@securitydept/client-react 0.2.0-beta.1

package/dist/index.d.mts

@@ -0,0 +1,88 @@
+import { AuthGuardClientOption, CandidateSelector, PlannerHost, ScopedRequirementsClientSet, resolveEffectiveClientSet } from "@securitydept/client/auth-coordination";
+import { ReactNode } from "react";
+import * as _$react_jsx_runtime0 from "react/jsx-runtime";
+
+//#region src/planner-host/index.d.ts
+/** Props for {@link AuthPlannerHostProvider}. */
+interface AuthPlannerHostProviderProps {
+  /**
+   * Custom candidate selection strategy.
+   * @see {@link CandidateSelector}
+   */
+  selectCandidate?: CandidateSelector;
+  /**
+   * Pre-constructed PlannerHost instance to use.
+   * If provided, `selectCandidate` is ignored.
+   */
+  plannerHost?: PlannerHost;
+  children: ReactNode;
+}
+/**
+ * Provide a {@link PlannerHost} at the current React tree scope.
+ *
+ * Use at the app level or at feature-route boundaries to establish
+ * planner-host scopes. Child components inherit the nearest provider.
+ *
+ * @example
+ * ```tsx
+ * // App-level (default sequential strategy)
+ * <AuthPlannerHostProvider>
+ *   <App />
+ * </AuthPlannerHostProvider>
+ *
+ * // Feature-route with custom chooser
+ * <AuthPlannerHostProvider selectCandidate={showChooser}>
+ *   <FeatureRoutes />
+ * </AuthPlannerHostProvider>
+ * ```
+ */
+declare function AuthPlannerHostProvider({
+  selectCandidate,
+  plannerHost,
+  children
+}: AuthPlannerHostProviderProps): _$react_jsx_runtime0.JSX.Element;
+/**
+ * Look up the nearest {@link PlannerHost} from the React Context tree.
+ *
+ * Throws an explicit error if no provider is found, preventing
+ * silent fallback behavior.
+ */
+declare function useAuthPlannerHost(): PlannerHost;
+/** Props for {@link AuthRequirementsClientSetProvider}. */
+interface AuthRequirementsClientSetProviderProps {
+  /** The scoped set to provide at this level. */
+  scopedSet: ScopedRequirementsClientSet;
+  children: ReactNode;
+}
+/**
+ * Provide a {@link ScopedRequirementsClientSet} at the current React tree scope.
+ *
+ * Automatically resolves the effective client set by composing with the
+ * parent scope's options according to the declared composition strategy.
+ *
+ * @example
+ * ```tsx
+ * // Feature route: merge OIDC requirement with parent's session requirement
+ * <AuthRequirementsClientSetProvider
+ *   scopedSet={{
+ *     composition: RequirementsClientSetComposition.Merge,
+ *     options: [oidcClientOption],
+ *   }}
+ * >
+ *   <ProtectedFeature />
+ * </AuthRequirementsClientSetProvider>
+ * ```
+ */
+declare function AuthRequirementsClientSetProvider({
+  scopedSet,
+  children
+}: AuthRequirementsClientSetProviderProps): _$react_jsx_runtime0.JSX.Element;
+/**
+ * Get the effective requirements client set for the current React tree scope.
+ *
+ * Returns the resolved options after applying all parent/child composition.
+ */
+declare function useEffectiveClientSet(): readonly AuthGuardClientOption[];
+//#endregion
+export { AuthPlannerHostProvider, AuthPlannerHostProviderProps, AuthRequirementsClientSetProvider, AuthRequirementsClientSetProviderProps, resolveEffectiveClientSet, useAuthPlannerHost, useEffectiveClientSet };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -0,0 +1,85 @@
+import { createPlannerHost, resolveEffectiveClientSet } from "@securitydept/client/auth-coordination";
+import { createContext, useContext, useMemo } from "react";
+import { jsx } from "react/jsx-runtime";
+//#region src/planner-host/index.tsx
+const PlannerHostContext = createContext(null);
+/**
+* Provide a {@link PlannerHost} at the current React tree scope.
+*
+* Use at the app level or at feature-route boundaries to establish
+* planner-host scopes. Child components inherit the nearest provider.
+*
+* @example
+* ```tsx
+* // App-level (default sequential strategy)
+* <AuthPlannerHostProvider>
+*   <App />
+* </AuthPlannerHostProvider>
+*
+* // Feature-route with custom chooser
+* <AuthPlannerHostProvider selectCandidate={showChooser}>
+*   <FeatureRoutes />
+* </AuthPlannerHostProvider>
+* ```
+*/
+function AuthPlannerHostProvider({ selectCandidate, plannerHost, children }) {
+	const host = useMemo(() => {
+		if (plannerHost) return plannerHost;
+		return createPlannerHost(selectCandidate ? { selectCandidate } : void 0);
+	}, [plannerHost, selectCandidate]);
+	return /* @__PURE__ */ jsx(PlannerHostContext.Provider, {
+		value: host,
+		children
+	});
+}
+/**
+* Look up the nearest {@link PlannerHost} from the React Context tree.
+*
+* Throws an explicit error if no provider is found, preventing
+* silent fallback behavior.
+*/
+function useAuthPlannerHost() {
+	const host = useContext(PlannerHostContext);
+	if (!host) throw new Error("[useAuthPlannerHost] No AuthPlannerHostProvider found in the component tree. Wrap your app or route with <AuthPlannerHostProvider>.");
+	return host;
+}
+const RequirementsClientSetContext = createContext([]);
+/**
+* Provide a {@link ScopedRequirementsClientSet} at the current React tree scope.
+*
+* Automatically resolves the effective client set by composing with the
+* parent scope's options according to the declared composition strategy.
+*
+* @example
+* ```tsx
+* // Feature route: merge OIDC requirement with parent's session requirement
+* <AuthRequirementsClientSetProvider
+*   scopedSet={{
+*     composition: RequirementsClientSetComposition.Merge,
+*     options: [oidcClientOption],
+*   }}
+* >
+*   <ProtectedFeature />
+* </AuthRequirementsClientSetProvider>
+* ```
+*/
+function AuthRequirementsClientSetProvider({ scopedSet, children }) {
+	const parentOptions = useContext(RequirementsClientSetContext);
+	const effective = useMemo(() => resolveEffectiveClientSet(parentOptions, scopedSet), [parentOptions, scopedSet]);
+	return /* @__PURE__ */ jsx(RequirementsClientSetContext.Provider, {
+		value: effective,
+		children
+	});
+}
+/**
+* Get the effective requirements client set for the current React tree scope.
+*
+* Returns the resolved options after applying all parent/child composition.
