@securitydept/client 0.3.0-beta.2 → 0.3.0-beta.5

package/dist/index.mjs

@@ -1,69 +1,273 @@
-import { C as ClientErrorSource, S as ClientErrorKind, T as UserRecovery, _ as createDefaultClock, b as OperationTraceEventType, c as PromiseSettlementKind, d as fromSignal, f as interval, g as createDefaultScheduler, h as createRuntime, l as fromEventPattern, m as timer, p as scheduleAt, t as FetchTransportRedirectKind, u as fromPromise, v as createOperationTracer, w as ErrorPresentationTone, x as ClientError, y as LogLevel } from "./fetch-transport-DtnSRWAH.mjs";
-import { _ as createEventStream, a as filter, b as fromRxObservable, c as merge, d as shareReplay, f as switchMap, g as withLatestFromSignal, h as throttleTime, i as exhaustMap, l as pipe, m as tap, n as concatMap, o as finalize, p as takeUntil, r as debounceTime, s as map, t as EventSourceKind, u as share, v as createReplaySubject, x as toRxObservable, y as createSubject } from "./events-BUlfsRfl.mjs";
-import { i as createJsonCodec, n as createEphemeralFlowStore, r as createKeyedEphemeralFlowStore, t as createInMemoryRecordStore } from "./persistence-CSB8770k.mjs";
-//#region src/cancellation/cancellation-token.ts
-var CancellationToken = class {
-	_isCancelled = false;
-	_reason;
-	_listeners = /* @__PURE__ */ new Set();
-	get isCancellationRequested() {
-		return this._isCancelled;
-	}
-	get reason() {
-		return this._reason;
+import { A as RxEventSubject, B as withDisposableStack, E as RxComputedSignal, F as SYMBOL_DISPOSE, G as UserRecovery, H as ClientErrorKind, I as SimpleDisposableStack, L as StdDisposableStack, M as isInteropObservableTrait, N as SYMBOL_ASYNC_DISPOSE, O as RxEventReplaySubject, P as SYMBOL_DISPOSABLE_STACK, R as createDisposableStack, U as ClientErrorSource, V as ClientError, W as ErrorPresentationTone, a as ResourceSnapshotUpdateKind, c as whenResourceSnapshotValue, d as ResourceErrorCode, f as CancellationToken, i as rxResource, j as SYMBOL_OBSERVABLE, k as RxEventStream, l as ResourceStatus, m as isCancellationTokenTrait, n as mapResource, o as flattenResourceSnapshot, p as createCancellationTokenSource, r as resourceFromSnapshots, s as reduceResourceSnapshot, u as ResourceError, z as injectDisposableStackFrom } from "./rx-BoB32Dzg.mjs";
+import { $ as INJECTOR_TOKEN, A as appendOrReplaceCompatFragment, B as createJsonRpcServerAndClient, C as IDLE_CALLBACK_TRAIT_TOKEN, D as RouterNavigationMode, E as RouterNavigationIntent, F as PopupAttachFailureReason, G as validateWithSchemaSync, H as throwValidationClientError, I as PopupClientWindowHandle, J as PAGE_LIFECYCLE_TRAIT_TOKEN, K as PopupErrorCode, L as PopupServerWindowHandle, M as parseCompatFragment, N as takeCompatFragment, O as takeCompatFragmentFromRouter, P as POPUP_TRAIT_TOKEN, Q as readonlySignal, R as createJsonRpcClient, S as SPAN_TRAIT_TOKEN, T as ROUTER_TRAIT_TOKEN, U as validateTraitInput, V as formatValidationFailure, W as validateWithSchema, X as isEventStreamTrait, Y as EventSourceKind, Z as createSignal, _ as abortSignalToCancellationToken, a as TracingLevel, at as createProviderIfTokenMissing, b as abortSignalToEventStream, c as PERSISTENT_STORAGE_TRAIT_TOKEN, ct as readErrorPresentationDescriptor, d as StorageChangeEventOrigin, et as PARENT_INJECTOR_TOKEN, f as FetchTransportRedirectKind, g as createTimeForStd, h as TransportErrorCode, i as TRACING_TRAIT_TOKEN, it as SecuritydeptInjectionToken, j as isCompatFragmentBlock, k as SECURITYDEPT_COMPAT_FRAGMENT_VERSION, l as REALM_STORAGE_TRAIT_TOKEN, m as TRANSPORT_TRAIT_TOKEN, n as ENVIRONMENT_TOKEN, nt as toRuntimeInjector, o as createTracing, ot as getSecuritydeptProviderToken, p as createBaseTransportForStdFetch, q as readPopupErrorPresentationDescriptor, r as OperationTraceEventType, rt as SecurityDeptOptional, s as createInMemoryRecordStore, st as notMissingProvider, t as createFoundationEnvironment, tt as SecuritydeptInjector, u as SESSION_STORAGE_TRAIT_TOKEN, v as cancellationTokenToAbortSignal, w as TIME_TRAIT_TOKEN, x as createRootSpan, y as normalizeAbortError, z as createJsonRpcServer } from "./create-Bm-XRA3G.mjs";
