@securitydept/client 0.3.0-beta.1 → 0.3.0-beta.11

package/dist/index-CbeZ3AfB.d.mts

@@ -0,0 +1,1680 @@
+import { B as WritableSignalTrait, C as IdleCallbackTrait, Ct as EventStreamTrait, D as ComputedSignalTrait, Dt as InteropObservableTrait, E as TimestampProviderTrait, F as ResourceSnapshot, Ft as SecuritydeptInjector, L as ResourceTrait, O as ReadableSignalTrait, R as ResourceWhenValueOptions, Rt as DisposableTrait, T as TimeTrait, Vt as SYMBOL_DISPOSE, W as CancellationTokenTrait, X as ClientError, an as SecuritydeptInjectorTrait, gt as SpanNodeAttributes, ht as SpanCreateOptions, in as SecuritydeptInjectionToken, it as ErrorPresentationDescriptor, mt as SpanAttributes, on as SecuritydeptProvider, st as ReadErrorPresentationDescriptorOptions, ut as MutableSpanTrait, v as RxEventSubject, vt as SpanTrait, wt as EventSubjectTrait, yt as EventObserverTrait, z as SignalOptions } from "./index-CFAJ969E.mjs";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/injection/destroy.d.ts
+declare abstract class SecuritydeptDestroyRef implements DisposableTrait {
+  abstract readonly destroyed: boolean;
+  abstract onDestroy(callback: () => void): () => void;
+  abstract dispose(): void;
+  [SYMBOL_DISPOSE](): void;
+}
+declare function createSecuritydeptDestroyRef(): SecuritydeptDestroyRef;
+//#endregion
+//#region src/compat/base64.d.ts
+declare const Base64CompatErrorCode: {
+  readonly EncoderUnavailable: "compat.base64.encoder_unavailable";
+  readonly DecoderUnavailable: "compat.base64.decoder_unavailable";
+};
+type Base64CompatErrorCode = (typeof Base64CompatErrorCode)[keyof typeof Base64CompatErrorCode];
+declare function encodeUint8ArrayToBase64(value: Uint8Array): string;
+declare function decodeBase64ToUint8Array(value: string): Uint8Array;
+//#endregion
+//#region src/compat/generator.d.ts
+declare function promisesToRacedAsyncGenerator<T>(promises: Promise<T>[]): AsyncGenerator<T, void, unknown>;
+//#endregion
+//#region src/page/index.d.ts
+interface PageLifecycleTrait<TResumeEvent = unknown> {
+  resume: EventStreamTrait<TResumeEvent>;
+}
+declare const PAGE_LIFECYCLE_TRAIT_TOKEN: SecuritydeptInjectionToken<PageLifecycleTrait<unknown> | null>;
+//#endregion
+//#region src/std/events/from-abort.d.ts
+type AbortSignalStdSource = Pick<AbortSignal, "aborted" | "reason"> & {
+  addEventListener?: (type: "abort", listener: EventListener) => void;
+  removeEventListener?: (type: "abort", listener: EventListener) => void;
+};
+/**
+ * Adapt an `AbortSignal`-like source into an event stream of abort reasons.
+ */
+declare function abortSignalToEventStream(signal: AbortSignalStdSource): EventStreamTrait<unknown>;
+//#endregion
+//#region src/events/create.d.ts
+/**
+ * Create a new event stream from a producer function.
+ *
+ * The producer receives an observer and should call `next()` to emit values,
+ * `error()` to signal an error, and `complete()` to signal completion.
+ * It may return a teardown function that will be called on unsubscribe.
+ */
+declare function createEventStream<T>(producer: (observer: EventObserverTrait<T>) => (() => void) | void): EventStreamTrait<T>;
+declare function createEventSubject<T>(): EventSubjectTrait<T>;
+declare function createEventReplaySubject<T>(bufferSize?: number): EventSubjectTrait<T>;
+declare function createEmptyEventStream<T>(): EventStreamTrait<T>;
+declare function createNeverEventStream<T>(): EventStreamTrait<T>;
+//#endregion
+//#region src/events/error.d.ts
+type ClientErrorEvent = {
+  readonly error: ClientError;
+} | {
+  readonly payload: {
+    readonly error: ClientError;
+  };
+};
+type ExtractClientErrorEvent<TEvent> = Extract<TEvent, ClientErrorEvent>;
+declare function isClientErrorEvent<TEvent>(event: TEvent): event is ExtractClientErrorEvent<TEvent>;
+//#endregion
+//#region src/events/interop.d.ts
+type ToEventStreamInput<T> = InteropObservableTrait<T> | Promise<T> | AsyncIterable<T> | PromiseLike<T> | ArrayLike<T> | Iterable<T> | EventStreamTrait<T> | ReadableSignalTrait<T>;
+declare function toEventStream<T>(input: ToEventStreamInput<T>): EventStreamTrait<T>;
+//#endregion
+//#region src/protocol/json-rpc/types.d.ts
+declare const JsonRpcIdSchema: import("arktype").BaseType<string | number, {}>;
+type JsonRpcId = typeof JsonRpcIdSchema.infer;
+declare const JsonRpcErrorPayloadSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  code: number;
+  message: string;
+  data?: unknown;
+}, {}>;
+type JsonRpcErrorPayload = typeof JsonRpcErrorPayloadSchema.infer;
+declare const JsonRpcRequestMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  method: string;
+  params?: unknown;
+}, {}>;
+type JsonRpcRequestMessage = typeof JsonRpcRequestMessageSchema.infer;
+declare const JsonRpcNotificationMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  method: string;
+  params?: unknown;
+}, {}>;
+type JsonRpcNotificationMessage = typeof JsonRpcNotificationMessageSchema.infer;
+declare const JsonRpcSuccessResponseMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  result: unknown;
+}, {}>;
+type JsonRpcSuccessResponseMessage = typeof JsonRpcSuccessResponseMessageSchema.infer;
+declare const JsonRpcErrorResponseMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  error: {
+    code: number;
+    message: string;
+    data?: unknown;
+  };
+}, {}>;
+type JsonRpcErrorResponseMessage = typeof JsonRpcErrorResponseMessageSchema.infer;
+declare const JsonRpcMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  method: string;
+  params?: unknown;
+} | {
+  jsonrpc: "2.0";
+  method: string;
+  params?: unknown;
+} | {
+  jsonrpc: "2.0";
+  id: string | number;
+  result: unknown;
+} | {
+  jsonrpc: "2.0";
+  id: string | number;
+  error: {
+    code: number;
+    message: string;
+    data?: unknown;
+  };
+}, {}>;
+type JsonRpcMessage = typeof JsonRpcMessageSchema.infer;
+interface JsonRpcRequestEvent {
+  id: JsonRpcId;
+  method: string;
+  params?: unknown;
+}
+interface JsonRpcNotificationEvent {
+  method: string;
+  params?: unknown;
+}
+interface JsonRpcRequestOptions {
+  timeoutMs?: number;
+}
+interface JsonRpcSendOptions {
+  send(message: JsonRpcMessage): void;
+}
+interface CreateJsonRpcClientOptions extends JsonRpcSendOptions {
+  time: TimeTrait;
+  defaultRequestTimeoutMs?: number;
+}
+interface CreateJsonRpcServerOptions extends JsonRpcSendOptions {}
+interface CreateJsonRpcServerAndClientOptions extends JsonRpcSendOptions {
+  time: TimeTrait;
+  defaultRequestTimeoutMs?: number;
+}
+interface JsonRpcClientTrait extends DisposableTrait {
+  readonly onNotification: EventStreamTrait<JsonRpcNotificationEvent>;
+  request<TResult = unknown>(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<TResult>;
+  notify(method: string, params?: unknown): void;
+  receive(message: unknown): void;
+  rejectAllPendingRequests(reason: unknown): void;
+}
+interface JsonRpcServerTrait extends DisposableTrait {
+  readonly onRequest: EventStreamTrait<JsonRpcRequestEvent>;
+  readonly onNotification: EventStreamTrait<JsonRpcNotificationEvent>;
+  notify(method: string, params?: unknown): void;
+  receive(message: unknown): void;
+  respondSuccess(id: JsonRpcId, result: unknown): void;
+  respondError(id: JsonRpcId, error: JsonRpcErrorPayload): void;
+}
+interface JsonRpcServerAndClientTrait extends JsonRpcClientTrait, JsonRpcServerTrait {}
+//#endregion
+//#region src/protocol/json-rpc/create.d.ts
+declare function createJsonRpcClient(options: CreateJsonRpcClientOptions): JsonRpcClientTrait;
+declare function createJsonRpcServer(options: CreateJsonRpcServerOptions): JsonRpcServerTrait;
+declare function createJsonRpcServerAndClient(options: CreateJsonRpcServerAndClientOptions): JsonRpcServerAndClientTrait;
+//#endregion
+//#region src/signals/computed.d.ts
+/**
+ * Create a lazy computed signal.
+ *
+ * Dependencies are collected dynamically while `compute()` runs.
+ */
+declare function createComputed<T>(compute: () => T, options?: SignalOptions<T>): ComputedSignalTrait<T>;
+//#endregion
+//#region src/signals/error.d.ts
+declare const ResourceErrorCode: {
+  readonly ValueUnavailable: "resource.value_unavailable";
+};
+type ResourceErrorCode = (typeof ResourceErrorCode)[keyof typeof ResourceErrorCode];
+interface ResourceValueUnavailableErrorOptions {
+  readonly status: string;
+}
+declare class ResourceError extends Error {
+  readonly name = "ResourceError";
+  readonly code: ResourceErrorCode;
+  readonly status?: string;
+  constructor(message: string, options: {
+    code: ResourceErrorCode;
+    status?: string;
+  });
+  static valueUnavailable(options: ResourceValueUnavailableErrorOptions): ResourceError;
+}
+//#endregion
+//#region src/signals/resource.d.ts
+interface ResourceStreamContext<T, R> {
+  readonly request: R;
+  readonly previous: ResourceSnapshot<T>;
+}
+interface CreateResourceOptions<T, R = undefined> {
+  readonly request?: ReadableSignalTrait<R | undefined> | (() => R | undefined);
+  readonly stream: (context: ResourceStreamContext<T, R>) => ToEventStreamInput<T>;
+}
+declare function createResource<T, R = undefined>(options: CreateResourceOptions<T, R>): ResourceTrait<T>;
+//#endregion
+//#region src/signals/resource-snapshot.d.ts
+declare function whenResourceSnapshotValue<T>(snapshotSignal: ReadableSignalTrait<ResourceSnapshot<T>>, options?: ResourceWhenValueOptions): Promise<T>;
+type AnyResourceSnapshotSelector = (value: any) => ReadableSignalTrait<ResourceSnapshot<unknown>>;
+declare function flattenResourceSnapshot<T1, T2>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>): ResourceSnapshot<T2>;
+declare function flattenResourceSnapshot<T1, T2, T3>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>, select2: (value: T2) => ReadableSignalTrait<ResourceSnapshot<T3>>): ResourceSnapshot<T3>;
+declare function flattenResourceSnapshot<T1, T2, T3, T4>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>, select2: (value: T2) => ReadableSignalTrait<ResourceSnapshot<T3>>, select3: (value: T3) => ReadableSignalTrait<ResourceSnapshot<T4>>): ResourceSnapshot<T4>;
+declare function flattenResourceSnapshot<T1, T2, T3, T4, T5>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>, select2: (value: T2) => ReadableSignalTrait<ResourceSnapshot<T3>>, select3: (value: T3) => ReadableSignalTrait<ResourceSnapshot<T4>>, select4: (value: T4) => ReadableSignalTrait<ResourceSnapshot<T5>>): ResourceSnapshot<T5>;
+declare function flattenResourceSnapshot(sourceSnapshot: ResourceSnapshot<unknown>, select: AnyResourceSnapshotSelector, ...selectors: readonly AnyResourceSnapshotSelector[]): ResourceSnapshot<unknown>;
+declare const ResourceSnapshotUpdateKind: {
+  readonly Load: "load";
+  readonly Resolve: "resolve";
+  readonly Fail: "fail";
+  readonly FailWithValue: "fail_with_value";
+};
+type ResourceSnapshotUpdateKind = (typeof ResourceSnapshotUpdateKind)[keyof typeof ResourceSnapshotUpdateKind];
+type ResourceSnapshotUpdate<T> = {
+  readonly kind: typeof ResourceSnapshotUpdateKind.Load;
+} | {
+  readonly kind: typeof ResourceSnapshotUpdateKind.Resolve;
+  readonly value: T;
+} | {
+  readonly kind: typeof ResourceSnapshotUpdateKind.Fail;
+  readonly error: unknown;
+} | {
+  readonly kind: typeof ResourceSnapshotUpdateKind.FailWithValue;
+  readonly value: T;
+  readonly error: unknown;
+};
+declare function reduceResourceSnapshot<T>(previous: ResourceSnapshot<T>, update: ResourceSnapshotUpdate<T>): ResourceSnapshot<T>;
+//#endregion
+//#region src/signals/signal.d.ts
+/**
+ * Minimal writable signal implementation.
