@securitydept/client 0.3.0-beta.2 → 0.3.0-beta.5

package/dist/create-Bm-XRA3G.mjs

@@ -0,0 +1,1573 @@
+import { A as RxEventSubject, D as RxStateSignal, F as SYMBOL_DISPOSE, G as UserRecovery, H as ClientErrorKind, M as isInteropObservableTrait, U as ClientErrorSource, V as ClientError, W as ErrorPresentationTone, h as createAsyncSchedulerWithTimestampProvider, j as SYMBOL_OBSERVABLE, k as RxEventStream } from "./rx-BoB32Dzg.mjs";
+import { v7 } from "uuid";
+import { InjectionToken, Injector, Optional, ReflectiveInjector } from "injection-js";
+import { BehaviorSubject, EMPTY, ReplaySubject, Subject, catchError, delayWhen, distinctUntilChanged, exhaustMap, filter, from, fromEventPattern, map, merge, of, shareReplay, take, takeUntil, timeout, timer } from "rxjs";
+import { type } from "arktype";
+//#region src/errors/presentation-descriptor.ts
+const DEFAULT_RECOVERY_LABELS = {
+	[UserRecovery.None]: "",
+	[UserRecovery.Retry]: "Try again",
+	[UserRecovery.RestartFlow]: "Restart flow",
+	[UserRecovery.Reauthenticate]: "Sign in again",
+	[UserRecovery.ContactSupport]: "Contact support"
+};
+const userRecoveryValues = new Set(Object.values(UserRecovery));
+const clientErrorKindValues = new Set(Object.values(ClientErrorKind));
+function readErrorPresentationDescriptor(error, options = {}) {
+	const clientError = error instanceof ClientError ? error : coerceClientErrorLike(error);
+	if (!clientError) return {
+		code: null,
+		kind: null,
+		title: options.fallbackTitle ?? "Operation failed",
+		description: options.fallbackDescription ?? "An unexpected error prevented the operation from completing.",
+		recovery: UserRecovery.None,
+		retryable: false,
+		tone: ErrorPresentationTone.Danger,
+		primaryAction: null
+	};
+	const code = clientError.presentation?.code ?? clientError.code;
+	const codePresentation = code ? options.codePresentations?.[code] : void 0;
+	const recovery = clientError.presentation?.recovery ?? codePresentation?.recovery ?? clientError.recovery;
+	const generic = readGenericPresentation(clientError.kind);
+	return {
+		code,
+		kind: clientError.kind,
+		source: clientError.source,
+		title: codePresentation?.title ?? generic.title,
+		description: clientError.presentation?.message ?? codePresentation?.description ?? generic.description,
+		recovery,
+		retryable: clientError.retryable,
+		tone: codePresentation?.tone ?? readClientErrorTone(clientError.kind, recovery),
+		primaryAction: readPrimaryAction(recovery, options)
+	};
+}
+function readGenericPresentation(kind) {
+	switch (kind) {
+		case ClientErrorKind.Unauthenticated: return {
+			title: "Authentication required",
+			description: "Sign in again to continue."
+		};
+		case ClientErrorKind.Unauthorized: return {
+			title: "Access denied",
+			description: "You do not have permission to complete this operation."
+		};
+		case ClientErrorKind.Cancelled: return {
+			title: "Operation cancelled",
+			description: "The operation was cancelled before it completed."
+		};
+		case ClientErrorKind.Timeout: return {
+			title: "Request timed out",
+			description: "The operation did not complete in time."
+		};
+		case ClientErrorKind.Configuration: return {
+			title: "Configuration error",
+			description: "The client is not configured to complete this operation."
+		};
+		case ClientErrorKind.Storage: return {
+			title: "Storage failed",
+			description: "The client could not access required stored data."
+		};
+		case ClientErrorKind.Transport: return {
+			title: "Network request failed",
+			description: "The client could not reach the service."
+		};
+		case ClientErrorKind.Server: return {
+			title: "Server request failed",
+			description: "The service could not complete the request."
+		};
+		case ClientErrorKind.Protocol: return {
+			title: "Invalid response",
+			description: "The service response did not satisfy the expected protocol."
+		};
+		case ClientErrorKind.Authorization: return {
+			title: "Authorization failed",
+			description: "The authorization flow could not be completed."
+		};
+		default: return {
+			title: "Operation failed",
+			description: "The operation could not be completed."
+		};
+	}
+}
+function readClientErrorTone(kind, recovery) {
+	if (kind === ClientErrorKind.Cancelled) return ErrorPresentationTone.Neutral;
+	if (kind === ClientErrorKind.Unauthenticated || kind === ClientErrorKind.Timeout || kind === ClientErrorKind.Transport || kind === ClientErrorKind.Server || recovery === UserRecovery.Retry || recovery === UserRecovery.RestartFlow || recovery === UserRecovery.Reauthenticate) return ErrorPresentationTone.Warning;
+	return ErrorPresentationTone.Danger;
+}
+function coerceClientErrorLike(error) {
+	if (typeof error !== "object" || error === null) return null;
+	const candidate = error;
+	if (typeof candidate.kind !== "string" || !clientErrorKindValues.has(candidate.kind)) return null;
+	return {
+		code: typeof candidate.code === "string" ? candidate.code : null,
+		kind: candidate.kind,
+		recovery: typeof candidate.recovery === "string" && userRecoveryValues.has(candidate.recovery) ? candidate.recovery : UserRecovery.None,
+		retryable: candidate.retryable === true,
+		source: typeof candidate.source === "string" ? candidate.source : void 0,
+		presentation: isErrorPresentation(candidate.presentation) ? candidate.presentation : void 0
+	};
+}
+function isErrorPresentation(value) {
+	return typeof value === "object" && value !== null && typeof value.code === "string" && typeof value.message === "string" && typeof value.recovery === "string" && userRecoveryValues.has(value.recovery);
+}
+function readPrimaryAction(recovery, options) {
+	if (recovery === UserRecovery.None) return null;
+	const label = options.recoveryLabels?.[recovery] ?? DEFAULT_RECOVERY_LABELS[recovery];
+	if (!label) return null;
+	return {
+		recovery,
+		label,
+		href: options.recoveryLinks?.[recovery] ?? null
+	};
+}
+//#endregion
+//#region src/injection/types.ts
+var SecuritydeptInjectionToken = class extends InjectionToken {};
+const SecurityDeptOptional = Optional;
+function getSecuritydeptProviderToken(provider) {
+	if (typeof provider === "function") return provider;
+	return provider.provide;
+}
+function createProviderIfTokenMissing(providedTokens, token, createProvider) {
+	return providedTokens.has(token) ? null : createProvider();
+}
+function notMissingProvider(provider) {
+	return provider !== null;
+}
+//#endregion
+//#region src/injection/injector.ts
+var SecuritydeptInjector = class SecuritydeptInjector {
+	runtimeInjector;
+	static resolveAndCreate(providers) {
+		const normalized = normalizeProviders([...providers, createInjectorSelfProvider()]);
+		return getSecuritydeptInjectorFromRuntime(ReflectiveInjector.resolveAndCreate(normalized.providers));
+	}
+	static fromParentInjector(parent, providers) {
+		const normalized = normalizeProviders([
+			{
+				provide: PARENT_INJECTOR_TOKEN,
+				useValue: parent
+			},
+			...providers,
+			createInjectorSelfProvider()
+		]);
+		return getSecuritydeptInjectorFromRuntime(ReflectiveInjector.resolveAndCreate(normalized.providers, toRuntimeInjector(parent)));
+	}
+	static fromRuntimeInjector(runtimeInjector) {
+		return new SecuritydeptInjector(runtimeInjector);
+	}
+	constructor(runtimeInjector) {