+import { i as UriString, n as UriReferenceString, r as UriRelativeString, t as UriParseError } from "./uri-string-BfnIT4gJ.mjs";
+import { v7 } from "uuid";
+import { inject as inject$1, runInInjectionContext as runInInjectionContext$1 } from "injection-js";
+import { EMPTY, NEVER, ReplaySubject, filter, from, merge, take, takeUntil } from "rxjs";
+import { type } from "arktype";
+import { isPromise } from "es-toolkit/predicate";
+//#region src/auth-coordination/contract.ts
+var StaticAttrsAuthRequirement = class StaticAttrsAuthRequirement {
+	id;
+	label;
+	attributes;
+	constructor(id, label, attributes) {
+		this.id = id;
+		this.label = label;
+		this.attributes = attributes;
+		Object.freeze(this);
 	}
-	/** @internal — called by `CancellationTokenSource`. */
-	_cancel(reason) {
-		if (this._isCancelled) return;
-		this._isCancelled = true;
-		this._reason = reason;
-		for (const listener of this._listeners) listener(reason);
-		this._listeners.clear();
+	static create(input) {
+		return new StaticAttrsAuthRequirement(input?.id ?? v7(), input?.label, input?.attributes ? Object.freeze(input.attributes) : void 0);
 	}
-	onCancellationRequested(listener) {
-		if (this._isCancelled) {
-			listener(this._reason);
-			return { dispose() {} };
-		}
-		this._listeners.add(listener);
-		return { dispose: () => {
-			this._listeners.delete(listener);
-		} };
+	static createList(inputs) {
+		return inputs.map((input) => StaticAttrsAuthRequirement.create(input));
 	}
-	throwIfCancellationRequested() {
-		if (this._isCancelled) throw new ClientError({
-			kind: ClientErrorKind.Cancelled,
-			message: "Operation was cancelled",
-			cause: this._reason
-		});
+};
+/** Outcome of resolving a single requirement. */
+const ResolutionStatus = {
+	Fulfilled: "fulfilled",
+	Failed: "failed",
+	Skipped: "skipped"
+};
+/** Overall plan status. */
+const PlanStatus = {
+	/** There are still pending requirements. */
+	Pending: "pending",
+	/** All requirements have been resolved. */
+	Settled: "settled"
+};
+/** Error thrown when a planner contract is violated (e.g. duplicate ids). */
+var RequirementPlannerError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RequirementPlannerError";
 	}
 };
+function isRouteStateSnapshotTrait(value) {
+	return typeof value === "object" && value !== null && "url" in value;
+}
+function isRouteBehaviourContextExtra(value) {
+	return typeof value === "object" && value !== null && "routeState" in value && isRouteStateSnapshotTrait(value.routeState);
+}
+/** Outcome of a pipeline step or run. */
+const PipelineOutcome = {
+	/** No candidates remain — the plan is satisfied. */
+	Settled: "settled",
+	/** A candidate was resolved as fulfilled; more may remain. */
+	Resolved: "resolved",
+	/** A candidate's handler blocked progress. */
+	Blocked: "blocked",
+	/** A candidate's handler requested a redirect. */
+	Redirect: "redirect"
+};
 /**
-* Create a `CancellationTokenSource` that produces a cooperative cancellation token.
+* How a route segment's requirements compose with the inherited parent chain.
+*
+* - `inherit` — keep the parent requirements unchanged (segment adds nothing)
+* - `merge` — inherit parent requirements, then append/override with the
+*   segment's own (same-id entries replace the parent's)
+* - `replace` — discard the parent chain, use only the segment's requirements
 */
-function createCancellationTokenSource() {
-	const ct = new CancellationToken();
-	let disposed = false;
-	return {
-		get token() {
-			return ct;
-		},
-		cancel(reason) {
-			if (!disposed) ct._cancel(reason);
-		},
-		dispose() {
-			if (!disposed) {
-				disposed = true;
-				ct._cancel(new ClientError({
-					kind: ClientErrorKind.Cancelled,
-					message: "Disposed"
-				}));
-			}
+const RequirementsComposition = {
+	Inherit: "inherit",
+	Merge: "merge",
+	Replace: "replace"
+};
+/**
+* Apply a route requirements declaration onto an effective requirement map.
+*
+* Reuse `effective` across a route chain so merge/replace fold in O(total
+* requirements) without rebuilding parent state each segment. When omitted, a
+* fresh map is created for one-shot composition.
