			});
 			return snapshot;
 		} catch (error) {
+			const clientError = clientErrorFromBasicAuthError(error, { span: operationSpan?.span });
 			this._boundarySnapshotSignal.set(reduceResourceSnapshot(loadingSnapshot, {
 				kind: ResourceSnapshotUpdateKind.Fail,
-				error
+				error: clientError
 			}));
 			this._emitEvent({
 				type: BasicAuthContextEventType.BoundaryRefreshFailed,
 				snapshot: this._readCurrentSnapshot(),
-				errorSummary: describeError(error)
+				error: clientError
 			});
-			throw error;
+			throw clientError;
 		} finally {
 			this._operationSignals.refreshPending.set(false);
 		}

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["ClientError","ClientErrorKind","encodeUint8ArrayToBase64","createBasicAuthorizationHeaderValue","options","username","includes","kind","Configuration","code","message","source","TextEncoder","encode","password","type","defineType","BasicAuthZoneConfigSchema","zonePrefix","BasicAuthContextClientConfigSchema","baseUrl","zones","array","atLeastLength","SecuritydeptInjectionToken","BASIC_AUTH_CONTEXT_CLIENT","BASIC_AUTH_CONTEXT_CLIENT_CONFIG","BasicAuthContextErrorCode","OperationFailed","InvalidConfig","ClientDisposed","RouterUnavailable","ProbePathRequired","ZoneNotFound","ZoneRequired","BasicAuthBoundaryKind","Authenticated","Challenge","Unauthorized","BasicAuthContextSource","BasicAuthContext","BasicAuthContextEventType","BoundaryRefreshStarted","BoundaryRefreshSucceeded","BoundaryRefreshFailed","LogoutStarted","LogoutSucceeded","LogoutFailed","LoginRedirectStarted","LoginRedirectSucceeded","LoginRedirectFailed","AuthGuardResultKind","Ok","Redirect","AuthGuardRedirectStatus","Found","SeeOther","TemporaryRedirect","ClientError","ClientErrorKind","createCancellationTokenSource","createLinkedCancellationToken","createOnceAsyncLockCallable","createSignal","defineInstrumentMethodDecorator","describeError","ENVIRONMENT_TOKEN","injectDisposableStackFrom","mapResource","ResourceSnapshotUpdateKind","ResourceStatus","RouterNavigationIntent","RouterNavigationMode","readonlySignal","reduceResourceSnapshot","resourceFromSnapshots","SecuritydeptDestroyRef","SYMBOL_DISPOSE","throwValidationClientError","UriReferenceString","validateTraitInput","withDisposableStack","commandResponseData","concatCommand","dispatchCommandLocallyToStream","RxEventReplaySubject","RxEventSubject","RxStateSignal","filter","from","lastValueFrom","take","takeUntil","v7","uuidv7","BasicAuthContextClientConfigSchema","BASIC_AUTH_CONTEXT_CLIENT_CONFIG","AuthGuardRedirectStatus","AuthGuardResultKind","BasicAuthBoundaryKind","BasicAuthBoundaryKindValues","BasicAuthContextErrorCode","BasicAuthContextEventType","BasicAuthContextSource","DEFAULT_LOGIN_SUBPATH","POST_AUTH_REDIRECT_PARAM","instrumentBasicAuthMethod","factoryArgs","operation","environment","span","name","config","tracing","prefix","target","fields","normalizeError","error","fromUnknown","code","OperationFailed","message","source","BasicAuthContext","resolveZone","zonePrefix","replace","loginSub","loginSubpath","loginPath","readBasicAuthBoundaryKind","options","status","Authenticated","challengeHeader","Challenge","Unauthorized","BasicAuthContextClient","_start","refresh","_refresh","logout","_logout","loginWithRedirect","_loginWithRedirect","defaultOptions","_environment","_config","_span","_rootCancellation","_destroyed","fromInitialValue","destroyed$","pipe","value","_boundarySnapshotSignal","Idle","_operationSignals","startPending","refreshPending","logoutPending","loginRedirectPending","_eventSubject","_refreshCommandSubject","_refreshResponseSubject","_startOnce","cancellationToken","operationSpan","throwIfCancellationRequested","set","_dispatchRefresh","_resolveRefreshOptions","id","zones","boundarySnapshot","boundaryResource","isAuthenticated","operations","events","fromEnvironmentConfig","fromInjector","injector","client","get","onDestroy","dispose","bundledSchema","onInvalid","failure","InvalidConfig","messagePrefix","resolvedConfig","baseUrl","map","probePath","fork","attributes","clientName","snapshot","authenticated","subscribe","cancel","kind","Cancelled","ClientDisposed","command","_executeRefresh","payload","autoStart","start","catch","token","disposableStack","use","_options","_emitEvent","type","LogoutStarted","_readCurrentSnapshot","Resolved","setAttributes","localProjectionCleared","LogoutSucceeded","LogoutFailed","errorSummary","_operationSpan","router","Configuration","RouterUnavailable","zone","_resolveZoneForAction","postAuthRedirectUri","currentPath","LoginRedirectStarted","navigate","url","parse","loginUrl","intent","AuthRedirect","mode","External","LoginRedirectSucceeded","LoginRedirectFailed","zoneForPath","path","matchedZone","matches","startsWith","length","zoneForPrefix","find","isInZone","undefined","base","params","URLSearchParams","toString","loginUrlForZonePrefix","handleUnauthorized","responseStatus","Ok","Redirect","Found","location","ProbePathRequired","action","ZoneNotFound","ZoneRequired","requestStream","responseStream","createCommandExtra","previous","loadingSnapshot","Load","BoundaryRefreshStarted","response","transport","execute","method","headers","accept","fromHttpResponse","body","_snapshotFromResponse","Resolve","boundaryKind","BoundaryRefreshSucceeded","Fail","BoundaryRefreshFailed","requestPath","Reloading","Error","input","next","at","time","now","INJECTOR_TOKEN","BasicAuthContextClient","BASIC_AUTH_CONTEXT_CLIENT","BASIC_AUTH_CONTEXT_CLIENT_CONFIG","provideBasicAuthContext","options","provide","useValue","config","useFactory","injector","fromInjector","deps"],"sources":["../src/authorization-header.ts","../src/schemas.ts","../src/tokens.ts","../src/types.ts","../src/client.ts","../src/providers.ts"],"sourcesContent":["import {\n\tClientError,\n\tClientErrorKind,\n\tencodeUint8ArrayToBase64,\n} from \"@securitydept/client\";\n\nexport interface CreateBasicAuthorizationHeaderValueOptions {\n\treadonly username: string;\n\treadonly password: string;\n}\n\nexport function createBasicAuthorizationHeaderValue(\n\toptions: CreateBasicAuthorizationHeaderValueOptions,\n): string {\n\tif (options.username.includes(\":\")) {\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\tcode: \"basic_auth.authorization_header.username_contains_colon\",\n\t\t\tmessage: \"A Basic authentication username cannot contain a colon.\",\n\t\t\tsource: \"basic_auth\",\n\t\t});\n\t}\n\n\treturn `Basic ${encodeUint8ArrayToBase64(\n\t\tnew TextEncoder().encode(`${options.username}:${options.password}`),\n\t)}`;\n}\n","import { type as defineType } from \"arktype\";\n\nexport const BasicAuthZoneConfigSchema = defineType({\n\tzonePrefix: \"string > 0\",\n\t\"loginSubpath?\": \"string\",\n});\n\nexport const BasicAuthContextClientConfigSchema = defineType({\n\t\"id?\": \"string > 0\",\n\tbaseUrl: \"string > 0\",\n\tzones: BasicAuthZoneConfigSchema.array().atLeastLength(1),\n\t\"probePath?\": \"string > 0\",\n\t\"autoStart?\": \"boolean\",\n\t\"tracing?\": {\n\t\t\"target?\": \"string > 0\",\n\t\t\"prefix?\": \"string > 0\",\n\t},\n});\n","import { SecuritydeptInjectionToken } from \"@securitydept/client\";\nimport { type BasicAuthContextClient } from \"./client\";\nimport { type BasicAuthContextClientConfig } from \"./types\";\n\nexport const BASIC_AUTH_CONTEXT_CLIENT =\n\tnew SecuritydeptInjectionToken<BasicAuthContextClient>(\n\t\t\"BASIC_AUTH_CONTEXT_CLIENT\",\n\t);\n\nexport const BASIC_AUTH_CONTEXT_CLIENT_CONFIG =\n\tnew SecuritydeptInjectionToken<BasicAuthContextClientConfig>(\n\t\t\"BASIC_AUTH_CONTEXT_CLIENT_CONFIG\",\n\t);\n","// --- Basic Auth Context Client types ---\n\nimport {\n\ttype CancellationTokenOptions,\n\ttype ErrorSummary,\n\ttype ReadableSignalTrait,\n\ttype ResourceSnapshot,\n\ttype ResourceTrait,\n} from \"@securitydept/client\";\n\n/** Configuration for a single Basic Auth zone. */\nexport const BasicAuthContextErrorCode = {\n\tOperationFailed: \"basic_auth.operation_failed\",\n\tInvalidConfig: \"basic_auth.invalid_config\",\n\tClientDisposed: \"basic_auth.client_disposed\",\n\tRouterUnavailable: \"basic_auth.router_unavailable\",\n\tProbePathRequired: \"basic_auth.probe_path_required\",\n\tZoneNotFound: \"basic_auth.zone_not_found\",\n\tZoneRequired: \"basic_auth.zone_required\",\n} as const;\n\nexport type BasicAuthContextErrorCode =\n\t(typeof BasicAuthContextErrorCode)[keyof typeof BasicAuthContextErrorCode];\n\nexport interface BasicAuthZoneConfig {\n\t/** URL path prefix for this zone (e.g. \"/basic\"). */\n\tzonePrefix: string;\n\t/** Login subpath relative to zone prefix (default: \"/login\"). */\n\tloginSubpath?: string;\n}\n\n/** Configuration for the Basic Auth Context Client. */\nexport interface BasicAuthContextClientConfig {\n\tid?: string;\n\t/** Base URL of the SecurityDept server. */\n\tbaseUrl: string;\n\t/** One or more Basic Auth zones to manage. */\n\tzones: BasicAuthZoneConfig[];\n\t/** Protected endpoint used by start()/refresh() to observe the boundary. */\n\tprobePath?: string;\n\tautoStart?: boolean;\n\ttracing?: BasicAuthContextClientTracingOptions;\n}\n\nexport interface BasicAuthContextClientTracingOptions {\n\ttarget?: string;\n\tprefix?: string;\n}\n\nexport interface ResolvedBasicAuthContextClientConfig {\n\tid: string;\n\tbaseUrl: string;\n\tzones: readonly ResolvedBasicAuthZone[];\n\tprobePath?: string;\n\ttracing: Required<BasicAuthContextClientTracingOptions>;\n}\n\nexport const BasicAuthBoundaryKind = {\n\tAuthenticated: \"authenticated\",\n\tChallenge: \"challenge\",\n\tUnauthorized: \"unauthorized\",\n} as const;\n\nexport type BasicAuthBoundaryKind =\n\t(typeof BasicAuthBoundaryKind)[keyof typeof BasicAuthBoundaryKind];\n\nexport interface BasicAuthBoundaryObservation {\n\tstatus: number;\n\tchallengeHeader?: string | null;\n\trequestPath?: string;\n}\n\nexport interface BasicAuthBoundarySnapshot {\n\tauthenticated: boolean;\n\tboundaryKind: BasicAuthBoundaryKind;\n\tstatus: number;\n\tpath: string;\n\tchallengeHeader: string | null;\n\tzone?: ResolvedBasicAuthZone;\n}\n\nexport const BasicAuthContextSource = {\n\tBasicAuthContext: \"basic-auth-context\",\n} as const;\n\nexport type BasicAuthContextSource =\n\t(typeof BasicAuthContextSource)[keyof typeof BasicAuthContextSource];\n\nexport const BasicAuthContextEventType = {\n\tBoundaryRefreshStarted: \"basic_auth.boundary.refresh.started\",\n\tBoundaryRefreshSucceeded: \"basic_auth.boundary.refresh.succeeded\",\n\tBoundaryRefreshFailed: \"basic_auth.boundary.refresh.failed\",\n\t/** These logout events describe local boundary-projection clearing only. */\n\tLogoutStarted: \"basic_auth.logout.started\",\n\tLogoutSucceeded: \"basic_auth.logout.succeeded\",\n\tLogoutFailed: \"basic_auth.logout.failed\",\n\tLoginRedirectStarted: \"basic_auth.login.redirect.started\",\n\tLoginRedirectSucceeded: \"basic_auth.login.redirect.succeeded\",\n\tLoginRedirectFailed: \"basic_auth.login.redirect.failed\",\n} as const;\n\nexport type BasicAuthContextEventType =\n\t(typeof BasicAuthContextEventType)[keyof typeof BasicAuthContextEventType];\n\nexport interface BasicAuthContextEvent {\n\ttype: BasicAuthContextEventType;\n\tat: number;\n\tclient: {\n\t\tid: string;\n\t};\n\tsnapshot?: BasicAuthBoundarySnapshot | null;\n\tzone?: ResolvedBasicAuthZone;\n\terrorSummary?: ErrorSummary;\n}\n\nexport interface BasicAuthContextOperationSignals {\n\treadonly startPending: ReadableSignalTrait<boolean>;\n\treadonly refreshPending: ReadableSignalTrait<boolean>;\n\treadonly logoutPending: ReadableSignalTrait<boolean>;\n\treadonly loginRedirectPending: ReadableSignalTrait<boolean>;\n}\n\nexport interface BasicAuthRefreshOptions extends CancellationTokenOptions {\n\tpath?: string;\n}\n\nexport type BasicAuthZoneSelectionOptions =\n\t| {\n\t\t\tcurrentPath: string;\n\t\t\tzonePrefix?: never;\n\t  }\n\t| {\n\t\t\tzonePrefix: string;\n\t\t\tcurrentPath?: never;\n\t  };\n\n/** Options for clearing the client's in-memory boundary projection. */\nexport interface BasicAuthLogoutOptions extends CancellationTokenOptions {}\n\nexport type BasicAuthLoginWithRedirectOptions = BasicAuthZoneSelectionOptions &\n\tCancellationTokenOptions & {\n\t\tpostAuthRedirectUri?: string;\n\t};\n\nexport const AuthGuardResultKind = {\n\tOk: \"ok\",\n\tRedirect: \"redirect\",\n} as const;\n\nexport type AuthGuardResultKind =\n\t(typeof AuthGuardResultKind)[keyof typeof AuthGuardResultKind];\n\nexport const AuthGuardRedirectStatus = {\n\tFound: 302,\n\tSeeOther: 303,\n\tTemporaryRedirect: 307,\n} as const;\n\nexport type AuthGuardRedirectStatus =\n\t(typeof AuthGuardRedirectStatus)[keyof typeof AuthGuardRedirectStatus];\n\n/** Redirect instruction — framework-neutral result. */\nexport type AuthGuardResult<T> =\n\t| { kind: typeof