+		this.runtimeInjector = runtimeInjector;
+	}
+	get(token, notFoundValue) {
+		try {
+			if (arguments.length === 1) return this.runtimeInjector.get(token);
+			return this.runtimeInjector.get(token, notFoundValue);
+		} catch (error) {
+			throw createInjectorResolutionError(token, error);
+		}
+	}
+};
+const INJECTOR_TOKEN = new SecuritydeptInjectionToken("INJECTOR_TOKEN");
+const PARENT_INJECTOR_TOKEN = new SecuritydeptInjectionToken("PARENT_INJECTOR_TOKEN");
+function normalizeProviders(providers) {
+	return { providers: providers.map((provider) => {
+		if (typeof provider === "function") return provider;
+		if ("useValue" in provider) return {
+			provide: provider.provide,
+			useValue: provider.useValue
+		};
+		if ("useClass" in provider) return {
+			provide: provider.provide,
+			useFactory: (...deps) => new provider.useClass(...deps),
+			deps: provider.deps ? [...provider.deps] : void 0
+		};
+		if ("useExisting" in provider) return {
+			provide: provider.provide,
+			useExisting: provider.useExisting
+		};
+		return {
+			provide: provider.provide,
+			useFactory: provider.useFactory,
+			deps: provider.deps ? [...provider.deps] : void 0
+		};
+	}) };
+}
+function createInjectorSelfProvider() {
+	return {
+		provide: INJECTOR_TOKEN,
+		useFactory: (runtimeInjector) => SecuritydeptInjector.fromRuntimeInjector(runtimeInjector),
+		deps: [Injector]
+	};
+}
+function getSecuritydeptInjectorFromRuntime(runtimeInjector) {
+	return runtimeInjector.get(INJECTOR_TOKEN);
+}
+var SecuritydeptRuntimeParentAdapter = class extends Injector {
+	parent;
+	constructor(parent) {
+		super();
+		this.parent = parent;
+	}
+	get(token, notFoundValue) {
+		if (arguments.length === 1) return this.parent.get(token);
+		return this.parent.get(token, notFoundValue);
+	}
+};
+function toRuntimeInjector(parent) {
+	return new SecuritydeptRuntimeParentAdapter(parent);
+}
+function createInjectorResolutionError(token, error) {
+	const tokenLabel = describeDependencyToken(token);
+	const originalMessage = error instanceof Error ? error.message : String(error);
+	const message = /No provider/i.test(originalMessage) ? `[SecuritydeptInjector] No provider found for ${tokenLabel}.` : `[SecuritydeptInjector] Failed to resolve ${tokenLabel}: ${originalMessage}`;
+	return new Error(message, { cause: error instanceof Error ? error : void 0 });
+}
+function describeDependencyToken(token) {
+	if (token instanceof InjectionToken) return token.toString().replace(/^InjectionToken\s+/, "Token ");
+	if (typeof token === "function" && token.name) return token.name;
+	return String(token);
+}
+//#endregion
+//#region src/signals/signal.ts
+/**
+* Minimal writable signal implementation.
+* `set()` always publishes a write. Equality-based value-version suppression is
+* handled by the underlying Rx signal for computed dependency validation.
+*/
+function createSignal(initial, options) {
+	return RxStateSignal.fromInitialValue(initial, options);
+}
+/**
+* Create a read-only view of a writable signal.
+*/
+function readonlySignal(signal) {
+	return signal;
+}
+//#endregion
+//#region src/events/types.ts
+const EventStreamTraitSchema = type({ subscribe: "Function" });
+const EventSourceKind = {
+	User: "user",
+	Timer: "timer",
+	Http: "http",
+	Storage: "storage",
+	Framework: "framework",
+	System: "system"
+};
+function isEventStreamTrait(value) {
+	return typeof value === "object" && value !== null && typeof value.subscribe === "function" && isInteropObservableTrait(value);
+}
+//#endregion
+//#region src/page/index.ts
+const PageLifecycleTraitSchema = type({ resume: EventStreamTraitSchema });
+const PAGE_LIFECYCLE_TRAIT_TOKEN = new SecuritydeptInjectionToken("PAGE_LIFECYCLE_TRAIT_TOKEN");
+//#endregion
+//#region src/popup/errors.ts
+const PopupErrorCode = {
+	Blocked: "popup.blocked",
+	Closed: "popup.closed_by_user"
+};
+function readPopupErrorPresentationDescriptor(error, options = {}) {
+	return readErrorPresentationDescriptor(error, {
+		...options,
+		codePresentations: {
+			[PopupErrorCode.Blocked]: {
+				title: "Popup was blocked",
+				description: "The browser blocked the popup window. Allow popups for this site, then try again.",
+				recovery: UserRecovery.Retry,
+				tone: ErrorPresentationTone.Warning
+			},
+			[PopupErrorCode.Closed]: {
+				title: "Popup was closed",
+				description: "The popup window was closed before the operation completed. Start the flow again.",
+				recovery: UserRecovery.RestartFlow,
+				tone: ErrorPresentationTone.Warning
+			},
+			...options.codePresentations
+		}
+	});
+}
+//#endregion
+//#region src/validation/validator.ts
+function formatValidationFailure(failure) {
+	if (!failure) return null;
+	const summary = failure.issues.map((issue) => issue.path && issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+	return summary.length > 0 ? summary : null;
+}
+function throwValidationClientError(options) {
+	const issueSummary = formatValidationFailure(options.failure);
+	throw new ClientError({
+		kind: ClientErrorKind.Configuration,
+		code: options.code,
+		message: issueSummary ? `${options.messagePrefix}: ${issueSummary}.` : `${options.messagePrefix}.`,
+		recovery: UserRecovery.RestartFlow,
+		source: options.source,
+		cause: options.failure?.issues
+	});
+}
+/**
+* Validate an unknown input against a `@standard-schema`-compatible schema.
+*
+* This is the foundation-level entry point for SDK validation. It accepts
+* any schema implementing `StandardSchemaV1` and returns a discriminated
+* `ValidationResult`.
+*
+* @example
+* ```ts
+* import { validateWithSchema } from "@securitydept/client";
+* import { z } from "zod";
+*
+* const UserSchema = z.object({ name: z.string() });
+* const result = await validateWithSchema(UserSchema, { name: "Alice" });
+* if (result.success) {
+*   console.log(result.value.name);
+* } else {
+*   console.error(result.issues);
+* }
+* ```
+*/
+async function validateWithSchema(schema, input) {
+	const result = await schema["~standard"].validate(input);
+	if ("value" in result) return {
+		success: true,
+		value: result.value
+	};
+	return {
+		success: false,
+		issues: result.issues
+	};
+}
+/**
+* Validate an unknown input synchronously against a `@standard-schema`-compatible schema.
+*
+* Only use this when you know the schema's validate function returns synchronously.
+* Throws if the schema returns a Promise.
+*/
+function validateWithSchemaSync(schema, input) {
+	const result = schema["~standard"].validate(input);
+	if (result instanceof Promise) throw new Error("validateWithSchemaSync: schema returned a Promise. Use validateWithSchema instead.");
+	if ("value" in result) return {
+		success: true,
+		value: result.value
+	};
+	return {
+		success: false,
+		issues: result.issues
+	};
+}
+function validateTraitInput(options) {
+	if (options.optional === true && (options.value === void 0 || options.value === null)) return;
+	const result = validateWithSchemaSync(options.validator ?? options.bundledSchema, options.value);
+	if (result.success) return;
+	options.onInvalid(result);
+}
+//#endregion
+//#region src/protocol/json-rpc/types.ts
+const JsonRpcIdSchema = type("string | number");
+const JsonRpcErrorPayloadSchema = type({
+	code: "number",
+	message: "string",
+	data: "unknown?"