+*/
+function resolveEffectiveRequirements(child, effective = /* @__PURE__ */ new Map()) {
+	switch (child.composition) {
+		case RequirementsComposition.Inherit: return effective;
+		case RequirementsComposition.Merge:
+			for (const requirement of child.requirements) effective.set(requirement.id, requirement);
+			return effective;
+		case RequirementsComposition.Replace:
+			effective.clear();
+			for (const requirement of child.requirements) effective.set(requirement.id, requirement);
+			return effective;
+		default: {
+			const _exhaustive = child.composition;
+			throw new RequirementPlannerError(`Unknown requirements composition: ${String(_exhaustive)}`);
 		}
+	}
+}
+//#endregion
+//#region src/errors/error-attributes.ts
+/** Extract secret-safe diagnostic attributes without copying runtime messages. */
+function describeError(error) {
+	if (error instanceof ClientError) return {
+		errorName: error.name,
+		errorKind: error.kind,
+		errorCode: error.code,
+		recovery: error.recovery
 	};
+	return { errorName: error instanceof Error ? error.name : typeof error };
+}
+//#endregion
+//#region src/compat/base64.ts
+const Base64CompatErrorCode = {
+	EncoderUnavailable: "compat.base64.encoder_unavailable",
+	DecoderUnavailable: "compat.base64.decoder_unavailable"
+};
+function encodeUint8ArrayToBase64(value) {
+	const toBase64 = globalThis.Uint8Array.prototype.toBase64;
+	if (typeof toBase64 === "function") return toBase64.call(value);
+	if (typeof globalThis.btoa === "function") {
+		let binary = "";
+		for (const byte of value) binary += String.fromCharCode(byte);
+		return globalThis.btoa(binary);
+	}
+	const BufferConstructor = Reflect.get(globalThis, "Buffer");
+	if (typeof BufferConstructor?.from === "function") return BufferConstructor.from(value).toString("base64");
+	throw new ClientError({
+		kind: ClientErrorKind.Configuration,
+		code: Base64CompatErrorCode.EncoderUnavailable,
+		message: "The current realm does not provide a Base64 encoder.",
+		source: "compat.base64"
+	});
+}
+function decodeBase64ToUint8Array(value) {
+	const Uint8ArrayConstructor = globalThis.Uint8Array;
+	if (typeof Uint8ArrayConstructor.fromBase64 === "function") return Uint8ArrayConstructor.fromBase64(value);
+	if (typeof globalThis.atob === "function") {
+		const binary = globalThis.atob(value);
+		const bytes = new Uint8Array(binary.length);
+		for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+		return bytes;
+	}
+	const BufferConstructor = Reflect.get(globalThis, "Buffer");
+	if (typeof BufferConstructor?.from === "function") return Uint8ArrayConstructor.from(BufferConstructor.from(value, "base64"));
+	throw new ClientError({
+		kind: ClientErrorKind.Configuration,
+		code: Base64CompatErrorCode.DecoderUnavailable,
+		message: "The current realm does not provide a Base64 decoder.",
+		source: "compat.base64"
+	});
+}
+//#endregion
+//#region src/compat/generator.ts
+async function* promisesToRacedAsyncGenerator(promises) {
+	const pending = new Map(promises.map((promise, index) => [index, promise.then((value) => ({
+		value,
+		index
+	}))]));
+	while (pending.size > 0) {
+		const next = await Promise.race(pending.values());
+		pending.delete(next.index);
+		yield next.value;
+	}
 }
 //#endregion
-//#region src/cancellation/linked-cancellation-token.ts
+//#region src/injection/context.ts
+function inject(token, options) {
+	if (options?.optional === true) return inject$1(token, { optional: true });
+	return inject$1(token);
+}
+function tryInjectInInjectionContext(token, options) {
+	try {
+		if (options?.optional === true) return inject(token, { optional: true });
+		return inject(token);
+	} catch (error) {
+		if (isMissingInjectionContextError(error)) return null;
+		throw error;
+	}
+}
+function runInInjectionContext(injector, fn) {
+	return runInInjectionContext$1(toRuntimeInjector(injector), fn);
+}
+function isMissingInjectionContextError(error) {
+	return error instanceof Error && error.message.includes("can only be used within an injection context");
+}
+//#endregion
+//#region src/injection/destroy.ts
+var SecuritydeptDestroyRef = class {
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+};
+var ManagedSecuritydeptDestroyRef = class extends SecuritydeptDestroyRef {
+	destroyedSignal = createSignal(false);
+	get destroyed() {
+		return this.destroyedSignal.get();
+	}
+	onDestroy(callback) {
+		if (this.destroyedSignal.get()) {
+			callback();
+			return () => void 0;
+		}
+		const subscription = from(this.destroyedSignal).pipe(filter((destroyed) => destroyed), take(1)).subscribe({ next: callback });
+		return () => {
+			subscription.unsubscribe();
+		};
+	}
+	dispose() {
+		if (this.destroyedSignal.get()) return;
+		this.destroyedSignal.set(true);
+	}
+	destroy() {
+		this.dispose();
+	}
+};
+function createSecuritydeptDestroyRef() {
+	return new ManagedSecuritydeptDestroyRef();
+}
+//#endregion
+//#region src/validation/schemas/uri.ts
+const UriStringSchema = type("string").narrow((value, context) => UriString.tryParse(value) == null ? context.reject("an absolute URI string") : true);
+const BaseURIStringSchema = UriStringSchema;
+const UriRelativeStringSchema = type("string").narrow((value, context) => UriRelativeString.tryParse(value) == null ? context.reject("a relative URI reference string") : true);
+const UriReferenceStringSchema = type("string").narrow((value, context) => UriReferenceString.tryParse(value) == null ? context.reject("a URI reference string") : true);
+//#endregion
+//#region src/cancellation/linked.ts
+var LinkedCancellationToken = class {
+	sources;
+	destoryed$ = new ReplaySubject(1);
+	token;
+	constructor(sources) {
+		this.sources = sources;
+		if (sources.length === 0) this.token = new CancellationToken();
+		if (sources.length === 1) this.token = sources[0];
+		for (const source of sources) if (source.isCancellationRequested) {
+			this.token = source;
+			return;
+		}
+		const newToken = new CancellationToken();
+		merge(...sources).pipe(take(1), takeUntil(this.destoryed$)).subscribe(({ reason }) => {
+			newToken._cancel(reason);
+		});
+		this.token = newToken;
+	}
+	get isCancellationRequested() {
+		return this.token.isCancellationRequested;
+	}
+	get cancellationError() {
+		return this.token.cancellationError;
+	}
+	get reason() {
+		return this.token.reason;
+	}
+	onCancellationRequested(listener) {
+		return this.token.onCancellationRequested(listener);
+	}
+	throwIfCancellationRequested() {
+		this.token.throwIfCancellationRequested();
+	}
+	dispose() {
+		this.destoryed$.next(true);
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+	[SYMBOL_OBSERVABLE]() {
+		return this.token[SYMBOL_OBSERVABLE]();
+	}
+};
 /**
 * Create a cancellation token that fires when ANY of the given source tokens
 * is cancelled.