+ * `set()` always publishes a write. Equality-based value-version suppression is
+ * handled by the underlying Rx signal for computed dependency validation.
+ */
+declare function createSignal<T>(initial: T, options?: SignalOptions<T>): WritableSignalTrait<T>;
+/**
+ * Create a read-only view of a writable signal.
+ */
+declare function readonlySignal<T>(signal: WritableSignalTrait<T>): ReadableSignalTrait<T>;
+//#endregion
+//#region src/popup/handle.d.ts
+interface PopupMessageChannelTrait<TOutgoing = unknown, TIncoming = unknown> {
+  outgoing: EventSubjectTrait<TOutgoing>;
+  incoming: EventStreamTrait<TIncoming>;
+}
+interface PopupWindowHandleTrait extends DisposableTrait {
+  messaging: PopupMessageChannelTrait;
+  readonly onNotification: EventStreamTrait<JsonRpcNotificationEvent>;
+  close(): void;
+  dispose(): void;
+  notify(method: string, params?: unknown): Promise<void>;
+}
+interface PopupClientWindowHandleTrait extends PopupWindowHandleTrait {
+  readonly failure: ReadableSignalTrait<ClientError | null>;
+  readonly isActive: ReadableSignalTrait<boolean>;
+  request<TResult = unknown>(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<TResult>;
+}
+interface PopupServerWindowHandleTrait extends PopupWindowHandleTrait {}
+interface PopupClientWindowHandleOptions {
+  close(): void;
+  messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+  time: TimeTrait;
+  closedStream: EventStreamTrait<boolean>;
+}
+interface PopupServerWindowHandleOptions {
+  close(): void;
+  messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+}
+/**
+ * popup opener
+ */
+declare class PopupClientWindowHandle implements PopupClientWindowHandleTrait {
+  readonly messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+  private disposed;
+  private readonly jsonRpc;
+  private readonly session;
+  private readonly incomingSubscription;
+  private readonly closePopup;
+  constructor(options: PopupClientWindowHandleOptions);
+  get onNotification(): EventStreamTrait<JsonRpcNotificationEvent>;
+  get failure(): ReadableSignalTrait<ClientError | null>;
+  get isActive(): ReadableSignalTrait<boolean>;
+  notify(method: string, params?: unknown): Promise<void>;
+  request<TResult = unknown>(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<TResult>;
+  close(): void;
+  dispose(): void;
+  [SYMBOL_DISPOSE](): void;
+}
+/**
+ * popup target
+ */
+declare class PopupServerWindowHandle implements PopupServerWindowHandleTrait {
+  readonly messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+  private disposed;
+  private readonly jsonRpc;
+  private readonly session;
+  private readonly incomingSubscription;
+  private readonly closePopup;
+  constructor(options: PopupServerWindowHandleOptions);
+  get onNotification(): EventStreamTrait<JsonRpcNotificationEvent>;
+  get onRequest(): EventStreamTrait<JsonRpcRequestEvent>;
+  notify(method: string, params?: unknown): Promise<void>;
+  close(): void;
+  dispose(): void;
+  [SYMBOL_DISPOSE](): void;
+}
+//#endregion
+//#region src/popup/errors.d.ts
+declare const PopupErrorCode: {
+  readonly Blocked: "popup.blocked";
+  readonly Closed: "popup.closed_by_user";
+};
+type PopupErrorCode = (typeof PopupErrorCode)[keyof typeof PopupErrorCode];
+declare function readPopupErrorPresentationDescriptor(error: unknown, options?: ReadErrorPresentationDescriptorOptions): ErrorPresentationDescriptor;
+//#endregion
+//#region src/popup/session.d.ts
+interface CreatePopupClientSessionOptions {
+  jsonRpc: JsonRpcClientTrait;
+  time: TimeTrait;
+  closedStream: EventStreamTrait<boolean>;
+  readyTimeoutMs?: number;
+  heartbeatIntervalMs?: number;
+  heartbeatTimeoutMs?: number;
+}
+interface CreatePopupServerSessionOptions {
+  jsonRpc: JsonRpcServerTrait;
+}
+//#endregion
+//#region src/popup/index.d.ts
+declare const PopupAttachFailureReason: {
+  readonly MissingOpener: "missing_opener";
+  readonly MissingOrigin: "missing_origin";
+};
+type PopupAttachFailureReason = (typeof PopupAttachFailureReason)[keyof typeof PopupAttachFailureReason];
+interface PopupAttachSuccess {
+  kind: "success";
+  handle: PopupServerWindowHandleTrait;
+}
+interface PopupAttachFailure {
+  kind: "failure";
+  reason: PopupAttachFailureReason;
+  error: ClientError;
+}
+type PopupAttachResult = PopupAttachSuccess | PopupAttachFailure;
+interface PopupOpenOptions {
+  target?: string;
+  width?: number;
+  height?: number;
+  expectedOrigin?: string;
+}
+interface PopupTrait {
+  open(url: string, options?: PopupOpenOptions): PopupClientWindowHandleTrait;
+  attach(): PopupAttachResult;
+}
+declare const POPUP_TRAIT_TOKEN: SecuritydeptInjectionToken<PopupTrait | null>;
+//#endregion
+//#region src/validation/schemas/uri.d.ts
+declare const UriStringSchema: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+declare const BaseURIStringSchema: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+declare const UriRelativeStringSchema: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+declare const UriReferenceStringSchema: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+//#endregion
+//#region src/router/metadata.d.ts
+/** Route-data key holding the SecurityDept metadata blob for a segment. */
+declare const SECURITYDEPT_ROUTE_METADATA_KEY = "__securitydept__";
+/** Serializable SecurityDept route metadata. */
+interface SecuritydeptRouteMetadata<TAuthRequirement extends AuthRequirement = AuthRequirement> {
+  requirements?: readonly TAuthRequirement[];
+  composition?: RequirementsComposition;
+}
+/** Read SecurityDept route metadata from a route `data` bag. */
+declare function readSecuritydeptRouteMetadata<TAuthRequirement extends AuthRequirement = AuthRequirement>(data: object | undefined): SecuritydeptRouteMetadata<TAuthRequirement> | undefined;
+/** Merge SecurityDept route metadata into a route `data` bag. */
+declare function writeSecuritydeptRouteMetadata<TAuthRequirement extends AuthRequirement = AuthRequirement>(base: object | undefined, patch: SecuritydeptRouteMetadata<TAuthRequirement>): Record<string, unknown>;
+//#endregion
+//#region src/struct/uri-string.d.ts
+/**
+ * Thrown when a string cannot be parsed into the requested URI variant.
+ */
+declare class UriParseError extends Error {
+  readonly input: string;
+  readonly kind: string;
+  constructor(input: string, kind: string, options?: ErrorOptions);
+}
+/**
+ * The relative components of a URL — pathname, search, and hash.
+ *
+ * All fields use the same format as the native `URL` accessors:
+ * - `pathname` starts with `/` (e.g. `"/path"`).
+ * - `search` includes the leading `?` when present (e.g. `"?q=1"`).
+ * - `hash` includes the leading `#` when present (e.g. `"#section"`).
+ */
+interface UriRelativeParts {
+  readonly pathname: string;
+  readonly search: string;
+  readonly hash: string;
+}
+/**
+ * Minimal structural type for URI fragment parsing.
+ *
+ * Matches any value that exposes a URL-style `hash` accessor — for example
+ * `URL`, `Location`, or {@link UriReferenceString}.
+ */
+interface UriFragmentPart {
+  readonly hash: string;
+}
+/**
+ * Minimal structural type for URI reference parsing.
+ *
+ * Matches any value that can be serialized via `toString()` — for example
+ * native `URL`, `Location`, or {@link UriReferenceString}.
+ */
+interface UriReferenceStringLike {
+  toString(): string;
+}
+type UriReferenceStringInput = string | UriReferenceStringLike;
+type UriSearchParamsInit = NonNullable<ConstructorParameters<typeof URLSearchParams>[0]>;
+/**
+ * Immutable wrapper around a URI-reference string.
+ *
+ * A URI-reference (RFC 3986 §4.1) is either an absolute URI or a relative
+ * reference.  Concrete subclasses {@link UriString} and
+ * {@link UriRelativeString} carry the additional type-level guarantee of
+ * which variant they hold.
+ *
+ * Instances created via `UriReferenceString.parse` / `.tryParse` are always
+ * one of the two subclasses, so {@link isAbsolute} and {@link isRelative}
+ * narrow correctly.
+ */
+declare class UriReferenceString {
+  /** The original, unmodified input string. */
+  protected readonly _raw: string;
+  /**
+   * Eagerly parsed URL helper.
+   *
+   * - Absolute URIs: `new URL(raw)`.
+   * - Relative URIs: `new URL(raw, RELATIVE_URI_SENTINEL_BASE)`.
+   *
+   * For relative URIs the scheme and host originate from the sentinel and
+   * MUST NOT be used for origin-sensitive operations.
+   */
+  protected readonly _parsed: URL;
+  protected readonly _isAbsolute: boolean;
+  protected constructor(raw: string, parsed: URL, isAbsolute: boolean);
+  /**
+   * Parse any valid URI reference (absolute or relative).