+*/
+function useEffectiveClientSet() {
+	return useContext(RequirementsClientSetContext);
+}
+//#endregion
+export { AuthPlannerHostProvider, AuthRequirementsClientSetProvider, resolveEffectiveClientSet, useAuthPlannerHost, useEffectiveClientSet };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/planner-host/index.tsx"],"sourcesContent":["// React planner-host integration — Context-based planner provider / lookup\n//\n// Canonical import path:\n//   import { AuthPlannerHostProvider, useAuthPlannerHost, ... } from \"@securitydept/client-react\"\n//\n// Provides React Context glue for the shared planner-host contract:\n//   - AuthPlannerHostProvider: provides a PlannerHost at a React tree scope\n//   - useAuthPlannerHost(): hook to look up the nearest PlannerHost (fail-fast)\n//   - AuthRequirementsClientSetProvider: provides scoped requirement client sets\n//   - useEffectiveClientSet(): resolves the current scope's effective client set\n//\n// Architecture boundary:\n//   - Does NOT own the planner-host contract (that lives in @securitydept/client)\n//   - Does NOT carry token-set-specific mapping\n//   - Provides the React Context wiring for the shared contract\n//\n// Stability: provisional\n\nimport type {\n\tAuthGuardClientOption,\n\tCandidateSelector,\n\tPlannerHost,\n\tScopedRequirementsClientSet,\n} from \"@securitydept/client/auth-coordination\";\nimport {\n\tcreatePlannerHost,\n\tresolveEffectiveClientSet,\n} from \"@securitydept/client/auth-coordination\";\nimport { createContext, type ReactNode, useContext, useMemo } from \"react\";\n\n// ---------------------------------------------------------------------------\n// PlannerHost context\n// ---------------------------------------------------------------------------\n\nconst PlannerHostContext = createContext<PlannerHost | null>(null);\n\n/** Props for {@link AuthPlannerHostProvider}. */\nexport interface AuthPlannerHostProviderProps {\n\t/**\n\t * Custom candidate selection strategy.\n\t * @see {@link CandidateSelector}\n\t */\n\tselectCandidate?: CandidateSelector;\n\n\t/**\n\t * Pre-constructed PlannerHost instance to use.\n\t * If provided, `selectCandidate` is ignored.\n\t */\n\tplannerHost?: PlannerHost;\n\n\tchildren: ReactNode;\n}\n\n/**\n * Provide a {@link PlannerHost} at the current React tree scope.\n *\n * Use at the app level or at feature-route boundaries to establish\n * planner-host scopes. Child components inherit the nearest provider.\n *\n * @example\n * ```tsx\n * // App-level (default sequential strategy)\n * <AuthPlannerHostProvider>\n *   <App />\n * </AuthPlannerHostProvider>\n *\n * // Feature-route with custom chooser\n * <AuthPlannerHostProvider selectCandidate={showChooser}>\n *   <FeatureRoutes />\n * </AuthPlannerHostProvider>\n * ```\n */\nexport function AuthPlannerHostProvider({\n\tselectCandidate,\n\tplannerHost,\n\tchildren,\n}: AuthPlannerHostProviderProps) {\n\tconst host = useMemo(() => {\n\t\tif (plannerHost) return plannerHost;\n\t\treturn createPlannerHost(selectCandidate ? { selectCandidate } : undefined);\n\t}, [plannerHost, selectCandidate]);\n\n\treturn (\n\t\t<PlannerHostContext.Provider value={host}>\n\t\t\t{children}\n\t\t</PlannerHostContext.Provider>\n\t);\n}\n\n/**\n * Look up the nearest {@link PlannerHost} from the React Context tree.\n *\n * Throws an explicit error if no provider is found, preventing\n * silent fallback behavior.\n */\nexport function useAuthPlannerHost(): PlannerHost {\n\tconst host = useContext(PlannerHostContext);\n\tif (!host) {\n\t\tthrow new Error(\n\t\t\t\"[useAuthPlannerHost] No AuthPlannerHostProvider found in the component tree. \" +\n\t\t\t\t\"Wrap your app or route with <AuthPlannerHostProvider>.\",\n\t\t);\n\t}\n\treturn host;\n}\n\n// ---------------------------------------------------------------------------\n// Requirements client set context\n// ---------------------------------------------------------------------------\n\nconst RequirementsClientSetContext = createContext<\n\treadonly AuthGuardClientOption[]\n>([]);\n\n/** Props for {@link AuthRequirementsClientSetProvider}. */\nexport interface AuthRequirementsClientSetProviderProps {\n\t/** The scoped set to provide at this level. */\n\tscopedSet: ScopedRequirementsClientSet;\n\tchildren: ReactNode;\n}\n\n/**\n * Provide a {@link ScopedRequirementsClientSet} at the current React tree scope.\n *\n * Automatically resolves the effective client set by composing with the\n * parent scope's options according to the declared composition strategy.\n *\n * @example\n * ```tsx\n * // Feature route: merge OIDC requirement with parent's session requirement\n * <AuthRequirementsClientSetProvider\n *   scopedSet={{\n *     composition: RequirementsClientSetComposition.Merge,\n *     options: [oidcClientOption],\n *   }}\n * >\n *   <ProtectedFeature />\n * </AuthRequirementsClientSetProvider>\n * ```\n */\nexport function AuthRequirementsClientSetProvider({\n\tscopedSet,\n\tchildren,\n}: AuthRequirementsClientSetProviderProps) {\n\tconst parentOptions = useContext(RequirementsClientSetContext);\n\tconst effective = useMemo(\n\t\t() => resolveEffectiveClientSet(parentOptions, scopedSet),\n\t\t[parentOptions, scopedSet],\n\t);\n\n\treturn (\n\t\t<RequirementsClientSetContext.Provider value={effective}>\n\t\t\t{children}\n\t\t</RequirementsClientSetContext.Provider>\n\t);\n}\n\n/**\n * Get the effective requirements client set for the current React tree scope.\n *\n * Returns the resolved options after applying all parent/child composition.\n */\nexport function useEffectiveClientSet(): readonly AuthGuardClientOption[] {\n\treturn useContext(RequirementsClientSetContext);\n}\n\n// Re-export composition constant for consumer convenience\nexport { resolveEffectiveClientSet };\n"],"mappings":";;;;AAkCA,MAAM,qBAAqB,cAAkC,KAAK;;;;;;;;;;;;;;;;;;;;AAsClE,SAAgB,wBAAwB,EACvC,iBACA,aACA,YACgC;CAChC,MAAM,OAAO,cAAc;AAC1B,MAAI,YAAa,QAAO;AACxB,SAAO,kBAAkB,kBAAkB,EAAE,iBAAiB,GAAG,KAAA,EAAU;IACzE,CAAC,aAAa,gBAAgB,CAAC;AAElC,QACC,oBAAC,mBAAmB,UAApB;EAA6B,OAAO;EAClC;EAC4B,CAAA;;;;;;;;AAUhC,SAAgB,qBAAkC;CACjD,MAAM,OAAO,WAAW,mBAAmB;AAC3C,KAAI,CAAC,KACJ,OAAM,IAAI,MACT,sIAEA;AAEF,QAAO;;AAOR,MAAM,+BAA+B,cAEnC,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;AA4BL,SAAgB,kCAAkC,EACjD,WACA,YAC0C;CAC1C,MAAM,gBAAgB,WAAW,6BAA6B;CAC9D,MAAM,YAAY,cACX,0BAA0B,eAAe,UAAU,EACzD,CAAC,eAAe,UAAU,CAC1B;AAED,QACC,oBAAC,6BAA6B,UAA9B;EAAuC,OAAO;EAC5C;EACsC,CAAA;;;;;;;AAS1C,SAAgB,wBAA0D;AACzE,QAAO,WAAW,6BAA6B"}

package/dist/tanstack-router/index.d.mts

@@ -0,0 +1,395 @@
+import { AuthRequirement, RequirementsClientSetComposition, RouteMatchNode } from "@securitydept/client/auth-coordination";
+import { AnyRoute, RegisteredRouter } from "@tanstack/react-router";
+
+//#region src/tanstack-router/index.d.ts
+/**
+ * Minimal shape of a TanStack Router route match entry.
+ *
+ * Structurally compatible with the matches returned by `useMatches()`.
+ * The adapter reads `staticData` (set via `beforeLoad` or `staticData` option)
+ * to find auth requirements.
+ */
+interface TanStackRouteMatch {
+  /** Route identifier (the route's `id` field). */
+  routeId: string;
+  /**
+   * Static route context, typically set via `beforeLoad` or `staticData`.
+   * Auth requirements should be declared here under a well-known key.
+   *
+   * Typed as `object` (not `Record<string, unknown>`) to remain structurally
+   * compatible with TanStack Router's open `StaticDataRouteOption` interface,
+   * which does not carry an index signature.
+   */
+  staticData?: object;
+  /** Route context merged from parent. */
+  context?: object;
+  /** Route loader data, if available. */
+  loaderData?: object;
+}
+/** Default key for auth requirements in TanStack Router `staticData`. */
+declare const DEFAULT_REQUIREMENTS_KEY = "authRequirements";
+/** Default key for the composition strategy in TanStack Router `staticData`. */
+declare const DEFAULT_COMPOSITION_KEY = "authRequirementsComposition";
+/** Options for {@link projectTanStackRouteMatches} and {@link createTanStackRouteActivator}. */
+interface TanStackRouterAdapterOptions {
+  /**
+   * Key used to read auth requirements from `staticData`.
+   *
+   * @default "authRequirements"
+   */
+  requirementsKey?: string;
+}
+/**
+ * Options for {@link withTanStackRouteRequirements}.
+ */
+interface WithTanStackRouteRequirementsOptions {
+  /**
+   * How this route segment composes with its parent route chain.
+   * @default RequirementsClientSetComposition.Merge
+   */
+  composition?: RequirementsClientSetComposition;
+  /**
+   * Additional staticData properties to merge into the returned object.
+   */
+  extra?: Record<string, unknown>;
+}
+/**
+ * Build a TanStack Router `staticData` object declaring auth requirements for
+ * a single route segment.
+ *
+ * This is the TanStack Router equivalent of Angular's `withRouteRequirements()`.
+ *
+ * @example
+ * ```ts
+ * import { createRoute } from "@tanstack/react-router";
+ * import { withTanStackRouteRequirements } from "@securitydept/client-react/tanstack-router";
+ *
+ * const dashboardRoute = createRoute({
+ *   getParentRoute: () => rootRoute,
+ *   path: "dashboard",
+ *   staticData: withTanStackRouteRequirements([
+ *     { id: "session", kind: "session" },
+ *   ]),
+ * });
+ *
+ * // Child route replaces parent requirements:
+ * const publicRoute = createRoute({
+ *   getParentRoute: () => dashboardRoute,
+ *   path: "public",
+ *   staticData: withTanStackRouteRequirements([], {
+ *     composition: RequirementsClientSetComposition.Replace,
+ *   }),
+ * });
+ * ```
+ *
+ * @param requirements - Auth requirements for this route segment.
+ * @param options - Optional composition strategy and extra staticData.
+ */
+declare function withTanStackRouteRequirements(requirements: AuthRequirement[], options?: WithTanStackRouteRequirementsOptions): Record<string, unknown>;
+/**
+ * Extract and compose auth requirements from a TanStack Router matched route
+ * chain, respecting merge/replace/inherit composition at each segment.
+ *
+ * This is the TanStack Router equivalent of Angular's
+ * `extractFullRouteRequirements()`. It walks the matched route chain from root
+ * to leaf and applies the composition strategy declared at each segment:
+ *
+ * - `inherit` — keep parent requirements unchanged
+ * - `merge` — append child requirements, replacing same-id parent entries
+ * - `replace` — discard parent chain, use only child's requirements
+ *
+ * @param matches - Matched route chain from root to leaf (as from `useMatches()`).
+ * @param options - Optional key override.
+ */
+declare function extractTanStackRouteRequirements(matches: readonly TanStackRouteMatch[], options?: TanStackRouterAdapterOptions): AuthRequirement[];
+/**
+ * Route-level auth requirement declaration for composition resolution.