@@ -79,218 +283,211 @@ function createCancellationTokenSource() {
 * await transport.execute({ ..., cancellationToken: linked });
 */
 function createLinkedCancellationToken(...sources) {
-	if (sources.length === 0) return createCancellationTokenSource().token;
-	if (sources.length === 1) return sources[0];
-	for (const source of sources) if (source.isCancellationRequested) return source;
-	const linked = createCancellationTokenSource();
-	const subscriptions = sources.map((source) => source.onCancellationRequested((reason) => linked.cancel(reason)));
-	linked.token.onCancellationRequested(() => {
-		for (const sub of subscriptions) sub.dispose();
-	});
-	return linked.token;
+	return new LinkedCancellationToken(sources.filter((s) => !!s));
 }
 //#endregion
-//#region src/errors/presentation-descriptor.ts
-const DEFAULT_RECOVERY_LABELS = {
-	[UserRecovery.None]: "",
-	[UserRecovery.Retry]: "Try again",
-	[UserRecovery.RestartFlow]: "Restart flow",
-	[UserRecovery.Reauthenticate]: "Sign in again",
-	[UserRecovery.ContactSupport]: "Contact support"
-};
-const POPUP_PRESENTATIONS = {
-	"popup.blocked": {
-		title: "Popup was blocked",
-		description: "The browser blocked the popup window before the login flow could start. Allow popups for this site, then try again.",
-		tone: ErrorPresentationTone.Warning
-	},
-	"popup.closed_by_user": {
-		title: "Popup login was closed",
-		description: "The popup window was closed before the OIDC provider returned a callback. Start the login flow again to continue.",
-		tone: ErrorPresentationTone.Warning
-	},
-	"popup.relay_timeout": {
-		title: "Popup relay timed out",
-		description: "The popup callback never relayed back to the opener before the timeout window expired.",
-		tone: ErrorPresentationTone.Warning
-	},
-	"popup.relay_error": {
-		title: "Popup relay failed",
-		description: "The popup callback page returned an error instead of a callback payload.",
-		tone: ErrorPresentationTone.Danger
-	}
-};
-function readErrorPresentationDescriptor(error, options = {}) {
-	if (error instanceof ClientError) return describeClientErrorPresentation(error, options);
-	const clientErrorLike = coerceClientErrorLike(error);
-	if (clientErrorLike) return describeClientErrorLikePresentation(clientErrorLike, options);
-	if (error instanceof Error) return {
-		code: null,
-		kind: null,
-		title: options.fallbackTitle ?? "Operation failed",
-		description: error.message || options.fallbackDescription || "An unexpected error prevented the operation from completing.",
-		recovery: UserRecovery.None,
-		retryable: false,
-		tone: ErrorPresentationTone.Danger,
-		primaryAction: null
-	};
-	return {
-		code: null,
-		kind: null,
-		title: options.fallbackTitle ?? "Operation failed",
-		description: options.fallbackDescription ?? "An unexpected error prevented the operation from completing.",
-		recovery: UserRecovery.None,
-		retryable: false,
-		tone: ErrorPresentationTone.Danger,
-		primaryAction: null
-	};
-}
-function describeClientErrorPresentation(error, options) {
-	return describeClientErrorLikePresentation({
-		code: error.code,
-		kind: error.kind,
-		message: error.message,
-		recovery: error.recovery,
-		retryable: error.retryable,
-		source: error.source,
-		presentation: error.presentation
-	}, options);
-}
-function describeClientErrorLikePresentation(error, options) {
-	const popupPresentation = POPUP_PRESENTATIONS[error.code];
-	const title = popupPresentation?.title ?? readClientErrorTitle(error);
-	const description = popupPresentation?.description ?? error.presentation?.message ?? error.message ?? options.fallbackDescription ?? "The operation could not complete.";
-	return {
-		code: error.code,
-		kind: error.kind,
-		source: error.source,
-		title,
-		description,
-		recovery: error.recovery,
-		retryable: error.retryable,
-		tone: popupPresentation?.tone ?? readClientErrorTone(error),
-		primaryAction: readPrimaryAction(error.recovery, options)
-	};
+//#region src/signals/computed.ts
+/**
+* Create a lazy computed signal.