+   *
+   * The returned instance is always a {@link UriString} or
+   * {@link UriRelativeString}.
+   *
+   * @throws {UriParseError} when the input is not a valid URI reference.
+   */
+  static parse(input: UriReferenceStringInput): UriReferenceString;
+  /**
+   * Try to parse a URI reference, returning `null` on failure.
+   *
+   * The returned instance is always a {@link UriString} or
+   * {@link UriRelativeString}.
+   */
+  static tryParse(input: UriReferenceStringInput): UriReferenceString | null;
+  /** Create from a native `URL`. Always produces a {@link UriString}. */
+  static fromURL(url: URL): UriString;
+  /**
+   * Create from the relative components of a URL.
+   * Always produces a {@link UriRelativeString}.
+   */
+  static fromURLRelative(parts: UriRelativeParts): UriRelativeString;
+  /** The original input string. */
+  get raw(): string;
+  get pathname(): string;
+  get hash(): string;
+  get search(): string;
+  get searchParams(): URLSearchParams;
+  /** Type-guard: narrows to {@link UriString} when the reference is absolute. */
+  isAbsolute(): this is UriString;
+  /** Type-guard: narrows to {@link UriRelativeString} when the reference is relative. */
+  isRelative(): this is UriRelativeString;
+  /** Narrow to {@link UriString} or return `null`. */
+  asAbsolute(): UriString | null;
+  /** Narrow to {@link UriRelativeString} or return `null`. */
+  asRelative(): UriRelativeString | null;
+  /**
+   * Returns a new instance with `hash` replaced.
+   *
+   * @param value URL-style hash, including a leading `#` when non-empty.
+   */
+  setHash(value: string): this;
+  /** Returns a new instance with the complete query parameter set replaced. */
+  setSearchParams(init?: UriSearchParamsInit): this;
+  /**
+   * Convert to a native `URL`.
+   *
+   * A `base` is required when the reference is relative; it is ignored
+   * for absolute references.
+   *
+   * @throws {TypeError} when the reference is relative and no base is provided.
+   */
+  toURL(base?: string | URL): URL;
+  toString(): string;
+  valueOf(): string;
+  toJSON(): string;
+}
+/**
+ * Immutable wrapper around an absolute URI string.
+ *
+ * An absolute URI (RFC 3986 §4.3) always starts with a scheme component
+ * (e.g. `https://example.com/path`).
+ */
+declare class UriString extends UriReferenceString {
+  protected constructor(raw: string, parsed: URL);
+  /**
+   * Parse an absolute URI string.
+   *
+   * @throws {UriParseError} when the input is not a valid absolute URI.
+   */
+  static parse(input: string): UriString;
+  /**
+   * Try to parse an absolute URI, returning `null` if the input is not
+   * a valid absolute URI.
+   */
+  static tryParse(input: string | UriString): UriString | null;
+  /** Create from a native `URL`, using its `href` as the raw string. */
+  static fromURL(url: URL): UriString;
+  /**
+   * Not supported — relative parts cannot produce an absolute URI.
+   *
+   * @throws {TypeError} unconditionally.
+   */
+  static fromURLRelative(_parts: UriRelativeParts): never;
+  get host(): string;
+  get hostname(): string;
+  get origin(): string;
+  get password(): string;
+  get port(): string;
+  get protocol(): string;
+  get username(): string;
+  /** Convert to a native `URL`. No base is required for absolute URIs. */
+  toURL(): URL;
+}
+/**
+ * Immutable wrapper around a relative URI reference string.
+ *
+ * A relative reference (RFC 3986 §4.2) has no scheme and must be resolved
+ * against a base URI to obtain an absolute URI.
+ *
+ * Internally, the raw string is parsed against a sentinel base
+ * (`http://localhost`) to enable eager validation and URL-component
+ * extraction.  The sentinel origin is never leaked through the public API.
+ */
+declare class UriRelativeString extends UriReferenceString {
+  protected constructor(raw: string, parsed: URL);
+  /**
+   * Parse a relative URI reference.
+   *
+   * @throws {UriParseError} when the input is absolute or not a valid
+   *   relative URI reference.
+   */
+  static parse(input: string): UriRelativeString;
+  /**
+   * Try to parse a relative URI reference, returning `null` if the input
+   * is an absolute URI or otherwise invalid.
+   */
+  static tryParse(input: string | UriRelativeString): UriRelativeString | null;
+  /**
+   * Not supported — a native `URL` is always absolute and cannot be
+   * represented as a relative URI reference.
+   *
+   * @throws {TypeError} unconditionally.
+   */
+  static fromURL(_url: URL): never;
+  /**
+   * Create from the relative components of a URL.
+   *
+   * Concatenates `pathname + search + hash` into a relative URI string.
+   */
+  static fromURLRelative(parts: UriRelativeParts): UriRelativeString;
+  /**
+   * Convert to a native `URL` by resolving against the given base.
+   *
+   * @param base - The base URL to resolve against (required).
+   */
+  toURL(base: string | URL): URL;
+}
+//#endregion
+//#region src/protocol/compat-fragment.d.ts
+declare const SECURITYDEPT_COMPAT_FRAGMENT_VERSION = "v1";
+type CompatFragmentParameters = Record<string, string>;
+interface CompatFragment {
+  payload: string;
+  parameters: CompatFragmentParameters;
+}
+interface AppendOrReplaceCompatFragmentOptions {
+  payload: string | URLSearchParams | CompatFragmentParameters;
+}
+interface TakeCompatFragmentResult<T> {
+  compatFragment: CompatFragment | null;
+  fragment: string;
+  url: UpdatedUriFragment<T>;
+}
+interface TakeCompatFragmentOptions<T> {
+  condition?: (compatFragment: CompatFragment) => boolean;
+  update: UpdateUriFragmentHash<T>;
+}
+interface AppendOrReplaceCompatFragmentResult<T> {
+  fragment: string;
+  url: UpdatedUriFragment<T>;
+}
+type UpdatedUriFragment<T> = T extends string ? string : T;
+type UpdateUriFragmentHash<T> = (input: T, hash: string) => UpdatedUriFragment<T>;
+declare function appendOrReplaceCompatFragment<T extends string | UriFragmentPart>(input: T, options: AppendOrReplaceCompatFragmentOptions, update: UpdateUriFragmentHash<T>): AppendOrReplaceCompatFragmentResult<T>;
+declare function parseCompatFragment(input: string | UriFragmentPart): CompatFragment | null;
+declare function takeCompatFragment<T extends string | UriFragmentPart>(input: T, options: TakeCompatFragmentOptions<T>): TakeCompatFragmentResult<T>;
+declare function isCompatFragmentBlock(block: string): boolean;
+//#endregion
+//#region src/router/router.d.ts
+declare const RouterNavigationIntent: {
+  readonly AuthRedirect: "auth_redirect";
+  readonly PostAuthRedirect: "post_auth_redirect";
+  readonly CallbackCleanup: "callback_cleanup";
+  readonly ExternalOpen: "external_open";
+};
+type RouterNavigationIntent = (typeof RouterNavigationIntent)[keyof typeof RouterNavigationIntent];
+declare const RouterNavigationMode: {
+  readonly Push: "push";
+  readonly Replace: "replace";
+  readonly External: "external";
+};
+type RouterNavigationMode = (typeof RouterNavigationMode)[keyof typeof RouterNavigationMode];
+interface RouterNavigationRequest {
+  url: UriReferenceString;
+  intent: RouterNavigationIntent;
+  mode: RouterNavigationMode;
+  state?: unknown;
+}
+interface RouterTrait {
+  currentUrl(): UriReferenceString | null;
+  navigate(request: RouterNavigationRequest): void | Promise<void>;
+}
+interface TakeCompatFragmentFromRouterOptions {
+  condition?: (compatFragment: CompatFragment) => boolean;
+}
+declare function takeCompatFragmentFromRouter(router: RouterTrait, options?: TakeCompatFragmentFromRouterOptions): Promise<CompatFragment | null>;
+declare const ROUTER_TRAIT_TOKEN: SecuritydeptInjectionToken<RouterTrait | null>;
+//#endregion
+//#region src/validation/validator.d.ts
+/**
+ * Successful validation result.
+ *
+ * Contains the parsed, typed output value from the schema.
+ */
+interface ValidationSuccess<T> {
+  readonly success: true;
+  readonly value: T;
+}
+/**
+ * Failed validation result.
+ *
+ * Contains the list of issues reported by the schema.
+ */
+interface ValidationFailure {
+  readonly success: false;
+  readonly issues: ReadonlyArray<StandardSchemaV1.Issue>;
+}
+/**
+ * Discriminated union of validation outcomes.
+ *
+ * Consumers can narrow on `success` to access either the typed value
+ * or the issue list.
+ */
+type ValidationResult<T> = ValidationSuccess<T> | ValidationFailure;
+type TraitInputValidator = StandardSchemaV1<unknown, unknown>;
+type TraitInputBundledSchema = StandardSchemaV1<unknown, unknown>;
+interface WithTraitInputValidator<TValidator = TraitInputValidator> {
+  validators?: TValidator;
+}
+interface ValidateTraitInputOptions {
+  value: unknown;
+  bundledSchema: TraitInputBundledSchema;
+  validator?: TraitInputValidator;
+  optional?: boolean;
+  onInvalid(failure: ValidationFailure): never;
+}
+declare function formatValidationFailure(failure: ValidationFailure | undefined): string | null;
+declare function throwValidationClientError(options: {
+  code: string;
+  source: string;
+  messagePrefix: string;
+  failure?: ValidationFailure;
+}): never;
+/**
+ * Validate an unknown input against a `@standard-schema`-compatible schema.
+ *
+ * This is the foundation-level entry point for SDK validation. It accepts
+ * any schema implementing `StandardSchemaV1` and returns a discriminated
+ * `ValidationResult`.
+ *
+ * @example
+ * ```ts
+ * import { validateWithSchema } from "@securitydept/client";
+ * import { z } from "zod";
+ *
+ * const UserSchema = z.object({ name: z.string() });
+ * const result = await validateWithSchema(UserSchema, { name: "Alice" });
+ * if (result.success) {
+ *   console.log(result.value.name);
+ * } else {
+ *   console.error(result.issues);
+ * }
+ * ```
+ */
+declare function validateWithSchema<I, O>(schema: StandardSchemaV1<I, O>, input: unknown): Promise<ValidationResult<O>>;
+/**
+ * Validate an unknown input synchronously against a `@standard-schema`-compatible schema.
+ *
+ * Only use this when you know the schema's validate function returns synchronously.
+ * Throws if the schema returns a Promise.