AuthGuardResultKind.Ok; value: T }\n\t| {\n\t\t\tkind: typeof AuthGuardResultKind.Redirect;\n\t\t\tstatus: AuthGuardRedirectStatus;\n\t\t\tlocation: string;\n\t  };\n\n/** Resolved zone with computed paths. */\nexport interface ResolvedBasicAuthZone {\n\tzonePrefix: string;\n\tloginPath: string;\n}\n\nexport interface BasicAuthContextClientStateSignals {\n\treadonly boundarySnapshot: ReadableSignalTrait<\n\t\tResourceSnapshot<BasicAuthBoundarySnapshot | null>\n\t>;\n\treadonly boundaryResource: ResourceTrait<BasicAuthBoundarySnapshot | null>;\n\treadonly isAuthenticated: ResourceTrait<boolean>;\n}\n","import {\n\ttype CancellationTokenSourceTrait,\n\ttype CancellationTokenTrait,\n\tClientError,\n\tClientErrorKind,\n\tcreateCancellationTokenSource,\n\tcreateLinkedCancellationToken,\n\tcreateOnceAsyncLockCallable,\n\tcreateSignal,\n\ttype DisposableTrait,\n\tdefineInstrumentMethodDecorator,\n\tdescribeError,\n\tENVIRONMENT_TOKEN,\n\ttype EventStreamTrait,\n\ttype FoundationEnvironment,\n\tinjectDisposableStackFrom,\n\tmapResource,\n\ttype OperationSpanTrait,\n\ttype ReadableSignalTrait,\n\ttype ResourceSnapshot,\n\tResourceSnapshotUpdateKind,\n\tResourceStatus,\n\ttype ResourceTrait,\n\tRouterNavigationIntent,\n\tRouterNavigationMode,\n\treadonlySignal,\n\treduceResourceSnapshot,\n\tresourceFromSnapshots,\n\tSecuritydeptDestroyRef,\n\ttype SecuritydeptInjectorTrait,\n\ttype SpanTrait,\n\tSYMBOL_DISPOSE,\n\tthrowValidationClientError,\n\tUriReferenceString,\n\tvalidateTraitInput,\n\ttype WritableSignalTrait,\n\twithDisposableStack,\n} from \"@securitydept/client\";\nimport {\n\ttype Command,\n\ttype CommandResponse,\n\tcommandResponseData,\n\tconcatCommand,\n\tdispatchCommandLocallyToStream,\n\tRxEventReplaySubject,\n\tRxEventSubject,\n\tRxStateSignal,\n} from \"@securitydept/client/rx\";\nimport { filter, from, lastValueFrom, take, takeUntil } from \"rxjs\";\nimport { v7 as uuidv7 } from \"uuid\";\nimport { BasicAuthContextClientConfigSchema } from \"./schemas\";\nimport { BASIC_AUTH_CONTEXT_CLIENT_CONFIG } from \"./tokens\";\nimport {\n\tAuthGuardRedirectStatus,\n\ttype AuthGuardResult,\n\tAuthGuardResultKind,\n\ttype BasicAuthBoundaryKind,\n\tBasicAuthBoundaryKind as BasicAuthBoundaryKindValues,\n\ttype BasicAuthBoundaryObservation,\n\ttype BasicAuthBoundarySnapshot,\n\ttype BasicAuthContextClientConfig,\n\tBasicAuthContextErrorCode,\n\ttype BasicAuthContextEvent,\n\tBasicAuthContextEventType,\n\ttype BasicAuthContextOperationSignals,\n\tBasicAuthContextSource,\n\ttype BasicAuthLoginWithRedirectOptions,\n\ttype BasicAuthLogoutOptions,\n\ttype BasicAuthRefreshOptions,\n\ttype BasicAuthZoneConfig,\n\ttype BasicAuthZoneSelectionOptions,\n\ttype ResolvedBasicAuthContextClientConfig,\n\ttype ResolvedBasicAuthZone,\n} from \"./types\";\n\nconst DEFAULT_LOGIN_SUBPATH = \"/login\";\nconst POST_AUTH_REDIRECT_PARAM = \"post_auth_redirect_uri\";\n\ninterface BasicAuthCommandExtra {\n\tcancellationToken: CancellationTokenTrait;\n\toperationSpan?: OperationSpanTrait;\n}\n\ntype ResolvedBasicAuthRefreshOptions = { path: string };\n\ntype BasicAuthRefreshCommand = Command<\n\tResolvedBasicAuthRefreshOptions,\n\tBasicAuthCommandExtra\n>;\n\nconst instrumentBasicAuthMethod = defineInstrumentMethodDecorator<\n\t[operation: string],\n\tBasicAuthContextClient\n>(\n\t({ factoryArgs: [operation] }) =>\n\t\tfunction (this: BasicAuthContextClient) {\n\t\t\treturn {\n\t\t\t\tenvironment: this.environment,\n\t\t\t\tspan: this.span,\n\t\t\t\tname: `${this.config.tracing.prefix}.${operation}`,\n\t\t\t\ttarget: this.config.tracing.target,\n\t\t\t\tfields: { operation },\n\t\t\t\tnormalizeError: (error: unknown) =>\n\t\t\t\t\tClientError.fromUnknown(error, {\n\t\t\t\t\t\tcode: BasicAuthContextErrorCode.OperationFailed,\n\t\t\t\t\t\tmessage: \"The Basic Auth operation failed unexpectedly\",\n\t\t\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t\t\t}),\n\t\t\t};\n\t\t},\n);\n\nfunction resolveZone(config: BasicAuthZoneConfig): ResolvedBasicAuthZone {\n\tconst prefix = config.zonePrefix.replace(/\\/+$/, \"\");\n\tconst loginSub = config.loginSubpath ?? DEFAULT_LOGIN_SUBPATH;\n\n\treturn {\n\t\tzonePrefix: prefix,\n\t\tloginPath: prefix + loginSub,\n\t};\n}\n\nexport function readBasicAuthBoundaryKind(\n\toptions: BasicAuthBoundaryObservation,\n): BasicAuthBoundaryKind {\n\tif (options.status < 400) {\n\t\treturn BasicAuthBoundaryKindValues.Authenticated;\n\t}\n\n\tif (options.challengeHeader) {\n\t\treturn BasicAuthBoundaryKindValues.Challenge;\n\t}\n\n\treturn BasicAuthBoundaryKindValues.Unauthorized;\n}\n\n/**\n * Basic Auth Context Client.\n *\n * Owns zone-aware Basic Auth boundary observations and login navigation.\n * It does not manage browser credentials or principal data.\n */\nexport class BasicAuthContextClient implements DisposableTrait {\n\tstatic defaultOptions = {\n\t\tloginSubpath: DEFAULT_LOGIN_SUBPATH,\n\t\ttracing: {\n\t\t\ttarget: \"basic-auth-context-client\",\n\t\t\tprefix: \"basic_auth_context\",\n\t\t},\n\t} as const;\n\n\tprivate readonly _environment: FoundationEnvironment;\n\tprivate readonly _config: ResolvedBasicAuthContextClientConfig;\n\tprivate readonly _span: SpanTrait;\n\tprivate readonly _rootCancellation: CancellationTokenSourceTrait =\n\t\tcreateCancellationTokenSource();\n\tprivate readonly _destroyed = RxStateSignal.fromInitialValue(false);\n\tprivate readonly destroyed$ = from(this._destroyed).pipe(\n\t\tfilter((value): value is true => value),\n\t\ttake(1),\n\t);\n\tprivate readonly _boundarySnapshotSignal = RxStateSignal.fromInitialValue<\n\t\tResourceSnapshot<BasicAuthBoundarySnapshot | null>\n\t>({ status: ResourceStatus.Idle });\n\tprivate readonly _operationSignals: {\n\t\treadonly startPending: WritableSignalTrait<boolean>;\n\t\treadonly refreshPending: WritableSignalTrait<boolean>;\n\t\treadonly logoutPending: WritableSignalTrait<boolean>;\n\t\treadonly loginRedirectPending: WritableSignalTrait<boolean>;\n\t} = {\n\t\tstartPending: createSignal(false),\n\t\trefreshPending: createSignal(false),\n\t\tlogoutPending: createSignal(false),\n\t\tloginRedirectPending: createSignal(false),\n\t};\n\tprivate readonly _eventSubject =\n\t\tnew RxEventReplaySubject<BasicAuthContextEvent>(100);\n\tprivate readonly _refreshCommandSubject =\n\t\tnew RxEventSubject<BasicAuthRefreshCommand>();\n\tprivate readonly _refreshResponseSubject = new RxEventSubject<\n\t\tCommandResponse<BasicAuthRefreshCommand, BasicAuthBoundarySnapshot>\n\t>();\n\tprivate readonly _startOnce = createOnceAsyncLockCallable(\n\t\tasync (\n\t\t\tcancellationToken: CancellationTokenTrait,\n\t\t\toperationSpan?: OperationSpanTrait,\n\t\t) => {\n\t\t\tcancellationToken.throwIfCancellationRequested();\n\t\t\tthis._operationSignals.startPending.set(true);\n\t\t\ttry {\n\t\t\t\treturn await this._dispatchRefresh(\n\t\t\t\t\tthis._resolveRefreshOptions({}),\n\t\t\t\t\tcancellationToken,\n\t\t\t\t\toperationSpan,\n\t\t\t\t);\n\t\t\t} finally {\n\t\t\t\tthis._operationSignals.startPending.set(false);\n\t\t\t}\n\t\t},\n\t);\n\n\treadonly id: string;\n\treadonly zones: readonly ResolvedBasicAuthZone[];\n\treadonly boundarySnapshot: ReadableSignalTrait<\n\t\tResourceSnapshot<BasicAuthBoundarySnapshot | null>\n\t>;\n\treadonly boundaryResource: ResourceTrait<BasicAuthBoundarySnapshot | null>;\n\treadonly isAuthenticated: ResourceTrait<boolean>;\n\treadonly operations: BasicAuthContextOperationSignals;\n\treadonly events: EventStreamTrait<BasicAuthContextEvent>;\n\n\tprotected get environment(): FoundationEnvironment {\n\t\treturn this._environment;\n\t}\n\n\tprotected get span(): SpanTrait {\n\t\treturn this._span;\n\t}\n\n\tprotected get config(): ResolvedBasicAuthContextClientConfig {\n\t\treturn this._config;\n\t}\n\n\tstatic fromEnvironmentConfig(options: {\n\t\treadonly config: BasicAuthContextClientConfig;\n\t\treadonly environment: FoundationEnvironment;\n\t}): BasicAuthContextClient {\n\t\treturn new BasicAuthContextClient(options.config, options.environment);\n\t}\n\n\tstatic fromInjector(\n\t\tinjector: SecuritydeptInjectorTrait,\n\t): BasicAuthContextClient {\n\t\tconst client = BasicAuthContextClient.fromEnvironmentConfig({\n\t\t\tconfig: injector.get(BASIC_AUTH_CONTEXT_CLIENT_CONFIG),\n\t\t\tenvironment: injector.get(ENVIRONMENT_TOKEN),\n\t\t});\n\t\tinjector\n\t\t\t.get(SecuritydeptDestroyRef, null)\n\t\t\t?.onDestroy(() => client.dispose());\n\t\treturn client;\n\t}\n\n\tprotected constructor(\n\t\tconfig: BasicAuthContextClientConfig,\n\t\tenvironment: FoundationEnvironment,\n\t) {\n\t\tvalidateTraitInput({\n\t\t\tvalue: config,\n\t\t\tbundledSchema: BasicAuthContextClientConfigSchema,\n\t\t\tonInvalid: (failure) =>\n\t\t\t\tthrowValidationClientError({\n\t\t\t\t\tcode: BasicAuthContextErrorCode.InvalidConfig,\n\t\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t\t\tmessagePrefix: \"BasicAuthContextClient could not validate config\",\n\t\t\t\t\tfailure,\n\t\t\t\t}),\n\t\t});\n\t\tconst resolvedConfig: ResolvedBasicAuthContextClientConfig = {\n\t\t\tid: config.id ?? uuidv7(),\n\t\t\tbaseUrl: (config.baseUrl ?? \"\").replace(/\\/+$/, \"\"),\n\t\t\tzones: (config.zones ?? []).map(resolveZone),\n\t\t\tprobePath: config.probePath,\n\t\t\ttracing: {\n\t\t\t\ttarget:\n\t\t\t\t\tconfig.tracing?.target ??\n\t\t\t\t\tBasicAuthContextClient.defaultOptions.tracing.target,\n\t\t\t\tprefix:\n\t\t\t\t\tconfig.tracing?.prefix ??\n\t\t\t\t\tBasicAuthContextClient.defaultOptions.tracing.prefix,\n\t\t\t},\n\t\t};\n\n\t\tthis._environment = environment;\n\t\tthis._config = resolvedConfig;\n\t\tthis.id = resolvedConfig.id;\n\t\tthis.zones = resolvedConfig.zones;\n\t\tthis._span = environment.span.fork({\n\t\t\tattributes: {\n\t\t\t\tclientName: this.constructor.name,\n\t\t\t\tid: this.id,\n\t\t\t},\n\t\t});\n\t\tthis.boundarySnapshot = readonlySignal(this._boundarySnapshotSignal);\n\t\tthis.boundaryResource = resourceFromSnapshots(() =>\n\t\t\tthis._boundarySnapshotSignal.get(),\n\t\t);\n\t\tthis.isAuthenticated = mapResource(\n\t\t\tthis.boundaryResource,\n\t\t\t(snapshot) => snapshot?.authenticated === true,\n\t\t);\n\t\tthis.operations = {\n\t\t\tstartPending: readonlySignal(this._operationSignals.startPending),\n\t\t\trefreshPending: readonlySignal(this._operationSignals.refreshPending),\n\t\t\tlogoutPending: readonlySignal(this._operationSignals.logoutPending),\n\t\t\tloginRedirectPending: readonlySignal(\n\t\t\t\tthis._operationSignals.loginRedirectPending,\n\t\t\t),\n\t\t};\n\t\tthis.events = this._eventSubject;\n\t\tthis.destroyed$.subscribe(() => {\n\t\t\tthis._rootCancellation.cancel(\n\t\t\t\tnew ClientError({\n\t\t\t\t\tkind: ClientErrorKind.Cancelled,\n\t\t\t\t\tcode: BasicAuthContextErrorCode.ClientDisposed,\n\t\t\t\t\tmessage: \"BasicAuthContextClient has been disposed.\",\n\t\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tthis.isAuthenticated.dispose();\n\t\t\tthis.boundaryResource.dispose();\n\t\t});\n\n\t\tfrom(this._refreshCommandSubject)\n\t\t\t.pipe(\n\t\t\t\ttakeUntil(this.destroyed$),\n\t\t\t\tconcatCommand((command) =>\n\t\t\t\t\tthis._executeRefresh(\n\t\t\t\t\t\tcommand.payload,\n\t\t\t\t\t\tcommand.cancellationToken,\n\t\t\t\t\t\tcommand.operationSpan,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t)\n\t\t\t.subscribe(this._refreshResponseSubject);\n\n\t\tif (config.autoStart === true) {\n\t\t\tthis.start().catch(() => {\n\t\t\t\t// Startup failure is reflected by boundarySnapshot.\n\t\t\t});\n\t\t}\n\t}\n\n\tasync start(): Promise<BasicAuthBoundarySnapshot> {\n\t\tconst cancellationToken = this._rootCancellation.token;\n\t\treturn await this._start(cancellationToken);\n\t}\n\n\t@instrumentBasicAuthMethod(\"start\")\n\tprivate async _start(\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\treturn await this._startOnce(cancellationToken, operationSpan);\n\t}\n\n\t@withDisposableStack(0, true)\n\tasync refresh(\n\t\toptions: BasicAuthRefreshOptions = {},\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\tconst disposableStack = injectDisposableStackFrom(options, true);\n\t\tconst cancellationToken = createLinkedCancellationToken(\n\t\t\tthis._rootCancellation.token,\n\t\t\toptions.cancellationToken,\n\t\t);\n\t\tdisposableStack?.use(cancellationToken);\n\t\treturn await this._refresh(options, cancellationToken);\n\t}\n\n\t@instrumentBasicAuthMethod(\"refresh\")\n\tprivate async _refresh(\n\t\toptions: BasicAuthRefreshOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\treturn await this._dispatchRefresh(\n\t\t\tthis._resolveRefreshOptions(options),\n\t\t\tcancellationToken,\n\t\t\toperationSpan,\n\t\t);\n\t}\n\n\t/**\n\t * Clears only this client's in-memory Basic Auth boundary projection.