+});
+const JsonRpcRequestMessageSchema = type({
+	jsonrpc: "\"2.0\"",
+	id: JsonRpcIdSchema,
+	method: "string",
+	params: "unknown?"
+});
+const JsonRpcNotificationMessageSchema = type({
+	jsonrpc: "\"2.0\"",
+	method: "string",
+	params: "unknown?"
+});
+const JsonRpcSuccessResponseMessageSchema = type({
+	jsonrpc: "\"2.0\"",
+	id: JsonRpcIdSchema,
+	result: "unknown"
+});
+const JsonRpcErrorResponseMessageSchema = type({
+	jsonrpc: "\"2.0\"",
+	id: JsonRpcIdSchema,
+	error: JsonRpcErrorPayloadSchema
+});
+const JsonRpcMessageSchema = JsonRpcRequestMessageSchema.or(JsonRpcNotificationMessageSchema).or(JsonRpcSuccessResponseMessageSchema).or(JsonRpcErrorResponseMessageSchema);
+//#endregion
+//#region src/protocol/json-rpc/create.ts
+function createJsonRpcClient(options) {
+	return new JsonRpcClient(options);
+}
+function createJsonRpcServer(options) {
+	return new JsonRpcServer(options);
+}
+function createJsonRpcServerAndClient(options) {
+	return new JsonRpcServerAndClient(options);
+}
+var JsonRpcClient = class {
+	options;
+	onNotification;
+	notificationSubject = new RxEventSubject();
+	pendingRequests = /* @__PURE__ */ new Map();
+	disposed = false;
+	nextRequestId = 1;
+	constructor(options) {
+		this.options = options;
+		this.onNotification = this.notificationSubject;
+	}
+	request(method, params, requestOptions = {}) {
+		if (this.disposed) return Promise.reject(createJsonRpcDisposedError("client"));
+		const id = this.nextRequestId++;
+		const timeoutMs = requestOptions.timeoutMs ?? this.options.defaultRequestTimeoutMs;
+		return new Promise((resolve, reject) => {
+			const pendingRequest = {
+				method,
+				reject,
+				resolve
+			};
+			if (timeoutMs !== void 0) pendingRequest.timeoutHandle = this.options.time.setTimeout(() => {
+				this.pendingRequests.delete(id);
+				reject(/* @__PURE__ */ new Error(`JSON-RPC request timed out for ${method}.`));
+			}, timeoutMs);
+			this.pendingRequests.set(id, pendingRequest);
+			try {
+				this.options.send({
+					jsonrpc: "2.0",
+					id,
+					method,
+					params
+				});
+			} catch (error) {
+				this.clearPendingRequest(id);
+				reject(error);
+			}
+		});
+	}
+	notify(method, params) {
+		if (this.disposed) return;
+		this.options.send({
+			jsonrpc: "2.0",
+			method,
+			params
+		});
+	}
+	receive(message) {
+		if (this.disposed) return;
+		for (const parsedMessage of parseIncomingMessages(message)) {
+			if (isJsonRpcResponseMessage(parsedMessage)) {
+				this.resolvePendingRequest(parsedMessage);
+				continue;
+			}
+			if (isJsonRpcNotificationMessage(parsedMessage)) this.notificationSubject.next({
+				method: parsedMessage.method,
+				params: parsedMessage.params
+			});
+		}
+	}
+	rejectAllPendingRequests(reason) {
+		for (const [id, pendingRequest] of this.pendingRequests) {
+			this.clearPendingRequest(id);
+			pendingRequest.reject(reason);
+		}
+	}
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		this.rejectAllPendingRequests(/* @__PURE__ */ new Error("JSON-RPC client disposed."));
+		this.notificationSubject.complete();
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+	resolvePendingRequest(message) {
+		const pendingRequest = this.pendingRequests.get(message.id);
+		if (!pendingRequest) return;
+		this.clearPendingRequest(message.id);
+		if ("error" in message) {
+			pendingRequest.reject(/* @__PURE__ */ new Error(`JSON-RPC request failed for ${pendingRequest.method}: ${message.error.message}`));
+			return;
+		}
+		pendingRequest.resolve(message.result);
+	}
+	clearPendingRequest(id) {
+		const pendingRequest = this.pendingRequests.get(id);
+		if (!pendingRequest) return;
+		if (pendingRequest.timeoutHandle !== void 0) this.options.time.clearTimeout(pendingRequest.timeoutHandle);
+		this.pendingRequests.delete(id);
+	}
+};
+var JsonRpcServer = class {
+	options;
+	onRequest;
+	onNotification;
+	requestSubject = new RxEventSubject();
+	notificationSubject = new RxEventSubject();
+	disposed = false;
+	constructor(options) {
+		this.options = options;
+		this.onRequest = this.requestSubject;
+		this.onNotification = this.notificationSubject;
+	}
+	notify(method, params) {
+		if (this.disposed) return;
+		this.options.send({
+			jsonrpc: "2.0",
+			method,
+			params
+		});
+	}
+	receive(message) {
+		if (this.disposed) return;
+		for (const parsedMessage of parseIncomingMessages(message)) {
+			if (isJsonRpcRequestMessage(parsedMessage)) {
+				this.requestSubject.next({
+					id: parsedMessage.id,
+					method: parsedMessage.method,
+					params: parsedMessage.params
+				});
+				continue;
+			}
+			if (isJsonRpcNotificationMessage(parsedMessage)) this.notificationSubject.next({
+				method: parsedMessage.method,
+				params: parsedMessage.params
+			});
+		}
+	}
+	respondSuccess(id, result) {
+		if (this.disposed) return;
+		this.options.send({
+			jsonrpc: "2.0",
+			id,
+			result
+		});
+	}
+	respondError(id, error) {
+		if (this.disposed) return;
+		this.options.send({
+			jsonrpc: "2.0",
+			id,
+			error
+		});
+	}
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		this.requestSubject.complete();
+		this.notificationSubject.complete();
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+};
+var JsonRpcServerAndClient = class {
+	onNotification;
+	onRequest;
+	client;
+	server;
+	disposed = false;
+	constructor(options) {
+		this.client = new JsonRpcClient(options);
+		this.server = new JsonRpcServer(options);
+		this.onNotification = this.server.onNotification;
+		this.onRequest = this.server.onRequest;
+	}
+	request(method, params, options) {
+		return this.client.request(method, params, options);
+	}
+	notify(method, params) {
+		this.client.notify(method, params);
+	}
+	receive(message) {
+		for (const parsedMessage of parseIncomingMessages(message)) {
+			if (isJsonRpcResponseMessage(parsedMessage)) {
+				this.client.receive(parsedMessage);
+				continue;
+			}
+			this.server.receive(parsedMessage);
+		}
+	}
+	rejectAllPendingRequests(reason) {
+		this.client.rejectAllPendingRequests(reason);
+	}
+	respondSuccess(id, result) {
+		this.server.respondSuccess(id, result);
+	}
+	respondError(id, error) {
+		this.server.respondError(id, error);
+	}
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		this.client.dispose();
+		this.server.dispose();
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+};
+function parseIncomingMessages(message) {
+	if (!Array.isArray(message)) return parseJsonRpcMessage(message);
+	const parsedMessages = [];
+	for (const entry of message) parsedMessages.push(...parseJsonRpcMessage(entry));
+	return parsedMessages;
+}
+function parseJsonRpcMessage(message) {
+	const result = validateWithSchemaSync(JsonRpcMessageSchema, message);