+ */
+declare function validateWithSchemaSync<I, O>(schema: StandardSchemaV1<I, O>, input: unknown): ValidationResult<O>;
+declare function validateTraitInput(options: ValidateTraitInputOptions): void;
+//#endregion
+//#region src/std/time.d.ts
+interface TimeTraitStdHost {
+  Date: Pick<DateConstructor, "now">;
+  setTimeout(handler: () => void, delayMs: number): unknown;
+  clearTimeout(handle: unknown): void;
+}
+interface TimeForStdCreateOptions {
+  host?: TimeTraitStdHost;
+}
+declare function createTimeForStd(options?: TimeForStdCreateOptions & WithTraitInputValidator<TraitInputValidator>): TimeTrait;
+//#endregion
+//#region src/std/transport/authorization-interceptor.d.ts
+type AuthorizationSignal = ReadableSignalTrait<string | null | undefined> | ResourceTrait<string | null | undefined>;
+type AuthorizationInterceptedFetchPredicate = (input: RequestInfo | URL, init: RequestInit | undefined) => boolean | Promise<boolean>;
+interface CreateAuthorizationInterceptedFetchOptions {
+  readonly predicate: AuthorizationInterceptedFetchPredicate;
+  readonly authorization: AuthorizationSignal;
+}
+declare function createAuthorizationInterceptedFetch(fetchImpl: typeof fetch, options: CreateAuthorizationInterceptedFetchOptions): typeof fetch;
+//#endregion
+//#region src/transport/types.d.ts
+declare const TransportErrorCode: {
+  readonly RequestFailed: "transport.request_failed";
+  readonly ResponseDecodeFailed: "transport.response_decode_failed";
+  readonly InvalidStdFetchOptions: "transport.invalid_std_fetch_options";
+  readonly InvalidAngularOptions: "transport.invalid_angular_options";
+};
+type TransportErrorCode = (typeof TransportErrorCode)[keyof typeof TransportErrorCode];
+/** Neutral HTTP request representation. */
+interface HttpRequest {
+  url: string;
+  method: string;
+  headers: Record<string, string>;
+  body?: unknown;
+  cancellationToken?: CancellationTokenTrait;
+}
+/** Neutral HTTP response representation. */
+interface HttpResponse {
+  status: number;
+  headers: Record<string, string>;
+  body?: unknown;
+}
+type HttpResponseJsonBody = Record<string, unknown>;
+/** Neutral request executor trait. */
+interface BaseTransportTrait {
+  execute(request: HttpRequest): Promise<HttpResponse>;
+}
+declare const TRANSPORT_TRAIT_TOKEN: SecuritydeptInjectionToken<BaseTransportTrait>;
+//#endregion
+//#region src/std/transport/base-transport.d.ts
+declare const FetchTransportRedirectKind: {
+  readonly Follow: "follow";
+  readonly Manual: "manual";
+};
+type FetchTransportRedirectKind = (typeof FetchTransportRedirectKind)[keyof typeof FetchTransportRedirectKind];
+interface BaseTransportForStdFetchCreateOptions {
+  redirect?: FetchTransportRedirectKind;
+  fetch?: typeof fetch;
+  baseUrl?: string | URL;
+}
+/**
+ * Default `BaseTransportTrait` backed by the global `fetch` API.
+ *
+ * The caller is responsible for ensuring `fetch` is available in the runtime.
+ * No polyfill is injected.
+ */
+declare function createBaseTransportForStdFetch(options?: BaseTransportForStdFetchCreateOptions & WithTraitInputValidator<TraitInputValidator>): BaseTransportTrait;
+//#endregion
+//#region src/storage/types.d.ts
+declare const StorageChangeEventOrigin: {
+  readonly Local: "local";
+  readonly External: "external";
+};
+type StorageChangeEventOrigin = (typeof StorageChangeEventOrigin)[keyof typeof StorageChangeEventOrigin];
+interface StorageChangeEvent {
+  readonly origin: StorageChangeEventOrigin;
+  readonly key: string | null;
+  readonly oldValue: string | null;
+  readonly newValue: string | null;
+}
+/** Low-level key-value storage trait. */
+interface StorageTrait {
+  readonly storageEvent?: EventStreamTrait<StorageChangeEvent>;
+  get(key: string): string | null | Promise<string | null>;
+  set(key: string, value: string): void | Promise<void>;
+  /**
+   * Atomically read and remove a record within the store's consistency domain.
+   */
+  take?(key: string): string | null | Promise<string | null>;
+  remove(key: string): void | Promise<void>;
+}
+/** Storage whose operations complete synchronously in the current realm. */
+interface SyncStorageTrait extends StorageTrait {
+  get(key: string): string | null;
+  set(key: string, value: string): void;
+  take?(key: string): string | null;
+  remove(key: string): void;
+}
+declare const REALM_STORAGE_TRAIT_TOKEN: SecuritydeptInjectionToken<SyncStorageTrait>;
+declare const PERSISTENT_STORAGE_TRAIT_TOKEN: SecuritydeptInjectionToken<StorageTrait | null>;
+declare const SESSION_STORAGE_TRAIT_TOKEN: SecuritydeptInjectionToken<StorageTrait | null>;
+/** Serialization codec for typed values. */
+interface Codec<T> {
+  encode(value: T): string;
+  decode(raw: string): T;
+}
+/** Semantic store for long-lived auth state. */
+interface PersistentAuthStore<T> {
+  load(): Promise<T | null>;
+  save(value: T): Promise<void>;
+  clear(): Promise<void>;
+}
+/** Semantic store for recoverable state (survives page reload). */
+interface RecoverableStateStore<T> {
+  load(): Promise<T | null>;
+  save(value: T): Promise<void>;
+  clear(): Promise<void>;
+}
+/** Semantic store for ephemeral flow state (one-time-use). */
+interface EphemeralFlowStore<T> {
+  load(): Promise<T | null>;
+  save(value: T): Promise<void>;
+  consume(): Promise<T | null>;
+  clear(): Promise<void>;
+}
+/** Semantic store for keyed ephemeral flow state (one-time-use per key). */
+interface KeyedEphemeralFlowStore<T> {
+  load(key: string): Promise<T | null>;
+  save(key: string, value: T): Promise<void>;
+  take(key: string): Promise<T | null>;
+  clear(key: string): Promise<void>;
+}
+/** Versioned storage envelope — first-version migration support. */
+interface StoredEnvelope<T> {
+  version: number;
+  storedAt: number;
+  expiresAt?: number;
+  value: T;
+}
+//#endregion
+//#region src/tracing/types.d.ts
+declare const TracingLevel: {
+  readonly Debug: "debug";
+  readonly Info: "info";
+  readonly Warn: "warn";
+  readonly Error: "error";
+};
+type TracingLevel = (typeof TracingLevel)[keyof typeof TracingLevel];
+declare const OperationTraceEventType: {
+  readonly Started: "operation.started";
+  readonly Event: "operation.event";
+  readonly Error: "operation.error";
+  readonly Ended: "operation.ended";
+};
+type OperationTraceEventType = (typeof OperationTraceEventType)[keyof typeof OperationTraceEventType];
+declare const TRACING_SPAN_ATTRIBUTE_PROVIDER_ID = "@securitydept/client/tracing";
+interface OperationSpanTrait {
+  readonly span: MutableSpanTrait;
+  setTraceAttributes(attributes: SpanAttributes): void;
+  addEvent(type: string, attributes?: SpanAttributes): void;
+  recordError(error: unknown, attributes?: SpanAttributes): void;
+}
+interface TracingEvent {
+  name: string;
+  at: number;
+  span: SpanTrait;
+  level: TracingLevel;
+  target: string;
+  fields?: SpanAttributes;
+}
+interface TracingTrait extends DisposableTrait {
+  record(event: TracingEvent): void;
+  readonly events: EventStreamTrait<TracingEvent>;
+}
+declare const TRACING_TRAIT_TOKEN: SecuritydeptInjectionToken<TracingTrait>;
+//#endregion
+//#region src/tracing/subscriber/types.d.ts
+interface TracingSubscriberTrait {
+  record(event: TracingEvent): void;
+}
+//#endregion
+//#region src/tracing/create.d.ts
+interface TracingCreateOptions {
+  subscribers?: readonly TracingSubscriberTrait[];
+}
+declare function createTracing(options?: TracingCreateOptions & WithTraitInputValidator<TraitInputValidator>): TracingTrait;
+//#endregion
+//#region src/environment/types.d.ts
+/**
+ * Foundation dependency environment injected into client-side auth runtimes
+ * via explicit wiring at the composition root.
+ *
+ * `transport`, `time`, `realmStorage`, `span`, and `tracing` are the required baseline
+ * capabilities. Optional page/router/popup/storage traits stay explicit.
+ * Raw host-material inputs such as `window`, `location`, or browser storage
+ * handles are intentionally outside this contract and should be resolved by
+ * host-specific creators before a `FoundationEnvironment` is assembled.
+ */
+interface FoundationEnvironment {
+  injector: SecuritydeptInjector;
+  transport: BaseTransportTrait;
+  time: TimeTrait;
+  realmStorage: SyncStorageTrait;
+  idleCallback?: IdleCallbackTrait;
+  persistentStorage?: StorageTrait;
+  sessionStorage?: StorageTrait;
+  span: SpanTrait;
+  tracing: TracingTrait;
+  router?: RouterTrait;
+  pageLifecycle?: PageLifecycleTrait;
+  popup?: PopupTrait;
+}
+interface ServiceWorkerEnvironment extends FoundationEnvironment {}
+declare const ENVIRONMENT_TOKEN: SecuritydeptInjectionToken<FoundationEnvironment>;
+interface EnvironmentValidators {
+  transport?: TraitInputValidator;
+  transportForStdFetchCreateOptions?: TraitInputValidator;
+  time?: TraitInputValidator;
+  timeForStdCreateOptions?: TraitInputValidator;
+  realmStorage?: TraitInputValidator;
+  idleCallback?: TraitInputValidator;
+  persistentStorage?: TraitInputValidator;
+  sessionStorage?: TraitInputValidator;
+  span?: TraitInputValidator;
+  spanCreateOptions?: TraitInputValidator;
+  tracing?: TraitInputValidator;
+  tracingCreateOptions?: TraitInputValidator;
+  router?: TraitInputValidator;
+  pageLifecycle?: TraitInputValidator;
+  popup?: TraitInputValidator;
+}
+//#endregion
+//#region src/environment/create.d.ts
+interface CreateFoundationEnvironmentOptions {
+  providers?: readonly SecuritydeptProvider[];
+  transport?: BaseTransportTrait;
+  transportForStdFetchCreateOptions?: BaseTransportForStdFetchCreateOptions;
+  time?: TimeTrait;
+  timeForStdCreateOptions?: TimeForStdCreateOptions;
+  realmStorage?: SyncStorageTrait;
+  span?: SpanTrait;
+  spanCreateOptions?: SpanCreateOptions;
+  tracing?: TracingTrait;
+  tracingCreateOptions?: TracingCreateOptions;
+  idleCallback?: IdleCallbackTrait | null;
+  persistentStorage?: StorageTrait | null;
+  sessionStorage?: StorageTrait | null;
+  router?: RouterTrait | null;
+  pageLifecycle?: PageLifecycleTrait | null;
+  popup?: PopupTrait | null;
+  validators?: EnvironmentValidators;
+}
+/**
+ * Create a `FoundationEnvironment` from explicit trait units and defaults.
+ *
+ * This helper owns foundation-wide baseline resolution and trait-graph wiring.