+ */
+interface RouteRequirementsDeclaration {
+  requirements: readonly AuthRequirement[];
+  composition: RequirementsClientSetComposition;
+}
+/**
+ * Resolve the effective auth requirements by composing the parent chain with a
+ * child route declaration.
+ *
+ * Composition semantics mirror Angular's `resolveEffectiveRequirements()`:
+ * - `inherit` keeps the parent requirements unchanged
+ * - `merge` appends child requirements and replaces same-id parent entries
+ * - `replace` discards the parent chain and uses only the child's requirements
+ */
+declare function resolveEffectiveRequirements(parentRequirements: readonly AuthRequirement[], child: RouteRequirementsDeclaration): AuthRequirement[];
+/**
+ * Project TanStack Router matched route entries into the SDK's
+ * `RouteMatchNode[]` contract.
+ *
+ * Each match entry is mapped to a `RouteMatchNode`:
+ *   - `routeId` is taken from `match.routeId`
+ *   - `requirements` is read from `match.staticData[requirementsKey]`
+ *
+ * Entries with no requirements produce nodes with an empty requirements array,
+ * preserving the full chain for shared-prefix diffing.
+ *
+ * @example
+ * ```ts
+ * import { useMatches } from "@tanstack/react-router";
+ * import { projectTanStackRouteMatches } from "@securitydept/client-react/tanstack-router";
+ *
+ * const matches = useMatches();
+ * const routeChain = projectTanStackRouteMatches(matches);
+ * orchestrator.activateMatchedRoutes(routeChain);
+ * ```
+ */
+declare function projectTanStackRouteMatches(matches: readonly TanStackRouteMatch[], options?: TanStackRouterAdapterOptions): RouteMatchNode[];
+/**
+ * Create a route-change activator that projects TanStack Router matches and
+ * activates them on the orchestrator.
+ *
+ * This is framework-agnostic (not a React hook) and can be called from a
+ * `useEffect`, route subscriber, or any mechanism that notifies match changes.
+ *
+ * @example
+ * ```ts
+ * import { useMatches } from "@@tanstack/react-router";
+ * import { createTanStackRouteActivator } from "@securitydept/client-react/tanstack-router";
+ *
+ * const activator = createTanStackRouteActivator(orchestrator);
+ *
+ * function RouteOrchestrationBridge() {
+ *   const matches = useMatches();
+ *   useEffect(() => activator.activate(matches), [matches]);
+ *   return null;
+ * }
+ * ```
+ */
+declare function createTanStackRouteActivator(orchestrator: {
+  activateMatchedRoutes(chain: readonly RouteMatchNode[]): void;
+  deactivateRoute(): void;
+}, options?: TanStackRouterAdapterOptions): {
+  /** Project matches and activate the route chain on the orchestrator. */activate(matches: readonly TanStackRouteMatch[]): void; /** Deactivate the current route (e.g. on unmount or navigation away). */
+  deactivate(): void;
+};
+/**
+ * Root-level runtime policy for a secured TanStack Router route tree.
+ *
+ * This is the TanStack Router equivalent of Angular's
+ * `SecureRouteRootSecurityOptions`. Non-serializable runtime callbacks
+ * (planner host, onUnauthenticated handlers) live here, NOT in individual
+ * route `staticData`.
+ *
+ * @example
+ * ```ts
+ * const routeSecurityPolicy = createTanStackRouteSecurityPolicy({
+ *   requirementHandlers: {
+ *     frontend_oidc: (failingRequirement) => {
+ *       redirectToLogin(failingRequirement);
+ *       return false;
+ *     },
+ *   },
+ * });
+ *
+ * // Use in beforeLoad:
+ * const protectedRoute = createRoute({
+ *   beforeLoad: ({ matches }) => {
+ *     routeSecurityPolicy.enforce(matches);
+ *   },
+ * });
+ * ```
+ */
+interface TanStackRouteSecurityPolicyOptions {
+  /**
+   * Per-requirement-kind handlers.
+   * Keys are `AuthRequirement.kind` strings.
+   */
+  requirementHandlers?: Record<string, (requirement: AuthRequirement) => boolean | string>;
+  /**
+   * Fallback handler when no kind-specific handler matches.
+   */
+  defaultOnUnauthenticated?: (requirement: AuthRequirement) => boolean | string;
+  /**
+   * Custom key for reading requirements from staticData.
+   * @default "authRequirements"
+   */
+  requirementsKey?: string;
+}
+/**
+ * Route security evaluation result from
+ * {@link createTanStackRouteSecurityPolicy}.
+ */
+interface TanStackRouteSecurityResult {
+  /** All requirements are met — allow navigation. */
+  readonly allMet: boolean;
+  /** The first unmet requirement, if any. */
+  readonly pendingRequirement: AuthRequirement | undefined;
+  /** Handler action for the pending requirement (from policy). */
+  readonly action: boolean | string | undefined;
+  /** The full effective requirements after composition. */
+  readonly effectiveRequirements: readonly AuthRequirement[];
+}
+/**
+ * Create a root-level route security policy that evaluates a TanStack Router
+ * matched route chain and returns the enforcement decision.
+ *
+ * This is the TanStack Router equivalent of Angular's `secureRouteRoot()`.
+ * It centralizes non-serializable runtime policy (handlers, redirects) at
+ * the root level, while individual routes only declare serializable metadata
+ * via `withTanStackRouteRequirements()`.
+ *
+ * The returned `evaluate()` function:
+ * 1. Extracts requirements from the matched route chain (with composition)
+ * 2. Finds the first unmet requirement using the provided `checkAuthenticated`
+ * 3. Resolves the handler action (kind handler → default handler → block)
+ *
+ * @example
+ * ```ts
+ * import { createTanStackRouteSecurityPolicy } from "@securitydept/client-react/tanstack-router";
+ *
+ * const policy = createTanStackRouteSecurityPolicy({
+ *   requirementHandlers: {
+ *     frontend_oidc: (req) => {
+ *       redirectToOidcLogin(req);
+ *       return false;
+ *     },
+ *   },
+ *   defaultOnUnauthenticated: () => "/login",
+ * });
+ *
+ * // In a route's beforeLoad or a React effect:
+ * const result = policy.evaluate(matches, (req) => isAuthenticated(req.kind));
+ * if (!result.allMet && typeof result.action === "string") {
+ *   navigate({ to: result.action });
+ * }
+ * ```
+ */
+declare function createTanStackRouteSecurityPolicy(options?: TanStackRouteSecurityPolicyOptions): {
+  /**
+   * Evaluate the route security policy for a matched route chain.
+   *
+   * @param matches - The matched route chain (root → leaf).
+   * @param checkAuthenticated - Returns true if a requirement is met.
+   */
+  evaluate(matches: readonly TanStackRouteMatch[], checkAuthenticated: (requirement: AuthRequirement) => boolean): TanStackRouteSecurityResult;
+};
+/**
+ * Navigation-blocked error thrown by {@link createSecureBeforeLoad} when a
+ * requirement is unmet and the handler returns `false`.
+ */
+declare class RouteSecurityBlockedError extends Error {
+  readonly requirement: AuthRequirement;
+  readonly result: TanStackRouteSecurityResult;
+  constructor(requirement: AuthRequirement, result: TanStackRouteSecurityResult);
+}
+/**
+ * Minimal shape of TanStack Router's `beforeLoad` context.
+ *
+ * Only the fields actually consumed by {@link createSecureBeforeLoad} are
+ * required. The full TanStack Router context has many more fields; this
+ * interface lets the helper stay structurally compatible without importing
+ * the full framework type.
+ */
+interface SecureBeforeLoadContext {
+  /** URL location of the target route. */
+  location: {
+    pathname: string;
+    href: string;
+  };
+  /**
+   * Matched route entries for the current navigation.
+   * Shape matches {@link TanStackRouteMatch}.
+   */
+  matches: readonly TanStackRouteMatch[];
+  /** Navigation cause ("enter", "stay", "push", "replace", etc.). */
+  cause: string;
+}
+/**
+ * Options for {@link createSecureBeforeLoad}.
+ */
+interface CreateSecureBeforeLoadOptions extends TanStackRouteSecurityPolicyOptions {
+  /**
+   * Returns true if the given auth requirement is currently satisfied.
+   *
+   * This is the auth-state bridge: the adopter supplies a function that
+   * checks their auth store / context.
+   */
+  checkAuthenticated: (requirement: AuthRequirement) => boolean;
+  /**
+   * TanStack Router's `redirect()` function.
+   *
+   * When a handler returns a string (redirect path), `createSecureBeforeLoad`
+   * throws `redirect({ to: path })` to trigger TanStack Router's redirect
+   * mechanism.
+   *
+   * Pass `redirect` from `@tanstack/react-router` here:
+   * ```ts
+   * import { redirect } from "@tanstack/react-router";
+   * createSecureBeforeLoad({ redirect, ... });
+   * ```
+   *
+   * If omitted, string actions cause a {@link RouteSecurityBlockedError}
+   * with the redirect path in the error message.
+   */
+  redirect?: (opts: {
+    to: string;
+  }) => never;
+}
+/**
+ * Create a `beforeLoad`-compatible function that enforces route-security
+ * requirements inside TanStack Router's execution semantics.