+	return result.success ? [result.value] : [];
+}
+function isJsonRpcRequestMessage(message) {
+	return "method" in message && "id" in message;
+}
+function isJsonRpcResponseMessage(message) {
+	return "id" in message && !("method" in message);
+}
+function isJsonRpcNotificationMessage(message) {
+	return "method" in message && !("id" in message);
+}
+function createJsonRpcDisposedError(role) {
+	return /* @__PURE__ */ new Error(`JSON-RPC ${role} disposed.`);
+}
+//#endregion
+//#region src/popup/session.ts
+const PopupSessionControlMethod = {
+	Ready: "securitydept.popup.session.ready",
+	Ping: "securitydept.popup.session.ping",
+	Pong: "securitydept.popup.session.pong"
+};
+const DEFAULT_READY_TIMEOUT_MS = 1e4;
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 5e3;
+const DEFAULT_HEARTBEAT_TIMEOUT_MS = 15e3;
+var PopupClientSession = class {
+	failure = createSignal(null);
+	isActive = createSignal(false);
+	init$ = new ReplaySubject();
+	destroyed = createSignal(false);
+	destroyed$ = from(this.destroyed).pipe(distinctUntilChanged(), filter(Boolean), shareReplay(1));
+	constructor(options) {
+		const timestampScheduler = createAsyncSchedulerWithTimestampProvider(options.time);
+		const ready$ = new Subject();
+		const pong$ = new Subject();
+		const closed$ = from(options.closedStream).pipe(filter(Boolean));
+		const ping$ = merge(ready$.pipe(filter(Boolean)), pong$.pipe(filter(Boolean))).pipe(delayWhen(() => timer(options.heartbeatIntervalMs ?? DEFAULT_HEARTBEAT_INTERVAL_MS, timestampScheduler)));
+		from(this.init$).pipe(exhaustMap(() => from(options.jsonRpc.onNotification).pipe(filter(function isReadyNotification(event) {
+			return event.method === PopupSessionControlMethod.Ready;
+		}), take(1), timeout({
+			each: options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,
+			scheduler: timestampScheduler
+		}), map(() => true), catchError(() => of(false)))), takeUntil(this.destroyed$)).subscribe(ready$);
+		ping$.pipe(exhaustMap(() => from(options.jsonRpc.onNotification).pipe(filter(function isPongNotification(event) {
+			return event.method === PopupSessionControlMethod.Pong;
+		}), take(1), timeout({
+			first: options.heartbeatTimeoutMs ?? DEFAULT_HEARTBEAT_TIMEOUT_MS,
+			scheduler: timestampScheduler
+		}), map(() => true), catchError(() => of(false)))), takeUntil(this.destroyed$)).subscribe(pong$);
+		merge(closed$.pipe(map(() => new ClientError({
+			kind: ClientErrorKind.Authorization,
+			code: PopupErrorCode.Closed,
+			message: "Popup window was closed before completing the login flow.",
+			recovery: UserRecovery.RestartFlow,
+			source: "popup"
+		}))), ready$.pipe(map((success) => !success ? new ClientError({
+			kind: ClientErrorKind.Protocol,
+			message: "Did not receive ready notification from popup within the expected time.",
+			recovery: UserRecovery.RestartFlow,
+			source: "popup"
+		}) : null)), pong$.pipe(map((success) => !success ? new ClientError({
+			kind: ClientErrorKind.Protocol,
+			message: "Did not receive pong notification from popup within the expected time.",
+			recovery: UserRecovery.RestartFlow,
+			source: "popup"
+		}) : null))).pipe(takeUntil(this.destroyed$), shareReplay({
+			bufferSize: 1,
+			refCount: false
+		})).subscribe((error) => this.failure.set(error));
+		merge(closed$.pipe(map(() => false)), ready$.pipe(map(Boolean)), pong$.pipe(map(Boolean))).pipe(takeUntil(this.destroyed$)).subscribe((nextIsActive) => {
+			this.isActive.set(nextIsActive);
+		});
+	}
+	init() {
+		this.init$.next(true);
+	}
+	dispose() {
+		this.destroyed.set(true);
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+};
+var PopupServerSession = class {
+	init$ = new ReplaySubject();
+	destroyed$$ = new BehaviorSubject(false);
+	destroyed$ = this.destroyed$$.pipe(distinctUntilChanged(), filter(Boolean), shareReplay(1));
+	constructor(options) {
+		const ready$ = from(this.init$);
+		const pong$ = from(options.jsonRpc.onNotification).pipe(filter(function isPing(event) {
+			return event.method === PopupSessionControlMethod.Ping;
+		}));
+		merge(ready$.pipe(map(function createReadyNotify() {
+			return { method: PopupSessionControlMethod.Ready };
+		})), pong$.pipe(map(function createPongNotify() {
+			return { method: PopupSessionControlMethod.Pong };
+		}))).pipe(takeUntil(this.destroyed$)).subscribe((event) => {
+			options.jsonRpc.notify(event.method, event.params);
+		});
+	}
+	init() {
+		this.init$.next(true);
+	}
+	dispose() {
+		this.destroyed$$.next(true);
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+};
+//#endregion
+//#region src/popup/handle.ts
+/**
+* popup opener
+*/
+var PopupClientWindowHandle = class {
+	messaging;
+	disposed = false;
+	jsonRpc;
+	session;
+	incomingSubscription;
+	closePopup;
+	constructor(options) {
+		this.messaging = options.messaging;
+		this.closePopup = options.close;
+		this.jsonRpc = createJsonRpcClient({
+			send: (message) => {
+				options.messaging.outgoing.next(message);
+			},
+			time: options.time
+		});
+		this.session = new PopupClientSession({
+			jsonRpc: this.jsonRpc,
+			time: options.time,
+			closedStream: options.closedStream
+		});
+		this.incomingSubscription = options.messaging.incoming.subscribe({ next: (message) => {
+			this.jsonRpc.receive(message);
+		} });
+		this.session.init();
+	}
+	get onNotification() {
+		return this.jsonRpc.onNotification;
+	}
+	get failure() {
+		return this.session.failure;
+	}
+	get isActive() {
+		return this.session.isActive;
+	}
+	async notify(method, params) {
+		this.jsonRpc.notify(method, params);
+	}
+	request(method, params, options) {
+		return this.jsonRpc.request(method, params, options);
+	}
+	close() {
+		this.closePopup();
+	}
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		this.session.dispose();
+		this.jsonRpc.dispose();
+		this.incomingSubscription.unsubscribe();
+		this.messaging.outgoing.complete();
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+};
+/**
+* popup target
+*/
+var PopupServerWindowHandle = class {
+	messaging;
+	disposed = false;
+	jsonRpc;
+	session;
+	incomingSubscription;
+	closePopup;
+	constructor(options) {
+		this.messaging = options.messaging;
+		this.closePopup = options.close;
+		this.jsonRpc = createJsonRpcServer({ send: (message) => {
+			options.messaging.outgoing.next(message);
+		} });
+		this.session = new PopupServerSession({ jsonRpc: this.jsonRpc });
+		this.incomingSubscription = options.messaging.incoming.subscribe({ next: (message) => {
+			this.jsonRpc.receive(message);
+		} });
+		this.session.init();
+	}
+	get onNotification() {
+		return this.jsonRpc.onNotification;
+	}
+	get onRequest() {
+		return this.jsonRpc.onRequest;
+	}