+ *
+ * It may resolve:
+ *   - public std adapters such as
+ *     `transportForStdFetchCreateOptions -> transport` and `timeForStdCreateOptions -> time`
+ *   - public hostless baseline constructors such as
+ *     `spanCreateOptions -> span` and `tracingCreateOptions -> tracing`
+ *
+ * Host-material discovery such as resolving `window`, `location`, `history`,
+ * or browser storage handles belongs to explicit host adapters such as
+ * `@securitydept/client/web`, which must first resolve those inputs into
+ * concrete traits before calling this helper.
+ */
+declare function createFoundationEnvironment(overrides: CreateFoundationEnvironmentOptions): FoundationEnvironment;
+//#endregion
+//#region src/auth-coordination/contract.d.ts
+interface AuthRequirement {
+  /** Unique entity id for this requirement within the plan. */
+  readonly id: string;
+  /** Human-readable label (for logging / debugging). */
+  readonly label?: string;
+}
+interface StaticAttrsAuthRequirementInput<TAttributes = Record<string, unknown>> {
+  readonly id?: string;
+  readonly label?: string;
+  readonly attributes?: TAttributes;
+}
+declare class StaticAttrsAuthRequirement<TAttributes = Record<string, unknown>> implements AuthRequirement {
+  readonly id: string;
+  readonly label: string | undefined;
+  readonly attributes: TAttributes | undefined;
+  protected constructor(id: string, label: string | undefined, attributes: TAttributes | undefined);
+  static create<TAttributes = Record<string, unknown>>(input?: StaticAttrsAuthRequirementInput<TAttributes>): StaticAttrsAuthRequirement<TAttributes>;
+  static createList<TAttributes = Record<string, unknown>>(inputs: readonly StaticAttrsAuthRequirementInput<TAttributes>[]): readonly StaticAttrsAuthRequirement<TAttributes>[];
+}
+/** Outcome of resolving a single requirement. */
+declare const ResolutionStatus: {
+  readonly Fulfilled: "fulfilled";
+  readonly Failed: "failed";
+  readonly Skipped: "skipped";
+};
+type ResolutionStatus = (typeof ResolutionStatus)[keyof typeof ResolutionStatus];
+/** The resolution result for a single requirement. */
+interface RequirementResolution {
+  /** The requirement ID this resolution applies to. */
+  requirementId: string;
+  /** Outcome status. */
+  status: ResolutionStatus;
+  /** Optional error or reason for failure/skip. */
+  reason?: string;
+}
+/** Overall plan status. */
+declare const PlanStatus: {
+  /** There are still pending requirements. */
+  readonly Pending: "pending";
+  /** All requirements have been resolved. */
+  readonly Settled: "settled";
+};
+type PlanStatus = (typeof PlanStatus)[keyof typeof PlanStatus];
+/** Error thrown when a planner contract is violated (e.g. duplicate ids). */
+declare class RequirementPlannerError extends Error {
+  constructor(message: string);
+}
+/** Result of an authentication check. */
+type AuthenticatedCheck = boolean | Promise<boolean>;
+/**
+ * Return value of an unauthenticated handler.
+ *
+ * - `true` — the requirement is now satisfied (resolved as fulfilled);
+ *   the pipeline records the resolution and may continue.
+ * - `false` — block: the requirement cannot proceed.
+ * - `string` — redirect to the given location.
+ * - A never-settling `Promise` — used when a full-page external redirect has
+ *   started; the step intentionally never resolves so the host navigation is
+ *   not finalized while the page is leaving.
+ */
+type UnauthenticatedAction = boolean | string | Promise<boolean | string>;
+/**
+ * Behaviour evaluation context handed to every behaviour callback.
+ *
+ * Reflects the planner state at the moment the callback is invoked.
+ */
+type RequirementBehaviourContext<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = {
+  readonly planContext: TPlanContext;
+  readonly environment: FoundationEnvironment;
+  /** The full effective requirement list for the active plan. */
+  readonly requirements: readonly TAuthRequirement[];
+  /** Resolutions collected so far (in requirement order). */
+  readonly resolutionList: readonly RequirementResolution[];
+};
+/** Stream of unauthenticated requirements discovered by the planner. */
+type RequirementCandidateGenerator<TAuthRequirement extends AuthRequirement = AuthRequirement> = AsyncGenerator<TAuthRequirement, void, unknown>;
+/**
+ * Context handed to candidate selection.
+ *
+ * `candidateList` is intentionally a stream: selectors that can act on the
+ * first available unauthenticated requirement do not need to wait for all
+ * checks to complete, while chooser-style selectors can still collect the full
+ * stream with `for await`.
+ */
+type RequirementCandidateSelectionContext<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = RequirementBehaviourContext<TAuthRequirement, TPlanContext> & {
+  /** Requirements not yet satisfied, yielded as their checks complete. */
+  readonly candidateList: RequirementCandidateGenerator<TAuthRequirement>;
+};
+/** Decide whether a single requirement is already satisfied. */
+type CheckAuthenticated<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = (requirement: TAuthRequirement, context: RequirementBehaviourContext<TAuthRequirement, TPlanContext>) => AuthenticatedCheck;
+/** Decide what to do when a selected requirement is unauthenticated. */
+type OnUnauthenticated<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = (requirement: TAuthRequirement, context: RequirementBehaviourContext<TAuthRequirement, TPlanContext>) => UnauthenticatedAction;
+/**
+ * Reduce the candidate set to the single requirement to act on next.
+ *
+ * The default strategy picks the first unauthenticated candidate yielded by the
+ * stream. Chooser-style strategies may collect the full stream when they need
+ * a complete candidate set.
+ */
+type SelectCandidate<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = (context: RequirementCandidateSelectionContext<TAuthRequirement, TPlanContext>) => TAuthRequirement | undefined | Promise<TAuthRequirement | undefined>;
+/** The full behaviour contract resolved by a planner host. */
+interface RequirementBehaviour<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> {
+  checkAuthenticated: CheckAuthenticated<TAuthRequirement, TPlanContext>;
+  onUnauthenticated: OnUnauthenticated<TAuthRequirement, TPlanContext>;
+  selectCandidate: SelectCandidate<TAuthRequirement, TPlanContext>;
+}
+interface RouteStateSnapshotTrait {
+  readonly url: string;
+}
+interface RouteBehaviourContextExtra {
+  readonly routeState: RouteStateSnapshotTrait;
+}
+declare function isRouteStateSnapshotTrait(value: unknown): value is RouteStateSnapshotTrait;
+declare function isRouteBehaviourContextExtra(value: unknown): value is RouteBehaviourContextExtra;
+type RequirementBehaviourWithRouteContext<TAuthRequirement extends AuthRequirement = AuthRequirement> = RequirementBehaviour<TAuthRequirement, RouteBehaviourContextExtra>;
+/** Outcome of a pipeline step or run. */
+declare const PipelineOutcome: {
+  /** No candidates remain — the plan is satisfied. */
+  readonly Settled: "settled";
+  /** A candidate was resolved as fulfilled; more may remain. */
+  readonly Resolved: "resolved";
+  /** A candidate's handler blocked progress. */
+  readonly Blocked: "blocked";
+  /** A candidate's handler requested a redirect. */
+  readonly Redirect: "redirect";
+};
+type PipelineOutcome = (typeof PipelineOutcome)[keyof typeof PipelineOutcome];
+/** Result of a single {@link BaseRequirementPlanner.runStep}. */
+type PipelineStepResult<TAuthRequirement extends AuthRequirement = AuthRequirement> = {
+  outcome: typeof PipelineOutcome.Settled;
+} | {
+  outcome: typeof PipelineOutcome.Resolved;
+  requirement: TAuthRequirement;
+} | {
+  outcome: typeof PipelineOutcome.Blocked;
+  requirement: TAuthRequirement;
+} | {
+  outcome: typeof PipelineOutcome.Redirect;
+  requirement: TAuthRequirement;
+  location: string;
+};
+/** Result of {@link BaseRequirementPlanner.runUntilSettled}. */
+type PipelineRunResult<TAuthRequirement extends AuthRequirement = AuthRequirement> = {
+  outcome: typeof PipelineOutcome.Settled;
+  resolutions: readonly RequirementResolution[];
+} | {
+  outcome: typeof PipelineOutcome.Blocked;
+  requirement: TAuthRequirement;
+} | {
+  outcome: typeof PipelineOutcome.Redirect;
+  requirement: TAuthRequirement;
+  location: string;
+};
+/**
+ * How a route segment's requirements compose with the inherited parent chain.
+ *
+ * - `inherit` — keep the parent requirements unchanged (segment adds nothing)
+ * - `merge` — inherit parent requirements, then append/override with the
+ *   segment's own (same-id entries replace the parent's)
+ * - `replace` — discard the parent chain, use only the segment's requirements
+ */
+declare const RequirementsComposition: {
+  readonly Inherit: "inherit";
+  readonly Merge: "merge";
+  readonly Replace: "replace";
+};
+type RequirementsComposition = (typeof RequirementsComposition)[keyof typeof RequirementsComposition];
+/** A single node in a matched route chain. */
+interface RouteTreeSegment<TAuthRequirement extends AuthRequirement = AuthRequirement> {
+  /** Route segment identifier (e.g. route name or path pattern). */
+  routeId: string;
+  /** Auth requirements declared on this route segment. */
+  requirements: readonly TAuthRequirement[];
+  /** Composition strategy against the inherited chain. Defaults to `merge`. */
+  composition?: RequirementsComposition;
+}
+/** A requirements declaration annotated with its composition strategy. */
+interface RouteRequirementsDeclaration<TAuthRequirement extends AuthRequirement = AuthRequirement> {
+  composition: RequirementsComposition;
+  requirements: readonly TAuthRequirement[];
+}
+/**
+ * Apply a route requirements declaration onto an effective requirement map.
+ *
+ * Reuse `effective` across a route chain so merge/replace fold in O(total
+ * requirements) without rebuilding parent state each segment. When omitted, a
+ * fresh map is created for one-shot composition.
+ */
+declare function resolveEffectiveRequirements<TAuthRequirement extends AuthRequirement = AuthRequirement>(child: RouteRequirementsDeclaration<TAuthRequirement>, effective?: Map<string, TAuthRequirement>): Map<string, TAuthRequirement>;
+//#endregion
+//#region src/auth-coordination/planner-host.d.ts
+declare const REQUIREMENT_PLANNER_HOST: SecuritydeptInjectionToken<RequirementPlannerHost<unknown>>;
+type RequirementPlannerHostBehaviour<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>> = TBehaviour | (() => TBehaviour);
+interface ProvideRequirementPlannerHostOptions<TBehaviour = Partial<RequirementBehaviour>> {
+  readonly parent?: RequirementPlannerHost<TBehaviour>;
+  readonly environment?: FoundationEnvironment;
+}
+interface InjectRequirementPlannerHostOptions {
+  readonly injector: SecuritydeptInjectorTrait;
+}
+/**
+ * Default candidate selector: first unauthenticated candidate as soon as it is
+ * discovered.