+ *
+ * **This is the canonical TanStack Router adopter-facing entry** — the
+ * equivalent of Angular's `secureRouteRoot()`.
+ *
+ * How it works:
+ * 1. Receives TanStack Router's `beforeLoad` context (including `matches`)
+ * 2. Extracts the full requirement chain with composition semantics
+ * 3. Finds the first unmet requirement
+ * 4. Calls the handler (kind handler → default → block)
+ * 5. If the handler returns a string path, throws `redirect({ to: path })`
+ * 6. If the handler returns `false`, throws {@link RouteSecurityBlockedError}
+ * 7. If all requirements are met, returns normally (navigation proceeds)
+ *
+ * @example
+ * ```ts
+ * import { redirect, createRoute } from "@tanstack/react-router";
+ * import {
+ *   createSecureBeforeLoad,
+ *   withTanStackRouteRequirements,
+ * } from "@securitydept/client-react/tanstack-router";
+ *
+ * // Root-level: non-serializable runtime policy
+ * const securedBeforeLoad = createSecureBeforeLoad({
+ *   redirect,
+ *   checkAuthenticated: (req) => authStore.isAuthenticated(req.kind),
+ *   requirementHandlers: {
+ *     frontend_oidc: (req) => "/login/oidc",
+ *     session: () => "/login",
+ *   },
+ * });
+ *
+ * // Root route — attach the beforeLoad
+ * const rootRoute = createRootRoute({
+ *   beforeLoad: securedBeforeLoad,
+ * });
+ *
+ * // Child routes — serializable declaration only
+ * const dashboardRoute = createRoute({
+ *   getParentRoute: () => rootRoute,
+ *   path: "dashboard",
+ *   staticData: withTanStackRouteRequirements([
+ *     { id: "session", kind: "session" },
+ *   ]),
+ * });
+ *
+ * const adminRoute = createRoute({
+ *   getParentRoute: () => dashboardRoute,
+ *   path: "admin",
+ *   staticData: withTanStackRouteRequirements([
+ *     { id: "admin-oidc", kind: "frontend_oidc" },
+ *   ]),
+ * });
+ * ```
+ */
+declare function createSecureBeforeLoad(options: CreateSecureBeforeLoadOptions): (ctx: SecureBeforeLoadContext) => void;
+//#endregion
+export { type AnyRoute, type AuthRequirement, CreateSecureBeforeLoadOptions, DEFAULT_COMPOSITION_KEY, DEFAULT_REQUIREMENTS_KEY, type RegisteredRouter, RequirementsClientSetComposition, type RouteMatchNode, RouteRequirementsDeclaration, RouteSecurityBlockedError, SecureBeforeLoadContext, TanStackRouteMatch, TanStackRouteSecurityPolicyOptions, TanStackRouteSecurityResult, TanStackRouterAdapterOptions, WithTanStackRouteRequirementsOptions, createSecureBeforeLoad, createTanStackRouteActivator, createTanStackRouteSecurityPolicy, extractTanStackRouteRequirements, projectTanStackRouteMatches, resolveEffectiveRequirements, withTanStackRouteRequirements };
+//# sourceMappingURL=index.d.mts.map

package/dist/tanstack-router/index.mjs

@@ -0,0 +1,308 @@
+import { RequirementsClientSetComposition } from "@securitydept/client/auth-coordination";
+//#region src/tanstack-router/index.ts
+/** Default key for auth requirements in TanStack Router `staticData`. */
+const DEFAULT_REQUIREMENTS_KEY = "authRequirements";
+/** Default key for the composition strategy in TanStack Router `staticData`. */
+const DEFAULT_COMPOSITION_KEY = "authRequirementsComposition";
+/**
+* Build a TanStack Router `staticData` object declaring auth requirements for
+* a single route segment.
+*
+* This is the TanStack Router equivalent of Angular's `withRouteRequirements()`.
+*
+* @example
+* ```ts
+* import { createRoute } from "@tanstack/react-router";
+* import { withTanStackRouteRequirements } from "@securitydept/client-react/tanstack-router";
+*
+* const dashboardRoute = createRoute({
+*   getParentRoute: () => rootRoute,
+*   path: "dashboard",
+*   staticData: withTanStackRouteRequirements([
+*     { id: "session", kind: "session" },
+*   ]),
+* });
+*
+* // Child route replaces parent requirements:
+* const publicRoute = createRoute({
+*   getParentRoute: () => dashboardRoute,
+*   path: "public",
+*   staticData: withTanStackRouteRequirements([], {
+*     composition: RequirementsClientSetComposition.Replace,
+*   }),
+* });
+* ```
+*
+* @param requirements - Auth requirements for this route segment.
+* @param options - Optional composition strategy and extra staticData.
+*/
+function withTanStackRouteRequirements(requirements, options) {
+	return {
+		...options?.extra ?? {},
+		[DEFAULT_REQUIREMENTS_KEY]: requirements,
+		[DEFAULT_COMPOSITION_KEY]: options?.composition ?? RequirementsClientSetComposition.Merge
+	};
+}
+/**
+* Extract and compose auth requirements from a TanStack Router matched route
+* chain, respecting merge/replace/inherit composition at each segment.
+*
+* This is the TanStack Router equivalent of Angular's
+* `extractFullRouteRequirements()`. It walks the matched route chain from root
+* to leaf and applies the composition strategy declared at each segment:
+*
+* - `inherit` — keep parent requirements unchanged
+* - `merge` — append child requirements, replacing same-id parent entries
+* - `replace` — discard parent chain, use only child's requirements
+*
+* @param matches - Matched route chain from root to leaf (as from `useMatches()`).
+* @param options - Optional key override.
+*/
+function extractTanStackRouteRequirements(matches, options) {
+	const key = options?.requirementsKey ?? "authRequirements";
+	let result = [];
+	for (const match of matches) {
+		const raw = match.staticData?.[key];
+		const compositionRaw = match.staticData?.[DEFAULT_COMPOSITION_KEY];
+		const composition = isValidComposition(compositionRaw) ? compositionRaw : RequirementsClientSetComposition.Merge;
+		result = resolveEffectiveRequirements(result, {
+			composition,
+			requirements: Array.isArray(raw) ? raw : []
+		});
+	}
+	return result;
+}
+/**
+* Resolve the effective auth requirements by composing the parent chain with a
+* child route declaration.
+*
+* Composition semantics mirror Angular's `resolveEffectiveRequirements()`:
+* - `inherit` keeps the parent requirements unchanged
+* - `merge` appends child requirements and replaces same-id parent entries
+* - `replace` discards the parent chain and uses only the child's requirements
+*/
+function resolveEffectiveRequirements(parentRequirements, child) {
+	switch (child.composition) {
+		case RequirementsClientSetComposition.Inherit: return [...parentRequirements];
+		case RequirementsClientSetComposition.Merge: {
+			const merged = /* @__PURE__ */ new Map();
+			for (const requirement of parentRequirements) merged.set(requirement.id, requirement);
+			for (const requirement of child.requirements) merged.set(requirement.id, requirement);
+			return [...merged.values()];
+		}
+		case RequirementsClientSetComposition.Replace: return [...child.requirements];
+		default: {
+			const _exhaustive = child.composition;
+			throw new Error(`[resolveEffectiveRequirements] Unknown composition: ${_exhaustive}`);
+		}
+	}
+}
+/**
+* Project TanStack Router matched route entries into the SDK's
+* `RouteMatchNode[]` contract.
+*
+* Each match entry is mapped to a `RouteMatchNode`:
+*   - `routeId` is taken from `match.routeId`
+*   - `requirements` is read from `match.staticData[requirementsKey]`
+*
+* Entries with no requirements produce nodes with an empty requirements array,
+* preserving the full chain for shared-prefix diffing.
+*
+* @example
+* ```ts
+* import { useMatches } from "@tanstack/react-router";
+* import { projectTanStackRouteMatches } from "@securitydept/client-react/tanstack-router";
+*
+* const matches = useMatches();
+* const routeChain = projectTanStackRouteMatches(matches);
+* orchestrator.activateMatchedRoutes(routeChain);
+* ```
+*/
+function projectTanStackRouteMatches(matches, options) {
+	const key = options?.requirementsKey ?? "authRequirements";
+	return matches.map((match) => {
+		const rawRequirements = match.staticData?.[key];
+		const requirements = Array.isArray(rawRequirements) ? rawRequirements : [];
+		return {
+			routeId: match.routeId,
+			requirements
+		};
+	});
+}
+/**
+* Create a route-change activator that projects TanStack Router matches and
+* activates them on the orchestrator.
+*
+* This is framework-agnostic (not a React hook) and can be called from a
+* `useEffect`, route subscriber, or any mechanism that notifies match changes.
+*
+* @example
+* ```ts
+* import { useMatches } from "@@tanstack/react-router";
+* import { createTanStackRouteActivator } from "@securitydept/client-react/tanstack-router";
+*
+* const activator = createTanStackRouteActivator(orchestrator);
+*
+* function RouteOrchestrationBridge() {
+*   const matches = useMatches();
+*   useEffect(() => activator.activate(matches), [matches]);
+*   return null;
+* }
+* ```
+*/
+function createTanStackRouteActivator(orchestrator, options) {
+	return {
+		activate(matches) {
+			const chain = projectTanStackRouteMatches(matches, options);
+			orchestrator.activateMatchedRoutes(chain);
+		},
+		deactivate() {
+			orchestrator.deactivateRoute();
+		}
+	};
+}
+/**
+* Create a root-level route security policy that evaluates a TanStack Router
+* matched route chain and returns the enforcement decision.