+*
+* Dependencies are collected dynamically while `compute()` runs.
+*/
+function createComputed(compute, options) {
+	return RxComputedSignal.computed(compute, options);
 }
-function readClientErrorTitle(error) {
-	if (error.kind === ClientErrorKind.Unauthenticated) return "Authentication required";
-	if (error.kind === ClientErrorKind.Unauthorized) return "Access denied";
-	if (error.kind === ClientErrorKind.Cancelled) return "Operation cancelled";
-	if (error.kind === ClientErrorKind.Timeout) return "Request timed out";
-	if (error.kind === ClientErrorKind.Configuration) return "Configuration error";
-	if (error.kind === ClientErrorKind.Validation) return "Validation failed";
-	if (error.kind === ClientErrorKind.Storage) return "Browser storage failed";
-	if (error.kind === ClientErrorKind.Authorization && error.recovery === UserRecovery.RestartFlow) return "Flow needs to restart";
-	if (error.kind === ClientErrorKind.Transport) return "Network request failed";
-	if (error.kind === ClientErrorKind.Server) return "Server request failed";
-	if (error.kind === ClientErrorKind.Protocol) return "Request failed";
-	return "Operation failed";
-}
-function readClientErrorTone(error) {
-	if (error.kind === ClientErrorKind.Cancelled) return ErrorPresentationTone.Neutral;
-	if (error.kind === ClientErrorKind.Unauthenticated || error.kind === ClientErrorKind.Timeout || error.kind === ClientErrorKind.Transport || error.kind === ClientErrorKind.Server || error.recovery === UserRecovery.Retry || error.recovery === UserRecovery.RestartFlow || error.recovery === UserRecovery.Reauthenticate) return ErrorPresentationTone.Warning;
-	return ErrorPresentationTone.Danger;
-}
-function coerceClientErrorLike(error) {
-	if (typeof error !== "object" || error === null) return null;
-	const candidate = error;
-	if (typeof candidate.message !== "string") return null;
-	return {
-		code: typeof candidate.code === "string" ? candidate.code : null,
-		kind: typeof candidate.kind === "string" ? candidate.kind : null,
-		message: candidate.message,
-		recovery: typeof candidate.recovery === "string" ? candidate.recovery : UserRecovery.None,
-		retryable: candidate.retryable === true,
-		source: typeof candidate.source === "string" ? candidate.source : void 0,
-		presentation: isErrorPresentation(candidate.presentation) ? candidate.presentation : void 0
-	};
+//#endregion
+//#region src/signals/resource.ts
+function createResource(options) {
+	return rxResource({
+		...options,
+		stream: (context) => from(options.stream(context))
+	});
 }
-function isErrorPresentation(value) {
-	return typeof value === "object" && value !== null && typeof value.code === "string" && typeof value.message === "string" && typeof value.recovery === "string";
+//#endregion
+//#region src/router/metadata.ts
+/** Route-data key holding the SecurityDept metadata blob for a segment. */
+const SECURITYDEPT_ROUTE_METADATA_KEY = "__securitydept__";
+/** Read SecurityDept route metadata from a route `data` bag. */
+function readSecuritydeptRouteMetadata(data) {
+	const raw = data?.[SECURITYDEPT_ROUTE_METADATA_KEY];
+	if (raw === void 0 || raw === null) return;
+	return raw;
 }
-function readPrimaryAction(recovery, options) {
-	if (recovery === UserRecovery.None) return null;
-	const label = options.recoveryLabels?.[recovery] ?? DEFAULT_RECOVERY_LABELS[recovery];
-	if (!label) return null;
-	return {
-		recovery,
-		label,
-		href: options.recoveryLinks?.[recovery] ?? null
+/** Merge SecurityDept route metadata into a route `data` bag. */
+function writeSecuritydeptRouteMetadata(base, patch) {
+	const data = { ...base ?? {} };
+	data[SECURITYDEPT_ROUTE_METADATA_KEY] = {
+		...data["__securitydept__"] ?? {},
+		...patch
 	};
+	return data;
 }
 //#endregion
-//#region src/identity/principal.ts
-function readClaimsBag(value) {
-	return typeof value === "object" && value !== null ? value : void 0;
-}
-function readOptionalString(value) {
-	return typeof value === "string" ? value : void 0;
-}
-function resolveDisplayName(displayName, subject) {
-	if (typeof displayName === "string" && displayName.trim().length > 0) return displayName;
-	return subject;
-}
-function normalizeAuthenticatedPrincipal(input) {
-	if (typeof input.subject !== "string" || input.subject.trim().length === 0) return null;
-	return {
-		subject: input.subject,