+ *
+ * If every requirement is already fulfilled the stream completes and the
+ * selector returns `undefined`.
+ */
+declare function defaultSelectCandidate<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}>(): SelectCandidate<TAuthRequirement, TPlanContext>;
+/** Options for {@link RequirementPlannerHost.fromBehaviour}. */
+interface RequirementPlannerHostOptions<TRequirementBehaviour = Partial<RequirementBehaviour>> {
+  /** Parent host to inherit unspecified behaviour from. */
+  parent?: RequirementPlannerHost<TRequirementBehaviour>;
+  environment?: FoundationEnvironment;
+}
+/**
+ * A coordination-scope host that resolves behaviour through a parent chain.
+ *
+ * Construct via {@link RequirementPlannerHost.fromBehaviour}. Each behaviour
+ * field is optional at host construction time; missing required behaviour is
+ * resolved from `parent` and fails fast during planner build if no host in the
+ * chain provides it.
+ *
+ * @example
+ * ```ts
+ * const root = RequirementPlannerHost.fromBehaviour({
+ *   checkAuthenticated: (req) => isAuthenticated(req),
+ *   onUnauthenticated: (req) => `/login/${req.id}`,
+ * });
+ *
+ * // Feature scope overrides only the chooser, inheriting the rest.
+ * const feature = RequirementPlannerHost.fromBehaviour(
+ *   { selectCandidate: async (ctx) => showChooser(ctx.candidateList) },
+ *   { parent: root },
+ * );
+ * ```
+ */
+declare class RequirementPlannerHost<TBehaviour = Partial<RequirementBehaviour>> {
+  readonly environment: FoundationEnvironment | undefined;
+  readonly parent: RequirementPlannerHost<TBehaviour> | undefined;
+  /** The parent host, or undefined at the root. */
+  private readonly _behaviour;
+  protected constructor(behaviour: TBehaviour, environment: FoundationEnvironment | undefined, parent: RequirementPlannerHost<TBehaviour> | undefined);
+  /** Create a host scope from a partial behaviour and optional parent. */
+  static fromBehaviour<TBehaviour = Partial<RequirementBehaviour>>(behaviour: TBehaviour, options?: RequirementPlannerHostOptions<TBehaviour>): RequirementPlannerHost<TBehaviour>;
+  resolveBehaviourOptionFor<K extends keyof TBehaviour>(key: K): Promise<TBehaviour[K] | undefined>;
+  resolveBehaviourFor<K extends keyof TBehaviour>(key: K, defaultValue: () => NonNullable<TBehaviour[K]> | Promise<NonNullable<TBehaviour[K]>>): Promise<NonNullable<TBehaviour[K]>>;
+  resolveEnvironmentOption(): Promise<FoundationEnvironment | undefined>;
+  resolveEnvironment(defaultValue: () => FoundationEnvironment | Promise<FoundationEnvironment>): Promise<FoundationEnvironment>;
+}
+declare function provideRequirementPlannerHost<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>>(behaviour: RequirementPlannerHostBehaviour<TAuthRequirement, TPlanContext, TBehaviour>, options?: ProvideRequirementPlannerHostOptions<TBehaviour>): SecuritydeptProvider<RequirementPlannerHost<TBehaviour>>;
+declare function injectRequirementPlannerHost<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>>(options: InjectRequirementPlannerHostOptions): RequirementPlannerHost<TBehaviour> | null;
+//#endregion
+//#region src/auth-coordination/planner/base-planner.d.ts
+/**
+ * Mutable pipeline state for one run: bound behaviour plus requirement list
+ * and evolving resolutions.
+ */
+interface RequirementPlan<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> extends Readonly<RequirementBehaviour<TAuthRequirement, TPlanContext>> {
+  readonly planContext: TPlanContext;
+  readonly environment: FoundationEnvironment;
+  readonly requirements: readonly TAuthRequirement[];
+  resolutionList: RequirementResolution[];
+}
+/**
+ * Abstract base for all requirement planners.
+ *
+ * Subclasses supply requirements via {@link buildRequirementList}. Pipeline
+ * state lives on {@link RequirementPlan}, produced by {@link buildPlan}.
+ */
+declare abstract class BaseRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>> {
+  protected readonly host: RequirementPlannerHost<TBehaviour>;
+  protected initialResolutions: readonly RequirementResolution[];
+  abstract get planContext(): TPlanContext;
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, initialResolutions?: readonly RequirementResolution[]);
+  /**
+   * Pipeline step 0: resolve host behaviour and materialize requirements into
+   * a {@link RequirementPlan}.
+   *
+   * Behaviour and the requirement list stay fixed on the returned plan until
+   * the next `buildPlan()` call. Resolve host parent chains (and any
+   * injection-context capture) here — not between async steps.
+   */
+  buildPlan(): Promise<RequirementPlan<TAuthRequirement, TPlanContext>>;
+  /**
+   * Return the effective requirement map for this planner.
+   *
+   * Keys are requirement ids; {@link Map} insertion order defines evaluation
+   * order. Subclasses own deduplication policy when folding multiple sources.
+   */
+  protected abstract buildRequirementList(): Map<string, TAuthRequirement> | Promise<Map<string, TAuthRequirement>>;
+  /**
+   * Materialize the effective requirement list (also invoked by {@link buildPlan}).
+   */
+  resolveRequirementList(): Promise<readonly TAuthRequirement[]>;
+  /**
+   * Pipeline step 1 — one loop iteration: select a candidate, run
+   * `onUnauthenticated`, then reduce `plan` state.
+   */
+  runStep(plan: RequirementPlan<TAuthRequirement, TPlanContext>): Promise<PipelineStepResult<TAuthRequirement>>;
+  protected reduceFromAction(plan: RequirementPlan<TAuthRequirement, TPlanContext>, candidate: TAuthRequirement, action: Exclude<UnauthenticatedAction, Promise<unknown>>): PipelineStepResult<TAuthRequirement>;
+  /**
+   * Run the full pipeline: {@link buildPlan}, step 1, then loop step 2 until
+   * settled or a terminal outcome (`blocked`, `redirect`, or a never-settling
+   * action).
+   */
+  runUntilSettled(): Promise<PipelineRunResult<TAuthRequirement>>;
+  runUntilSettledWithPlan(plan: RequirementPlan<TAuthRequirement, TPlanContext>): Promise<PipelineRunResult<TAuthRequirement>>;
+  private createCandidateStream;
+  private recordFulfilled;
+}
+//#endregion
+//#region src/auth-coordination/planner/merge-planner.d.ts
+/**
+ * A planner whose effective requirements are the ordered union of its source
+ * planners. Overlapping ids follow Map semantics (later source wins).
+ *
+ * @example
+ * ```ts
+ * const planner = MergeRequirementPlanner.fromPlanners(host, [
+ *   sessionPlanner,
+ *   oidcPlanner,
+ * ]);
+ * ```
+ */
+declare class MergeRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>> extends BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour> {
+  private readonly sources;
+  get planContext(): TPlanContext;
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, sources: readonly BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour>[]);
+  /** Create a merge planner from an ordered list of source planners. */
+  static fromPlanners<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>>(host: RequirementPlannerHost<TBehaviour>, planners: readonly BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour>[]): MergeRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour>;
+  protected buildRequirementList(): Promise<Map<string, TAuthRequirement>>;
+}
+//#endregion
+//#region src/auth-coordination/planner/route-composition-planner.d.ts
+/**
+ * A planner driven by a matched route chain with composition semantics.
+ *
+ * Construct via {@link fromRouteSegments} for a matched route chain, or
+ * {@link fromRouteTransition} for a transition that preserves shared-prefix
+ * resolutions from the previous planner instance.
+ */
+declare class RouteCompositionRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>> extends BaseRequirementPlanner<TAuthRequirement, RouteBehaviourContextExtra, TBehaviour> {
+  private readonly _segments;
+  private readonly _effective;
+  private readonly _planContext;
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, segments: readonly RouteTreeSegment<TAuthRequirement>[], routeState: RouteStateSnapshotTrait, preservedResolutions?: readonly RequirementResolution[]);
+  /** Build a planner from a matched route chain. */
+  static fromRouteSegments<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>>(host: RequirementPlannerHost<TBehaviour>, segments: readonly RouteTreeSegment<TAuthRequirement>[], routeState: RouteStateSnapshotTrait): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour>;
+  /**
+   * Build a planner for a route transition, preserving resolutions for the
+   * shared requirement prefix carried over from `previousPlan`.
+   */
+  static fromRouteTransition<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>>(host: RequirementPlannerHost<TBehaviour>, currentSegments: readonly RouteTreeSegment<TAuthRequirement>[], routeState: RouteStateSnapshotTrait, previousPlanner: RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour>, previousPlan: RequirementPlan<TAuthRequirement, RouteBehaviourContextExtra>): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour>;
+  get planContext(): RouteBehaviourContextExtra;
+  /** The matched route chain backing this planner. */
+  get segments(): readonly RouteTreeSegment<TAuthRequirement>[];
+  /** The folded effective requirement list (composition applied). */
+  get effectiveRequirements(): readonly TAuthRequirement[];
+  protected buildRequirementList(): Map<string, TAuthRequirement>;
+}
+//#endregion
+//#region src/auth-coordination/planner/static-planner.d.ts
+/**
+ * A planner whose effective requirement list is a fixed array supplied at
+ * construction time.
+ *
+ * @example
+ * ```ts
+ * const planner = StaticRequirementPlanner.fromRequirements(host, [
+ *   StaticAttrsAuthRequirement.create({ id: "session" }),
+ * ] as Readonly<AuthRequirement[]>);
+ * const plan = await planner.buildPlan();
+ * const step = await planner.runStep(plan);
+ * // or: const result = await planner.runUntilSettled();
+ * ```
+ */
+declare class StaticRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement>> = Partial<RequirementBehaviour<TAuthRequirement>>> extends BaseRequirementPlanner<TAuthRequirement, {}, TBehaviour> {
+  private readonly staticRequirements;
+  get planContext(): {};
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, requirements: readonly TAuthRequirement[]);
+  /** Create a static planner from an ordered requirement list. */
+  static fromRequirements<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement>> = Partial<RequirementBehaviour<TAuthRequirement>>>(host: RequirementPlannerHost<TBehaviour>, requirements: readonly TAuthRequirement[]): StaticRequirementPlanner<TAuthRequirement, TBehaviour>;
+  protected buildRequirementList(): Map<string, TAuthRequirement>;
+}
+//#endregion
+//#region src/identity/contracts.d.ts
+interface IdentityPrincipal {
+  subject: string;
+  displayName: string;
+  picture?: string;
+  issuer?: string;
+  claims?: Record<string, unknown>;
+}
+interface ProjectIdentityPrincipalOptions {
+  principal?: IdentityPrincipal | null;
+  fallbackDisplayName?: string;
+  fallbackSubject?: string;
+  fallbackIssuer?: string;
+  fallbackClaims?: Record<string, unknown>;
+}
+//#endregion
+//#region src/identity/parsers.d.ts
+declare function parseIdentityPrincipal(input: unknown): IdentityPrincipal;
+declare function parseIdentityPrincipalWire(input: unknown): IdentityPrincipal;
+declare function projectIdentityPrincipal(options: ProjectIdentityPrincipalOptions): IdentityPrincipal;
+//#endregion
+//#region src/identity/schemas.d.ts
+declare const IdentityPrincipalSchema: import("arktype/internal/variants/object.ts").ObjectType<(In: {
+  subject: string;
+  displayName?: string | null | undefined;
+  picture?: string | null | undefined;
+  issuer?: string | null | undefined;
+  claims?: object | null | undefined;
+}) => import("arktype").Out<IdentityPrincipal>, {}>;
+declare const IdentityPrincipalWireSchema: import("arktype/internal/variants/object.ts").ObjectType<(In: {
+  subject: string;
+  display_name?: string | null | undefined;
+  picture?: string | null | undefined;
+  issuer?: string | null | undefined;
+  claims?: object | null | undefined;
+}) => import("arktype").Out<IdentityPrincipal>, {}>;
+//#endregion
+//#region src/protocol/jwt/types.d.ts
+type JwtAudienceClaim = string | readonly string[];
+interface JwtClaimsSet extends Record<string, unknown> {
+  iss?: string;
+  sub?: string;
+  aud?: JwtAudienceClaim;
+  exp?: number;
+  nbf?: number;
+  iat?: number;
+  jti?: string;
+}
+interface DecodeJwtPayloadOptions {
+  /**
+   * Optional label used in error messages. It does not affect parsing.