+*
+* This is the TanStack Router equivalent of Angular's `secureRouteRoot()`.
+* It centralizes non-serializable runtime policy (handlers, redirects) at
+* the root level, while individual routes only declare serializable metadata
+* via `withTanStackRouteRequirements()`.
+*
+* The returned `evaluate()` function:
+* 1. Extracts requirements from the matched route chain (with composition)
+* 2. Finds the first unmet requirement using the provided `checkAuthenticated`
+* 3. Resolves the handler action (kind handler → default handler → block)
+*
+* @example
+* ```ts
+* import { createTanStackRouteSecurityPolicy } from "@securitydept/client-react/tanstack-router";
+*
+* const policy = createTanStackRouteSecurityPolicy({
+*   requirementHandlers: {
+*     frontend_oidc: (req) => {
+*       redirectToOidcLogin(req);
+*       return false;
+*     },
+*   },
+*   defaultOnUnauthenticated: () => "/login",
+* });
+*
+* // In a route's beforeLoad or a React effect:
+* const result = policy.evaluate(matches, (req) => isAuthenticated(req.kind));
+* if (!result.allMet && typeof result.action === "string") {
+*   navigate({ to: result.action });
+* }
+* ```
+*/
+function createTanStackRouteSecurityPolicy(options = {}) {
+	return { evaluate(matches, checkAuthenticated) {
+		const effectiveRequirements = extractTanStackRouteRequirements(matches, { requirementsKey: options.requirementsKey });
+		for (const req of effectiveRequirements) if (!checkAuthenticated(req)) {
+			const handler = options.requirementHandlers?.[req.kind] ?? options.defaultOnUnauthenticated;
+			return {
+				allMet: false,
+				pendingRequirement: req,
+				action: handler ? handler(req) : false,
+				effectiveRequirements
+			};
+		}
+		return {
+			allMet: true,
+			pendingRequirement: void 0,
+			action: void 0,
+			effectiveRequirements
+		};
+	} };
+}
+/**
+* Navigation-blocked error thrown by {@link createSecureBeforeLoad} when a
+* requirement is unmet and the handler returns `false`.
+*/
+var RouteSecurityBlockedError = class extends Error {
+	constructor(requirement, result) {
+		super(`[secureBeforeLoad] Navigation blocked: requirement "${requirement.id}" (kind: ${requirement.kind}) is not authenticated.`);
+		this.requirement = requirement;
+		this.result = result;
+		this.name = "RouteSecurityBlockedError";
+	}
+};
+/**
+* Create a `beforeLoad`-compatible function that enforces route-security
+* requirements inside TanStack Router's execution semantics.
+*
+* **This is the canonical TanStack Router adopter-facing entry** — the
+* equivalent of Angular's `secureRouteRoot()`.
+*
+* How it works:
+* 1. Receives TanStack Router's `beforeLoad` context (including `matches`)
+* 2. Extracts the full requirement chain with composition semantics
+* 3. Finds the first unmet requirement
+* 4. Calls the handler (kind handler → default → block)
+* 5. If the handler returns a string path, throws `redirect({ to: path })`
+* 6. If the handler returns `false`, throws {@link RouteSecurityBlockedError}
+* 7. If all requirements are met, returns normally (navigation proceeds)
+*
+* @example
+* ```ts
+* import { redirect, createRoute } from "@tanstack/react-router";
+* import {
+*   createSecureBeforeLoad,
+*   withTanStackRouteRequirements,
+* } from "@securitydept/client-react/tanstack-router";
+*
+* // Root-level: non-serializable runtime policy
+* const securedBeforeLoad = createSecureBeforeLoad({
+*   redirect,
+*   checkAuthenticated: (req) => authStore.isAuthenticated(req.kind),
+*   requirementHandlers: {
+*     frontend_oidc: (req) => "/login/oidc",
+*     session: () => "/login",
+*   },
+* });
+*
+* // Root route — attach the beforeLoad
+* const rootRoute = createRootRoute({
+*   beforeLoad: securedBeforeLoad,
+* });
+*
+* // Child routes — serializable declaration only
+* const dashboardRoute = createRoute({
+*   getParentRoute: () => rootRoute,
+*   path: "dashboard",
+*   staticData: withTanStackRouteRequirements([
+*     { id: "session", kind: "session" },
+*   ]),
+* });
+*
+* const adminRoute = createRoute({
+*   getParentRoute: () => dashboardRoute,
+*   path: "admin",
+*   staticData: withTanStackRouteRequirements([
+*     { id: "admin-oidc", kind: "frontend_oidc" },
+*   ]),
+* });
+* ```
+*/
+function createSecureBeforeLoad(options) {
+	const policy = createTanStackRouteSecurityPolicy(options);
+	return function secureBeforeLoad(ctx) {
+		const result = policy.evaluate(ctx.matches, options.checkAuthenticated);
+		if (result.allMet) return;
+		const { action, pendingRequirement } = result;
+		if (!pendingRequirement) return;
+		if (typeof action === "string") {
+			if (options.redirect) throw options.redirect({ to: action });
+			throw new RouteSecurityBlockedError(pendingRequirement, result);
+		}
+		throw new RouteSecurityBlockedError(pendingRequirement, result);
+	};
+}
+function isValidComposition(raw) {
+	return raw === RequirementsClientSetComposition.Inherit || raw === RequirementsClientSetComposition.Merge || raw === RequirementsClientSetComposition.Replace;
+}
+//#endregion
+export { DEFAULT_COMPOSITION_KEY, DEFAULT_REQUIREMENTS_KEY, RequirementsClientSetComposition, RouteSecurityBlockedError, createSecureBeforeLoad, createTanStackRouteActivator, createTanStackRouteSecurityPolicy, extractTanStackRouteRequirements, projectTanStackRouteMatches, resolveEffectiveRequirements, withTanStackRouteRequirements };
+
+//# sourceMappingURL=index.mjs.map

package/dist/tanstack-router/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/tanstack-router/index.ts"],"sourcesContent":["// TanStack React Router route-security contract for auth-coordination\n//\n// Canonical import path:\n//   import { ... } from \"@securitydept/client-react/tanstack-router\"\n//\n// Provides the complete route-security contract for TanStack React Router,\n// aligned with the Angular Router contract in @securitydept/client-angular:\n//\n// Adopter-facing canonical path (highest level):\n//   - createSecureBeforeLoad()   — root-level beforeLoad factory that wires\n//     non-serializable runtime policy (handlers, redirect logic) into\n//     TanStack Router's execution semantics. This is the TanStack equivalent\n//     of Angular's secureRouteRoot().\n//   - withTanStackRouteRequirements() — child-route serializable metadata\n//     declaration. This is the TanStack equivalent of Angular's secureRoute().\n//\n// Lower-level building blocks:\n//   - extractTanStackRouteRequirements() — full-route aggregation with\n//     merge/replace/inherit composition\n//   - createTanStackRouteSecurityPolicy() — headless evaluator (no router\n//     execution glue; for custom integrations)\n//   - projectTanStackRouteMatches() / createTanStackRouteActivator() —\n//     RouteRequirementOrchestrator projection helpers\n//\n// Architecture boundary:\n//   - Does NOT own the router, lifecycle, or render UI.\n//   - Does NOT re-export core orchestration primitives.\n//   - Does NOT carry token-set-specific mapping, policy, or registry logic.\n//   - The adopter wires this into their router setup.\n//\n// Relationship to Angular sibling:\n//   - createSecureBeforeLoad()              ↔  secureRouteRoot()\n//   - withTanStackRouteRequirements()       ↔  secureRoute() / withRouteRequirements()\n//   - extractTanStackRouteRequirements()    ↔  extractFullRouteRequirements()\n//   - createTanStackRouteSecurityPolicy()   ↔  createTokenSetRouteAggregationGuard()\n//   - Both share RequirementsClientSetComposition from @securitydept/client/auth-coordination\n//\n// Stability: provisional\n\nimport type {\n\tAuthRequirement,\n\tRouteMatchNode,\n} from \"@securitydept/client/auth-coordination\";\nimport { RequirementsClientSetComposition } from \"@securitydept/client/auth-coordination\";\nimport type { AnyRoute, RegisteredRouter } from \"@tanstack/react-router\";\n\nexport type { AuthRequirement, RouteMatchNode };\n\n// ---------------------------------------------------------------------------\n// Route match shape\n// ---------------------------------------------------------------------------\n\n/**\n * Minimal shape of a TanStack Router route match entry.