\n\t *\n\t * Browsers own HTTP Basic credentials. This method cannot revoke or clear\n\t * those credentials, and a later probe may observe an authenticated state\n\t * again when the browser continues sending them.\n\t */\n\t@withDisposableStack(0, true)\n\tasync logout(options: BasicAuthLogoutOptions = {}): Promise<void> {\n\t\tconst disposableStack = injectDisposableStackFrom(options, true);\n\t\tconst cancellationToken = createLinkedCancellationToken(\n\t\t\tthis._rootCancellation.token,\n\t\t\toptions.cancellationToken,\n\t\t);\n\t\tdisposableStack?.use(cancellationToken);\n\t\treturn await this._logout(options, cancellationToken);\n\t}\n\n\t@instrumentBasicAuthMethod(\"logout\")\n\tprivate async _logout(\n\t\t_options: BasicAuthLogoutOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<void> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\tthis._operationSignals.logoutPending.set(true);\n\t\tthis._emitEvent({\n\t\t\ttype: BasicAuthContextEventType.LogoutStarted,\n\t\t\tsnapshot: this._readCurrentSnapshot(),\n\t\t});\n\t\ttry {\n\t\t\tcancellationToken.throwIfCancellationRequested();\n\t\t\tthis._boundarySnapshotSignal.set({\n\t\t\t\tstatus: ResourceStatus.Resolved,\n\t\t\t\tvalue: null,\n\t\t\t});\n\t\t\toperationSpan?.setAttributes({ localProjectionCleared: true });\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.LogoutSucceeded,\n\t\t\t\tsnapshot: null,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.LogoutFailed,\n\t\t\t\tsnapshot: this._readCurrentSnapshot(),\n\t\t\t\terrorSummary: describeError(error),\n\t\t\t});\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\tthis._operationSignals.logoutPending.set(false);\n\t\t}\n\t}\n\n\t@withDisposableStack(0, true)\n\tasync loginWithRedirect(\n\t\toptions: BasicAuthLoginWithRedirectOptions,\n\t): Promise<void> {\n\t\tconst disposableStack = injectDisposableStackFrom(options, true);\n\t\tconst cancellationToken = createLinkedCancellationToken(\n\t\t\tthis._rootCancellation.token,\n\t\t\toptions.cancellationToken,\n\t\t);\n\t\tdisposableStack?.use(cancellationToken);\n\t\tawait this._loginWithRedirect(options, cancellationToken);\n\t}\n\n\t@instrumentBasicAuthMethod(\"login.redirect\")\n\tprivate async _loginWithRedirect(\n\t\toptions: BasicAuthLoginWithRedirectOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\t_operationSpan?: OperationSpanTrait,\n\t): Promise<void> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\tconst router = this._environment.router;\n\t\tif (!router) {\n\t\t\tthrow new ClientError({\n\t\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\t\tcode: BasicAuthContextErrorCode.RouterUnavailable,\n\t\t\t\tmessage: \"loginWithRedirect() requires environment.router.\",\n\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t});\n\t\t}\n\t\tconst zone = this._resolveZoneForAction(options, \"login redirect\");\n\t\tconst postAuthRedirectUri =\n\t\t\toptions.postAuthRedirectUri ?? options.currentPath;\n\n\t\tthis._operationSignals.loginRedirectPending.set(true);\n\t\tthis._emitEvent({\n\t\t\ttype: BasicAuthContextEventType.LoginRedirectStarted,\n\t\t\tzone,\n\t\t});\n\t\ttry {\n\t\t\tawait router.navigate({\n\t\t\t\turl: UriReferenceString.parse(this.loginUrl(zone, postAuthRedirectUri)),\n\t\t\t\tintent: RouterNavigationIntent.AuthRedirect,\n\t\t\t\tmode: RouterNavigationMode.External,\n\t\t\t});\n\t\t\tcancellationToken.throwIfCancellationRequested();\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.LoginRedirectSucceeded,\n\t\t\t\tzone,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.LoginRedirectFailed,\n\t\t\t\tzone,\n\t\t\t\terrorSummary: describeError(error),\n\t\t\t});\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\tthis._operationSignals.loginRedirectPending.set(false);\n\t\t}\n\t}\n\n\t/** Find the zone that contains the given path. */\n\tzoneForPath(path: string): ResolvedBasicAuthZone | undefined {\n\t\tlet matchedZone: ResolvedBasicAuthZone | undefined;\n\n\t\tfor (const zone of this.zones) {\n\t\t\tconst matches =\n\t\t\t\tpath === zone.zonePrefix || path.startsWith(`${zone.zonePrefix}/`);\n\t\t\tif (!matches) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\t!matchedZone ||\n\t\t\t\tzone.zonePrefix.length > matchedZone.zonePrefix.length\n\t\t\t) {\n\t\t\t\tmatchedZone = zone;\n\t\t\t}\n\t\t}\n\n\t\treturn matchedZone;\n\t}\n\n\tzoneForPrefix(zonePrefix: string): ResolvedBasicAuthZone | undefined {\n\t\treturn this.zones.find((zone) => zone.zonePrefix === zonePrefix);\n\t}\n\n\t/** Check whether a path falls inside any configured zone. */\n\tisInZone(path: string): boolean {\n\t\treturn this.zoneForPath(path) !== undefined;\n\t}\n\n\t/** Build the full login URL for a zone, optionally with a post-auth redirect. */\n\tloginUrl(zone: ResolvedBasicAuthZone, postAuthRedirectUri?: string): string {\n\t\tconst base = this._config.baseUrl + zone.loginPath;\n\t\tif (postAuthRedirectUri) {\n\t\t\tconst params = new URLSearchParams({\n\t\t\t\t[POST_AUTH_REDIRECT_PARAM]: postAuthRedirectUri,\n\t\t\t});\n\t\t\treturn `${base}?${params.toString()}`;\n\t\t}\n\t\treturn base;\n\t}\n\n\tloginUrlForZonePrefix(\n\t\tzonePrefix: string,\n\t\tpostAuthRedirectUri?: string,\n\t): string | null {\n\t\tconst zone = this.zoneForPrefix(zonePrefix);\n\t\treturn zone ? this.loginUrl(zone, postAuthRedirectUri) : null;\n\t}\n\n\t/**\n\t * Handle a 401 response: if the current path is inside a zone,\n\t * return a redirect instruction to the zone's login URL.\n\t */\n\thandleUnauthorized(\n\t\tcurrentPath: string,\n\t\tresponseStatus: number,\n\t): AuthGuardResult<null> {\n\t\tif (responseStatus !== 401) {\n\t\t\treturn { kind: AuthGuardResultKind.Ok, value: null };\n\t\t}\n\n\t\tconst zone = this.zoneForPath(currentPath);\n\t\tif (!zone) {\n\t\t\treturn { kind: AuthGuardResultKind.Ok, value: null };\n\t\t}\n\n\t\treturn {\n\t\t\tkind: AuthGuardResultKind.Redirect,\n\t\t\tstatus: AuthGuardRedirectStatus.Found,\n\t\t\tlocation: this.loginUrl(zone, currentPath),\n\t\t};\n\t}\n\n\tdispose(): void {\n\t\tthis._destroyed.set(true);\n\t}\n\n\t[SYMBOL_DISPOSE](): void {\n\t\tthis.dispose();\n\t}\n\n\tprivate _resolveRefreshOptions(\n\t\toptions: BasicAuthRefreshOptions,\n\t): ResolvedBasicAuthRefreshOptions {\n\t\tconst path = options.path ?? this._config.probePath;\n\t\tif (!path) {\n\t\t\tthrow new ClientError({\n\t\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\t\tcode: BasicAuthContextErrorCode.ProbePathRequired,\n\t\t\t\tmessage:\n\t\t\t\t\t\"BasicAuthContextClient.refresh() requires options.path or config.probePath.\",\n\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t});\n\t\t}\n\t\treturn { path };\n\t}\n\n\tprivate _resolveZoneForAction(\n\t\toptions: BasicAuthZoneSelectionOptions,\n\t\taction: string,\n\t): ResolvedBasicAuthZone {\n\t\tif (options.zonePrefix) {\n\t\t\tconst zone = this.zoneForPrefix(options.zonePrefix);\n\t\t\tif (zone) {\n\t\t\t\treturn zone;\n\t\t\t}\n\t\t\tthrow new ClientError({\n\t\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\t\tcode: BasicAuthContextErrorCode.ZoneNotFound,\n\t\t\t\tmessage: `BasicAuthContextClient ${action} could not find zone \"${options.zonePrefix}\".`,\n\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t});\n\t\t}\n\n\t\tconst zone =\n\t\t\ttypeof options.currentPath === \"string\"\n\t\t\t\t? this.zoneForPath(options.currentPath)\n\t\t\t\t: undefined;\n\t\tif (zone) {\n\t\t\treturn zone;\n\t\t}\n\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\tcode: BasicAuthContextErrorCode.ZoneRequired,\n\t\t\tmessage: `BasicAuthContextClient ${action} requires options.currentPath inside a configured zone or options.zonePrefix.`,\n\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t});\n\t}\n\n\tprivate async _dispatchRefresh(\n\t\tpayload: ResolvedBasicAuthRefreshOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\tconst snapshot = await lastValueFrom(\n\t\t\tdispatchCommandLocallyToStream<\n\t\t\t\tResolvedBasicAuthRefreshOptions,\n\t\t\t\tBasicAuthCommandExtra,\n\t\t\t\tBasicAuthBoundarySnapshot,\n\t\t\t\tBasicAuthRefreshCommand\n\t\t\t>({\n\t\t\t\tpayload,\n\t\t\t\trequestStream: this._refreshCommandSubject,\n\t\t\t\tresponseStream: this._refreshResponseSubject,\n\t\t\t\tcreateCommandExtra: () => ({ cancellationToken, operationSpan }),\n\t\t\t}).pipe(commandResponseData()),\n\t\t);\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\treturn snapshot;\n\t}\n\n\tprivate async _executeRefresh(\n\t\toptions: ResolvedBasicAuthRefreshOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\tthis._operationSignals.refreshPending.set(true);\n\t\tconst previous = this._boundarySnapshotSignal.get();\n\t\tconst loadingSnapshot = reduceResourceSnapshot(previous, {\n\t\t\tkind: ResourceSnapshotUpdateKind.Load,\n\t\t});\n\t\tthis._boundarySnapshotSignal.set(loadingSnapshot);\n\t\tthis._emitEvent({\n\t\t\ttype: BasicAuthContextEventType.BoundaryRefreshStarted,\n\t\t\tsnapshot: this._readCurrentSnapshot(),\n\t\t});\n\t\ttry {\n\t\t\tconst response = await this._environment.transport.execute({\n\t\t\t\turl: this._config.baseUrl + options.path,\n\t\t\t\tmethod: \"GET\",\n\t\t\t\theaders: { accept: \"application/json\" },\n\t\t\t\tcancellationToken,\n\t\t\t});\n\t\t\tif (\n\t\t\t\tresponse.status >= 400 &&\n\t\t\t\tresponse.status !== 401 &&\n\t\t\t\tresponse.status !== 403\n\t\t\t) {\n\t\t\t\tthrow ClientError.fromHttpResponse({\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t\tbody: response.body,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tcancellationToken.throwIfCancellationRequested();\n\t\t\tconst snapshot = this._snapshotFromResponse(options.path, response);\n\t\t\tthis._boundarySnapshotSignal.set(\n\t\t\t\treduceResourceSnapshot(loadingSnapshot, {\n\t\t\t\t\tkind: ResourceSnapshotUpdateKind.Resolve,\n\t\t\t\t\tvalue: snapshot,\n\t\t\t\t}),\n\t\t\t);\n\t\t\toperationSpan?.setAttributes({\n\t\t\t\tauthenticated: snapshot.authenticated,\n\t\t\t\tboundaryKind: snapshot.boundaryKind,\n\t\t\t});\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.BoundaryRefreshSucceeded,\n\t\t\t\tsnapshot,\n\t\t\t\tzone: snapshot.zone,\n\t\t\t});\n\t\t\treturn snapshot;\n\t\t} catch (error) {\n\t\t\tthis._boundarySnapshotSignal.set(\n\t\t\t\treduceResourceSnapshot(loadingSnapshot, {\n\t\t\t\t\tkind: ResourceSnapshotUpdateKind.Fail,\n\t\t\t\t\terror,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.BoundaryRefreshFailed,\n\t\t\t\tsnapshot: this._readCurrentSnapshot(),\n\t\t\t\terrorSummary: describeError(error),\n\t\t\t});\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\tthis._operationSignals.refreshPending.set(false);\n\t\t}\n\t}\n\n\tprivate _snapshotFromResponse(\n\t\tpath: string,\n\t\tresponse: { status: number; headers: Record<string, string> },\n\t): BasicAuthBoundarySnapshot {\n\t\tconst challengeHeader =\n\t\t\tresponse.headers[\"WWW-Authenticate\"] ??\n\t\t\tresponse.headers[\"www-authenticate\"] ??\n\t\t\tnull;\n\t\tconst zone = this.zoneForPath(path);\n\t\tconst boundaryKind = readBasicAuthBoundaryKind({\n\t\t\tstatus: response.status,\n\t\t\tchallengeHeader,\n\t\t\trequestPath: path,\n\t\t});\n\t\treturn {\n\t\t\tauthenticated: boundaryKind === BasicAuthBoundaryKindValues.Authenticated,\n\t\t\tboundaryKind,\n\t\t\tstatus: response.status,\n\t\t\tpath,\n\t\t\tchallengeHeader,\n\t\t\tzone,\n\t\t};\n\t}\n\n\tprivate _readCurrentSnapshot(): BasicAuthBoundarySnapshot | null {\n\t\tconst snapshot = this._boundarySnapshotSignal.get();\n\t\treturn snapshot.status === ResourceStatus.Reloading ||\n\t\t\tsnapshot.status === ResourceStatus.Resolved ||\n\t\t\tsnapshot.status === ResourceStatus.Error\n\t\t\t? snapshot.value\n\t\t\t: null;\n\t}\n\n\tprivate _emitEvent(\n\t\tinput: Omit<BasicAuthContextEvent, \"at\" | \"client\">,\n\t): void {\n\t\tthis._eventSubject.next({\n\t\t\t...input,\n\t\t\tat: this._environment.time.now(),\n\t\t\tclient: {\n\t\t\t\tid: this.id,\n\t\t\t},\n\t\t});\n\t}\n}\n","import {\n\tINJECTOR_TOKEN,\n\ttype SecuritydeptInjectorTrait,\n\ttype SecuritydeptProvider,\n} from \"@securitydept/client\";\nimport { BasicAuthContextClient } from \"./client\";\nimport {\n\tBASIC_AUTH_CONTEXT_CLIENT,\n\tBASIC_AUTH_CONTEXT_CLIENT_CONFIG,\n} from \"./tokens\";\nimport { type BasicAuthContextClientConfig } from \"./types\";\n\nexport interface ProvideBasicAuthContextOptions {\n\treadonly config: BasicAuthContextClientConfig;\n}\n\nexport function provideBasicAuthContext(\n\toptions: ProvideBasicAuthContextOptions,\n): readonly SecuritydeptProvider[] {\n\treturn [\n\t\t{\n\t\t\tprovide: BASIC_AUTH_CONTEXT_CLIENT_CONFIG,\n\t\t\tuseValue: options.config,\n\t\t},\n\t\t{\n\t\t\tprovide: BASIC_AUTH_CONTEXT_CLIENT,\n\t\t\tuseFactory: (injector: SecuritydeptInjectorTrait) =>\n\t\t\t\tBasicAuthContextClient.fromInjector(injector),\n\t\t\tdeps: [INJECTOR_TOKEN],\n\t\t},\n\t];\n}\n"],"mappings":";;;;;;AAWA,SAAgBG,oCACfC,SAAmD;CAEnD,IAAIA,QAAQC,SAASC,SAAS,GAAA,GAC7B,MAAM,IAAIN,YAAY;EACrBO,MAAMN,gBAAgBO;EACtBC,MAAM;EACNC,SAAS;EACTC,QAAQ;CACT,CAAA;CAGD,OAAO,SAAST,yBACf,IAAIU,YAAAA,CAAAA,CAAcC,OAAO,GAAGT,QAAQC,SAAS,GAAGD,QAAQU,UAAU,CAAA;AAEpE;;;ACxBA,MAAaG,4BAA4BD,KAAW;CACnDE,YAAY;CACZ,iBAAiB;AAClB,CAAA;AAEA,MAAaC,qCAAqCH,KAAW;CAC5D,OAAO;CACPI,SAAS;CACTC,OAAOJ,0BAA0BK,MAAK,CAAA,CAAGC,cAAc,CAAA;CACvD,cAAc;CACd,cAAc;CACd,YAAY;EACX,WAAW;EACX,WAAW;CACZ;AACD,CAAA;;;ACbA,MAAaE,4BACZ,IAAID,2BACH,2BAAA;AAGF,MAAaE,mCACZ,IAAIF,2BACH,kCAAA;;;mDCAF,MAAaG,4BAA4B;CACxCC,iBAAiB;CACjBC,eAAe;CACfC,gBAAgB;CAChBC,mBAAmB;CACnBC,mBAAmB;CACnBC,cAAc;CACdC,cAAc;AACf;AAsCA,MAAaC,wBAAwB;CACpCC,eAAe;CACfC,WAAW;CACXC,cAAc;AACf;AAoBA,MAAaC,yBAAyB,EACrCC,kBAAkB,qBACnB;AAKA,MAAaC,4BAA4B;CACxCC,wBAAwB;CACxBC,0BAA0B;CAC1BC,uBAAuB;8EAEvBC,eAAe;CACfC,iBAAiB;CACjBC,cAAc;CACdC,sBAAsB;CACtBC,wBAAwB;CACxBC,qBAAqB;AACtB;AA6CA,MAAaC,sBAAsB;CAClCC,IAAI;CACJC,UAAU;AACX;AAKA,MAAaC,0BAA0B;CACtCC,OAAO;CACPC,UAAU;CACVC,mBAAmB;AACpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjFA,MAAM+C,wBAAwB;AAC9B,MAAMC,2BAA2B;AAcjC,MAAMC,4BAA4B1C,iCAIhC,EAAE2C,aAAa,CAACC,iBAChB,WAAA;CACC,OAAO;EACNC,aAAa,KAAKA;EAClBC,MAAM,KAAKA;EACXC,MAAM,GAAG,KAAKC,OAAOC,QAAQC,OAAO,GAAGN;EACvCO,QAAQ,KAAKH,OAAOC,QAAQE;EAC5BC,QAAQ,EAAER,UAAU;EACpBS,iBAAiBC,UAChB5D,YAAY6D,YAAYD,OAAO;GAC9BE,MAAMnB,0BAA0BoB;GAChCC,SAAS;GACTC,QAAQpB,uBAAuBqB;EAChC,CAAA;CACF;AACD,CAAA;AAGF,SAASC,YAAYb,QAA2B;CAC/C,MAAME,SAASF,OAAOc,WAAWC,QAAQ,QAAQ,EAAA;CAGjD,OAAO;EACND,YAAYZ;EACZgB,WAAWhB,UAJKF,OAAOiB,gBAAgBzB;CAKxC;AACD;AAEA,SAAgB2B,0BACfC,SAAqC;CAErC,IAAIA,QAAQC,SAAS,KACpB,OAAOjC,sBAA4BkC;CAGpC,IAAIF,QAAQG,iBACX,OAAOnC,sBAA4BoC;CAGpC,OAAOpC,sBAA4BqC;AACpC;AA4ME/B,OAAAA,0BAA0B,OAAA,GAAA,QAQ1BzB,oBAAoB,GAAG,IAAA,GAAA,QAavByB,0BAA0B,SAAA,GAAA,QAqB1BzB,oBAAoB,GAAG,IAAA,GAAA,QAWvByB,0BAA0B,QAAA,GAAA,QAmC1BzB,oBAAoB,GAAG,IAAA,GAAA,QAavByB,0BAA0B,gBAAA;;;;;;GAzS5B,IAAagC,yBAAb,MAAaA,uBAAAA;;;;;;IAqMEC;;;;;IAQRC;;;;;IAaQC;;;;;IAqBRC;;;;;IAWQC;;;;;IAmCRC;;;;;IAaQC;;;;CAzSd,OAAOC,iBAAiB;EACvBjB,cAAczB;EACdS,SAAS;GACRE,QAAQ;GACRD,QAAQ;EACT;CACD;CAEiBiC;CACAC;CACAC;CACAC,qBAAAA,WAAAA,IAAAA,GAChB1F,8BAAAA;CACgB2F,aAAahE,cAAciE,iBAAiB,KAAA;CAC5CC,aAAahE,KAAK,KAAK8D,UAAU,CAAA,CAAEG,KACnDlE,QAAQmE,UAAyBA,KAAAA,GACjChE,KAAK,CAAA,CAAA;CAEWiE,0BAA0BrE,cAAciE,iBAEvD,EAAEnB,QAAQ/D,eAAeuF,KAAK,CAAA;CACfC,oBAKb;EACHC,cAAchG,aAAa,KAAA;EAC3BiG,gBAAgBjG,aAAa,KAAA;EAC7BkG,eAAelG,aAAa,KAAA;EAC5BmG,sBAAsBnG,aAAa,KAAA;CACpC;CACiBoG,gBAChB,IAAI9E,qBAA4C,GAAA;CAChC+E,yBAChB,IAAI9E,eAAAA;CACY+E,0BAA0B,IAAI/E,eAAAA;CAG9BgF,aAAaxG,4BAC7B,OACCyG,mBACAC,kBAAAA;EAEAD,kBAAkBE,6BAA4B;EAC9C,KAAKX,kBAAkBC,aAAaW,IAAI,IAAA;EACxC,IAAI;GACH,OAAO,MAAM,KAAKC,iBACjB,KAAKC,uBAAuB,CAAC,CAAA,GAC7BL,mBACAC,aAAAA;EAEF,UAAU;GACT,KAAKV,kBAAkBC,aAAaW,IAAI,KAAA;EACzC;CACD,CAAA;CAGQG;CACAC;CACAC;CAGAC;CACAC;CACAC;CACAC;CAET,IAActE,cAAqC;EAClD,OAAO,KAAKsC;CACb;CAEA,IAAcrC,OAAkB;EAC/B,OAAO,KAAKuC;CACb;CAEA,IAAcrC,SAA+C;EAC5D,OAAO,KAAKoC;CACb;CAEA,OAAOgC,sBAAsBhD,SAGF;EAC1B,OAAO,IAAIM,uBAAuBN,QAAQpB,QAAQoB,QAAQvB,WAAW;CACtE;CAEA,OAAOwE,aACNC,UACyB;EACzB,MAAMC,SAAS7C,uBAAuB0C,sBAAsB;GAC3DpE,QAAQsE,SAASE,IAAIxF,gCAAAA;GACrBa,aAAayE,SAASE,IAAItH,iBAAAA;EAC3B,CAAA;EACAoH,SACEE,IAAI5G,wBAAwB,IAAA,CAAA,EAC3B6G,gBAAgBF,OAAOG,QAAO,CAAA;EACjC,OAAOH;CACR;CAEA,YACCvE,QACAH,aACC;EACD7B,mBAAmB;GAClB2E,OAAO3C;GACP2E,eAAe5F;GACf6F,YAAYC,YACX/G,2BAA2B;IAC1B0C,MAAMnB,0BAA0ByF;IAChCnE,QAAQpB,uBAAuBqB;IAC/BmE,eAAe;IACfF;GACD,CAAA;EACF,CAAA;EACA,MAAMG,iBAAuD;GAC5DnB,IAAI7D,OAAO6D,MAAM/E,GAAAA;GACjBmG,UAAUjF,OAAOiF,WAAW,GAAA,CAAIlE,QAAQ,QAAQ,EAAA;GAChD+C,QAAQ9D,OAAO8D,SAAS,CAAA,EAAA,CAAIoB,IAAIrE,WAAAA;GAChCsE,WAAWnF,OAAOmF;GAClBlF,SAAS;IACRE,QACCH,OAAOC,SAASE,UAChBuB,uBAAuBQ,eAAejC,QAAQE;IAC/CD,QACCF,OAAOC,SAASC,UAChBwB,uBAAuBQ,eAAejC,QAAQC;GAChD;EACD;EAEA,KAAKiC,eAAetC;EACpB,KAAKuC,UAAU4C;EACf,KAAKnB,KAAKmB,eAAenB;EACzB,KAAKC,QAAQkB,eAAelB;EAC5B,KAAKzB,QAAQxC,YAAYC,KAAKsF,KAAK,EAClCC,YAAY;GACXC,YAAY,KAAK,YAAYvF;GAC7B8D,IAAI,KAAKA;EACV,EACD,CAAA;EACA,KAAKE,mBAAmBtG,eAAe,KAAKmF,uBAAuB;EACnE,KAAKoB,mBAAmBrG,4BACvB,KAAKiF,wBAAwB4B,IAAG,CAAA;EAEjC,KAAKP,kBAAkB7G,YACtB,KAAK4G,mBACJuB,aAAaA,UAAUC,kBAAkB,IAAA;EAE3C,KAAKtB,aAAa;GACjBnB,cAActF,eAAe,KAAKqF,kBAAkBC,YAAY;GAChEC,gBAAgBvF,eAAe,KAAKqF,kBAAkBE,cAAc;GACpEC,eAAexF,eAAe,KAAKqF,kBAAkBG,aAAa;GAClEC,sBAAsBzF,eACrB,KAAKqF,kBAAkBI,oBAAoB;EAE7C;EACA,KAAKiB,SAAS,KAAKhB;EACnB,KAAKV,WAAWgD,gBAAU;GACzB,KAAKnD,kBAAkBoD,OACtB,IAAIhJ,YAAY;IACfiJ,MAAMhJ,gBAAgBiJ;IACtBpF,MAAMnB,0BAA0BwG;IAChCnF,SAAS;IACTC,QAAQpB,uBAAuBqB;GAChC,CAAA,CAAA;GAED,KAAKqD,gBAAgBS,QAAO;GAC5B,KAAKV,iBAAiBU,QAAO;EAC9B,CAAA;EAEAjG,KAAK,KAAK2E,sBAAsB,CAAA,CAC9BV,KACA9D,UAAU,KAAK6D,UAAU,GACzBtE,eAAe2H,YACd,KAAKC,gBACJD,QAAQE,SACRF,QAAQvC,mBACRuC,QAAQtC,aAAa,CAAA,CAAA,CAAA,CAIvBiC,UAAU,KAAKpC,uBAAuB;EAExC,IAAIrD,OAAOiG,cAAc,MACxB,KAAKC,MAAK,CAAA,CAAGC,YAAM,CAEnB,CAAA;CAEF;CAEA,MAAMD,QAA4C;EACjD,MAAM3C,oBAAoB,KAAKjB,kBAAkB8D;EACjD,OAAO,MAAM,KAAKzE,OAAO4B,iBAAAA;CAC1B;CAEA,MACc5B,OACb4B,mBACAC,eACqC;EACrC,OAAO,MAAM,KAAKF,WAAWC,mBAAmBC,aAAAA;CACjD;CAEA,MACM5B,QACLR,UAAmC,CAAC,GACC;EACrC,MAAMiF,kBAAkBlJ,0BAA0BiE,SAAS,IAAA;EAC3D,MAAMmC,oBAAoB1G,8BACzB,KAAKyF,kBAAkB8D,OACvBhF,QAAQmC,iBAAiB;EAE1B8C,iBAAiBC,IAAI/C,iBAAAA;EACrB,OAAO,MAAM,KAAK1B,SAAST,SAASmC,iBAAAA;CACrC;CAEA,MACc1B,SACbT,SACAmC,mBACAC,eACqC;EACrCD,kBAAkBE,6BAA4B;EAC9C,OAAO,MAAM,KAAKE,iBACjB,KAAKC,uBAAuBxC,OAAAA,GAC5BmC,mBACAC,aAAAA;CAEF;;;;;;;IASA,MACM1B,OAAOV,UAAkC,CAAC,GAAkB;EACjE,MAAMiF,kBAAkBlJ,0BAA0BiE,SAAS,IAAA;EAC3D,MAAMmC,oBAAoB1G,8BACzB,KAAKyF,kBAAkB8D,OACvBhF,QAAQmC,iBAAiB;EAE1B8C,iBAAiBC,IAAI/C,iBAAAA;EACrB,OAAO,MAAM,KAAKxB,QAAQX,SAASmC,iBAAAA;CACpC;CAEA,MACcxB,QACbwE,UACAhD,mBACAC,eACgB;EAChBD,kBAAkBE,6BAA4B;EAC9C,KAAKX,kBAAkBG,cAAcS,IAAI,IAAA;EACzC,KAAK8C,WAAW;GACfC,MAAMnH,0BAA0BoH;GAChCnB,UAAU,KAAKoB,qBAAoB;EACpC,CAAA;EACA,IAAI;GACHpD,kBAAkBE,6BAA4B;GAC9C,KAAKb,wBAAwBc,IAAI;IAChCrC,QAAQ/D,eAAesJ;IACvBjE,OAAO;GACR,CAAA;GACAa,eAAeqD,cAAc,EAAEC,wBAAwB,KAAK,CAAA;GAC5D,KAAKN,WAAW;IACfC,MAAMnH,0BAA0ByH;IAChCxB,UAAU;GACX,CAAA;EACD,SAASjF,OAAO;GACf,KAAKkG,WAAW;IACfC,MAAMnH,0BAA0B0H;IAChCzB,UAAU,KAAKoB,qBAAoB;IACnCM,cAAchK,cAAcqD,KAAAA;GAC7B,CAAA;GACA,MAAMA;EACP,UAAU;GACT,KAAKwC,kBAAkBG,cAAcS,IAAI,KAAA;EAC1C;CACD;CAEA,MACM1B,kBACLZ,SACgB;EAChB,MAAMiF,kBAAkBlJ,0BAA0BiE,SAAS,IAAA;EAC3D,MAAMmC,oBAAoB1G,8BACzB,KAAKyF,kBAAkB8D,OACvBhF,QAAQmC,iBAAiB;EAE1B8C,iBAAiBC,IAAI/C,iBAAAA;EACrB,MAAM,KAAKtB,mBAAmBb,SAASmC,iBAAAA;CACxC;CAEA,MACctB,mBACbb,SACAmC,mBACA2D,gBACgB;EAChB3D,kBAAkBE,6BAA4B;EAC9C,MAAM0D,SAAS,KAAKhF,aAAagF;EACjC,IAAI,CAACA,QACJ,MAAM,IAAIzK,YAAY;GACrBiJ,MAAMhJ,gBAAgByK;GACtB5G,MAAMnB,0BAA0BgI;GAChC3G,SAAS;GACTC,QAAQpB,uBAAuBqB;EAChC,CAAA;EAED,MAAM0G,OAAO,KAAKC,sBAAsBnG,SAAS,gBAAA;EACjD,MAAMoG,sBACLpG,QAAQoG,uBAAuBpG,QAAQqG;EAExC,KAAK3E,kBAAkBI,qBAAqBQ,IAAI,IAAA;EAChD,KAAK8C,WAAW;GACfC,MAAMnH,0BAA0BoI;GAChCJ;EACD,CAAA;EACA,IAAI;GACH,MAAMH,OAAOQ,SAAS;IACrBC,KAAK7J,mBAAmB8J,MAAM,KAAKC,SAASR,MAAME,mBAAAA,CAAAA;IAClDO,QAAQxK,uBAAuByK;IAC/BC,MAAMzK,qBAAqB0K;GAC5B,CAAA;GACA3E,kBAAkBE,6BAA4B;GAC9C,KAAK+C,WAAW;IACfC,MAAMnH,0BAA0B6I;IAChCb;GACD,CAAA;EACD,SAAShH,OAAO;GACf,KAAKkG,WAAW;IACfC,MAAMnH,0BAA0B8I;IAChCd;IACAL,cAAchK,cAAcqD,KAAAA;GAC7B,CAAA;GACA,MAAMA;EACP,UAAU;GACT,KAAKwC,kBAAkBI,qBAAqBQ,IAAI,KAAA;EACjD;CACD;oDAGA2E,YAAYC,MAAiD;EAC5D,IAAIC;EAEJ,KAAK,MAAMjB,QAAQ,KAAKxD,OAAO;GAG9B,IAAI,EADHwE,SAAShB,KAAKxG,cAAcwH,KAAKG,WAAW,GAAGnB,KAAKxG,WAAW,EAAE,IAEjE;GAGD,IACC,CAACyH,eACDjB,KAAKxG,WAAW4H,SAASH,YAAYzH,WAAW4H,QAEhDH,cAAcjB;EAEhB;EAEA,OAAOiB;CACR;CAEAI,cAAc7H,YAAuD;EACpE,OAAO,KAAKgD,MAAM8E,MAAMtB,SAASA,KAAKxG,eAAeA,UAAAA;CACtD;+DAGA+H,SAASP,MAAuB;EAC/B,OAAO,KAAKD,YAAYC,IAAAA,MAAUQ,KAAAA;CACnC;mFAGAhB,SAASR,MAA6BE,qBAAsC;EAC3E,MAAMuB,OAAO,KAAK3G,QAAQ6C,UAAUqC,KAAKpG;EACzC,IAAIsG,qBAIH,OAAO,GAAGuB,KAAK,GAAGC,IAHCC,gBAAgB,GACjCxJ,2BAA2B+H,oBAC7B,CACkBwB,CAAAA,CAAOE,SAAQ;EAElC,OAAOH;CACR;CAEAI,sBACCrI,YACA0G,qBACgB;EAChB,MAAMF,OAAO,KAAKqB,cAAc7H,UAAAA;EAChC,OAAOwG,OAAO,KAAKQ,SAASR,MAAME,mBAAAA,IAAuB;CAC1D;;;;IAMA4B,mBACC3B,aACA4B,gBACwB;EACxB,IAAIA,mBAAmB,KACtB,OAAO;GAAE1D,MAAMzG,oBAAoBoK;GAAI3G,OAAO;EAAK;EAGpD,MAAM2E,OAAO,KAAKe,YAAYZ,WAAAA;EAC9B,IAAI,CAACH,MACJ,OAAO;GAAE3B,MAAMzG,oBAAoBoK;GAAI3G,OAAO;EAAK;EAGpD,OAAO;GACNgD,MAAMzG,oBAAoBqK;GAC1BlI,QAAQpC,wBAAwBuK;GAChCC,UAAU,KAAK3B,SAASR,MAAMG,WAAAA;EAC/B;CACD;CAEA/C,UAAgB;EACf,KAAKnC,WAAWmB,IAAI,IAAA;CACrB;CAEA,CAAC7F,kBAAwB;EACxB,KAAK6G,QAAO;CACb;CAEQd,uBACPxC,SACkC;EAClC,MAAMkH,OAAOlH,QAAQkH,QAAQ,KAAKlG,QAAQ+C;EAC1C,IAAI,CAACmD,MACJ,MAAM,IAAI5L,YAAY;GACrBiJ,MAAMhJ,gBAAgByK;GACtB5G,MAAMnB,0BAA0BqK;GAChChJ,SACC;GACDC,QAAQpB,uBAAuBqB;EAChC,CAAA;EAED,OAAO,EAAE0H,KAAK;CACf;CAEQf,sBACPnG,SACAuI,QACwB;EACxB,IAAIvI,QAAQN,YAAY;GACvB,MAAMwG,OAAO,KAAKqB,cAAcvH,QAAQN,UAAU;GAClD,IAAIwG,MACH,OAAOA;GAER,MAAM,IAAI5K,YAAY;IACrBiJ,MAAMhJ,gBAAgByK;IACtB5G,MAAMnB,0BAA0BuK;IAChClJ,SAAS,0BAA0BiJ,OAAO,wBAAwBvI,QAAQN,WAAW;IACrFH,QAAQpB,uBAAuBqB;GAChC,CAAA;EACD;EAEA,MAAM0G,OACL,OAAOlG,QAAQqG,gBAAgB,WAC5B,KAAKY,YAAYjH,QAAQqG,WAAW,IACpCqB,KAAAA;EACJ,IAAIxB,MACH,OAAOA;EAGR,MAAM,IAAI5K,YAAY;GACrBiJ,MAAMhJ,gBAAgByK;GACtB5G,MAAMnB,0BAA0BwK;GAChCnJ,SAAS,0BAA0BiJ,OAAO;GAC1ChJ,QAAQpB,uBAAuBqB;EAChC,CAAA;CACD;CAEA,MAAc+C,iBACbqC,SACAzC,mBACAC,eACqC;EACrCD,kBAAkBE,6BAA4B;EAC9C,MAAM8B,WAAW,MAAM7G,cACtBN,+BAKE;GACD4H;GACA8D,eAAe,KAAK1G;GACpB2G,gBAAgB,KAAK1G;GACrB2G,2BAA2B;IAAEzG;IAAmBC;GAAc;EAC/D,CAAA,CAAA,CAAGd,KAAKxE,oBAAAA,CAAAA,CAAAA;EAETqF,kBAAkBE,6BAA4B;EAC9C,OAAO8B;CACR;CAEA,MAAcQ,gBACb3E,SACAmC,mBACAC,eACqC;EACrCD,kBAAkBE,6BAA4B;EAC9C,KAAKX,kBAAkBE,eAAeU,IAAI,IAAA;EAC1C,MAAMuG,WAAW,KAAKrH,wBAAwB4B,IAAG;EACjD,MAAM0F,kBAAkBxM,uBAAuBuM,UAAU,EACxDtE,MAAMtI,2BAA2B8M,KAClC,CAAA;EACA,KAAKvH,wBAAwBc,IAAIwG,eAAAA;EACjC,KAAK1D,WAAW;GACfC,MAAMnH,0BAA0B8K;GAChC7E,UAAU,KAAKoB,qBAAoB;EACpC,CAAA;EACA,IAAI;GACH,MAAM0D,WAAW,MAAM,KAAKlI,aAAamI,UAAUC,QAAQ;IAC1D3C,KAAK,KAAKxF,QAAQ6C,UAAU7D,QAAQkH;IACpCkC,QAAQ;IACRC,SAAS,EAAEC,QAAQ,mBAAmB;IACtCnH;GACD,CAAA;GACA,IACC8G,SAAShJ,UAAU,OACnBgJ,SAAShJ,WAAW,OACpBgJ,SAAShJ,WAAW,KAEpB,MAAM3E,YAAYiO,iBAAiB;IAClCtJ,QAAQgJ,SAAShJ;IACjBuJ,MAAMP,SAASO;GAChB,CAAA;GAGDrH,kBAAkBE,6BAA4B;GAC9C,MAAM8B,WAAW,KAAKsF,sBAAsBzJ,QAAQkH,MAAM+B,QAAAA;GAC1D,KAAKzH,wBAAwBc,IAC5BhG,uBAAuBwM,iBAAiB;IACvCvE,MAAMtI,2BAA2ByN;IACjCnI,OAAO4C;GACR,CAAA,CAAA;GAED/B,eAAeqD,cAAc;IAC5BrB,eAAeD,SAASC;IACxBuF,cAAcxF,SAASwF;GACxB,CAAA;GACA,KAAKvE,WAAW;IACfC,MAAMnH,0BAA0B0L;IAChCzF;IACA+B,MAAM/B,SAAS+B;GAChB,CAAA;GACA,OAAO/B;EACR,SAASjF,OAAO;GACf,KAAKsC,wBAAwBc,IAC5BhG,uBAAuBwM,iBAAiB;IACvCvE,MAAMtI,2BAA2B4N;IACjC3K;GACD,CAAA,CAAA;GAED,KAAKkG,WAAW;IACfC,MAAMnH,0BAA0B4L;IAChC3F,UAAU,KAAKoB,qBAAoB;IACnCM,cAAchK,cAAcqD,KAAAA;GAC7B,CAAA;GACA,MAAMA;EACP,UAAU;GACT,KAAKwC,kBAAkBE,eAAeU,IAAI,KAAA;EAC3C;CACD;CAEQmH,sBACPvC,MACA+B,UAC4B;EAC5B,MAAM9I,kBACL8I,SAASI,QAAQ,uBACjBJ,SAASI,QAAQ,uBACjB;EACD,MAAMnD,OAAO,KAAKe,YAAYC,IAAAA;EAC9B,MAAMyC,eAAe5J,0BAA0B;GAC9CE,QAAQgJ,SAAShJ;GACjBE;GACA4J,aAAa7C;EACd,CAAA;EACA,OAAO;GACN9C,eAAeuF,iBAAiB3L,sBAA4BkC;GAC5DyJ;GACA1J,QAAQgJ,SAAShJ;GACjBiH;GACA/G;GACA+F;EACD;CACD;CAEQX,uBAAyD;EAChE,MAAMpB,WAAW,KAAK3C,wBAAwB4B,IAAG;EACjD,OAAOe,SAASlE,WAAW/D,eAAe8N,aACzC7F,SAASlE,WAAW/D,eAAesJ,YACnCrB,SAASlE,WAAW/D,eAAe+N,QACjC9F,SAAS5C,QACT;CACJ;CAEQ6D,WACP8E,OACO;EACP,KAAKnI,cAAcoI,KAAK;GACvB,GAAGD;GACHE,IAAI,KAAKrJ,aAAasJ,KAAKC,IAAG;GAC9BnH,QAAQ,EACPV,IAAI,KAAKA,GACV;EACD,CAAA;CACD;AACD;;;ACpuBA,SAAgBkI,wBACfC,SAAuC;CAEvC,OAAO,CACN;EACCC,SAASH;EACTI,UAAUF,QAAQG;CACnB,GACA;EACCF,SAASJ;EACTO,aAAaC,aACZT,uBAAuBU,aAAaD,QAAAA;EACrCE,MAAM,CAACZ,cAAe;CACvB,CACA;AACF"}