+	notify(method, params) {
+		this.jsonRpc.notify(method, params);
+		return Promise.resolve();
+	}
+	close() {
+		this.closePopup();
+	}
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		this.session.dispose();
+		this.jsonRpc.dispose();
+		this.incomingSubscription.unsubscribe();
+		this.messaging.outgoing.complete();
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+};
+//#endregion
+//#region src/popup/index.ts
+const PopupAttachFailureReason = {
+	MissingOpener: "missing_opener",
+	MissingOrigin: "missing_origin"
+};
+const PopupTraitSchema = type({
+	open: "Function",
+	attach: "Function"
+});
+const POPUP_TRAIT_TOKEN = new SecuritydeptInjectionToken("POPUP_TRAIT_TOKEN");
+//#endregion
+//#region src/protocol/compat-fragment.ts
+const SECURITYDEPT_COMPAT_FRAGMENT_VERSION = "v1";
+function appendOrReplaceCompatFragment(input, options, update) {
+	const blocks = splitFragmentBlocks(readUriFragmentHash(input));
+	if (isCompatFragmentBlock(blocks.at(-1) ?? "")) blocks.pop();
+	blocks.push(buildCompatFragmentBlock(options));
+	const fragment = joinFragmentBlocks(blocks);
+	return {
+		fragment,
+		url: update(input, fragment)
+	};
+}
+function parseCompatFragment(input) {
+	const block = splitFragmentBlocks(readUriFragmentHash(input)).at(-1);
+	if (!block || !isCompatFragmentBlock(block)) return null;
+	const blockParameters = new URLSearchParams(block);
+	blockParameters.delete("securitydept");
+	const parameters = {};
+	blockParameters.forEach((value, key) => {
+		parameters[key] = value;
+	});
+	return {
+		payload: blockParameters.toString(),
+		parameters
+	};
+}
+function takeCompatFragment(input, options) {
+	const currentFragment = readUriFragmentHash(input);
+	const blocks = splitFragmentBlocks(currentFragment);
+	const block = blocks.at(-1);
+	if (!block || !isCompatFragmentBlock(block)) return {
+		compatFragment: null,
+		fragment: currentFragment,
+		url: input
+	};
+	const compatFragment = parseCompatFragment(block);
+	if (!compatFragment || options.condition && !options.condition(compatFragment)) return {
+		compatFragment: null,
+		fragment: currentFragment,
+		url: input
+	};
+	blocks.pop();
+	const fragment = joinFragmentBlocks(blocks);
+	return {
+		compatFragment,
+		fragment,
+		url: options.update(input, fragment)
+	};
+}
+function isCompatFragmentBlock(block) {
+	return new URLSearchParams(block.startsWith("#") ? block.slice(1) : block).get("securitydept") === "v1";
+}
+function readUriFragmentHash(input) {
+	if (typeof input === "string") return input.startsWith("#") ? input : `#${input}`;
+	return input.hash;
+}
+function joinFragmentBlocks(blocks) {
+	return blocks.length > 0 ? `#${blocks.join("#")}` : "";
+}
+function splitFragmentBlocks(fragment) {
+	if (fragment === "#") return [""];
+	const normalized = fragment.startsWith("#") ? fragment.slice(1) : fragment;
+	return normalized ? normalized.split("#") : [];
+}
+function buildCompatFragmentBlock(options) {
+	const block = new URLSearchParams();
+	block.set("securitydept", "v1");
+	const payload = typeof options.payload === "string" ? new URLSearchParams(options.payload.startsWith("#") ? options.payload.slice(1) : options.payload) : new URLSearchParams(options.payload);
+	for (const [key, value] of payload) if (key !== "securitydept") block.append(key, value);
+	return block.toString();
+}
+//#endregion
+//#region src/router/router.ts
+const RouterNavigationIntent = {
+	AuthRedirect: "auth_redirect",
+	PostAuthRedirect: "post_auth_redirect",
+	CallbackCleanup: "callback_cleanup",
+	ExternalOpen: "external_open"
+};
+const RouterNavigationMode = {
+	Push: "push",
+	Replace: "replace",
+	External: "external"
+};
+async function takeCompatFragmentFromRouter(router, options = {}) {
+	const currentUrl = router.currentUrl();
+	if (!currentUrl) return null;
+	const { compatFragment, url: cleanedUrl } = takeCompatFragment(currentUrl, {
+		condition: options.condition,
+		update: (ref, hash) => ref.setHash(hash)
+	});
+	if (!compatFragment) return null;
+	await router.navigate({
+		url: cleanedUrl,
+		intent: RouterNavigationIntent.CallbackCleanup,
+		mode: RouterNavigationMode.Replace
+	});
+	return compatFragment;
+}
+const RouterTraitSchema = type({
+	currentUrl: "Function",
+	navigate: "Function"
+});
+const ROUTER_TRAIT_TOKEN = new SecuritydeptInjectionToken("ROUTER_TRAIT_TOKEN");
+//#endregion
+//#region src/scheduling/types.ts
+const TimeTraitSchema = type({
+	now: "Function",
+	setTimeout: "Function",
+	clearTimeout: "Function"
+});
+const TIME_TRAIT_TOKEN = new SecuritydeptInjectionToken("TIME_TRAIT_TOKEN");
+const IDLE_CALLBACK_TRAIT_TOKEN = new SecuritydeptInjectionToken("IDLE_CALLBACK_TRAIT_TOKEN");
+const IdleCallbackTraitSchema = type({
+	requestIdleCallback: "Function",
+	cancelIdleCallback: "Function"
+});
+//#endregion
+//#region src/span/types.ts
+const SpanCreateOptionsSchema = type({
+	idFactory: "Function",
+	attributes: "object"
+});
+const SpanTraitSchema = type({
+	id: "string",
+	fork: "Function",
+	attributes: "object"
+});
+const SPAN_TRAIT_TOKEN = new SecuritydeptInjectionToken("SPAN_TRAIT_TOKEN");
+//#endregion
+//#region src/span/span.ts
+function createDefaultSpanId() {
+	return `span_${v7()}`;
+}
+var DefaultSpan = class DefaultSpan {
+	id;
+	parent;
+	_attributes;
+	_idFactory;
+	get attributes() {
+		return this._attributes;
+	}
+	constructor(parent, idFactory, attributes) {
+		this._idFactory = idFactory;
+		this.id = idFactory();
+		this.parent = parent;
+		this._attributes = attributes;
+	}
+	static root(options = {}) {
+		return new DefaultSpan(void 0, options.idFactory ?? createDefaultSpanId, Object.freeze({ ...options.attributes ?? {} }));
+	}
+	fork(options = {}) {
+		return new DefaultSpan(this, options.idFactory ?? this._idFactory, Object.freeze({ ...options.attributes }));
+	}
+	setAttributes(attributes) {
+		this._attributes = Object.freeze({
+			...this._attributes,
+			...attributes
+		});
+	}
+};
+function createRootSpan(options = {}) {
+	const { validators, ...resolvedOptions } = options;
+	const resolvedCreateOptions = {
+		idFactory: resolvedOptions.idFactory ?? createDefaultSpanId,
+		attributes: resolvedOptions.attributes ?? {}
+	};
+	validateTraitInput({
+		value: resolvedCreateOptions,
+		bundledSchema: SpanCreateOptionsSchema,
+		validator: validators,
+		onInvalid: (failure) => throwValidationClientError({
+			code: "span.invalid_options",
+			source: "span",
+			messagePrefix: "createRootSpan could not validate spanCreateOptions",
+			failure
+		})
+	});
+	return DefaultSpan.root(resolvedCreateOptions);
+}
+//#endregion
+//#region src/std/events/from-abort.ts
+/**
+* Adapt an `AbortSignal`-like source into an event stream of abort reasons.