+   */
+  label?: string;
+}
+//#endregion
+//#region src/protocol/jwt/decode.d.ts
+declare function decodeJwtPayload(jwt: string, options?: DecodeJwtPayloadOptions): JwtClaimsSet;
+//#endregion
+//#region src/protocol/jwt/error.d.ts
+declare const JwtDecodeErrorCode: {
+  readonly InvalidFormat: "protocol.jwt.invalid_format";
+  readonly InvalidPayload: "protocol.jwt.invalid_payload";
+  readonly InvalidClaim: "protocol.jwt.invalid_claim";
+};
+type JwtDecodeErrorCode = (typeof JwtDecodeErrorCode)[keyof typeof JwtDecodeErrorCode];
+declare class JwtDecodeError extends ClientError {
+  readonly code: JwtDecodeErrorCode;
+  constructor(options: {
+    code: JwtDecodeErrorCode;
+    message: string;
+    cause?: unknown;
+  });
+}
+//#endregion
+//#region src/scheduling/duration.d.ts
+/**
+ * Parse a human-readable duration string (for example `5m` or `300s`) into
+ * milliseconds.
+ */
+declare function parseDurationToMs(duration: string): number;
+//#endregion
+//#region src/span/attributes.d.ts
+declare const SpanSharedAttributeName: {
+  readonly ClientName: "client.name";
+  readonly ClientId: "client.id";
+  readonly OperationName: "operation.name";
+};
+type SpanSharedAttributeName = (typeof SpanSharedAttributeName)[keyof typeof SpanSharedAttributeName];
+//#endregion
+//#region src/span/span.d.ts
+declare function createRootSpan(options?: SpanCreateOptions & WithTraitInputValidator<TraitInputValidator>): SpanTrait;
+//#endregion
+//#region src/std/cancellation/abort-signal.d.ts
+/**
+ * Bridge a web `AbortSignal` back into the foundation cancellation contract.
+ *
+ * This is the canonical consumer-side path for browser hosts that receive an
+ * `AbortSignal` from framework/runtime APIs (for example React Query queryFns)
+ * but need to call SDK surfaces that accept `CancellationTokenTrait`.
+ */
+declare function abortSignalToCancellationToken(signal: AbortSignal): CancellationTokenTrait;
+declare function abortSignalToCancellationToken(signal?: undefined): undefined;
+declare function abortSignalToCancellationToken(signal?: AbortSignal): CancellationTokenTrait | undefined;
+interface AbortSignalBridge extends DisposableTrait {
+  signal?: AbortSignal;
+}
+/**
+ * Bridge foundation cancellation to `AbortSignal` without exposing
+ * `AbortSignal` in core contracts.
+ */
+declare function cancellationTokenToAbortSignal(token: CancellationTokenTrait): AbortSignalBridge;
+declare function cancellationTokenToAbortSignal(token?: undefined): undefined;
+declare function cancellationTokenToAbortSignal(token?: CancellationTokenTrait): AbortSignalBridge | undefined;
+declare function normalizeAbortError(token: CancellationTokenTrait | undefined, error: unknown): unknown;
+//#endregion
+//#region src/storage/ephemeral-flow-store.d.ts
+interface CreateEphemeralFlowStoreOptions<T> {
+  store: StorageTrait;
+  key: string;
+  codec?: Codec<T>;
+}
+interface CreateKeyedEphemeralFlowStoreOptions<T> {
+  store: StorageTrait;
+  keyPrefix: string;
+  codec?: Codec<T>;
+}
+/**
+ * Create a typed ephemeral flow-state store backed by a low-level `StorageTrait`.
+ *
+ * Intended for short-lived browser/session coordination state such as pending
+ * redirects or callback fragments.
+ */
+declare function createEphemeralFlowStore<T>(options: CreateEphemeralFlowStoreOptions<T>): EphemeralFlowStore<T>;
+/**
+ * Create a typed keyed ephemeral flow-state store backed by a low-level
+ * `StorageTrait`.
+ *
+ * Intended for short-lived browser/session coordination state where multiple
+ * pending records must coexist and be consumed independently.
+ */
+declare function createKeyedEphemeralFlowStore<T>(options: CreateKeyedEphemeralFlowStoreOptions<T>): KeyedEphemeralFlowStore<T>;
+//#endregion
+//#region src/storage/json-codec.d.ts
+/** Default JSON codec. */
+declare function createJsonCodec<T>(): Codec<T>;
+//#endregion
+//#region src/storage/memory-store.d.ts
+/** In-memory `SyncStorageTrait` — useful for realm state, tests, and SSR. */
+declare function createInMemoryRecordStore(): SyncStorageTrait;
+//#endregion
+//#region src/struct/async-lock.d.ts
+declare const OnceAsyncLockState: {
+  readonly Init: "init";
+  readonly Running: "running";
+  readonly Success: "success";
+  readonly Error: "error";
+};
+type OnceAsyncLockState = (typeof OnceAsyncLockState)[keyof typeof OnceAsyncLockState];
+type OnceAsyncLockInit = {
+  readonly state: typeof OnceAsyncLockState.Init;
+  readonly promise?: never;
+};
+type OnceAsyncLockRunning = {
+  readonly state: typeof OnceAsyncLockState.Running;
+  readonly promise: Promise<unknown>;
+};
+type OnceAsyncLockSuccess<T> = {
+  readonly state: typeof OnceAsyncLockState.Success;
+  readonly data: T;
+};
+type OnceAsyncLockError<E> = {
+  readonly state: typeof OnceAsyncLockState.Error;
+  readonly error: E;
+};
+type OnceAsyncLock<T, E> = OnceAsyncLockInit | OnceAsyncLockRunning | OnceAsyncLockSuccess<T> | OnceAsyncLockError<E>;
+type OnceAsyncLockCallable<F extends (...args: any[]) => PromiseLike<any>, E = unknown> = F & OnceAsyncLock<Awaited<ReturnType<F>>, E> & ReadableSignalTrait<OnceAsyncLock<Awaited<ReturnType<F>>, E>>;
+declare function createOnceAsyncLockCallable<F extends (...args: any[]) => PromiseLike<any>, E = unknown>(fn: F): OnceAsyncLockCallable<F, E>;
+//#endregion
+//#region src/tracing/operation-runner.d.ts
+interface RunOperationEnvironment {
+  environment: {
+    time: TimestampProviderTrait;
+    tracing: TracingTrait;
+  };
+}
+interface RunOperationOptionsBase extends RunOperationEnvironment {
+  span: SpanTrait;
+  name: string;
+  target: string;
+  traceAttributes?: SpanAttributes;
+  idFactory?: () => string;
+  clientErrorFromUnknown?: (error: unknown, options: {
+    span: SpanTrait;
+  }) => ClientError;
+}
+interface RunOperationOptions<T> extends RunOperationOptionsBase {
+  execute: (span: OperationSpanTrait) => T;
+}
+declare class OperationSpan implements OperationSpanTrait {
+  readonly span: MutableSpanTrait;
+  private readonly _environment;
+  private readonly _target;
+  private constructor();
+  static start(options: RunOperationOptionsBase): OperationSpan;
+  setTraceAttributes(attributes: SpanAttributes): void;
+  addEvent(name: string, fields?: SpanAttributes): void;
+  recordError(error: unknown, fields?: SpanAttributes): void;
+  recordStarted(): void;
+  recordEnded(outcome: "succeeded" | "failed"): void;
+  private _record;
+}
+declare function runOperation<T>(options: RunOperationOptions<T>): T;
+declare function runOperation<T>(options: RunOperationOptions<Promise<T>>): Promise<T>;
+//#endregion
+//#region src/tracing/operation-method.d.ts
+interface InstrumentMethodThisContext<TArgs extends unknown[]> {
+  args: TArgs;
+  methodName: string;
+}
+interface InstrumentMethodResolvedOptions extends Omit<RunOperationOptionsBase, "name"> {
+  name?: string;
+}
+type InstrumentMethodThisResolver<TThis extends object, TArgs extends unknown[]> = (this: TThis, context: InstrumentMethodThisContext<TArgs>) => InstrumentMethodResolvedOptions;
+interface DefineInstrumentMethodDecoratorContext<TFactoryArgs extends unknown[]> {
+  factoryArgs: TFactoryArgs;
+  methodName: string;
+}
+type DefineInstrumentMethodDecoratorFactory<TFactoryArgs extends unknown[], TBaseThis extends object = object> = <TThis extends TBaseThis, TArgs extends unknown[]>(context: DefineInstrumentMethodDecoratorContext<TFactoryArgs>) => InstrumentMethodThisResolver<TThis, TArgs>;
+declare function defineInstrumentMethodDecorator<TFactoryArgs extends unknown[], TBaseThis extends object = object>(factory: DefineInstrumentMethodDecoratorFactory<TFactoryArgs, TBaseThis>): (...factoryArgs: TFactoryArgs) => <TThis extends TBaseThis, TArgs extends unknown[], TReturn>(target: (this: TThis, ...args: TArgs) => TReturn, context: ClassMethodDecoratorContext<TThis, (this: TThis, ...args: TArgs) => TReturn>) => (this: TThis, ...args: TArgs) => TReturn;
+//#endregion
+//#region src/tracing/subscriber/console.d.ts
+declare class ConsoleTracingSubscriber implements TracingSubscriberTrait {
+  record(event: TracingEvent): void;
+}
+declare function createConsoleTracingSubscriber(): ConsoleTracingSubscriber;
+//#endregion
+//#region src/struct/ring-buffer.d.ts
+declare class FixedCapacityRingBuffer<T> {
+  readonly capacity: number;
+  private readonly values;
+  private head;
+  private tail;
+  private _size;
+  constructor(capacity: number);
+  get size(): number;
+  append(value: T): void;
+  toArray(): T[];
+  clear(): void;
+}
+//#endregion
+//#region src/tracing/subscriber/timeline-store.d.ts
+interface TraceTimelineEntry extends Omit<TracingEvent, "span"> {
+  id: number;
+  recordedAtIso: string;
+  span: {
+    readonly id: string;
+    readonly parentId?: string;
+  };
+  spanAttributes: readonly SpanNodeAttributes[];
+}
+/**
+ * Bounded subscriber-side trace timeline.