+{"version":3,"file":"index.mjs","names":["ClientError","ClientErrorKind","encodeUint8ArrayToBase64","createBasicAuthorizationHeaderValue","options","username","includes","kind","Configuration","code","message","source","TextEncoder","encode","password","ClientError","BasicAuthContextErrorCode","OperationFailed","InvalidConfig","ClientDisposed","RouterUnavailable","ProbePathRequired","ZoneNotFound","ZoneRequired","BasicAuthContextSource","BasicAuthContext","clientErrorFromBasicAuthError","error","options","fromUnknown","code","message","source","span","type","defineType","BasicAuthZoneConfigSchema","zonePrefix","BasicAuthContextClientConfigSchema","baseUrl","zones","array","atLeastLength","SecuritydeptInjectionToken","BASIC_AUTH_CONTEXT_CLIENT","BASIC_AUTH_CONTEXT_CLIENT_CONFIG","BasicAuthBoundaryKind","Authenticated","Challenge","Unauthorized","BasicAuthContextEventType","BoundaryRefreshStarted","BoundaryRefreshSucceeded","BoundaryRefreshFailed","LogoutStarted","LogoutSucceeded","LogoutFailed","LoginRedirectStarted","LoginRedirectSucceeded","LoginRedirectFailed","AuthGuardResultKind","Ok","Redirect","AuthGuardRedirectStatus","Found","SeeOther","TemporaryRedirect","ClientError","ClientErrorKind","createCancellationTokenSource","createLinkedCancellationToken","createOnceAsyncLockCallable","createSignal","defineInstrumentMethodDecorator","ENVIRONMENT_TOKEN","injectDisposableStackFrom","mapResource","ResourceSnapshotUpdateKind","ResourceStatus","RouterNavigationIntent","RouterNavigationMode","readonlySignal","reduceResourceSnapshot","resourceFromSnapshots","SecuritydeptDestroyRef","SpanSharedAttributeName","SYMBOL_DISPOSE","throwValidationClientError","UriReferenceString","validateTraitInput","withDisposableStack","commandResponseData","concatCommand","dispatchCommandLocallyToStream","RxEventSubject","RxStateSignal","filter","from","lastValueFrom","take","takeUntil","v7","uuidv7","BasicAuthContextErrorCode","BasicAuthContextSource","clientErrorFromBasicAuthError","BasicAuthContextClientConfigSchema","BASIC_AUTH_CONTEXT_CLIENT_CONFIG","AuthGuardRedirectStatus","AuthGuardResultKind","BasicAuthBoundaryKind","BasicAuthBoundaryKindValues","BasicAuthContextEventType","DEFAULT_LOGIN_SUBPATH","POST_AUTH_REDIRECT_PARAM","instrumentBasicAuthMethod","factoryArgs","operation","environment","span","name","config","tracing","prefix","target","traceAttributes","clientErrorFromUnknown","error","options","resolveZone","zonePrefix","replace","loginSub","loginSubpath","loginPath","readBasicAuthBoundaryKind","status","Authenticated","challengeHeader","Challenge","Unauthorized","BasicAuthContextClient","_start","refresh","_refresh","logout","_logout","loginWithRedirect","_loginWithRedirect","defaultOptions","_environment","_config","_span","_rootCancellation","_destroyed","fromInitialValue","destroyed$","pipe","value","_boundarySnapshotSignal","Idle","_operationSignals","startPending","refreshPending","logoutPending","loginRedirectPending","_eventSubject","_refreshCommandSubject","_refreshResponseSubject","_startOnce","cancellationToken","operationSpan","throwIfCancellationRequested","set","_dispatchRefresh","_resolveRefreshOptions","id","zones","boundarySnapshot","boundaryResource","isAuthenticated","operations","events","fromEnvironmentConfig","fromInjector","injector","client","get","onDestroy","dispose","bundledSchema","onInvalid","failure","code","InvalidConfig","source","BasicAuthContext","messagePrefix","resolvedConfig","baseUrl","map","probePath","fork","attributes","ClientName","ClientId","snapshot","authenticated","subscribe","cancel","kind","Cancelled","ClientDisposed","message","command","_executeRefresh","payload","autoStart","start","catch","token","disposableStack","use","_options","_emitEvent","type","LogoutStarted","_readCurrentSnapshot","Resolved","setTraceAttributes","localProjectionCleared","LogoutSucceeded","clientError","LogoutFailed","_operationSpan","router","Configuration","RouterUnavailable","zone","_resolveZoneForAction","postAuthRedirectUri","currentPath","LoginRedirectStarted","navigate","url","parse","loginUrl","intent","AuthRedirect","mode","External","LoginRedirectSucceeded","LoginRedirectFailed","zoneForPath","path","matchedZone","matches","startsWith","length","zoneForPrefix","find","isInZone","undefined","base","params","URLSearchParams","toString","loginUrlForZonePrefix","handleUnauthorized","responseStatus","Ok","Redirect","Found","location","complete","ProbePathRequired","action","ZoneNotFound","ZoneRequired","requestStream","responseStream","createCommandExtra","previous","loadingSnapshot","Load","BoundaryRefreshStarted","response","transport","execute","method","headers","accept","fromHttpResponse","body","_snapshotFromResponse","Resolve","boundaryKind","BoundaryRefreshSucceeded","Fail","BoundaryRefreshFailed","requestPath","Reloading","Error","input","next","at","time","now","INJECTOR_TOKEN","BasicAuthContextClient","BASIC_AUTH_CONTEXT_CLIENT","BASIC_AUTH_CONTEXT_CLIENT_CONFIG","provideBasicAuthContext","options","provide","useValue","config","useFactory","injector","fromInjector","deps"],"sources":["../src/authorization-header.ts","../src/error.ts","../src/schemas.ts","../src/tokens.ts","../src/types.ts","../src/client.ts","../src/providers.ts"],"sourcesContent":["import {\n\tClientError,\n\tClientErrorKind,\n\tencodeUint8ArrayToBase64,\n} from \"@securitydept/client\";\n\nexport interface CreateBasicAuthorizationHeaderValueOptions {\n\treadonly username: string;\n\treadonly password: string;\n}\n\nexport function createBasicAuthorizationHeaderValue(\n\toptions: CreateBasicAuthorizationHeaderValueOptions,\n): string {\n\tif (options.username.includes(\":\")) {\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\tcode: \"basic_auth.authorization_header.username_contains_colon\",\n\t\t\tmessage: \"A Basic authentication username cannot contain a colon.\",\n\t\t\tsource: \"basic_auth\",\n\t\t});\n\t}\n\n\treturn `Basic ${encodeUint8ArrayToBase64(\n\t\tnew TextEncoder().encode(`${options.username}:${options.password}`),\n\t)}`;\n}\n","import { ClientError, type SpanTrait } from \"@securitydept/client\";\n\nexport const BasicAuthContextErrorCode = {\n\tOperationFailed: \"basic_auth.operation_failed\",\n\tInvalidConfig: \"basic_auth.invalid_config\",\n\tClientDisposed: \"basic_auth.client_disposed\",\n\tRouterUnavailable: \"basic_auth.router_unavailable\",\n\tProbePathRequired: \"basic_auth.probe_path_required\",\n\tZoneNotFound: \"basic_auth.zone_not_found\",\n\tZoneRequired: \"basic_auth.zone_required\",\n} as const;\n\nexport type BasicAuthContextErrorCode =\n\t(typeof BasicAuthContextErrorCode)[keyof typeof BasicAuthContextErrorCode];\n\nexport const BasicAuthContextSource = {\n\tBasicAuthContext: \"basic-auth-context\",\n} as const;\n\nexport type BasicAuthContextSource =\n\t(typeof BasicAuthContextSource)[keyof typeof BasicAuthContextSource];\n\nexport function clientErrorFromBasicAuthError(\n\terror: unknown,\n\toptions: { span: SpanTrait | undefined },\n): ClientError {\n\treturn ClientError.fromUnknown(error, {\n\t\tcode: BasicAuthContextErrorCode.OperationFailed,\n\t\tmessage: \"The Basic Auth operation failed unexpectedly\",\n\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\tspan: options.span,\n\t});\n}\n","import { type as defineType } from \"arktype\";\n\nexport const BasicAuthZoneConfigSchema = defineType({\n\tzonePrefix: \"string > 0\",\n\t\"loginSubpath?\": \"string\",\n});\n\nexport const BasicAuthContextClientConfigSchema = defineType({\n\t\"id?\": \"string > 0\",\n\tbaseUrl: \"string > 0\",\n\tzones: BasicAuthZoneConfigSchema.array().atLeastLength(1),\n\t\"probePath?\": \"string > 0\",\n\t\"autoStart?\": \"boolean\",\n\t\"tracing?\": {\n\t\t\"target?\": \"string > 0\",\n\t\t\"prefix?\": \"string > 0\",\n\t},\n});\n","import { SecuritydeptInjectionToken } from \"@securitydept/client\";\nimport { type BasicAuthContextClient } from \"./client\";\nimport { type BasicAuthContextClientConfig } from \"./types\";\n\nexport const BASIC_AUTH_CONTEXT_CLIENT =\n\tnew SecuritydeptInjectionToken<BasicAuthContextClient>(\n\t\t\"BASIC_AUTH_CONTEXT_CLIENT\",\n\t);\n\nexport const BASIC_AUTH_CONTEXT_CLIENT_CONFIG =\n\tnew SecuritydeptInjectionToken<BasicAuthContextClientConfig>(\n\t\t\"BASIC_AUTH_CONTEXT_CLIENT_CONFIG\",\n\t);\n","// --- Basic Auth Context Client types ---\n\nimport {\n\ttype CancellationTokenOptions,\n\ttype ClientError,\n\ttype ReadableSignalTrait,\n\ttype ResourceSnapshot,\n\ttype ResourceTrait,\n} from \"@securitydept/client\";\n\nexport interface BasicAuthZoneConfig {\n\t/** URL path prefix for this zone (e.g. \"/basic\"). */\n\tzonePrefix: string;\n\t/** Login subpath relative to zone prefix (default: \"/login\"). */\n\tloginSubpath?: string;\n}\n\n/** Configuration for the Basic Auth Context Client. */\nexport interface BasicAuthContextClientConfig {\n\tid?: string;\n\t/** Base URL of the SecurityDept server. */\n\tbaseUrl: string;\n\t/** One or more Basic Auth zones to manage. */\n\tzones: BasicAuthZoneConfig[];\n\t/** Protected endpoint used by start()/refresh() to observe the boundary. */\n\tprobePath?: string;\n\tautoStart?: boolean;\n\ttracing?: BasicAuthContextClientTracingOptions;\n}\n\nexport interface BasicAuthContextClientTracingOptions {\n\ttarget?: string;\n\tprefix?: string;\n}\n\nexport interface ResolvedBasicAuthContextClientConfig {\n\tid: string;\n\tbaseUrl: string;\n\tzones: readonly ResolvedBasicAuthZone[];\n\tprobePath?: string;\n\ttracing: Required<BasicAuthContextClientTracingOptions>;\n}\n\nexport const BasicAuthBoundaryKind = {\n\tAuthenticated: \"authenticated\",\n\tChallenge: \"challenge\",\n\tUnauthorized: \"unauthorized\",\n} as const;\n\nexport type BasicAuthBoundaryKind =\n\t(typeof BasicAuthBoundaryKind)[keyof typeof BasicAuthBoundaryKind];\n\nexport interface BasicAuthBoundaryObservation {\n\tstatus: number;\n\tchallengeHeader?: string | null;\n\trequestPath?: string;\n}\n\nexport interface BasicAuthBoundarySnapshot {\n\tauthenticated: boolean;\n\tboundaryKind: BasicAuthBoundaryKind;\n\tstatus: number;\n\tpath: string;\n\tchallengeHeader: string | null;\n\tzone?: ResolvedBasicAuthZone;\n}\n\nexport const BasicAuthContextEventType = {\n\tBoundaryRefreshStarted: \"basic_auth.boundary.refresh.started\",\n\tBoundaryRefreshSucceeded: \"basic_auth.boundary.refresh.succeeded\",\n\tBoundaryRefreshFailed: \"basic_auth.boundary.refresh.failed\",\n\t/** These logout events describe local boundary-projection clearing only. */\n\tLogoutStarted: \"basic_auth.logout.started\",\n\tLogoutSucceeded: \"basic_auth.logout.succeeded\",\n\tLogoutFailed: \"basic_auth.logout.failed\",\n\tLoginRedirectStarted: \"basic_auth.login.redirect.started\",\n\tLoginRedirectSucceeded: \"basic_auth.login.redirect.succeeded\",\n\tLoginRedirectFailed: \"basic_auth.login.redirect.failed\",\n} as const;\n\nexport type BasicAuthContextEventType =\n\t(typeof BasicAuthContextEventType)[keyof typeof BasicAuthContextEventType];\n\ninterface BasicAuthContextEventBase {\n\treadonly at: number;\n\treadonly client: {\n\t\treadonly id: string;\n\t};\n}\n\ntype BasicAuthContextEventData =\n\t| {\n\t\t\treadonly type: typeof BasicAuthContextEventType.BoundaryRefreshStarted;\n\t\t\treadonly snapshot: BasicAuthBoundarySnapshot | null;\n\t  }\n\t| {\n\t\t\treadonly type: typeof BasicAuthContextEventType.BoundaryRefreshSucceeded;\n\t\t\treadonly snapshot: BasicAuthBoundarySnapshot;\n\t\t\treadonly zone?: ResolvedBasicAuthZone;\n\t  }\n\t| {\n\t\t\treadonly type: typeof BasicAuthContextEventType.BoundaryRefreshFailed;\n\t\t\treadonly snapshot: BasicAuthBoundarySnapshot | null;\n\t\t\treadonly error: ClientError;\n\t  }\n\t| {\n\t\t\treadonly type: typeof BasicAuthContextEventType.LogoutStarted;\n\t\t\treadonly snapshot: BasicAuthBoundarySnapshot | null;\n\t  }\n\t| {\n\t\t\treadonly type: typeof BasicAuthContextEventType.LogoutSucceeded;\n\t\t\treadonly snapshot: null;\n\t  }\n\t| {\n\t\t\treadonly type: typeof BasicAuthContextEventType.LogoutFailed;\n\t\t\treadonly snapshot: BasicAuthBoundarySnapshot | null;\n\t\t\treadonly error: ClientError;\n\t  }\n\t| {\n\t\t\treadonly type:\n\t\t\t\t| typeof BasicAuthContextEventType.LoginRedirectStarted\n\t\t\t\t| typeof BasicAuthContextEventType.LoginRedirectSucceeded;\n\t\t\treadonly zone: ResolvedBasicAuthZone;\n\t  }\n\t| {\n\t\t\treadonly type: typeof BasicAuthContextEventType.LoginRedirectFailed;\n\t\t\treadonly zone: ResolvedBasicAuthZone;\n\t\t\treadonly error: ClientError;\n\t  };\n\nexport type BasicAuthContextEvent = BasicAuthContextEventBase &\n\tBasicAuthContextEventData;\n\nexport type BasicAuthContextEventInput = BasicAuthContextEventData;\n\nexport interface BasicAuthContextOperationSignals {\n\treadonly startPending: ReadableSignalTrait<boolean>;\n\treadonly refreshPending: ReadableSignalTrait<boolean>;\n\treadonly logoutPending: ReadableSignalTrait<boolean>;\n\treadonly loginRedirectPending: ReadableSignalTrait<boolean>;\n}\n\nexport interface BasicAuthRefreshOptions extends CancellationTokenOptions {\n\tpath?: string;\n}\n\nexport type BasicAuthZoneSelectionOptions =\n\t| {\n\t\t\tcurrentPath: string;\n\t\t\tzonePrefix?: never;\n\t  }\n\t| {\n\t\t\tzonePrefix: string;\n\t\t\tcurrentPath?: never;\n\t  };\n\n/** Options for clearing the client's in-memory boundary projection. */\nexport interface BasicAuthLogoutOptions extends CancellationTokenOptions {}\n\nexport type BasicAuthLoginWithRedirectOptions = BasicAuthZoneSelectionOptions &\n\tCancellationTokenOptions & {\n\t\tpostAuthRedirectUri?: string;\n\t};\n\nexport const AuthGuardResultKind = {\n\tOk: \"ok\",\n\tRedirect: \"redirect\",\n} as const;\n\nexport type AuthGuardResultKind =\n\t(typeof AuthGuardResultKind)[keyof typeof AuthGuardResultKind];\n\nexport const AuthGuardRedirectStatus = {\n\tFound: 302,\n\tSeeOther: 303,\n\tTemporaryRedirect: 307,\n} as const;\n\nexport type AuthGuardRedirectStatus =\n\t(typeof AuthGuardRedirectStatus)[keyof typeof AuthGuardRedirectStatus];\n\n/** Redirect instruction — framework-neutral result. */\nexport type AuthGuardResult<T> =\n\t| { kind: typeof AuthGuardResultKind.Ok; value: T }\n\t| {\n\t\t\tkind: typeof AuthGuardResultKind.Redirect;\n\t\t\tstatus: AuthGuardRedirectStatus;\n\t\t\tlocation: string;\n\t  };\n\n/** Resolved zone with computed paths. */\nexport interface ResolvedBasicAuthZone {\n\tzonePrefix: string;\n\tloginPath: string;\n}\n\nexport interface BasicAuthContextClientStateSignals {\n\treadonly boundarySnapshot: ReadableSignalTrait<\n\t\tResourceSnapshot<BasicAuthBoundarySnapshot | null>\n\t>;\n\treadonly boundaryResource: ResourceTrait<BasicAuthBoundarySnapshot | null>;\n\treadonly isAuthenticated: ResourceTrait<boolean>;\n}\n","import {\n\ttype CancellationTokenSourceTrait,\n\ttype CancellationTokenTrait,\n\tClientError,\n\tClientErrorKind,\n\tcreateCancellationTokenSource,\n\tcreateLinkedCancellationToken,\n\tcreateOnceAsyncLockCallable,\n\tcreateSignal,\n\ttype DisposableTrait,\n\tdefineInstrumentMethodDecorator,\n\tENVIRONMENT_TOKEN,\n\ttype EventStreamTrait,\n\ttype FoundationEnvironment,\n\tinjectDisposableStackFrom,\n\tmapResource,\n\ttype OperationSpanTrait,\n\ttype ReadableSignalTrait,\n\ttype ResourceSnapshot,\n\tResourceSnapshotUpdateKind,\n\tResourceStatus,\n\ttype ResourceTrait,\n\tRouterNavigationIntent,\n\tRouterNavigationMode,\n\treadonlySignal,\n\treduceResourceSnapshot,\n\tresourceFromSnapshots,\n\tSecuritydeptDestroyRef,\n\ttype SecuritydeptInjectorTrait,\n\tSpanSharedAttributeName,\n\ttype SpanTrait,\n\tSYMBOL_DISPOSE,\n\tthrowValidationClientError,\n\tUriReferenceString,\n\tvalidateTraitInput,\n\ttype WritableSignalTrait,\n\twithDisposableStack,\n} from \"@securitydept/client\";\nimport {\n\ttype Command,\n\ttype CommandResponse,\n\tcommandResponseData,\n\tconcatCommand,\n\tdispatchCommandLocallyToStream,\n\tRxEventSubject,\n\tRxStateSignal,\n} from \"@securitydept/client/rx\";\nimport { filter, from, lastValueFrom, take, takeUntil } from \"rxjs\";\nimport { v7 as uuidv7 } from \"uuid\";\nimport {\n\tBasicAuthContextErrorCode,\n\tBasicAuthContextSource,\n\tclientErrorFromBasicAuthError,\n} from \"./error\";\nimport { BasicAuthContextClientConfigSchema } from \"./schemas\";\nimport { BASIC_AUTH_CONTEXT_CLIENT_CONFIG } from \"./tokens\";\nimport {\n\tAuthGuardRedirectStatus,\n\ttype AuthGuardResult,\n\tAuthGuardResultKind,\n\ttype BasicAuthBoundaryKind,\n\tBasicAuthBoundaryKind as BasicAuthBoundaryKindValues,\n\ttype BasicAuthBoundaryObservation,\n\ttype BasicAuthBoundarySnapshot,\n\ttype BasicAuthContextClientConfig,\n\ttype BasicAuthContextEvent,\n\ttype BasicAuthContextEventInput,\n\tBasicAuthContextEventType,\n\ttype BasicAuthContextOperationSignals,\n\ttype BasicAuthLoginWithRedirectOptions,\n\ttype BasicAuthLogoutOptions,\n\ttype BasicAuthRefreshOptions,\n\ttype BasicAuthZoneConfig,\n\ttype BasicAuthZoneSelectionOptions,\n\ttype ResolvedBasicAuthContextClientConfig,\n\ttype ResolvedBasicAuthZone,\n} from \"./types\";\n\nconst DEFAULT_LOGIN_SUBPATH = \"/login\";\nconst POST_AUTH_REDIRECT_PARAM = \"post_auth_redirect_uri\";\n\ninterface BasicAuthCommandExtra {\n\tcancellationToken: CancellationTokenTrait;\n\toperationSpan?: OperationSpanTrait;\n}\n\ntype ResolvedBasicAuthRefreshOptions = { path: string };\n\ntype BasicAuthRefreshCommand = Command<\n\tResolvedBasicAuthRefreshOptions,\n\tBasicAuthCommandExtra\n>;\n\nconst instrumentBasicAuthMethod = defineInstrumentMethodDecorator<\n\t[operation: string],\n\tBasicAuthContextClient\n>(\n\t({ factoryArgs: [operation] }) =>\n\t\tfunction (this: BasicAuthContextClient) {\n\t\t\treturn {\n\t\t\t\tenvironment: this.environment,\n\t\t\t\tspan: this.span,\n\t\t\t\tname: `${this.config.tracing.prefix}.${operation}`,\n\t\t\t\ttarget: this.config.tracing.target,\n\t\t\t\ttraceAttributes: { operation },\n\t\t\t\tclientErrorFromUnknown: (error, options) =>\n\t\t\t\t\tclientErrorFromBasicAuthError(error, options),\n\t\t\t};\n\t\t},\n);\n\nfunction resolveZone(config: BasicAuthZoneConfig): ResolvedBasicAuthZone {\n\tconst prefix = config.zonePrefix.replace(/\\/+$/, \"\");\n\tconst loginSub = config.loginSubpath ?? DEFAULT_LOGIN_SUBPATH;\n\n\treturn {\n\t\tzonePrefix: prefix,\n\t\tloginPath: prefix + loginSub,\n\t};\n}\n\nexport function readBasicAuthBoundaryKind(\n\toptions: BasicAuthBoundaryObservation,\n): BasicAuthBoundaryKind {\n\tif (options.status < 400) {\n\t\treturn BasicAuthBoundaryKindValues.Authenticated;\n\t}\n\n\tif (options.challengeHeader) {\n\t\treturn BasicAuthBoundaryKindValues.Challenge;\n\t}\n\n\treturn BasicAuthBoundaryKindValues.Unauthorized;\n}\n\n/**\n * Basic Auth Context Client.\n *\n * Owns zone-aware Basic Auth boundary observations and login navigation.\n * It does not manage browser credentials or principal data.\n */\nexport class BasicAuthContextClient implements DisposableTrait {\n\tstatic defaultOptions = {\n\t\tloginSubpath: DEFAULT_LOGIN_SUBPATH,\n\t\ttracing: {\n\t\t\ttarget: \"basic-auth-context-client\",\n\t\t\tprefix: \"basic_auth_context\",\n\t\t},\n\t} as const;\n\n\tprivate readonly _environment: FoundationEnvironment;\n\tprivate readonly _config: ResolvedBasicAuthContextClientConfig;\n\tprivate readonly _span: SpanTrait;\n\tprivate readonly _rootCancellation: CancellationTokenSourceTrait =\n\t\tcreateCancellationTokenSource();\n\tprivate readonly _destroyed = RxStateSignal.fromInitialValue(false);\n\tprivate readonly destroyed$ = from(this._destroyed).pipe(\n\t\tfilter((value): value is true => value),\n\t\ttake(1),\n\t);\n\tprivate readonly _boundarySnapshotSignal = RxStateSignal.fromInitialValue<\n\t\tResourceSnapshot<BasicAuthBoundarySnapshot | null>\n\t>({ status: ResourceStatus.Idle });\n\tprivate readonly _operationSignals: {\n\t\treadonly startPending: WritableSignalTrait<boolean>;\n\t\treadonly refreshPending: WritableSignalTrait<boolean>;\n\t\treadonly logoutPending: WritableSignalTrait<boolean>;\n\t\treadonly loginRedirectPending: WritableSignalTrait<boolean>;\n\t} = {\n\t\tstartPending: createSignal(false),\n\t\trefreshPending: createSignal(false),\n\t\tlogoutPending: createSignal(false),\n\t\tloginRedirectPending: createSignal(false),\n\t};\n\tprivate readonly _eventSubject = new RxEventSubject<BasicAuthContextEvent>();\n\tprivate readonly _refreshCommandSubject =\n\t\tnew RxEventSubject<BasicAuthRefreshCommand>();\n\tprivate readonly _refreshResponseSubject = new RxEventSubject<\n\t\tCommandResponse<BasicAuthRefreshCommand, BasicAuthBoundarySnapshot>\n\t>();\n\tprivate readonly _startOnce = createOnceAsyncLockCallable(\n\t\tasync (\n\t\t\tcancellationToken: CancellationTokenTrait,\n\t\t\toperationSpan?: OperationSpanTrait,\n\t\t) => {\n\t\t\tcancellationToken.throwIfCancellationRequested();\n\t\t\tthis._operationSignals.startPending.set(true);\n\t\t\ttry {\n\t\t\t\treturn await this._dispatchRefresh(\n\t\t\t\t\tthis._resolveRefreshOptions({}),\n\t\t\t\t\tcancellationToken,\n\t\t\t\t\toperationSpan,\n\t\t\t\t);\n\t\t\t} finally {\n\t\t\t\tthis._operationSignals.startPending.set(false);\n\t\t\t}\n\t\t},\n\t);\n\n\treadonly id: string;\n\treadonly zones: readonly ResolvedBasicAuthZone[];\n\treadonly boundarySnapshot: ReadableSignalTrait<\n\t\tResourceSnapshot<BasicAuthBoundarySnapshot | null>\n\t>;\n\treadonly boundaryResource: ResourceTrait<BasicAuthBoundarySnapshot | null>;\n\treadonly isAuthenticated: ResourceTrait<boolean>;\n\treadonly operations: BasicAuthContextOperationSignals;\n\treadonly events: EventStreamTrait<BasicAuthContextEvent>;\n\n\tprotected get environment(): FoundationEnvironment {\n\t\treturn this._environment;\n\t}\n\n\tprotected get span(): SpanTrait {\n\t\treturn this._span;\n\t}\n\n\tprotected get config(): ResolvedBasicAuthContextClientConfig {\n\t\treturn this._config;\n\t}\n\n\tstatic fromEnvironmentConfig(options: {\n\t\treadonly config: BasicAuthContextClientConfig;\n\t\treadonly environment: FoundationEnvironment;\n\t}): BasicAuthContextClient {\n\t\treturn new BasicAuthContextClient(options.config, options.environment);\n\t}\n\n\tstatic fromInjector(\n\t\tinjector: SecuritydeptInjectorTrait,\n\t): BasicAuthContextClient {\n\t\tconst client = BasicAuthContextClient.fromEnvironmentConfig({\n\t\t\tconfig: injector.get(BASIC_AUTH_CONTEXT_CLIENT_CONFIG),\n\t\t\tenvironment: injector.get(ENVIRONMENT_TOKEN),\n\t\t});\n\t\tinjector\n\t\t\t.get(SecuritydeptDestroyRef, null)\n\t\t\t?.onDestroy(() => client.dispose());\n\t\treturn client;\n\t}\n\n\tprotected constructor(\n\t\tconfig: BasicAuthContextClientConfig,\n\t\tenvironment: FoundationEnvironment,\n\t) {\n\t\tvalidateTraitInput({\n\t\t\tvalue: config,\n\t\t\tbundledSchema: BasicAuthContextClientConfigSchema,\n\t\t\tonInvalid: (failure) =>\n\t\t\t\tthrowValidationClientError({\n\t\t\t\t\tcode: BasicAuthContextErrorCode.InvalidConfig,\n\t\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t\t\tmessagePrefix: \"BasicAuthContextClient could not validate config\",\n\t\t\t\t\tfailure,\n\t\t\t\t}),\n\t\t});\n\t\tconst resolvedConfig: ResolvedBasicAuthContextClientConfig = {\n\t\t\tid: config.id ?? uuidv7(),\n\t\t\tbaseUrl: (config.baseUrl ?? \"\").replace(/\\/+$/, \"\"),\n\t\t\tzones: (config.zones ?? []).map(resolveZone),\n\t\t\tprobePath: config.probePath,\n\t\t\ttracing: {\n\t\t\t\ttarget:\n\t\t\t\t\tconfig.tracing?.target ??\n\t\t\t\t\tBasicAuthContextClient.defaultOptions.tracing.target,\n\t\t\t\tprefix:\n\t\t\t\t\tconfig.tracing?.prefix ??\n\t\t\t\t\tBasicAuthContextClient.defaultOptions.tracing.prefix,\n\t\t\t},\n\t\t};\n\n\t\tthis._environment = environment;\n\t\tthis._config = resolvedConfig;\n\t\tthis.id = resolvedConfig.id;\n\t\tthis.zones = resolvedConfig.zones;\n\t\tthis._span = environment.span.fork({\n\t\t\tattributes: {\n\t\t\t\t[SpanSharedAttributeName.ClientName]: this.constructor.name,\n\t\t\t\t[SpanSharedAttributeName.ClientId]: this.id,\n\t\t\t},\n\t\t});\n\t\tthis.boundarySnapshot = readonlySignal(this._boundarySnapshotSignal);\n\t\tthis.boundaryResource = resourceFromSnapshots(() =>\n\t\t\tthis._boundarySnapshotSignal.get(),\n\t\t);\n\t\tthis.isAuthenticated = mapResource(\n\t\t\tthis.boundaryResource,\n\t\t\t(snapshot) => snapshot?.authenticated === true,\n\t\t);\n\t\tthis.operations = {\n\t\t\tstartPending: readonlySignal(this._operationSignals.startPending),\n\t\t\trefreshPending: readonlySignal(this._operationSignals.refreshPending),\n\t\t\tlogoutPending: readonlySignal(this._operationSignals.logoutPending),\n\t\t\tloginRedirectPending: readonlySignal(\n\t\t\t\tthis._operationSignals.loginRedirectPending,\n\t\t\t),\n\t\t};\n\t\tthis.events = this._eventSubject;\n\t\tthis.destroyed$.subscribe(() => {\n\t\t\tthis._rootCancellation.cancel(\n\t\t\t\tnew ClientError({\n\t\t\t\t\tkind: ClientErrorKind.Cancelled,\n\t\t\t\t\tcode: BasicAuthContextErrorCode.ClientDisposed,\n\t\t\t\t\tmessage: \"BasicAuthContextClient has been disposed.\",\n\t\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tthis.isAuthenticated.dispose();\n\t\t\tthis.boundaryResource.dispose();\n\t\t});\n\n\t\tfrom(this._refreshCommandSubject)\n\t\t\t.pipe(\n\t\t\t\ttakeUntil(this.destroyed$),\n\t\t\t\tconcatCommand((command) =>\n\t\t\t\t\tthis._executeRefresh(\n\t\t\t\t\t\tcommand.payload,\n\t\t\t\t\t\tcommand.cancellationToken,\n\t\t\t\t\t\tcommand.operationSpan,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t)\n\t\t\t.subscribe(this._refreshResponseSubject);\n\n\t\tif (config.autoStart === true) {\n\t\t\tthis.start().catch(() => {\n\t\t\t\t// Startup failure is reflected by boundarySnapshot.\n\t\t\t});\n\t\t}\n\t}\n\n\tasync start(): Promise<BasicAuthBoundarySnapshot> {\n\t\tconst cancellationToken = this._rootCancellation.token;\n\t\treturn await this._start(cancellationToken);\n\t}\n\n\t@instrumentBasicAuthMethod(\"start\")\n\tprivate async _start(\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\treturn await this._startOnce(cancellationToken, operationSpan);\n\t}\n\n\t@withDisposableStack(0, true)\n\tasync refresh(\n\t\toptions: BasicAuthRefreshOptions = {},\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\tconst disposableStack = injectDisposableStackFrom(options, true);\n\t\tconst cancellationToken = createLinkedCancellationToken(\n\t\t\tthis._rootCancellation.token,\n\t\t\toptions.cancellationToken,\n\t\t);\n\t\tdisposableStack?.use(cancellationToken);\n\t\treturn await this._refresh(options, cancellationToken);\n\t}\n\n\t@instrumentBasicAuthMethod(\"refresh\")\n\tprivate async _refresh(\n\t\toptions: BasicAuthRefreshOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\treturn await this._dispatchRefresh(\n\t\t\tthis._resolveRefreshOptions(options),\n\t\t\tcancellationToken,\n\t\t\toperationSpan,\n\t\t);\n\t}\n\n\t/**\n\t * Clears only this client's in-memory Basic Auth boundary projection.\n\t *\n\t * Browsers own HTTP Basic credentials. This method cannot revoke or clear\n\t * those credentials, and a later probe may observe an authenticated state\n\t * again when the browser continues sending them.