+*/
+function abortSignalToEventStream(signal) {
+	return RxEventStream.fromObservableInput(merge(signal.aborted ? of(signal.reason) : EMPTY, fromEventPattern((handler) => {
+		signal.addEventListener?.("abort", handler);
+	}, (handler) => {
+		signal.removeEventListener?.("abort", handler);
+	}).pipe(map(() => signal.reason))));
+}
+//#endregion
+//#region src/std/cancellation/abort-signal.ts
+function abortSignalToCancellationToken(signal) {
+	if (!signal) return;
+	return {
+		get isCancellationRequested() {
+			return signal.aborted;
+		},
+		get reason() {
+			return signal.reason;
+		},
+		get cancellationError() {
+			return signal.aborted ? new ClientError({
+				kind: ClientErrorKind.Cancelled,
+				message: "Request was cancelled via AbortSignal",
+				code: "client.cancelled",
+				source: ClientErrorSource.Transport,
+				cause: signal.reason
+			}) : void 0;
+		},
+		onCancellationRequested(listener) {
+			const subscription = abortSignalToEventStream(signal).subscribe({ next: (reason) => listener({
+				reason,
+				cancellationError: new ClientError({
+					kind: ClientErrorKind.Cancelled,
+					message: "Request was cancelled via AbortSignal",
+					code: "client.cancelled",
+					source: ClientErrorSource.Transport,
+					cause: reason
+				})
+			}) });
+			return {
+				dispose() {
+					subscription.unsubscribe();
+				},
+				[SYMBOL_DISPOSE]: () => {
+					subscription.unsubscribe();
+				}
+			};
+		},
+		[SYMBOL_OBSERVABLE]() {
+			return from(abortSignalToEventStream(signal)).pipe(map((reason) => ({
+				reason,
+				cancellationError: new ClientError({
+					kind: ClientErrorKind.Cancelled,
+					message: "Request was cancelled via AbortSignal",
+					code: "client.cancelled",
+					source: ClientErrorSource.Transport,
+					cause: reason
+				})
+			})));
+		},
+		throwIfCancellationRequested() {
+			if (signal.aborted) throw new ClientError({
+				kind: ClientErrorKind.Cancelled,
+				message: "Request was cancelled via AbortSignal",
+				code: "client.cancelled",
+				source: ClientErrorSource.Transport,
+				cause: signal.reason
+			});
+		}
+	};
+}
+function cancellationTokenToAbortSignal(token) {
+	if (!token) return;
+	const controller = new AbortController();
+	if (token.isCancellationRequested) controller.abort(token.reason);
+	let subscription = token.onCancellationRequested(({ reason }) => {
+		controller.abort(reason);
+	});
+	const dispose = () => {
+		if (subscription) {
+			subscription.dispose();
+			subscription = null;
+		}
+	};
+	return {
+		signal: controller.signal,
+		dispose,
+		[SYMBOL_DISPOSE]: dispose
+	};
+}
+function normalizeAbortError(token, error) {
+	if (!isAbortError(error) && !token?.isCancellationRequested) return error;
+	if (token?.cancellationError) return token.cancellationError;
+	return new ClientError({
+		kind: ClientErrorKind.Cancelled,
+		message: "HTTP request was cancelled",
+		code: "client.cancelled",
+		source: ClientErrorSource.Transport,
+		cause: token?.reason ?? error
+	});
+}
+function isAbortError(error) {
+	return typeof error === "object" && error !== null && "name" in error && error.name === "AbortError";
+}
+const TimeForStdCreateOptionsSchema = type({ host: type({
+	Date: type({ now: "Function" }),
+	setTimeout: "Function",
+	clearTimeout: "Function"
+}) });
+function createTimeForStd(options = {}) {
+	const { validators, ...createOptions } = options;
+	const resolvedCreateOptions = { host: createOptions.host ?? globalThis };
+	validateTraitInput({
+		value: resolvedCreateOptions,
+		bundledSchema: TimeForStdCreateOptionsSchema,
+		validator: validators,
+		onInvalid: (failure) => throwValidationClientError({
+			code: "time.invalid_std_options",
+			source: "time",
+			messagePrefix: "createTimeForStd could not validate timeForStdCreateOptions",
+			failure
+		})
+	});
+	const host = resolvedCreateOptions.host;
+	return {
+		now: () => host.Date.now(),
+		setTimeout: (handler, delayMs) => host.setTimeout(handler, delayMs),
+		clearTimeout: (handle) => host.clearTimeout(handle)
+	};
+}
+//#endregion
+//#region src/transport/types.ts
+const TransportErrorCode = {
+	RequestFailed: "transport.request_failed",
+	ResponseDecodeFailed: "transport.response_decode_failed",
+	InvalidStdFetchOptions: "transport.invalid_std_fetch_options",
+	InvalidAngularOptions: "transport.invalid_angular_options"
+};
+const BaseTransportTraitSchema = type({ execute: "Function" });
+const TRANSPORT_TRAIT_TOKEN = new SecuritydeptInjectionToken("TRANSPORT_TRAIT_TOKEN");
+//#endregion
+//#region src/std/transport/base-transport.ts
+const FetchTransportRedirectKind = {
+	Follow: "follow",
+	Manual: "manual"
+};
+const BaseTransportForStdFetchCreateOptionsSchema = type({
+	redirect: "\"follow\" | \"manual\"",
+	fetch: "Function",
+	baseUrl: "unknown"
+});
+/**
+* Default `BaseTransportTrait` backed by the global `fetch` API.
+*
+* The caller is responsible for ensuring `fetch` is available in the runtime.
+* No polyfill is injected.