\n *\n * Structurally compatible with the matches returned by `useMatches()`.\n * The adapter reads `staticData` (set via `beforeLoad` or `staticData` option)\n * to find auth requirements.\n */\nexport interface TanStackRouteMatch {\n\t/** Route identifier (the route's `id` field). */\n\trouteId: string;\n\t/**\n\t * Static route context, typically set via `beforeLoad` or `staticData`.\n\t * Auth requirements should be declared here under a well-known key.\n\t *\n\t * Typed as `object` (not `Record<string, unknown>`) to remain structurally\n\t * compatible with TanStack Router's open `StaticDataRouteOption` interface,\n\t * which does not carry an index signature.\n\t */\n\tstaticData?: object;\n\t/** Route context merged from parent. */\n\tcontext?: object;\n\t/** Route loader data, if available. */\n\tloaderData?: object;\n}\n\n// ---------------------------------------------------------------------------\n// Route data keys\n// ---------------------------------------------------------------------------\n\n/** Default key for auth requirements in TanStack Router `staticData`. */\nexport const DEFAULT_REQUIREMENTS_KEY = \"authRequirements\";\n\n/** Default key for the composition strategy in TanStack Router `staticData`. */\nexport const DEFAULT_COMPOSITION_KEY = \"authRequirementsComposition\";\n\n// ---------------------------------------------------------------------------\n// Options\n// ---------------------------------------------------------------------------\n\n/** Options for {@link projectTanStackRouteMatches} and {@link createTanStackRouteActivator}. */\nexport interface TanStackRouterAdapterOptions {\n\t/**\n\t * Key used to read auth requirements from `staticData`.\n\t *\n\t * @default \"authRequirements\"\n\t */\n\trequirementsKey?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Route metadata declaration helper\n// ---------------------------------------------------------------------------\n\n/**\n * Options for {@link withTanStackRouteRequirements}.\n */\nexport interface WithTanStackRouteRequirementsOptions {\n\t/**\n\t * How this route segment composes with its parent route chain.\n\t * @default RequirementsClientSetComposition.Merge\n\t */\n\tcomposition?: RequirementsClientSetComposition;\n\n\t/**\n\t * Additional staticData properties to merge into the returned object.\n\t */\n\textra?: Record<string, unknown>;\n}\n\n/**\n * Build a TanStack Router `staticData` object declaring auth requirements for\n * a single route segment.\n *\n * This is the TanStack Router equivalent of Angular's `withRouteRequirements()`.\n *\n * @example\n * ```ts\n * import { createRoute } from \"@tanstack/react-router\";\n * import { withTanStackRouteRequirements } from \"@securitydept/client-react/tanstack-router\";\n *\n * const dashboardRoute = createRoute({\n *   getParentRoute: () => rootRoute,\n *   path: \"dashboard\",\n *   staticData: withTanStackRouteRequirements([\n *     { id: \"session\", kind: \"session\" },\n *   ]),\n * });\n *\n * // Child route replaces parent requirements:\n * const publicRoute = createRoute({\n *   getParentRoute: () => dashboardRoute,\n *   path: \"public\",\n *   staticData: withTanStackRouteRequirements([], {\n *     composition: RequirementsClientSetComposition.Replace,\n *   }),\n * });\n * ```\n *\n * @param requirements - Auth requirements for this route segment.\n * @param options - Optional composition strategy and extra staticData.\n */\nexport function withTanStackRouteRequirements(\n\trequirements: AuthRequirement[],\n\toptions?: WithTanStackRouteRequirementsOptions,\n): Record<string, unknown> {\n\treturn {\n\t\t...(options?.extra ?? {}),\n\t\t[DEFAULT_REQUIREMENTS_KEY]: requirements,\n\t\t[DEFAULT_COMPOSITION_KEY]:\n\t\t\toptions?.composition ?? RequirementsClientSetComposition.Merge,\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Full-route aggregation with composition semantics\n// ---------------------------------------------------------------------------\n\n/**\n * Extract and compose auth requirements from a TanStack Router matched route\n * chain, respecting merge/replace/inherit composition at each segment.\n *\n * This is the TanStack Router equivalent of Angular's\n * `extractFullRouteRequirements()`. It walks the matched route chain from root\n * to leaf and applies the composition strategy declared at each segment:\n *\n * - `inherit` — keep parent requirements unchanged\n * - `merge` — append child requirements, replacing same-id parent entries\n * - `replace` — discard parent chain, use only child's requirements\n *\n * @param matches - Matched route chain from root to leaf (as from `useMatches()`).\n * @param options - Optional key override.\n */\nexport function extractTanStackRouteRequirements(\n\tmatches: readonly TanStackRouteMatch[],\n\toptions?: TanStackRouterAdapterOptions,\n): AuthRequirement[] {\n\tconst key = options?.requirementsKey ?? DEFAULT_REQUIREMENTS_KEY;\n\tlet result: AuthRequirement[] = [];\n\n\tfor (const match of matches) {\n\t\tconst raw = (match.staticData as Record<string, unknown>)?.[key];\n\t\tconst compositionRaw = (match.staticData as Record<string, unknown>)?.[\n\t\t\tDEFAULT_COMPOSITION_KEY\n\t\t];\n\t\tconst composition = isValidComposition(compositionRaw)\n\t\t\t? compositionRaw\n\t\t\t: RequirementsClientSetComposition.Merge;\n\t\tconst requirements: AuthRequirement[] = Array.isArray(raw) ? raw : [];\n\n\t\tresult = resolveEffectiveRequirements(result, {\n\t\t\tcomposition,\n\t\t\trequirements,\n\t\t});\n\t}\n\treturn result;\n}\n\n// ---------------------------------------------------------------------------\n// Composition resolution (shared logic with Angular sibling)\n// ---------------------------------------------------------------------------\n\n/**\n * Route-level auth requirement declaration for composition resolution.\n */\nexport interface RouteRequirementsDeclaration {\n\trequirements: readonly AuthRequirement[];\n\tcomposition: RequirementsClientSetComposition;\n}\n\n/**\n * Resolve the effective auth requirements by composing the parent chain with a\n * child route declaration.\n *\n * Composition semantics mirror Angular's `resolveEffectiveRequirements()`:\n * - `inherit` keeps the parent requirements unchanged\n * - `merge` appends child requirements and replaces same-id parent entries\n * - `replace` discards the parent chain and uses only the child's requirements\n */\nexport function resolveEffectiveRequirements(\n\tparentRequirements: readonly AuthRequirement[],\n\tchild: RouteRequirementsDeclaration,\n): AuthRequirement[] {\n\tswitch (child.composition) {\n\t\tcase RequirementsClientSetComposition.Inherit:\n\t\t\treturn [...parentRequirements];\n\n\t\tcase RequirementsClientSetComposition.Merge: {\n\t\t\tconst merged = new Map<string, AuthRequirement>();\n\t\t\tfor (const requirement of parentRequirements) {\n\t\t\t\tmerged.set(requirement.id, requirement);\n\t\t\t}\n\t\t\tfor (const requirement of child.requirements) {\n\t\t\t\tmerged.set(requirement.id, requirement);\n\t\t\t}\n\t\t\treturn [...merged.values()];\n\t\t}\n\n\t\tcase RequirementsClientSetComposition.Replace:\n\t\t\treturn [...child.requirements];\n\n\t\tdefault: {\n\t\t\tconst _exhaustive: never = child.composition;\n\t\t\tthrow new Error(\n\t\t\t\t`[resolveEffectiveRequirements] Unknown composition: ${_exhaustive}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Projection (lower-level — preserved for backward compatibility)\n// ---------------------------------------------------------------------------\n\n/**\n * Project TanStack Router matched route entries into the SDK's\n * `RouteMatchNode[]` contract.\n *\n * Each match entry is mapped to a `RouteMatchNode`:\n *   - `routeId` is taken from `match.routeId`\n *   - `requirements` is read from `match.staticData[requirementsKey]`\n *\n * Entries with no requirements produce nodes with an empty requirements array,\n * preserving the full chain for shared-prefix diffing.