-		displayName: resolveDisplayName(input.displayName, input.subject),
-		picture: readOptionalString(input.picture),
-		issuer: readOptionalString(input.issuer),
-		claims: readClaimsBag(input.claims)
+//#region src/std/transport/authorization-interceptor.ts
+function createAuthorizationInterceptedFetch(fetchImpl, options) {
+	return async (input, init) => {
+		if (!await options.predicate(input, init)) return fetchImpl(input, init);
+		const authorization = "whenValue" in options.authorization ? await options.authorization.whenValue() : options.authorization.get();
+		if (!authorization) return fetchImpl(input, init);
+		const headers = new Headers(typeof Request !== "undefined" && input instanceof Request ? input.headers : void 0);
+		if (init?.headers) new Headers(init.headers).forEach((value, key) => {
+			headers.set(key, value);
+		});
+		headers.set("authorization", authorization);
+		return fetchImpl(input, {
+			...init,
+			headers
+		});
 	};
 }
-function normalizeAuthenticatedPrincipalWire(input) {
-	if (typeof input.subject !== "string" || input.subject.trim().length === 0) return null;
-	return {
-		subject: input.subject,
-		displayName: resolveDisplayName(input.display_name, input.subject),
-		picture: readOptionalString(input.picture),
-		issuer: readOptionalString(input.issuer),
-		claims: readClaimsBag(input.claims)
+//#endregion
+//#region src/tracing/operation-runner.ts
+var OperationSpan = class OperationSpan {
+	_span;
+	_environment;
+	_name;
+	_target;
+	constructor(_span, _environment, _name, _target) {
+		this._span = _span;
+		this._environment = _environment;
+		this._name = _name;
+		this._target = _target;
+	}
+	static start(options) {
+		const operationSpan = new OperationSpan(options.span.fork({
+			mutable: true,
+			idFactory: options.idFactory,
+			attributes: options.fields
+		}), options.environment, options.name, options.target);
+		operationSpan.recordStarted();
+		return operationSpan;
+	}
+	get id() {
+		return this._span.id;
+	}
+	get parent() {
+		return this._span.parent;
+	}
+	get attributes() {
+		return this._span.attributes;
+	}
+	fork(options = {}) {
+		return this._span.fork(options);
+	}
+	setAttributes(attributes) {
+		this._span.setAttributes(attributes);
+	}
+	addEvent(name, fields) {
+		this._record(OperationTraceEventType.Event, TracingLevel.Info, {
+			eventName: name,
+			...fields ?? {}
+		});
+	}
+	recordError(error, fields) {
+		this._record(OperationTraceEventType.Error, TracingLevel.Error, {
+			...describeError(error),
+			...fields ?? {}
+		});
+	}
+	recordStarted() {
+		this._record(OperationTraceEventType.Started, TracingLevel.Info);
+	}
+	recordEnded(outcome) {
+		this._record(OperationTraceEventType.Ended, outcome === "succeeded" ? TracingLevel.Info : TracingLevel.Error, { outcome });
+	}
+	_record(name, level, fields) {
+		this._environment.tracing.record({
+			name,
+			at: this._environment.time.now(),
+			span: this,
+			level,
+			target: this._target,
+			fields: {
+				operationName: this._name,
+				...this.attributes,
+				...fields ?? {}
+			}
+		});
+	}
+};
+function runOperation(options) {
+	const operationSpan = OperationSpan.start(options);
+	const complete = (result) => {
+		operationSpan.recordEnded("succeeded");
+		return result;
+	};
+	const fail = (error) => {
+		const normalizedError = options.normalizeError?.(error) ?? error;
+		operationSpan.recordError(normalizedError);
+		operationSpan.recordEnded("failed");
+		throw normalizedError;
 	};
+	const invoke = () => options.execute(operationSpan);
+	try {
+		const result = invoke();
+		if (isPromise(result)) return result.then(complete, fail);
+		return complete(result);
+	} catch (error) {
+		return fail(error);
+	}
 }
-function projectAuthenticatedPrincipal(options) {
-	const principal = options.principal;
-	const subject = principal?.subject ?? options.fallbackSubject ?? "context.anonymous";
-	return {
-		subject,
-		displayName: principal?.displayName?.trim() || options.fallbackDisplayName || subject,
-		picture: principal?.picture,
-		issuer: principal?.issuer ?? options.fallbackIssuer,
-		claims: principal?.claims ?? options.fallbackClaims
+//#endregion
+//#region src/tracing/operation-method.ts
+function defineInstrumentMethodDecorator(factory) {
+	return (...factoryArgs) => (target, context) => {