+*/
+function createBaseTransportForStdFetch(options = {}) {
+	const { validators, ...createOptions } = options;
+	const resolvedCreateOptions = {
+		redirect: createOptions.redirect ?? FetchTransportRedirectKind.Manual,
+		fetch: createOptions.fetch ?? fetch,
+		baseUrl: createOptions.baseUrl
+	};
+	validateTraitInput({
+		value: resolvedCreateOptions,
+		bundledSchema: BaseTransportForStdFetchCreateOptionsSchema,
+		validator: validators,
+		onInvalid: (failure) => throwValidationClientError({
+			code: TransportErrorCode.InvalidStdFetchOptions,
+			source: "transport",
+			messagePrefix: "createBaseTransportForStdFetch could not validate transportForStdFetchCreateOptions",
+			failure
+		})
+	});
+	const redirect = resolvedCreateOptions.redirect;
+	const fetchImpl = resolvedCreateOptions.fetch;
+	const baseUrl = resolvedCreateOptions.baseUrl;
+	return { async execute(request) {
+		const requestUrl = baseUrl ? new URL(request.url, baseUrl).toString() : request.url;
+		const abortBridge = cancellationTokenToAbortSignal(request.cancellationToken);
+		const init = {
+			method: request.method,
+			headers: request.headers,
+			redirect,
+			signal: abortBridge?.signal
+		};
+		if (request.body !== void 0 && request.method !== "GET" && request.method !== "HEAD") init.body = typeof request.body === "string" ? request.body : JSON.stringify(request.body);
+		try {
+			let res;
+			try {
+				res = await fetchImpl(requestUrl, init);
+			} catch (error) {
+				const normalized = normalizeAbortError(request.cancellationToken, error);
+				if (normalized instanceof ClientError) throw normalized;
+				throw new ClientError({
+					kind: ClientErrorKind.Transport,
+					message: "The HTTP request could not reach the remote service",
+					code: TransportErrorCode.RequestFailed,
+					source: ClientErrorSource.Transport,
+					retryable: true,
+					cause: error
+				});
+			}
+			const responseHeaders = {};
+			res.headers.forEach((value, key) => {
+				responseHeaders[key] = value;
+			});
+			let body;
+			try {
+				if (res.headers.get("content-type")?.includes("application/json")) body = await res.json();
+				else if (res.status !== 302 && res.status !== 303 && res.status !== 301) body = await res.text();
+			} catch (error) {
+				throw new ClientError({
+					kind: ClientErrorKind.Protocol,
+					message: "The HTTP response body could not be decoded",
+					code: TransportErrorCode.ResponseDecodeFailed,
+					source: ClientErrorSource.Transport,
+					cause: error
+				});
+			}
+			return {
+				status: res.status,
+				headers: responseHeaders,
+				body
+			};
+		} finally {
+			abortBridge?.dispose();
+		}
+	} };
+}
+//#endregion
+//#region src/storage/types.ts
+const StorageChangeEventOrigin = {
+	Local: "local",
+	External: "external"
+};
+const StorageTraitSchema = type({
+	"storageEvent?": { subscribe: "Function" },
+	get: "Function",
+	set: "Function",
+	take: "Function?",
+	remove: "Function"
+});
+const REALM_STORAGE_TRAIT_TOKEN = new SecuritydeptInjectionToken("REALM_STORAGE_TRAIT_TOKEN");
+const PERSISTENT_STORAGE_TRAIT_TOKEN = new SecuritydeptInjectionToken("PERSISTENT_STORAGE_TRAIT_TOKEN");
+const SESSION_STORAGE_TRAIT_TOKEN = new SecuritydeptInjectionToken("SESSION_STORAGE_TRAIT_TOKEN");
+//#endregion
+//#region src/storage/memory-store.ts
+/** In-memory `SyncStorageTrait` — useful for realm state, tests, and SSR. */
+function createInMemoryRecordStore() {
+	const store = /* @__PURE__ */ new Map();
+	const storageEvent = new RxEventSubject();
+	return {
+		storageEvent,
+		get(key) {
+			return store.get(key) ?? null;
+		},
+		set(key, value) {
+			const oldValue = store.get(key) ?? null;
+			store.set(key, value);
+			storageEvent.next({
+				origin: StorageChangeEventOrigin.Local,
+				key,
+				oldValue,
+				newValue: value
+			});
+		},
+		take(key) {
+			const value = store.get(key) ?? null;
+			if (value !== null) {
+				store.delete(key);
+				storageEvent.next({
+					origin: StorageChangeEventOrigin.Local,
+					key,
+					oldValue: value,
+					newValue: null
+				});
+			}
+			return value;
+		},
+		remove(key) {
+			const oldValue = store.get(key) ?? null;
+			if (oldValue !== null) {
+				store.delete(key);
+				storageEvent.next({
+					origin: StorageChangeEventOrigin.Local,
+					key,
+					oldValue,
+					newValue: null
+				});
+			}
+		}
+	};
+}
+//#endregion
+//#region src/tracing/create.ts
+const TracingCreateOptionsSchema = type({ subscribers: type({ record: "Function" }).array() });
+function createTracing(options) {
+	const { validators, ...resolvedOptions } = options ?? {};
+	const resolvedCreateOptions = { subscribers: resolvedOptions.subscribers ?? [] };
+	validateTraitInput({
+		value: resolvedCreateOptions,
+		bundledSchema: TracingCreateOptionsSchema,
+		validator: validators,
+		onInvalid: (failure) => throwValidationClientError({
+			code: "tracing.invalid_options",
+			source: "tracing",
+			messagePrefix: "createTracing could not validate tracingCreateOptions",
+			failure
+		})
+	});
+	const subject = new RxEventSubject();
+	const events = subject;
+	const subscriptions = [];
+	for (const subscriber of resolvedCreateOptions.subscribers) subscriptions.push(events.subscribe({ next(event) {
+		subscriber.record(event);
+	} }));
+	return {
+		record(event) {
+			subject.next(event);
+		},
+		events,
+		dispose() {
+			for (const subscription of subscriptions.splice(0)) subscription.unsubscribe();
+		},
+		[SYMBOL_DISPOSE]() {
+			this.dispose();
+		}
+	};
+}
+//#endregion
+//#region src/tracing/types.ts
+const TracingLevel = {
+	Debug: "debug",
+	Info: "info",
+	Warn: "warn",
+	Error: "error"
+};
+const OperationTraceEventType = {
+	Started: "operation.started",
+	Event: "operation.event",
+	Error: "operation.error",
+	Ended: "operation.ended"
+};
+const TracingTraitSchema = type({
+	record: "Function",
+	dispose: "Function",
+	events: EventStreamTraitSchema
+});
+const TRACING_TRAIT_TOKEN = new SecuritydeptInjectionToken("TRACING_TRAIT_TOKEN");
+//#endregion
+//#region src/environment/types.ts
+const ENVIRONMENT_TOKEN = new SecuritydeptInjectionToken("ENVIRONMENT_TOKEN");
+//#endregion
+//#region src/environment/create.ts
+/**
+* Create a `FoundationEnvironment` from explicit trait units and defaults.
+*
+* This helper owns foundation-wide baseline resolution and trait-graph wiring.
+*
+* It may resolve:
+*   - public std adapters such as
+*     `transportForStdFetchCreateOptions -> transport` and `timeForStdCreateOptions -> time`
+*   - public hostless baseline constructors such as
+*     `spanCreateOptions -> span` and `tracingCreateOptions -> tracing`
+*
+* Host-material discovery such as resolving `window`, `location`, `history`,
+* or browser storage handles belongs to explicit host adapters such as
+* `@securitydept/client/web`, which must first resolve those inputs into
+* concrete traits before calling this helper.