\n\t */\n\t@withDisposableStack(0, true)\n\tasync logout(options: BasicAuthLogoutOptions = {}): Promise<void> {\n\t\tconst disposableStack = injectDisposableStackFrom(options, true);\n\t\tconst cancellationToken = createLinkedCancellationToken(\n\t\t\tthis._rootCancellation.token,\n\t\t\toptions.cancellationToken,\n\t\t);\n\t\tdisposableStack?.use(cancellationToken);\n\t\treturn await this._logout(options, cancellationToken);\n\t}\n\n\t@instrumentBasicAuthMethod(\"logout\")\n\tprivate async _logout(\n\t\t_options: BasicAuthLogoutOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<void> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\tthis._operationSignals.logoutPending.set(true);\n\t\tthis._emitEvent({\n\t\t\ttype: BasicAuthContextEventType.LogoutStarted,\n\t\t\tsnapshot: this._readCurrentSnapshot(),\n\t\t});\n\t\ttry {\n\t\t\tcancellationToken.throwIfCancellationRequested();\n\t\t\tthis._boundarySnapshotSignal.set({\n\t\t\t\tstatus: ResourceStatus.Resolved,\n\t\t\t\tvalue: null,\n\t\t\t});\n\t\t\toperationSpan?.setTraceAttributes({ localProjectionCleared: true });\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.LogoutSucceeded,\n\t\t\t\tsnapshot: null,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst clientError = clientErrorFromBasicAuthError(error, {\n\t\t\t\tspan: operationSpan?.span,\n\t\t\t});\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.LogoutFailed,\n\t\t\t\tsnapshot: this._readCurrentSnapshot(),\n\t\t\t\terror: clientError,\n\t\t\t});\n\t\t\tthrow clientError;\n\t\t} finally {\n\t\t\tthis._operationSignals.logoutPending.set(false);\n\t\t}\n\t}\n\n\t@withDisposableStack(0, true)\n\tasync loginWithRedirect(\n\t\toptions: BasicAuthLoginWithRedirectOptions,\n\t): Promise<void> {\n\t\tconst disposableStack = injectDisposableStackFrom(options, true);\n\t\tconst cancellationToken = createLinkedCancellationToken(\n\t\t\tthis._rootCancellation.token,\n\t\t\toptions.cancellationToken,\n\t\t);\n\t\tdisposableStack?.use(cancellationToken);\n\t\tawait this._loginWithRedirect(options, cancellationToken);\n\t}\n\n\t@instrumentBasicAuthMethod(\"login.redirect\")\n\tprivate async _loginWithRedirect(\n\t\toptions: BasicAuthLoginWithRedirectOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\t_operationSpan?: OperationSpanTrait,\n\t): Promise<void> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\tconst router = this._environment.router;\n\t\tif (!router) {\n\t\t\tthrow new ClientError({\n\t\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\t\tcode: BasicAuthContextErrorCode.RouterUnavailable,\n\t\t\t\tmessage: \"loginWithRedirect() requires environment.router.\",\n\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t});\n\t\t}\n\t\tconst zone = this._resolveZoneForAction(options, \"login redirect\");\n\t\tconst postAuthRedirectUri =\n\t\t\toptions.postAuthRedirectUri ?? options.currentPath;\n\n\t\tthis._operationSignals.loginRedirectPending.set(true);\n\t\tthis._emitEvent({\n\t\t\ttype: BasicAuthContextEventType.LoginRedirectStarted,\n\t\t\tzone,\n\t\t});\n\t\ttry {\n\t\t\tawait router.navigate({\n\t\t\t\turl: UriReferenceString.parse(this.loginUrl(zone, postAuthRedirectUri)),\n\t\t\t\tintent: RouterNavigationIntent.AuthRedirect,\n\t\t\t\tmode: RouterNavigationMode.External,\n\t\t\t});\n\t\t\tcancellationToken.throwIfCancellationRequested();\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.LoginRedirectSucceeded,\n\t\t\t\tzone,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst clientError = clientErrorFromBasicAuthError(error, {\n\t\t\t\tspan: _operationSpan?.span,\n\t\t\t});\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.LoginRedirectFailed,\n\t\t\t\tzone,\n\t\t\t\terror: clientError,\n\t\t\t});\n\t\t\tthrow clientError;\n\t\t} finally {\n\t\t\tthis._operationSignals.loginRedirectPending.set(false);\n\t\t}\n\t}\n\n\t/** Find the zone that contains the given path. */\n\tzoneForPath(path: string): ResolvedBasicAuthZone | undefined {\n\t\tlet matchedZone: ResolvedBasicAuthZone | undefined;\n\n\t\tfor (const zone of this.zones) {\n\t\t\tconst matches =\n\t\t\t\tpath === zone.zonePrefix || path.startsWith(`${zone.zonePrefix}/`);\n\t\t\tif (!matches) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\t!matchedZone ||\n\t\t\t\tzone.zonePrefix.length > matchedZone.zonePrefix.length\n\t\t\t) {\n\t\t\t\tmatchedZone = zone;\n\t\t\t}\n\t\t}\n\n\t\treturn matchedZone;\n\t}\n\n\tzoneForPrefix(zonePrefix: string): ResolvedBasicAuthZone | undefined {\n\t\treturn this.zones.find((zone) => zone.zonePrefix === zonePrefix);\n\t}\n\n\t/** Check whether a path falls inside any configured zone. */\n\tisInZone(path: string): boolean {\n\t\treturn this.zoneForPath(path) !== undefined;\n\t}\n\n\t/** Build the full login URL for a zone, optionally with a post-auth redirect. */\n\tloginUrl(zone: ResolvedBasicAuthZone, postAuthRedirectUri?: string): string {\n\t\tconst base = this._config.baseUrl + zone.loginPath;\n\t\tif (postAuthRedirectUri) {\n\t\t\tconst params = new URLSearchParams({\n\t\t\t\t[POST_AUTH_REDIRECT_PARAM]: postAuthRedirectUri,\n\t\t\t});\n\t\t\treturn `${base}?${params.toString()}`;\n\t\t}\n\t\treturn base;\n\t}\n\n\tloginUrlForZonePrefix(\n\t\tzonePrefix: string,\n\t\tpostAuthRedirectUri?: string,\n\t): string | null {\n\t\tconst zone = this.zoneForPrefix(zonePrefix);\n\t\treturn zone ? this.loginUrl(zone, postAuthRedirectUri) : null;\n\t}\n\n\t/**\n\t * Handle a 401 response: if the current path is inside a zone,\n\t * return a redirect instruction to the zone's login URL.\n\t */\n\thandleUnauthorized(\n\t\tcurrentPath: string,\n\t\tresponseStatus: number,\n\t): AuthGuardResult<null> {\n\t\tif (responseStatus !== 401) {\n\t\t\treturn { kind: AuthGuardResultKind.Ok, value: null };\n\t\t}\n\n\t\tconst zone = this.zoneForPath(currentPath);\n\t\tif (!zone) {\n\t\t\treturn { kind: AuthGuardResultKind.Ok, value: null };\n\t\t}\n\n\t\treturn {\n\t\t\tkind: AuthGuardResultKind.Redirect,\n\t\t\tstatus: AuthGuardRedirectStatus.Found,\n\t\t\tlocation: this.loginUrl(zone, currentPath),\n\t\t};\n\t}\n\n\tdispose(): void {\n\t\tthis._destroyed.set(true);\n\t\tthis._eventSubject.complete();\n\t}\n\n\t[SYMBOL_DISPOSE](): void {\n\t\tthis.dispose();\n\t}\n\n\tprivate _resolveRefreshOptions(\n\t\toptions: BasicAuthRefreshOptions,\n\t): ResolvedBasicAuthRefreshOptions {\n\t\tconst path = options.path ?? this._config.probePath;\n\t\tif (!path) {\n\t\t\tthrow new ClientError({\n\t\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\t\tcode: BasicAuthContextErrorCode.ProbePathRequired,\n\t\t\t\tmessage:\n\t\t\t\t\t\"BasicAuthContextClient.refresh() requires options.path or config.probePath.\",\n\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t});\n\t\t}\n\t\treturn { path };\n\t}\n\n\tprivate _resolveZoneForAction(\n\t\toptions: BasicAuthZoneSelectionOptions,\n\t\taction: string,\n\t): ResolvedBasicAuthZone {\n\t\tif (options.zonePrefix) {\n\t\t\tconst zone = this.zoneForPrefix(options.zonePrefix);\n\t\t\tif (zone) {\n\t\t\t\treturn zone;\n\t\t\t}\n\t\t\tthrow new ClientError({\n\t\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\t\tcode: BasicAuthContextErrorCode.ZoneNotFound,\n\t\t\t\tmessage: `BasicAuthContextClient ${action} could not find zone \"${options.zonePrefix}\".`,\n\t\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t\t});\n\t\t}\n\n\t\tconst zone =\n\t\t\ttypeof options.currentPath === \"string\"\n\t\t\t\t? this.zoneForPath(options.currentPath)\n\t\t\t\t: undefined;\n\t\tif (zone) {\n\t\t\treturn zone;\n\t\t}\n\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\tcode: BasicAuthContextErrorCode.ZoneRequired,\n\t\t\tmessage: `BasicAuthContextClient ${action} requires options.currentPath inside a configured zone or options.zonePrefix.`,\n\t\t\tsource: BasicAuthContextSource.BasicAuthContext,\n\t\t});\n\t}\n\n\tprivate async _dispatchRefresh(\n\t\tpayload: ResolvedBasicAuthRefreshOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\tconst snapshot = await lastValueFrom(\n\t\t\tdispatchCommandLocallyToStream<\n\t\t\t\tResolvedBasicAuthRefreshOptions,\n\t\t\t\tBasicAuthCommandExtra,\n\t\t\t\tBasicAuthBoundarySnapshot,\n\t\t\t\tBasicAuthRefreshCommand\n\t\t\t>({\n\t\t\t\tpayload,\n\t\t\t\trequestStream: this._refreshCommandSubject,\n\t\t\t\tresponseStream: this._refreshResponseSubject,\n\t\t\t\tcreateCommandExtra: () => ({ cancellationToken, operationSpan }),\n\t\t\t}).pipe(commandResponseData()),\n\t\t);\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\treturn snapshot;\n\t}\n\n\tprivate async _executeRefresh(\n\t\toptions: ResolvedBasicAuthRefreshOptions,\n\t\tcancellationToken: CancellationTokenTrait,\n\t\toperationSpan?: OperationSpanTrait,\n\t): Promise<BasicAuthBoundarySnapshot> {\n\t\tcancellationToken.throwIfCancellationRequested();\n\t\tthis._operationSignals.refreshPending.set(true);\n\t\tconst previous = this._boundarySnapshotSignal.get();\n\t\tconst loadingSnapshot = reduceResourceSnapshot(previous, {\n\t\t\tkind: ResourceSnapshotUpdateKind.Load,\n\t\t});\n\t\tthis._boundarySnapshotSignal.set(loadingSnapshot);\n\t\tthis._emitEvent({\n\t\t\ttype: BasicAuthContextEventType.BoundaryRefreshStarted,\n\t\t\tsnapshot: this._readCurrentSnapshot(),\n\t\t});\n\t\ttry {\n\t\t\tconst response = await this._environment.transport.execute({\n\t\t\t\turl: this._config.baseUrl + options.path,\n\t\t\t\tmethod: \"GET\",\n\t\t\t\theaders: { accept: \"application/json\" },\n\t\t\t\tcancellationToken,\n\t\t\t});\n\t\t\tif (\n\t\t\t\tresponse.status >= 400 &&\n\t\t\t\tresponse.status !== 401 &&\n\t\t\t\tresponse.status !== 403\n\t\t\t) {\n\t\t\t\tthrow ClientError.fromHttpResponse({\n\t\t\t\t\tstatus: response.status,\n\t\t\t\t\tbody: response.body,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tcancellationToken.throwIfCancellationRequested();\n\t\t\tconst snapshot = this._snapshotFromResponse(options.path, response);\n\t\t\tthis._boundarySnapshotSignal.set(\n\t\t\t\treduceResourceSnapshot(loadingSnapshot, {\n\t\t\t\t\tkind: ResourceSnapshotUpdateKind.Resolve,\n\t\t\t\t\tvalue: snapshot,\n\t\t\t\t}),\n\t\t\t);\n\t\t\toperationSpan?.setTraceAttributes({\n\t\t\t\tauthenticated: snapshot.authenticated,\n\t\t\t\tboundaryKind: snapshot.boundaryKind,\n\t\t\t});\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.BoundaryRefreshSucceeded,\n\t\t\t\tsnapshot,\n\t\t\t\tzone: snapshot.zone,\n\t\t\t});\n\t\t\treturn snapshot;\n\t\t} catch (error) {\n\t\t\tconst clientError = clientErrorFromBasicAuthError(error, {\n\t\t\t\tspan: operationSpan?.span,\n\t\t\t});\n\t\t\tthis._boundarySnapshotSignal.set(\n\t\t\t\treduceResourceSnapshot(loadingSnapshot, {\n\t\t\t\t\tkind: ResourceSnapshotUpdateKind.Fail,\n\t\t\t\t\terror: clientError,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tthis._emitEvent({\n\t\t\t\ttype: BasicAuthContextEventType.BoundaryRefreshFailed,\n\t\t\t\tsnapshot: this._readCurrentSnapshot(),\n\t\t\t\terror: clientError,\n\t\t\t});\n\t\t\tthrow clientError;\n\t\t} finally {\n\t\t\tthis._operationSignals.refreshPending.set(false);\n\t\t}\n\t}\n\n\tprivate _snapshotFromResponse(\n\t\tpath: string,\n\t\tresponse: { status: number; headers: Record<string, string> },\n\t): BasicAuthBoundarySnapshot {\n\t\tconst challengeHeader =\n\t\t\tresponse.headers[\"WWW-Authenticate\"] ??\n\t\t\tresponse.headers[\"www-authenticate\"] ??