+		const methodName = String(context.name);
+		const resolve = factory({
+			factoryArgs,
+			methodName
+		});
+		return function(...args) {
+			const resolvedOptions = resolve.call(this, {
+				args,
+				methodName
+			});
+			return runOperation({
+				environment: resolvedOptions.environment,
+				span: resolvedOptions.span,
+				name: resolvedOptions.name ?? methodName,
+				target: resolvedOptions.target,
+				fields: resolvedOptions.fields,
+				idFactory: resolvedOptions.idFactory,
+				normalizeError: resolvedOptions.normalizeError,
+				execute: (span) => target.call(this, ...args, span)
+			});
+		};
 	};
 }
 //#endregion
-//#region src/logging/console-logger.ts
-/** Simple console-based logger implementation. */
-function createConsoleLogger(scope) {
-	return { log(entry) {
-		const label = `[${entry.scope ?? scope ?? "securitydept"}]`;
-		switch (entry.level) {
+//#region src/tracing/subscriber/console.ts
+function createConsoleTracingSubscriber() {
+	return { record(event) {
+		const label = `[${event.target}] ${event.name}`;
+		switch (event.level) {
 			case "debug":
-				console.debug(label, entry.message, entry.attributes ?? "");
+				console.debug(label, event.fields ?? {});
 				break;
 			case "info":
-				console.info(label, entry.message, entry.attributes ?? "");
+				console.info(label, event.fields ?? {});
 				break;
 			case "warn":
-				console.warn(label, entry.message, entry.attributes ?? "");
+				console.warn(label, event.fields ?? {});
 				break;
 			case "error":
-				console.error(label, entry.message, entry.error ?? "", entry.attributes ?? "");
+				console.error(label, event.fields ?? {});
 				break;
 		}
 	} };
 }
 //#endregion
-//#region src/logging/noop-logger.ts
-/** No-op logger — default when no logger is provided. */
-function createNoopLogger() {
-	return { log() {} };
-}
-//#endregion
-//#region src/logging/trace-timeline-store.ts
+//#region src/tracing/subscriber/timeline-store.ts
+/**
+* Create a subscriber-side trace timeline store.
+*
+* This store consumes tracing events through `record(event)` and keeps a
+* bounded local timeline for tests and UI surfaces. It is not the tracing
+* runtime itself.
+*/
 function createTraceTimelineStore(limit = 200) {
 	let nextId = 1;
 	let entries = [];
@@ -332,165 +529,730 @@ function createTraceTimelineStore(limit = 200) {
 	};
 }
 //#endregion
-//#region src/signals/computed.ts
+//#region src/auth-coordination/planner-host.ts
+const REQUIREMENT_PLANNER_HOST = new SecuritydeptInjectionToken("REQUIREMENT_PLANNER_HOST");
 /**
-* Create a computed signal that derives its value from other signals.
+* Default candidate selector: first unauthenticated candidate as soon as it is
+* discovered.
 *
-* Semantics: lazy + cached.
-* - The compute function is NOT called at construction time.
-* - `get()` recomputes only when dirty (a dependency changed since last read).
-* - Subscribers are notified only when a dependency changes (dirty-flagged),
-*   and the next `get()` will produce the fresh value.
-*
-* Dependency subscriptions are permanent for the lifetime of the computed signal.
+* If every requirement is already fulfilled the stream completes and the
+* selector returns `undefined`.
 */
-function createComputed(compute, deps) {
-	let cached;
-	let dirty = true;
-	const listeners = /* @__PURE__ */ new Set();
-	const markDirty = () => {
-		if (!dirty) {
-			dirty = true;
-			for (const listener of listeners) listener();
-		}
+function defaultSelectCandidate() {
+	return async function selectFirstCandidate(context) {
+		const result = await context.candidateList.next();
+		return result.done ? void 0 : result.value;
 	};
-	for (const dep of deps) dep.subscribe(markDirty);
+}
+/**
+* A coordination-scope host that resolves behaviour through a parent chain.
+*
+* Construct via {@link RequirementPlannerHost.fromBehaviour}. Each behaviour
+* field is optional at host construction time; missing required behaviour is
+* resolved from `parent` and fails fast during planner build if no host in the
+* chain provides it.
+*
+* @example
+* ```ts
+* const root = RequirementPlannerHost.fromBehaviour({
+*   checkAuthenticated: (req) => isAuthenticated(req),
+*   onUnauthenticated: (req) => `/login/${req.id}`,
+* });
+*
+* // Feature scope overrides only the chooser, inheriting the rest.