+*/
+function createFoundationEnvironment(overrides) {
+	const providers = overrides.providers ?? [];
+	const externalProviderTokens = new Set(providers.map((provider) => getSecuritydeptProviderToken(provider)));
+	if (externalProviderTokens.has(ENVIRONMENT_TOKEN)) throwValidationClientError({
+		code: "environment.foundation_provider_reserved",
+		source: "environment",
+		messagePrefix: "createFoundationEnvironment does not allow overriding ENVIRONMENT_TOKEN"
+	});
+	return SecuritydeptInjector.resolveAndCreate([
+		...createBuiltInTraitUnits(overrides, externalProviderTokens),
+		...providers,
+		createFoundationEnvironmentUnit()
+	]).get(ENVIRONMENT_TOKEN);
+}
+function createBuiltInTraitUnits(overrides, externalProviderTokens) {
+	return [
+		createProviderIfTokenMissing(externalProviderTokens, TRANSPORT_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: TRANSPORT_TRAIT_TOKEN,
+			traitName: "transport",
+			bundledSchema: BaseTransportTraitSchema,
+			validator: overrides.validators?.transport,
+			createValue: () => overrides.transport ?? createBaseTransportForStdFetch({
+				...overrides.transportForStdFetchCreateOptions,
+				validators: overrides.validators?.transportForStdFetchCreateOptions
+			})
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, TIME_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: TIME_TRAIT_TOKEN,
+			traitName: "time",
+			bundledSchema: TimeTraitSchema,
+			validator: overrides.validators?.time,
+			createValue: () => overrides.time ?? createTimeForStd({
+				...overrides.timeForStdCreateOptions,
+				validators: overrides.validators?.timeForStdCreateOptions
+			})
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, REALM_STORAGE_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: REALM_STORAGE_TRAIT_TOKEN,
+			traitName: "realmStorage",
+			bundledSchema: StorageTraitSchema,
+			validator: overrides.validators?.realmStorage,
+			createValue: () => overrides.realmStorage ?? createInMemoryRecordStore()
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, SPAN_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: SPAN_TRAIT_TOKEN,
+			traitName: "span",
+			bundledSchema: SpanTraitSchema,
+			validator: overrides.validators?.span,
+			createValue: () => overrides.span ?? createRootSpan({
+				...overrides.spanCreateOptions,
+				validators: overrides.validators?.spanCreateOptions
+			})
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, TRACING_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: TRACING_TRAIT_TOKEN,
+			traitName: "tracing",
+			bundledSchema: TracingTraitSchema,
+			validator: overrides.validators?.tracing,
+			createValue: () => overrides.tracing ?? createTracing({
+				...overrides.tracingCreateOptions,
+				validators: overrides.validators?.tracingCreateOptions
+			})
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, IDLE_CALLBACK_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: IDLE_CALLBACK_TRAIT_TOKEN,
+			traitName: "idleCallback",
+			bundledSchema: IdleCallbackTraitSchema,
+			validator: overrides.validators?.idleCallback,
+			optional: true,
+			createValue: () => overrides.idleCallback ?? null
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, PERSISTENT_STORAGE_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: PERSISTENT_STORAGE_TRAIT_TOKEN,
+			traitName: "persistentStorage",
+			bundledSchema: StorageTraitSchema,
+			validator: overrides.validators?.persistentStorage,
+			optional: true,
+			createValue: () => overrides.persistentStorage ?? null
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, SESSION_STORAGE_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: SESSION_STORAGE_TRAIT_TOKEN,
+			traitName: "sessionStorage",
+			bundledSchema: StorageTraitSchema,
+			validator: overrides.validators?.sessionStorage,
+			optional: true,
+			createValue: () => overrides.sessionStorage ?? null
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, ROUTER_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: ROUTER_TRAIT_TOKEN,
+			traitName: "router",
+			bundledSchema: RouterTraitSchema,
+			validator: overrides.validators?.router,
+			optional: true,
+			createValue: () => overrides.router ?? null
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, PAGE_LIFECYCLE_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: PAGE_LIFECYCLE_TRAIT_TOKEN,
+			traitName: "pageLifecycle",
+			bundledSchema: PageLifecycleTraitSchema,
+			validator: overrides.validators?.pageLifecycle,
+			optional: true,
+			createValue: () => overrides.pageLifecycle ?? null
+		})),
+		createProviderIfTokenMissing(externalProviderTokens, POPUP_TRAIT_TOKEN, () => createBuiltInTraitUnit({
+			token: POPUP_TRAIT_TOKEN,
+			traitName: "popup",
+			bundledSchema: PopupTraitSchema,
+			validator: overrides.validators?.popup,
+			optional: true,
+			createValue: () => overrides.popup ?? null
+		}))
+	].filter(notMissingProvider);
+}
+function createBuiltInTraitUnit(options) {
+	return {
+		provide: options.token,
+		useFactory: ((...deps) => {
+			const value = options.createValue(...deps);
+			validateTraitInput({
+				value,
+				bundledSchema: options.bundledSchema,
+				validator: options.validator,
+				optional: options.optional,
+				onInvalid: (failure) => throwValidationClientError({
+					code: "environment.trait_validation_failed",
+					source: "environment",
+					messagePrefix: `createFoundationEnvironment could not validate ${options.traitName}`,
+					failure
+				})
+			});
+			return value;
+		}),
+		deps: options.deps
+	};
+}
+function createFoundationEnvironmentUnit() {
+	return {
+		provide: ENVIRONMENT_TOKEN,
+		useFactory: ((injector, transport, time, realmStorage, span, tracing, idleCallback, persistentStorage, sessionStorage, router, pageLifecycle, popup) => {
+			return {
+				injector,
+				transport,
+				time,
+				realmStorage,
+				idleCallback: idleCallback ?? void 0,
+				persistentStorage: persistentStorage ?? void 0,
+				sessionStorage: sessionStorage ?? void 0,
+				span,
+				tracing,
+				router: router ?? void 0,
+				pageLifecycle: pageLifecycle ?? void 0,
+				popup: popup ?? void 0
+			};
+		}),
+		deps: [
+			INJECTOR_TOKEN,
+			TRANSPORT_TRAIT_TOKEN,
+			TIME_TRAIT_TOKEN,
+			REALM_STORAGE_TRAIT_TOKEN,
+			SPAN_TRAIT_TOKEN,
+			TRACING_TRAIT_TOKEN,
+			IDLE_CALLBACK_TRAIT_TOKEN,
+			PERSISTENT_STORAGE_TRAIT_TOKEN,
+			SESSION_STORAGE_TRAIT_TOKEN,
+			ROUTER_TRAIT_TOKEN,
+			PAGE_LIFECYCLE_TRAIT_TOKEN,
+			POPUP_TRAIT_TOKEN
+		]
+	};
+}
+//#endregion
+export { INJECTOR_TOKEN as $, appendOrReplaceCompatFragment as A, createJsonRpcServerAndClient as B, IDLE_CALLBACK_TRAIT_TOKEN as C, RouterNavigationMode as D, RouterNavigationIntent as E, PopupAttachFailureReason as F, validateWithSchemaSync as G, throwValidationClientError as H, PopupClientWindowHandle as I, PAGE_LIFECYCLE_TRAIT_TOKEN as J, PopupErrorCode as K, PopupServerWindowHandle as L, parseCompatFragment as M, takeCompatFragment as N, takeCompatFragmentFromRouter as O, POPUP_TRAIT_TOKEN as P, readonlySignal as Q, createJsonRpcClient as R, SPAN_TRAIT_TOKEN as S, ROUTER_TRAIT_TOKEN as T, validateTraitInput as U, formatValidationFailure as V, validateWithSchema as W, isEventStreamTrait as X, EventSourceKind as Y, createSignal as Z, abortSignalToCancellationToken as _, TracingLevel as a, createProviderIfTokenMissing as at, abortSignalToEventStream as b, PERSISTENT_STORAGE_TRAIT_TOKEN as c, readErrorPresentationDescriptor as ct, StorageChangeEventOrigin as d, PARENT_INJECTOR_TOKEN as et, FetchTransportRedirectKind as f, createTimeForStd as g, TransportErrorCode as h, TRACING_TRAIT_TOKEN as i, SecuritydeptInjectionToken as it, isCompatFragmentBlock as j, SECURITYDEPT_COMPAT_FRAGMENT_VERSION as k, REALM_STORAGE_TRAIT_TOKEN as l, TRANSPORT_TRAIT_TOKEN as m, ENVIRONMENT_TOKEN as n, toRuntimeInjector as nt, createTracing as o, getSecuritydeptProviderToken as ot, createBaseTransportForStdFetch as p, readPopupErrorPresentationDescriptor as q, OperationTraceEventType as r, SecurityDeptOptional as rt, createInMemoryRecordStore as s, notMissingProvider as st, createFoundationEnvironment as t, SecuritydeptInjector as tt, SESSION_STORAGE_TRAIT_TOKEN as u, cancellationTokenToAbortSignal as v, TIME_TRAIT_TOKEN as w, createRootSpan as x, normalizeAbortError as y, createJsonRpcServer as z };
+
+//# sourceMappingURL=create-Bm-XRA3G.mjs.map