\n\t\t\tnull;\n\t\tconst zone = this.zoneForPath(path);\n\t\tconst boundaryKind = readBasicAuthBoundaryKind({\n\t\t\tstatus: response.status,\n\t\t\tchallengeHeader,\n\t\t\trequestPath: path,\n\t\t});\n\t\treturn {\n\t\t\tauthenticated: boundaryKind === BasicAuthBoundaryKindValues.Authenticated,\n\t\t\tboundaryKind,\n\t\t\tstatus: response.status,\n\t\t\tpath,\n\t\t\tchallengeHeader,\n\t\t\tzone,\n\t\t};\n\t}\n\n\tprivate _readCurrentSnapshot(): BasicAuthBoundarySnapshot | null {\n\t\tconst snapshot = this._boundarySnapshotSignal.get();\n\t\treturn snapshot.status === ResourceStatus.Reloading ||\n\t\t\tsnapshot.status === ResourceStatus.Resolved ||\n\t\t\tsnapshot.status === ResourceStatus.Error\n\t\t\t? snapshot.value\n\t\t\t: null;\n\t}\n\n\tprivate _emitEvent(input: BasicAuthContextEventInput): void {\n\t\tthis._eventSubject.next({\n\t\t\t...input,\n\t\t\tat: this._environment.time.now(),\n\t\t\tclient: {\n\t\t\t\tid: this.id,\n\t\t\t},\n\t\t});\n\t}\n}\n","import {\n\tINJECTOR_TOKEN,\n\ttype SecuritydeptInjectorTrait,\n\ttype SecuritydeptProvider,\n} from \"@securitydept/client\";\nimport { BasicAuthContextClient } from \"./client\";\nimport {\n\tBASIC_AUTH_CONTEXT_CLIENT,\n\tBASIC_AUTH_CONTEXT_CLIENT_CONFIG,\n} from \"./tokens\";\nimport { type BasicAuthContextClientConfig } from \"./types\";\n\nexport interface ProvideBasicAuthContextOptions {\n\treadonly config: BasicAuthContextClientConfig;\n}\n\nexport function provideBasicAuthContext(\n\toptions: ProvideBasicAuthContextOptions,\n): readonly SecuritydeptProvider[] {\n\treturn [\n\t\t{\n\t\t\tprovide: BASIC_AUTH_CONTEXT_CLIENT_CONFIG,\n\t\t\tuseValue: options.config,\n\t\t},\n\t\t{\n\t\t\tprovide: BASIC_AUTH_CONTEXT_CLIENT,\n\t\t\tuseFactory: (injector: SecuritydeptInjectorTrait) =>\n\t\t\t\tBasicAuthContextClient.fromInjector(injector),\n\t\t\tdeps: [INJECTOR_TOKEN],\n\t\t},\n\t];\n}\n"],"mappings":";;;;;;AAWA,SAAgBG,oCACfC,SAAmD;CAEnD,IAAIA,QAAQC,SAASC,SAAS,GAAA,GAC7B,MAAM,IAAIN,YAAY;EACrBO,MAAMN,gBAAgBO;EACtBC,MAAM;EACNC,SAAS;EACTC,QAAQ;CACT,CAAA;CAGD,OAAO,SAAST,yBACf,IAAIU,YAAAA,CAAAA,CAAcC,OAAO,GAAGT,QAAQC,SAAS,GAAGD,QAAQU,UAAU,CAAA;AAEpE;;;ACxBA,MAAaE,4BAA4B;CACxCC,iBAAiB;CACjBC,eAAe;CACfC,gBAAgB;CAChBC,mBAAmB;CACnBC,mBAAmB;CACnBC,cAAc;CACdC,cAAc;AACf;AAKA,MAAaC,yBAAyB,EACrCC,kBAAkB,qBACnB;AAKA,SAAgBC,8BACfC,OACAC,SAAwC;CAExC,OAAOb,YAAYc,YAAYF,OAAO;EACrCG,MAAMd,0BAA0BC;EAChCc,SAAS;EACTC,QAAQR,uBAAuBC;EAC/BQ,MAAML,QAAQK;CACf,CAAA;AACD;;;AC9BA,MAAaG,4BAA4BD,KAAW;CACnDE,YAAY;CACZ,iBAAiB;AAClB,CAAA;AAEA,MAAaC,qCAAqCH,KAAW;CAC5D,OAAO;CACPI,SAAS;CACTC,OAAOJ,0BAA0BK,MAAK,CAAA,CAAGC,cAAc,CAAA;CACvD,cAAc;CACd,cAAc;CACd,YAAY;EACX,WAAW;EACX,WAAW;CACZ;AACD,CAAA;;;ACbA,MAAaE,4BACZ,IAAID,2BACH,2BAAA;AAGF,MAAaE,mCACZ,IAAIF,2BACH,kCAAA;;;ACgCF,MAAaG,wBAAwB;CACpCC,eAAe;CACfC,WAAW;CACXC,cAAc;AACf;AAoBA,MAAaC,4BAA4B;CACxCC,wBAAwB;CACxBC,0BAA0B;CAC1BC,uBAAuB;8EAEvBC,eAAe;CACfC,iBAAiB;CACjBC,cAAc;CACdC,sBAAsB;CACtBC,wBAAwB;CACxBC,qBAAqB;AACtB;AAsFA,MAAaC,sBAAsB;CAClCC,IAAI;CACJC,UAAU;AACX;AAKA,MAAaC,0BAA0B;CACtCC,OAAO;CACPC,UAAU;CACVC,mBAAmB;AACpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AClGA,MAAM+C,wBAAwB;AAC9B,MAAMC,2BAA2B;AAcjC,MAAMC,4BAA4B1C,iCAIhC,EAAE2C,aAAa,CAACC,iBAChB,WAAA;CACC,OAAO;EACNC,aAAa,KAAKA;EAClBC,MAAM,KAAKA;EACXC,MAAM,GAAG,KAAKC,OAAOC,QAAQC,OAAO,GAAGN;EACvCO,QAAQ,KAAKH,OAAOC,QAAQE;EAC5BC,iBAAiB,EAAER,UAAU;EAC7BS,yBAAyBC,OAAOC,YAC/BvB,8BAA8BsB,OAAOC,OAAAA;CACvC;AACD,CAAA;AAGF,SAASC,YAAYR,QAA2B;CAC/C,MAAME,SAASF,OAAOS,WAAWC,QAAQ,QAAQ,EAAA;CAGjD,OAAO;EACND,YAAYP;EACZW,WAAWX,UAJKF,OAAOY,gBAAgBpB;CAKxC;AACD;AAEA,SAAgBsB,0BACfP,SAAqC;CAErC,IAAIA,QAAQQ,SAAS,KACpB,OAAOzB,sBAA4B0B;CAGpC,IAAIT,QAAQU,iBACX,OAAO3B,sBAA4B4B;CAGpC,OAAO5B,sBAA4B6B;AACpC;AA2MEzB,OAAAA,0BAA0B,OAAA,GAAA,QAQ1BzB,oBAAoB,GAAG,IAAA,GAAA,QAavByB,0BAA0B,SAAA,GAAA,QAqB1BzB,oBAAoB,GAAG,IAAA,GAAA,QAWvByB,0BAA0B,QAAA,GAAA,QAsC1BzB,oBAAoB,GAAG,IAAA,GAAA,QAavByB,0BAA0B,gBAAA;;;;;;GA3S5B,IAAa0B,yBAAb,MAAaA,uBAAAA;;;;;;IAoMEC;;;;;IAQRC;;;;;IAaQC;;;;;IAqBRC;;;;;IAWQC;;;;;IAsCRC;;;;;IAaQC;;;;CA3Sd,OAAOC,iBAAiB;EACvBhB,cAAcpB;EACdS,SAAS;GACRE,QAAQ;GACRD,QAAQ;EACT;CACD;CAEiB2B;CACAC;CACAC;CACAC,qBAAAA,WAAAA,IAAAA,GAChBpF,8BAAAA;CACgBqF,aAAa3D,cAAc4D,iBAAiB,KAAA;CAC5CC,aAAa3D,KAAK,KAAKyD,UAAU,CAAA,CAAEG,KACnD7D,QAAQ8D,UAAyBA,KAAAA,GACjC3D,KAAK,CAAA,CAAA;CAEW4D,0BAA0BhE,cAAc4D,iBAEvD,EAAEnB,QAAQ1D,eAAekF,KAAK,CAAA;CACfC,oBAKb;EACHC,cAAc1F,aAAa,KAAA;EAC3B2F,gBAAgB3F,aAAa,KAAA;EAC7B4F,eAAe5F,aAAa,KAAA;EAC5B6F,sBAAsB7F,aAAa,KAAA;CACpC;CACiB8F,gBAAgB,IAAIxE,eAAAA;CACpByE,yBAChB,IAAIzE,eAAAA;CACY0E,0BAA0B,IAAI1E,eAAAA;CAG9B2E,aAAalG,4BAC7B,OACCmG,mBACAC,kBAAAA;EAEAD,kBAAkBE,6BAA4B;EAC9C,KAAKX,kBAAkBC,aAAaW,IAAI,IAAA;EACxC,IAAI;GACH,OAAO,MAAM,KAAKC,iBACjB,KAAKC,uBAAuB,CAAC,CAAA,GAC7BL,mBACAC,aAAAA;EAEF,UAAU;GACT,KAAKV,kBAAkBC,aAAaW,IAAI,KAAA;EACzC;CACD,CAAA;CAGQG;CACAC;CACAC;CAGAC;CACAC;CACAC;CACAC;CAET,IAAchE,cAAqC;EAClD,OAAO,KAAKgC;CACb;CAEA,IAAc/B,OAAkB;EAC/B,OAAO,KAAKiC;CACb;CAEA,IAAc/B,SAA+C;EAC5D,OAAO,KAAK8B;CACb;CAEA,OAAOgC,sBAAsBvD,SAGF;EAC1B,OAAO,IAAIa,uBAAuBb,QAAQP,QAAQO,QAAQV,WAAW;CACtE;CAEA,OAAOkE,aACNC,UACyB;EACzB,MAAMC,SAAS7C,uBAAuB0C,sBAAsB;GAC3D9D,QAAQgE,SAASE,IAAIhF,gCAAAA;GACrBW,aAAamE,SAASE,IAAIjH,iBAAAA;EAC3B,CAAA;EACA+G,SACEE,IAAIvG,wBAAwB,IAAA,CAAA,EAC3BwG,gBAAgBF,OAAOG,QAAO,CAAA;EACjC,OAAOH;CACR;CAEA,YACCjE,QACAH,aACC;EACD7B,mBAAmB;GAClBqE,OAAOrC;GACPqE,eAAepF;GACfqF,YAAYC,YACXzG,2BAA2B;IAC1B0G,MAAM1F,0BAA0B2F;IAChCC,QAAQ3F,uBAAuB4F;IAC/BC,eAAe;IACfL;GACD,CAAA;EACF,CAAA;EACA,MAAMM,iBAAuD;GAC5DtB,IAAIvD,OAAOuD,MAAM1E,GAAAA;GACjBiG,UAAU9E,OAAO8E,WAAW,GAAA,CAAIpE,QAAQ,QAAQ,EAAA;GAChD8C,QAAQxD,OAAOwD,SAAS,CAAA,EAAA,CAAIuB,IAAIvE,WAAAA;GAChCwE,WAAWhF,OAAOgF;GAClB/E,SAAS;IACRE,QACCH,OAAOC,SAASE,UAChBiB,uBAAuBQ,eAAe3B,QAAQE;IAC/CD,QACCF,OAAOC,SAASC,UAChBkB,uBAAuBQ,eAAe3B,QAAQC;GAChD;EACD;EAEA,KAAK2B,eAAehC;EACpB,KAAKiC,UAAU+C;EACf,KAAKtB,KAAKsB,eAAetB;EACzB,KAAKC,QAAQqB,eAAerB;EAC5B,KAAKzB,QAAQlC,YAAYC,KAAKmF,KAAK,EAClCC,YAAY;IACVtH,wBAAwBuH,aAAa,KAAK,YAAYpF;IACtDnC,wBAAwBwH,WAAW,KAAK7B;EAC1C,EACD,CAAA;EACA,KAAKE,mBAAmBjG,eAAe,KAAK8E,uBAAuB;EACnE,KAAKoB,mBAAmBhG,4BACvB,KAAK4E,wBAAwB4B,IAAG,CAAA;EAEjC,KAAKP,kBAAkBxG,YACtB,KAAKuG,mBACJ2B,aAAaA,UAAUC,kBAAkB,IAAA;EAE3C,KAAK1B,aAAa;GACjBnB,cAAcjF,eAAe,KAAKgF,kBAAkBC,YAAY;GAChEC,gBAAgBlF,eAAe,KAAKgF,kBAAkBE,cAAc;GACpEC,eAAenF,eAAe,KAAKgF,kBAAkBG,aAAa;GAClEC,sBAAsBpF,eACrB,KAAKgF,kBAAkBI,oBAAoB;EAE7C;EACA,KAAKiB,SAAS,KAAKhB;EACnB,KAAKV,WAAWoD,gBAAU;GACzB,KAAKvD,kBAAkBwD,OACtB,IAAI9I,YAAY;IACf+I,MAAM9I,gBAAgB+I;IACtBlB,MAAM1F,0BAA0B6G;IAChCC,SAAS;IACTlB,QAAQ3F,uBAAuB4F;GAChC,CAAA,CAAA;GAED,KAAKhB,gBAAgBS,QAAO;GAC5B,KAAKV,iBAAiBU,QAAO;EAC9B,CAAA;EAEA5F,KAAK,KAAKsE,sBAAsB,CAAA,CAC9BV,KACAzD,UAAU,KAAKwD,UAAU,GACzBhE,eAAe0H,YACd,KAAKC,gBACJD,QAAQE,SACRF,QAAQ5C,mBACR4C,QAAQ3C,aAAa,CAAA,CAAA,CAAA,CAIvBqC,UAAU,KAAKxC,uBAAuB;EAExC,IAAI/C,OAAOgG,cAAc,MACxB,KAAKC,MAAK,CAAA,CAAGC,YAAM,CAEnB,CAAA;CAEF;CAEA,MAAMD,QAA4C;EACjD,MAAMhD,oBAAoB,KAAKjB,kBAAkBmE;EACjD,OAAO,MAAM,KAAK9E,OAAO4B,iBAAAA;CAC1B;CAEA,MACc5B,OACb4B,mBACAC,eACqC;EACrC,OAAO,MAAM,KAAKF,WAAWC,mBAAmBC,aAAAA;CACjD;CAEA,MACM5B,QACLf,UAAmC,CAAC,GACC;EACrC,MAAM6F,kBAAkBlJ,0BAA0BqD,SAAS,IAAA;EAC3D,MAAM0C,oBAAoBpG,8BACzB,KAAKmF,kBAAkBmE,OACvB5F,QAAQ0C,iBAAiB;EAE1BmD,iBAAiBC,IAAIpD,iBAAAA;EACrB,OAAO,MAAM,KAAK1B,SAAShB,SAAS0C,iBAAAA;CACrC;CAEA,MACc1B,SACbhB,SACA0C,mBACAC,eACqC;EACrCD,kBAAkBE,6BAA4B;EAC9C,OAAO,MAAM,KAAKE,iBACjB,KAAKC,uBAAuB/C,OAAAA,GAC5B0C,mBACAC,aAAAA;CAEF;;;;;;;IASA,MACM1B,OAAOjB,UAAkC,CAAC,GAAkB;EACjE,MAAM6F,kBAAkBlJ,0BAA0BqD,SAAS,IAAA;EAC3D,MAAM0C,oBAAoBpG,8BACzB,KAAKmF,kBAAkBmE,OACvB5F,QAAQ0C,iBAAiB;EAE1BmD,iBAAiBC,IAAIpD,iBAAAA;EACrB,OAAO,MAAM,KAAKxB,QAAQlB,SAAS0C,iBAAAA;CACpC;CAEA,MACcxB,QACb6E,UACArD,mBACAC,eACgB;EAChBD,kBAAkBE,6BAA4B;EAC9C,KAAKX,kBAAkBG,cAAcS,IAAI,IAAA;EACzC,KAAKmD,WAAW;GACfC,MAAMjH,0BAA0BkH;GAChCpB,UAAU,KAAKqB,qBAAoB;EACpC,CAAA;EACA,IAAI;GACHzD,kBAAkBE,6BAA4B;GAC9C,KAAKb,wBAAwBc,IAAI;IAChCrC,QAAQ1D,eAAesJ;IACvBtE,OAAO;GACR,CAAA;GACAa,eAAe0D,mBAAmB,EAAEC,wBAAwB,KAAK,CAAA;GACjE,KAAKN,WAAW;IACfC,MAAMjH,0BAA0BuH;IAChCzB,UAAU;GACX,CAAA;EACD,SAAS/E,OAAO;GACf,MAAMyG,cAAc/H,8BAA8BsB,OAAO,EACxDR,MAAMoD,eAAepD,KACtB,CAAA;GACA,KAAKyG,WAAW;IACfC,MAAMjH,0BAA0ByH;IAChC3B,UAAU,KAAKqB,qBAAoB;IACnCpG,OAAOyG;GACR,CAAA;GACA,MAAMA;EACP,UAAU;GACT,KAAKvE,kBAAkBG,cAAcS,IAAI,KAAA;EAC1C;CACD;CAEA,MACM1B,kBACLnB,SACgB;EAChB,MAAM6F,kBAAkBlJ,0BAA0BqD,SAAS,IAAA;EAC3D,MAAM0C,oBAAoBpG,8BACzB,KAAKmF,kBAAkBmE,OACvB5F,QAAQ0C,iBAAiB;EAE1BmD,iBAAiBC,IAAIpD,iBAAAA;EACrB,MAAM,KAAKtB,mBAAmBpB,SAAS0C,iBAAAA;CACxC;CAEA,MACctB,mBACbpB,SACA0C,mBACAgE,gBACgB;EAChBhE,kBAAkBE,6BAA4B;EAC9C,MAAM+D,SAAS,KAAKrF,aAAaqF;EACjC,IAAI,CAACA,QACJ,MAAM,IAAIxK,YAAY;GACrB+I,MAAM9I,gBAAgBwK;GACtB3C,MAAM1F,0BAA0BsI;GAChCxB,SAAS;GACTlB,QAAQ3F,uBAAuB4F;EAChC,CAAA;EAED,MAAM0C,OAAO,KAAKC,sBAAsB/G,SAAS,gBAAA;EACjD,MAAMgH,sBACLhH,QAAQgH,uBAAuBhH,QAAQiH;EAExC,KAAKhF,kBAAkBI,qBAAqBQ,IAAI,IAAA;EAChD,KAAKmD,WAAW;GACfC,MAAMjH,0BAA0BkI;GAChCJ;EACD,CAAA;EACA,IAAI;GACH,MAAMH,OAAOQ,SAAS;IACrBC,KAAK5J,mBAAmB6J,MAAM,KAAKC,SAASR,MAAME,mBAAAA,CAAAA;IAClDO,QAAQxK,uBAAuByK;IAC/BC,MAAMzK,qBAAqB0K;GAC5B,CAAA;GACAhF,kBAAkBE,6BAA4B;GAC9C,KAAKoD,WAAW;IACfC,MAAMjH,0BAA0B2I;IAChCb;GACD,CAAA;EACD,SAAS/G,OAAO;GACf,MAAMyG,cAAc/H,8BAA8BsB,OAAO,EACxDR,MAAMmH,gBAAgBnH,KACvB,CAAA;GACA,KAAKyG,WAAW;IACfC,MAAMjH,0BAA0B4I;IAChCd;IACA/G,OAAOyG;GACR,CAAA;GACA,MAAMA;EACP,UAAU;GACT,KAAKvE,kBAAkBI,qBAAqBQ,IAAI,KAAA;EACjD;CACD;oDAGAgF,YAAYC,MAAiD;EAC5D,IAAIC;EAEJ,KAAK,MAAMjB,QAAQ,KAAK7D,OAAO;GAG9B,IAAI,EADH6E,SAAShB,KAAK5G,cAAc4H,KAAKG,WAAW,GAAGnB,KAAK5G,WAAW,EAAE,IAEjE;GAGD,IACC,CAAC6H,eACDjB,KAAK5G,WAAWgI,SAASH,YAAY7H,WAAWgI,QAEhDH,cAAcjB;EAEhB;EAEA,OAAOiB;CACR;CAEAI,cAAcjI,YAAuD;EACpE,OAAO,KAAK+C,MAAMmF,MAAMtB,SAASA,KAAK5G,eAAeA,UAAAA;CACtD;+DAGAmI,SAASP,MAAuB;EAC/B,OAAO,KAAKD,YAAYC,IAAAA,MAAUQ,KAAAA;CACnC;mFAGAhB,SAASR,MAA6BE,qBAAsC;EAC3E,MAAMuB,OAAO,KAAKhH,QAAQgD,UAAUuC,KAAKxG;EACzC,IAAI0G,qBAIH,OAAO,GAAGuB,KAAK,GAAGC,IAHCC,gBAAgB,GACjCvJ,2BAA2B8H,oBAC7B,CACkBwB,CAAAA,CAAOE,SAAQ;EAElC,OAAOH;CACR;CAEAI,sBACCzI,YACA8G,qBACgB;EAChB,MAAMF,OAAO,KAAKqB,cAAcjI,UAAAA;EAChC,OAAO4G,OAAO,KAAKQ,SAASR,MAAME,mBAAAA,IAAuB;CAC1D;;;;IAMA4B,mBACC3B,aACA4B,gBACwB;EACxB,IAAIA,mBAAmB,KACtB,OAAO;GAAE3D,MAAMrG,oBAAoBiK;GAAIhH,OAAO;EAAK;EAGpD,MAAMgF,OAAO,KAAKe,YAAYZ,WAAAA;EAC9B,IAAI,CAACH,MACJ,OAAO;GAAE5B,MAAMrG,oBAAoBiK;GAAIhH,OAAO;EAAK;EAGpD,OAAO;GACNoD,MAAMrG,oBAAoBkK;GAC1BvI,QAAQ5B,wBAAwBoK;GAChCC,UAAU,KAAK3B,SAASR,MAAMG,WAAAA;EAC/B;CACD;CAEApD,UAAgB;EACf,KAAKnC,WAAWmB,IAAI,IAAA;EACpB,KAAKP,cAAc4G,SAAQ;CAC5B;CAEA,CAAC5L,kBAAwB;EACxB,KAAKuG,QAAO;CACb;CAEQd,uBACP/C,SACkC;EAClC,MAAM8H,OAAO9H,QAAQ8H,QAAQ,KAAKvG,QAAQkD;EAC1C,IAAI,CAACqD,MACJ,MAAM,IAAI3L,YAAY;GACrB+I,MAAM9I,gBAAgBwK;GACtB3C,MAAM1F,0BAA0B4K;GAChC9D,SACC;GACDlB,QAAQ3F,uBAAuB4F;EAChC,CAAA;EAED,OAAO,EAAE0D,KAAK;CACf;CAEQf,sBACP/G,SACAoJ,QACwB;EACxB,IAAIpJ,QAAQE,YAAY;GACvB,MAAM4G,OAAO,KAAKqB,cAAcnI,QAAQE,UAAU;GAClD,IAAI4G,MACH,OAAOA;GAER,MAAM,IAAI3K,YAAY;IACrB+I,MAAM9I,gBAAgBwK;IACtB3C,MAAM1F,0BAA0B8K;IAChChE,SAAS,0BAA0B+D,OAAO,wBAAwBpJ,QAAQE,WAAW;IACrFiE,QAAQ3F,uBAAuB4F;GAChC,CAAA;EACD;EAEA,MAAM0C,OACL,OAAO9G,QAAQiH,gBAAgB,WAC5B,KAAKY,YAAY7H,QAAQiH,WAAW,IACpCqB,KAAAA;EACJ,IAAIxB,MACH,OAAOA;EAGR,MAAM,IAAI3K,YAAY;GACrB+I,MAAM9I,gBAAgBwK;GACtB3C,MAAM1F,0BAA0B+K;GAChCjE,SAAS,0BAA0B+D,OAAO;GAC1CjF,QAAQ3F,uBAAuB4F;EAChC,CAAA;CACD;CAEA,MAActB,iBACb0C,SACA9C,mBACAC,eACqC;EACrCD,kBAAkBE,6BAA4B;EAC9C,MAAMkC,WAAW,MAAM5G,cACtBL,+BAKE;GACD2H;GACA+D,eAAe,KAAKhH;GACpBiH,gBAAgB,KAAKhH;GACrBiH,2BAA2B;IAAE/G;IAAmBC;GAAc;EAC/D,CAAA,CAAA,CAAGd,KAAKlE,oBAAAA,CAAAA,CAAAA;EAET+E,kBAAkBE,6BAA4B;EAC9C,OAAOkC;CACR;CAEA,MAAcS,gBACbvF,SACA0C,mBACAC,eACqC;EACrCD,kBAAkBE,6BAA4B;EAC9C,KAAKX,kBAAkBE,eAAeU,IAAI,IAAA;EAC1C,MAAM6G,WAAW,KAAK3H,wBAAwB4B,IAAG;EACjD,MAAMgG,kBAAkBzM,uBAAuBwM,UAAU,EACxDxE,MAAMrI,2BAA2B+M,KAClC,CAAA;EACA,KAAK7H,wBAAwBc,IAAI8G,eAAAA;EACjC,KAAK3D,WAAW;GACfC,MAAMjH,0BAA0B6K;GAChC/E,UAAU,KAAKqB,qBAAoB;EACpC,CAAA;EACA,IAAI;GACH,MAAM2D,WAAW,MAAM,KAAKxI,aAAayI,UAAUC,QAAQ;IAC1D5C,KAAK,KAAK7F,QAAQgD,UAAUvE,QAAQ8H;IACpCmC,QAAQ;IACRC,SAAS,EAAEC,QAAQ,mBAAmB;IACtCzH;GACD,CAAA;GACA,IACCoH,SAAStJ,UAAU,OACnBsJ,SAAStJ,WAAW,OACpBsJ,SAAStJ,WAAW,KAEpB,MAAMrE,YAAYiO,iBAAiB;IAClC5J,QAAQsJ,SAAStJ;IACjB6J,MAAMP,SAASO;GAChB,CAAA;GAGD3H,kBAAkBE,6BAA4B;GAC9C,MAAMkC,WAAW,KAAKwF,sBAAsBtK,QAAQ8H,MAAMgC,QAAAA;GAC1D,KAAK/H,wBAAwBc,IAC5B3F,uBAAuByM,iBAAiB;IACvCzE,MAAMrI,2BAA2B0N;IACjCzI,OAAOgD;GACR,CAAA,CAAA;GAEDnC,eAAe0D,mBAAmB;IACjCtB,eAAeD,SAASC;IACxByF,cAAc1F,SAAS0F;GACxB,CAAA;GACA,KAAKxE,WAAW;IACfC,MAAMjH,0BAA0ByL;IAChC3F;IACAgC,MAAMhC,SAASgC;GAChB,CAAA;GACA,OAAOhC;EACR,SAAS/E,OAAO;GACf,MAAMyG,cAAc/H,8BAA8BsB,OAAO,EACxDR,MAAMoD,eAAepD,KACtB,CAAA;GACA,KAAKwC,wBAAwBc,IAC5B3F,uBAAuByM,iBAAiB;IACvCzE,MAAMrI,2BAA2B6N;IACjC3K,OAAOyG;GACR,CAAA,CAAA;GAED,KAAKR,WAAW;IACfC,MAAMjH,0BAA0B2L;IAChC7F,UAAU,KAAKqB,qBAAoB;IACnCpG,OAAOyG;GACR,CAAA;GACA,MAAMA;EACP,UAAU;GACT,KAAKvE,kBAAkBE,eAAeU,IAAI,KAAA;EAC3C;CACD;CAEQyH,sBACPxC,MACAgC,UAC4B;EAC5B,MAAMpJ,kBACLoJ,SAASI,QAAQ,uBACjBJ,SAASI,QAAQ,uBACjB;EACD,MAAMpD,OAAO,KAAKe,YAAYC,IAAAA;EAC9B,MAAM0C,eAAejK,0BAA0B;GAC9CC,QAAQsJ,SAAStJ;GACjBE;GACAkK,aAAa9C;EACd,CAAA;EACA,OAAO;GACN/C,eAAeyF,iBAAiBzL,sBAA4B0B;GAC5D+J;GACAhK,QAAQsJ,SAAStJ;GACjBsH;GACApH;GACAoG;EACD;CACD;CAEQX,uBAAyD;EAChE,MAAMrB,WAAW,KAAK/C,wBAAwB4B,IAAG;EACjD,OAAOmB,SAAStE,WAAW1D,eAAe+N,aACzC/F,SAAStE,WAAW1D,eAAesJ,YACnCtB,SAAStE,WAAW1D,eAAegO,QACjChG,SAAShD,QACT;CACJ;CAEQkE,WAAW+E,OAAyC;EAC3D,KAAKzI,cAAc0I,KAAK;GACvB,GAAGD;GACHE,IAAI,KAAK3J,aAAa4J,KAAKC,IAAG;GAC9BzH,QAAQ,EACPV,IAAI,KAAKA,GACV;EACD,CAAA;CACD;AACD;;;AC1uBA,SAAgBwI,wBACfC,SAAuC;CAEvC,OAAO,CACN;EACCC,SAASH;EACTI,UAAUF,QAAQG;CACnB,GACA;EACCF,SAASJ;EACTO,aAAaC,aACZT,uBAAuBU,aAAaD,QAAAA;EACrCE,MAAM,CAACZ,cAAe;CACvB,CACA;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securitydept/basic-auth-context-client",
-  "version": "0.3.0-beta.6",
+  "version": "0.3.0-beta.8",
   "description": "Basic Auth Context Client of the SecurityDept TypeScript SDK, a layered authentication and authorization toolkit built as reusable Rust crates, a TypeScript client SDK workspace, and reference server/web apps.",
   "author": "Zhou Yeheng <root@aitiotekt.com>",
   "license": "MIT",
@@ -40,7 +40,7 @@
     "arktype": "^2.2.3",
     "rxjs": "^7.8.2",
     "uuid": "^14.0.1",
-    "@securitydept/client": "0.3.0-beta.6"
+    "@securitydept/client": "0.3.0-beta.8"
   },
   "devDependencies": {
     "vitest": "^4.1.10"