\n *\n * @example\n * ```ts\n * import { useMatches } from \"@tanstack/react-router\";\n * import { projectTanStackRouteMatches } from \"@securitydept/client-react/tanstack-router\";\n *\n * const matches = useMatches();\n * const routeChain = projectTanStackRouteMatches(matches);\n * orchestrator.activateMatchedRoutes(routeChain);\n * ```\n */\nexport function projectTanStackRouteMatches(\n\tmatches: readonly TanStackRouteMatch[],\n\toptions?: TanStackRouterAdapterOptions,\n): RouteMatchNode[] {\n\tconst key = options?.requirementsKey ?? DEFAULT_REQUIREMENTS_KEY;\n\treturn matches.map((match) => {\n\t\tconst rawRequirements = (match.staticData as Record<string, unknown>)?.[\n\t\t\tkey\n\t\t];\n\t\tconst requirements: AuthRequirement[] = Array.isArray(rawRequirements)\n\t\t\t? rawRequirements\n\t\t\t: [];\n\t\treturn {\n\t\t\trouteId: match.routeId,\n\t\t\trequirements,\n\t\t};\n\t});\n}\n\n// ---------------------------------------------------------------------------\n// Activator factory (lower-level — preserved for backward compatibility)\n// ---------------------------------------------------------------------------\n\n/**\n * Create a route-change activator that projects TanStack Router matches and\n * activates them on the orchestrator.\n *\n * This is framework-agnostic (not a React hook) and can be called from a\n * `useEffect`, route subscriber, or any mechanism that notifies match changes.\n *\n * @example\n * ```ts\n * import { useMatches } from \"@@tanstack/react-router\";\n * import { createTanStackRouteActivator } from \"@securitydept/client-react/tanstack-router\";\n *\n * const activator = createTanStackRouteActivator(orchestrator);\n *\n * function RouteOrchestrationBridge() {\n *   const matches = useMatches();\n *   useEffect(() => activator.activate(matches), [matches]);\n *   return null;\n * }\n * ```\n */\nexport function createTanStackRouteActivator(\n\torchestrator: {\n\t\tactivateMatchedRoutes(chain: readonly RouteMatchNode[]): void;\n\t\tdeactivateRoute(): void;\n\t},\n\toptions?: TanStackRouterAdapterOptions,\n) {\n\treturn {\n\t\t/** Project matches and activate the route chain on the orchestrator. */\n\t\tactivate(matches: readonly TanStackRouteMatch[]): void {\n\t\t\tconst chain = projectTanStackRouteMatches(matches, options);\n\t\t\torchestrator.activateMatchedRoutes(chain);\n\t\t},\n\t\t/** Deactivate the current route (e.g. on unmount or navigation away). */\n\t\tdeactivate(): void {\n\t\t\torchestrator.deactivateRoute();\n\t\t},\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Root-level route security runtime policy\n// ---------------------------------------------------------------------------\n\n/**\n * Root-level runtime policy for a secured TanStack Router route tree.\n *\n * This is the TanStack Router equivalent of Angular's\n * `SecureRouteRootSecurityOptions`. Non-serializable runtime callbacks\n * (planner host, onUnauthenticated handlers) live here, NOT in individual\n * route `staticData`.\n *\n * @example\n * ```ts\n * const routeSecurityPolicy = createTanStackRouteSecurityPolicy({\n *   requirementHandlers: {\n *     frontend_oidc: (failingRequirement) => {\n *       redirectToLogin(failingRequirement);\n *       return false;\n *     },\n *   },\n * });\n *\n * // Use in beforeLoad:\n * const protectedRoute = createRoute({\n *   beforeLoad: ({ matches }) => {\n *     routeSecurityPolicy.enforce(matches);\n *   },\n * });\n * ```\n */\nexport interface TanStackRouteSecurityPolicyOptions {\n\t/**\n\t * Per-requirement-kind handlers.\n\t * Keys are `AuthRequirement.kind` strings.\n\t */\n\trequirementHandlers?: Record<\n\t\tstring,\n\t\t(requirement: AuthRequirement) => boolean | string\n\t>;\n\n\t/**\n\t * Fallback handler when no kind-specific handler matches.\n\t */\n\tdefaultOnUnauthenticated?: (requirement: AuthRequirement) => boolean | string;\n\n\t/**\n\t * Custom key for reading requirements from staticData.\n\t * @default \"authRequirements\"\n\t */\n\trequirementsKey?: string;\n}\n\n/**\n * Route security evaluation result from\n * {@link createTanStackRouteSecurityPolicy}.\n */\nexport interface TanStackRouteSecurityResult {\n\t/** All requirements are met — allow navigation. */\n\treadonly allMet: boolean;\n\t/** The first unmet requirement, if any. */\n\treadonly pendingRequirement: AuthRequirement | undefined;\n\t/** Handler action for the pending requirement (from policy). */\n\treadonly action: boolean | string | undefined;\n\t/** The full effective requirements after composition. */\n\treadonly effectiveRequirements: readonly AuthRequirement[];\n}\n\n/**\n * Create a root-level route security policy that evaluates a TanStack Router\n * matched route chain and returns the enforcement decision.\n *\n * This is the TanStack Router equivalent of Angular's `secureRouteRoot()`.\n * It centralizes non-serializable runtime policy (handlers, redirects) at\n * the root level, while individual routes only declare serializable metadata\n * via `withTanStackRouteRequirements()`.\n *\n * The returned `evaluate()` function:\n * 1. Extracts requirements from the matched route chain (with composition)\n * 2. Finds the first unmet requirement using the provided `checkAuthenticated`\n * 3. Resolves the handler action (kind handler → default handler → block)\n *\n * @example\n * ```ts\n * import { createTanStackRouteSecurityPolicy } from \"@securitydept/client-react/tanstack-router\";\n *\n * const policy = createTanStackRouteSecurityPolicy({\n *   requirementHandlers: {\n *     frontend_oidc: (req) => {\n *       redirectToOidcLogin(req);\n *       return false;\n *     },\n *   },\n *   defaultOnUnauthenticated: () => \"/login\",\n * });\n *\n * // In a route's beforeLoad or a React effect:\n * const result = policy.evaluate(matches, (req) => isAuthenticated(req.kind));\n * if (!result.allMet && typeof result.action === \"string\") {\n *   navigate({ to: result.action });\n * }\n * ```\n */\nexport function createTanStackRouteSecurityPolicy(\n\toptions: TanStackRouteSecurityPolicyOptions = {},\n) {\n\treturn {\n\t\t/**\n\t\t * Evaluate the route security policy for a matched route chain.\n\t\t *\n\t\t * @param matches - The matched route chain (root → leaf).\n\t\t * @param checkAuthenticated - Returns true if a requirement is met.\n\t\t */\n\t\tevaluate(\n\t\t\tmatches: readonly TanStackRouteMatch[],\n\t\t\tcheckAuthenticated: (requirement: AuthRequirement) => boolean,\n\t\t): TanStackRouteSecurityResult {\n\t\t\tconst effectiveRequirements = extractTanStackRouteRequirements(matches, {\n\t\t\t\trequirementsKey: options.requirementsKey,\n\t\t\t});\n\n\t\t\tfor (const req of effectiveRequirements) {\n\t\t\t\tif (!checkAuthenticated(req)) {\n\t\t\t\t\tconst handler =\n\t\t\t\t\t\toptions.requirementHandlers?.[req.kind] ??\n\t\t\t\t\t\toptions.defaultOnUnauthenticated;\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallMet: false,\n\t\t\t\t\t\tpendingRequirement: req,\n\t\t\t\t\t\taction: handler ? handler(req) : false,\n\t\t\t\t\t\teffectiveRequirements,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tallMet: true,\n\t\t\t\tpendingRequirement: undefined,\n\t\t\t\taction: undefined,\n\t\t\t\teffectiveRequirements,\n\t\t\t};\n\t\t},\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Route-security beforeLoad factory — canonical adopter-facing entry\n// ---------------------------------------------------------------------------\n\n/**\n * Navigation-blocked error thrown by {@link createSecureBeforeLoad} when a\n * requirement is unmet and the handler returns `false`.\n */\nexport class RouteSecurityBlockedError extends Error {\n\tconstructor(\n\t\tpublic readonly requirement: AuthRequirement,\n\t\tpublic readonly result: TanStackRouteSecurityResult,\n\t) {\n\t\tsuper(\n\t\t\t`[secureBeforeLoad] Navigation blocked: requirement \"${requirement.id}\" (kind: ${requirement.kind}) is not authenticated.`,\n\t\t);\n\t\tthis.name = \"RouteSecurityBlockedError\";\n\t}\n}\n\n/**\n * Minimal shape of TanStack Router's `beforeLoad` context.\n *\n * Only the fields actually consumed by {@link createSecureBeforeLoad} are\n * required. The full TanStack Router context has many more fields; this\n * interface lets the helper stay structurally compatible without importing\n * the full framework type.