+ *
+ * This store consumes tracing events through `record(event)` and keeps a
+ * bounded local timeline for tests and UI surfaces. It is not the tracing
+ * runtime itself.
+ */
+declare class TraceTimelineStore implements TracingSubscriberTrait {
+  protected readonly limit: number;
+  protected nextId: number;
+  protected readonly timeline: FixedCapacityRingBuffer<TraceTimelineEntry>;
+  protected readonly latestEntrySubject: RxEventSubject<TraceTimelineEntry | null>;
+  constructor(limit?: number);
+  get latestEntry(): EventStreamTrait<TraceTimelineEntry | null>;
+  get entries(): readonly TraceTimelineEntry[];
+  record(event: TracingEvent): void;
+  clear(): void;
+}
+declare function createTraceTimelineStore(limit?: number): TraceTimelineStore;
+//#endregion
+//#region src/transport/url.d.ts
+/**
+ * Returns `true` for loopback HTTP URLs that browsers and local tooling often
+ * permit during development flows.
+ */
+declare function isLoopbackHttpUrl(url: URL): boolean;
+//#endregion
+export { RequirementPlan as $, appendOrReplaceCompatFragment as $n, createJsonRpcServerAndClient as $r, Codec as $t, abortSignalToCancellationToken as A, Base64CompatErrorCode as Ai, ValidationResult as An, readPopupErrorPresentationDescriptor as Ar, SelectCandidate as At, JwtAudienceClaim as B, RouterNavigationMode as Bn, ResourceSnapshotUpdateKind as Br, EnvironmentValidators as Bt, OnceAsyncLockState as C, createEventStream as Ci, CreateAuthorizationInterceptedFetchOptions as Cn, PopupAttachResult as Cr, RequirementResolution as Ct, createJsonCodec as D, PAGE_LIFECYCLE_TRAIT_TOKEN as Di, TraitInputValidator as Dn, CreatePopupClientSessionOptions as Dr, RouteRequirementsDeclaration as Dt, createInMemoryRecordStore as E, abortSignalToEventStream as Ei, createTimeForStd as En, PopupTrait as Er, RouteBehaviourContextExtra as Et, parseDurationToMs as F, validateTraitInput as Fn, PopupServerWindowHandleTrait as Fr, isRouteStateSnapshotTrait as Ft, parseIdentityPrincipalWire as G, AppendOrReplaceCompatFragmentOptions as Gn, ResourceStreamContext as Gr, TracingSubscriberTrait as Gt, IdentityPrincipalSchema as H, RouterTrait as Hn, reduceResourceSnapshot as Hr, ServiceWorkerEnvironment as Ht, JwtDecodeError as I, validateWithSchema as In, PopupWindowHandleTrait as Ir, resolveEffectiveRequirements as It, ProjectIdentityPrincipalOptions as J, CompatFragmentParameters as Jn, ResourceErrorCode as Jr, TRACING_SPAN_ATTRIBUTE_PROVIDER_ID as Jt, projectIdentityPrincipal as K, AppendOrReplaceCompatFragmentResult as Kn, createResource as Kr, OperationSpanTrait as Kt, JwtDecodeErrorCode as L, validateWithSchemaSync as Ln, createSignal as Lr, CreateFoundationEnvironmentOptions as Lt, normalizeAbortError as M, encodeUint8ArrayToBase64 as Mi, WithTraitInputValidator as Mn, PopupClientWindowHandleTrait as Mr, StaticAttrsAuthRequirementInput as Mt, createRootSpan as N, SecuritydeptDestroyRef as Ni, formatValidationFailure as Nn, PopupMessageChannelTrait as Nr, UnauthenticatedAction as Nt, createEphemeralFlowStore as O, PageLifecycleTrait as Oi, ValidateTraitInputOptions as On, CreatePopupServerSessionOptions as Or, RouteStateSnapshotTrait as Ot, SpanSharedAttributeName as P, createSecuritydeptDestroyRef as Pi, throwValidationClientError as Pn, PopupServerWindowHandle as Pr, isRouteBehaviourContextExtra as Pt, BaseRequirementPlanner as Q, UpdateUriFragmentHash as Qn, createJsonRpcServer as Qr, TracingTrait as Qt, decodeJwtPayload as R, ROUTER_TRAIT_TOKEN as Rn, readonlySignal as Rr, createFoundationEnvironment as Rt, OnceAsyncLockRunning as S, createEventReplaySubject as Si, AuthorizationSignal as Sn, PopupAttachFailureReason as Sr, RequirementPlannerError as St, createOnceAsyncLockCallable as T, createNeverEventStream as Ti, TimeForStdCreateOptions as Tn, PopupOpenOptions as Tr, ResolutionStatus as Tt, IdentityPrincipalWireSchema as U, TakeCompatFragmentFromRouterOptions as Un, whenResourceSnapshotValue as Ur, TracingCreateOptions as Ut, JwtClaimsSet as V, RouterNavigationRequest as Vn, flattenResourceSnapshot as Vr, FoundationEnvironment as Vt, parseIdentityPrincipal as W, takeCompatFragmentFromRouter as Wn, CreateResourceOptions as Wr, createTracing as Wt, RouteCompositionRequirementPlanner as X, TakeCompatFragmentOptions as Xn, createComputed as Xr, TracingEvent as Xt, StaticRequirementPlanner as Y, SECURITYDEPT_COMPAT_FRAGMENT_VERSION as Yn, ResourceValueUnavailableErrorOptions as Yr, TRACING_TRAIT_TOKEN as Yt, MergeRequirementPlanner as Z, TakeCompatFragmentResult as Zn, createJsonRpcClient as Zr, TracingLevel as Zt, runOperation as _, toEventStream as _i, HttpResponse as _n, UriReferenceStringSchema as _r, RequirementBehaviour as _t, ConsoleTracingSubscriber as a, JsonRpcErrorResponseMessage as ai, RecoverableStateStore as an, UriReferenceString as ar, RequirementPlannerHostOptions as at, OnceAsyncLockError as b, isClientErrorEvent as bi, TransportErrorCode as bn, POPUP_TRAIT_TOKEN as br, RequirementCandidateGenerator as bt, DefineInstrumentMethodDecoratorFactory as c, JsonRpcNotificationEvent as ci, StorageChangeEventOrigin as cn, UriRelativeParts as cr, provideRequirementPlannerHost as ct, InstrumentMethodThisResolver as d, JsonRpcRequestMessage as di, SyncStorageTrait as dn, UriString as dr, CheckAuthenticated as dt, CreateJsonRpcClientOptions as ei, EphemeralFlowStore as en, isCompatFragmentBlock as er, InjectRequirementPlannerHostOptions as et, defineInstrumentMethodDecorator as f, JsonRpcRequestOptions as fi, BaseTransportForStdFetchCreateOptions as fn, SECURITYDEPT_ROUTE_METADATA_KEY as fr, OnUnauthenticated as ft, RunOperationOptionsBase as g, ToEventStreamInput as gi, HttpRequest as gn, BaseURIStringSchema as gr, PlanStatus as gt, RunOperationOptions as h, JsonRpcSuccessResponseMessage as hi, BaseTransportTrait as hn, writeSecuritydeptRouteMetadata as hr, PipelineStepResult as ht, createTraceTimelineStore as i, JsonRpcErrorPayload as ii, REALM_STORAGE_TRAIT_TOKEN as in, UriParseError as ir, RequirementPlannerHostBehaviour as it, cancellationTokenToAbortSignal as j, decodeBase64ToUint8Array as ji, ValidationSuccess as jn, PopupClientWindowHandle as jr, StaticAttrsAuthRequirement as jt, createKeyedEphemeralFlowStore as k, promisesToRacedAsyncGenerator as ki, ValidationFailure as kn, PopupErrorCode as kr, RouteTreeSegment as kt, InstrumentMethodResolvedOptions as l, JsonRpcNotificationMessage as li, StorageTrait as ln, UriRelativeString as lr, AuthRequirement as lt, RunOperationEnvironment as m, JsonRpcServerTrait as mi, createBaseTransportForStdFetch as mn, readSecuritydeptRouteMetadata as mr, PipelineRunResult as mt, TraceTimelineEntry as n, CreateJsonRpcServerOptions as ni, PERSISTENT_STORAGE_TRAIT_TOKEN as nn, takeCompatFragment as nr, REQUIREMENT_PLANNER_HOST as nt, createConsoleTracingSubscriber as o, JsonRpcId as oi, SESSION_STORAGE_TRAIT_TOKEN as on, UriReferenceStringInput as or, defaultSelectCandidate as ot, OperationSpan as p, JsonRpcServerAndClientTrait as pi, FetchTransportRedirectKind as pn, SecuritydeptRouteMetadata as pr, PipelineOutcome as pt, IdentityPrincipal as q, CompatFragment as qn, ResourceError as qr, OperationTraceEventType as qt, TraceTimelineStore as r, JsonRpcClientTrait as ri, PersistentAuthStore as rn, UriFragmentPart as rr, RequirementPlannerHost as rt, DefineInstrumentMethodDecoratorContext as s, JsonRpcMessage as si, StorageChangeEvent as sn, UriReferenceStringLike as sr, injectRequirementPlannerHost as st, isLoopbackHttpUrl as t, CreateJsonRpcServerAndClientOptions as ti, KeyedEphemeralFlowStore as tn, parseCompatFragment as tr, ProvideRequirementPlannerHostOptions as tt, InstrumentMethodThisContext as u, JsonRpcRequestEvent as ui, StoredEnvelope as un, UriSearchParamsInit as ur, AuthenticatedCheck as ut, OnceAsyncLock as v, ClientErrorEvent as vi, HttpResponseJsonBody as vn, UriRelativeStringSchema as vr, RequirementBehaviourContext as vt, OnceAsyncLockSuccess as w, createEventSubject as wi, createAuthorizationInterceptedFetch as wn, PopupAttachSuccess as wr, RequirementsComposition as wt, OnceAsyncLockInit as x, createEmptyEventStream as xi, AuthorizationInterceptedFetchPredicate as xn, PopupAttachFailure as xr, RequirementCandidateSelectionContext as xt, OnceAsyncLockCallable as y, ExtractClientErrorEvent as yi, TRANSPORT_TRAIT_TOKEN as yn, UriStringSchema as yr, RequirementBehaviourWithRouteContext as yt, DecodeJwtPayloadOptions as z, RouterNavigationIntent as zn, ResourceSnapshotUpdate as zr, ENVIRONMENT_TOKEN as zt };
+//# sourceMappingURL=index-CbeZ3AfB.d.mts.map