\n */\nexport interface SecureBeforeLoadContext {\n\t/** URL location of the target route. */\n\tlocation: { pathname: string; href: string };\n\t/**\n\t * Matched route entries for the current navigation.\n\t * Shape matches {@link TanStackRouteMatch}.\n\t */\n\tmatches: readonly TanStackRouteMatch[];\n\t/** Navigation cause (\"enter\", \"stay\", \"push\", \"replace\", etc.). */\n\tcause: string;\n}\n\n/**\n * Options for {@link createSecureBeforeLoad}.\n */\nexport interface CreateSecureBeforeLoadOptions\n\textends TanStackRouteSecurityPolicyOptions {\n\t/**\n\t * Returns true if the given auth requirement is currently satisfied.\n\t *\n\t * This is the auth-state bridge: the adopter supplies a function that\n\t * checks their auth store / context.\n\t */\n\tcheckAuthenticated: (requirement: AuthRequirement) => boolean;\n\n\t/**\n\t * TanStack Router's `redirect()` function.\n\t *\n\t * When a handler returns a string (redirect path), `createSecureBeforeLoad`\n\t * throws `redirect({ to: path })` to trigger TanStack Router's redirect\n\t * mechanism.\n\t *\n\t * Pass `redirect` from `@tanstack/react-router` here:\n\t * ```ts\n\t * import { redirect } from \"@tanstack/react-router\";\n\t * createSecureBeforeLoad({ redirect, ... });\n\t * ```\n\t *\n\t * If omitted, string actions cause a {@link RouteSecurityBlockedError}\n\t * with the redirect path in the error message.\n\t */\n\tredirect?: (opts: { to: string }) => never;\n}\n\n/**\n * Create a `beforeLoad`-compatible function that enforces route-security\n * requirements inside TanStack Router's execution semantics.\n *\n * **This is the canonical TanStack Router adopter-facing entry** — the\n * equivalent of Angular's `secureRouteRoot()`.\n *\n * How it works:\n * 1. Receives TanStack Router's `beforeLoad` context (including `matches`)\n * 2. Extracts the full requirement chain with composition semantics\n * 3. Finds the first unmet requirement\n * 4. Calls the handler (kind handler → default → block)\n * 5. If the handler returns a string path, throws `redirect({ to: path })`\n * 6. If the handler returns `false`, throws {@link RouteSecurityBlockedError}\n * 7. If all requirements are met, returns normally (navigation proceeds)\n *\n * @example\n * ```ts\n * import { redirect, createRoute } from \"@tanstack/react-router\";\n * import {\n *   createSecureBeforeLoad,\n *   withTanStackRouteRequirements,\n * } from \"@securitydept/client-react/tanstack-router\";\n *\n * // Root-level: non-serializable runtime policy\n * const securedBeforeLoad = createSecureBeforeLoad({\n *   redirect,\n *   checkAuthenticated: (req) => authStore.isAuthenticated(req.kind),\n *   requirementHandlers: {\n *     frontend_oidc: (req) => \"/login/oidc\",\n *     session: () => \"/login\",\n *   },\n * });\n *\n * // Root route — attach the beforeLoad\n * const rootRoute = createRootRoute({\n *   beforeLoad: securedBeforeLoad,\n * });\n *\n * // Child routes — serializable declaration only\n * const dashboardRoute = createRoute({\n *   getParentRoute: () => rootRoute,\n *   path: \"dashboard\",\n *   staticData: withTanStackRouteRequirements([\n *     { id: \"session\", kind: \"session\" },\n *   ]),\n * });\n *\n * const adminRoute = createRoute({\n *   getParentRoute: () => dashboardRoute,\n *   path: \"admin\",\n *   staticData: withTanStackRouteRequirements([\n *     { id: \"admin-oidc\", kind: \"frontend_oidc\" },\n *   ]),\n * });\n * ```\n */\nexport function createSecureBeforeLoad(\n\toptions: CreateSecureBeforeLoadOptions,\n): (ctx: SecureBeforeLoadContext) => void {\n\tconst policy = createTanStackRouteSecurityPolicy(options);\n\n\treturn function secureBeforeLoad(ctx: SecureBeforeLoadContext): void {\n\t\tconst result = policy.evaluate(ctx.matches, options.checkAuthenticated);\n\n\t\tif (result.allMet) return;\n\n\t\tconst { action, pendingRequirement } = result;\n\n\t\tif (!pendingRequirement) return;\n\n\t\tif (typeof action === \"string\") {\n\t\t\tif (options.redirect) {\n\t\t\t\tthrow options.redirect({ to: action });\n\t\t\t}\n\t\t\t// No redirect function provided — throw a descriptive error.\n\t\t\tthrow new RouteSecurityBlockedError(pendingRequirement, result);\n\t\t}\n\n\t\t// action is false or undefined — block navigation.\n\t\tthrow new RouteSecurityBlockedError(pendingRequirement, result);\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction isValidComposition(\n\traw: unknown,\n): raw is RequirementsClientSetComposition {\n\treturn (\n\t\traw === RequirementsClientSetComposition.Inherit ||\n\t\traw === RequirementsClientSetComposition.Merge ||\n\t\traw === RequirementsClientSetComposition.Replace\n\t);\n}\n\n// Unused import prevents TS from complaining if @tanstack/react-router types\n// are not available at build time (peerDep is optional for pure orchestration).\nexport type { AnyRoute, RegisteredRouter };\n// Re-export composition enum for adopter convenience\nexport { RequirementsClientSetComposition };\n"],"mappings":";;;AAkFA,MAAa,2BAA2B;;AAGxC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoEvC,SAAgB,8BACf,cACA,SAC0B;AAC1B,QAAO;EACN,GAAI,SAAS,SAAS,EAAE;GACvB,2BAA2B;GAC3B,0BACA,SAAS,eAAe,iCAAiC;EAC1D;;;;;;;;;;;;;;;;;AAsBF,SAAgB,iCACf,SACA,SACoB;CACpB,MAAM,MAAM,SAAS,mBAAA;CACrB,IAAI,SAA4B,EAAE;AAElC,MAAK,MAAM,SAAS,SAAS;EAC5B,MAAM,MAAO,MAAM,aAAyC;EAC5D,MAAM,iBAAkB,MAAM,aAC7B;EAED,MAAM,cAAc,mBAAmB,eAAe,GACnD,iBACA,iCAAiC;AAGpC,WAAS,6BAA6B,QAAQ;GAC7C;GACA,cAJuC,MAAM,QAAQ,IAAI,GAAG,MAAM,EAAE;GAKpE,CAAC;;AAEH,QAAO;;;;;;;;;;;AAwBR,SAAgB,6BACf,oBACA,OACoB;AACpB,SAAQ,MAAM,aAAd;EACC,KAAK,iCAAiC,QACrC,QAAO,CAAC,GAAG,mBAAmB;EAE/B,KAAK,iCAAiC,OAAO;GAC5C,MAAM,yBAAS,IAAI,KAA8B;AACjD,QAAK,MAAM,eAAe,mBACzB,QAAO,IAAI,YAAY,IAAI,YAAY;AAExC,QAAK,MAAM,eAAe,MAAM,aAC/B,QAAO,IAAI,YAAY,IAAI,YAAY;AAExC,UAAO,CAAC,GAAG,OAAO,QAAQ,CAAC;;EAG5B,KAAK,iCAAiC,QACrC,QAAO,CAAC,GAAG,MAAM,aAAa;EAE/B,SAAS;GACR,MAAM,cAAqB,MAAM;AACjC,SAAM,IAAI,MACT,uDAAuD,cACvD;;;;;;;;;;;;;;;;;;;;;;;;;AA8BJ,SAAgB,4BACf,SACA,SACmB;CACnB,MAAM,MAAM,SAAS,mBAAA;AACrB,QAAO,QAAQ,KAAK,UAAU;EAC7B,MAAM,kBAAmB,MAAM,aAC9B;EAED,MAAM,eAAkC,MAAM,QAAQ,gBAAgB,GACnE,kBACA,EAAE;AACL,SAAO;GACN,SAAS,MAAM;GACf;GACA;GACA;;;;;;;;;;;;;;;;;;;;;;;AA4BH,SAAgB,6BACf,cAIA,SACC;AACD,QAAO;EAEN,SAAS,SAA8C;GACtD,MAAM,QAAQ,4BAA4B,SAAS,QAAQ;AAC3D,gBAAa,sBAAsB,MAAM;;EAG1C,aAAmB;AAClB,gBAAa,iBAAiB;;EAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0GF,SAAgB,kCACf,UAA8C,EAAE,EAC/C;AACD,QAAO,EAON,SACC,SACA,oBAC8B;EAC9B,MAAM,wBAAwB,iCAAiC,SAAS,EACvE,iBAAiB,QAAQ,iBACzB,CAAC;AAEF,OAAK,MAAM,OAAO,sBACjB,KAAI,CAAC,mBAAmB,IAAI,EAAE;GAC7B,MAAM,UACL,QAAQ,sBAAsB,IAAI,SAClC,QAAQ;AAET,UAAO;IACN,QAAQ;IACR,oBAAoB;IACpB,QAAQ,UAAU,QAAQ,IAAI,GAAG;IACjC;IACA;;AAIH,SAAO;GACN,QAAQ;GACR,oBAAoB,KAAA;GACpB,QAAQ,KAAA;GACR;GACA;IAEF;;;;;;AAWF,IAAa,4BAAb,cAA+C,MAAM;CACpD,YACC,aACA,QACC;AACD,QACC,uDAAuD,YAAY,GAAG,WAAW,YAAY,KAAK,yBAClG;AALe,OAAA,cAAA;AACA,OAAA,SAAA;AAKhB,OAAK,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiHd,SAAgB,uBACf,SACyC;CACzC,MAAM,SAAS,kCAAkC,QAAQ;AAEzD,QAAO,SAAS,iBAAiB,KAAoC;EACpE,MAAM,SAAS,OAAO,SAAS,IAAI,SAAS,QAAQ,mBAAmB;AAEvE,MAAI,OAAO,OAAQ;EAEnB,MAAM,EAAE,QAAQ,uBAAuB;AAEvC,MAAI,CAAC,mBAAoB;AAEzB,MAAI,OAAO,WAAW,UAAU;AAC/B,OAAI,QAAQ,SACX,OAAM,QAAQ,SAAS,EAAE,IAAI,QAAQ,CAAC;AAGvC,SAAM,IAAI,0BAA0B,oBAAoB,OAAO;;AAIhE,QAAM,IAAI,0BAA0B,oBAAoB,OAAO;;;AAQjE,SAAS,mBACR,KAC0C;AAC1C,QACC,QAAQ,iCAAiC,WACzC,QAAQ,iCAAiC,SACzC,QAAQ,iCAAiC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+	"name": "@securitydept/client-react",
+	"version": "0.2.0-beta.1",
+	"type": "module",
+	"sideEffects": false,
+	"exports": {
+		".": {
+			"monorepo-tsc": "./src/planner-host/index.tsx",
+			"types": "./dist/index.d.mts",
+			"import": "./dist/index.mjs"
+		},
+		"./tanstack-router": {
+			"monorepo-tsc": "./src/tanstack-router/index.ts",
+			"types": "./dist/tanstack-router/index.d.mts",
+			"import": "./dist/tanstack-router/index.mjs"
+		}
+	},
+	"files": [
+		"dist"
+	],
+	"scripts": {
+		"build": "tsdown",
+		"typecheck": "tsc -b"
+	},
+	"dependencies": {
+		"@securitydept/client": "workspace:*"
+	},
+	"peerDependencies": {
+		"react": ">=19.0.0",
+		"@tanstack/react-router": ">=1.0.0"
+	},
+	"peerDependenciesMeta": {
+		"@tanstack/react-router": {
+			"optional": true
+		}
+	}
+}