+* const feature = RequirementPlannerHost.fromBehaviour(
+*   { selectCandidate: async (ctx) => showChooser(ctx.candidateList) },
+*   { parent: root },
+* );
+* ```
+*/
+var RequirementPlannerHost = class RequirementPlannerHost {
+	environment;
+	parent;
+	/** The parent host, or undefined at the root. */
+	_behaviour;
+	constructor(behaviour, environment, parent) {
+		this.environment = environment;
+		this.parent = parent;
+		this._behaviour = behaviour;
+	}
+	/** Create a host scope from a partial behaviour and optional parent. */
+	static fromBehaviour(behaviour, options = {}) {
+		return new RequirementPlannerHost(behaviour, options.environment, options.parent);
+	}
+	async resolveBehaviourOptionFor(key) {
+		return this._behaviour[key] ?? await this.parent?.resolveBehaviourOptionFor(key);
+	}
+	async resolveBehaviourFor(key, defaultValue) {
+		return await this.resolveBehaviourOptionFor(key) ?? await defaultValue();
+	}
+	async resolveEnvironmentOption() {
+		return this.environment ?? await this.parent?.resolveEnvironmentOption();
+	}
+	async resolveEnvironment(defaultValue) {
+		return await this.resolveEnvironmentOption() ?? await defaultValue();
+	}
+};
+function provideRequirementPlannerHost(behaviour, options = {}) {
 	return {
-		get() {
-			if (dirty) {
-				cached = compute();
-				dirty = false;
-			}
-			return cached;
+		provide: REQUIREMENT_PLANNER_HOST,
+		useFactory: (parentInjector, environment) => {
+			const parent = options.parent ?? parentInjector?.get(REQUIREMENT_PLANNER_HOST, null) ?? void 0;
+			const resolved = typeof behaviour === "function" ? behaviour() : behaviour;
+			return RequirementPlannerHost.fromBehaviour(resolved, {
+				parent,
+				environment: options.environment ?? environment ?? void 0
+			});
 		},
-		subscribe(listener) {
-			listeners.add(listener);
-			return () => {
-				listeners.delete(listener);
-			};
-		}
+		deps: [[new SecurityDeptOptional(), PARENT_INJECTOR_TOKEN], [new SecurityDeptOptional(), ENVIRONMENT_TOKEN]]
 	};
 }
+function injectRequirementPlannerHost(options) {
+	return options.injector.get(REQUIREMENT_PLANNER_HOST, null);
+}
 //#endregion
-//#region src/signals/signal.ts
+//#region src/auth-coordination/planner/base-planner.ts
 /**
-* Minimal writable signal implementation.
-* Snapshot-first: values are immutable snapshots, mutations go through `set()`.
+* Abstract base for all requirement planners.
+*
+* Subclasses supply requirements via {@link buildRequirementList}. Pipeline
+* state lives on {@link RequirementPlan}, produced by {@link buildPlan}.
 */
-function createSignal(initial) {
-	let current = initial;
-	const listeners = /* @__PURE__ */ new Set();
-	return {
-		get() {
-			return current;
-		},
-		set(value) {
-			if (Object.is(current, value)) return;
-			current = value;
-			for (const listener of listeners) listener();
-		},
-		subscribe(listener) {
-			listeners.add(listener);
-			return () => {
-				listeners.delete(listener);
+var BaseRequirementPlanner = class {
+	host;
+	initialResolutions;
+	constructor(host, initialResolutions = []) {
+		this.host = host;
+		this.initialResolutions = initialResolutions.map((resolution) => Object.freeze({ ...resolution }));
+	}
+	/**
+	* Pipeline step 0: resolve host behaviour and materialize requirements into
+	* a {@link RequirementPlan}.
+	*
+	* Behaviour and the requirement list stay fixed on the returned plan until
+	* the next `buildPlan()` call. Resolve host parent chains (and any
+	* injection-context capture) here — not between async steps.
+	*/
+	async buildPlan() {
+		return {
+			planContext: this.planContext,
+			environment: await this.host.resolveEnvironment(() => {
+				throw new RequirementPlannerError("No environment resolved");
+			}),
+			checkAuthenticated: await this.host.resolveBehaviourFor("checkAuthenticated", () => {
+				throw new RequirementPlannerError("No checkAuthenticated resolved");
+			}),
+			onUnauthenticated: await this.host.resolveBehaviourFor("onUnauthenticated", () => {
+				throw new RequirementPlannerError("No onUnauthenticated behaviour resolved");
+			}),
+			selectCandidate: await this.host.resolveBehaviourFor("selectCandidate", defaultSelectCandidate),
+			requirements: await this.resolveRequirementList(),
+			resolutionList: [...this.initialResolutions]
+		};
+	}
+	/**
+	* Materialize the effective requirement list (also invoked by {@link buildPlan}).
+	*/
+	async resolveRequirementList() {
+		return [...(await this.buildRequirementList()).values()];
+	}
+	/**
+	* Pipeline step 1 — one loop iteration: select a candidate, run
+	* `onUnauthenticated`, then reduce `plan` state.
+	*/
+	async runStep(plan) {
+		const candidate = await plan.selectCandidate({
+			...plan,
+			candidateList: this.createCandidateStream(plan)
+		});
+		if (!candidate) return { outcome: PipelineOutcome.Settled };
+		const action = await plan.onUnauthenticated(candidate, plan);
+		return this.reduceFromAction(plan, candidate, action);
+	}
+	reduceFromAction(plan, candidate, action) {
+		if (action === true) {
+			this.recordFulfilled(plan, candidate);
+			return {
+				outcome: PipelineOutcome.Resolved,
+				requirement: candidate
 			};
 		}
-	};
-}
+		if (action === false) return {
+			outcome: PipelineOutcome.Blocked,
+			requirement: candidate
+		};
+		return {
+			outcome: PipelineOutcome.Redirect,
+			requirement: candidate,
+			location: action
+		};
+	}
+	/**
+	* Run the full pipeline: {@link buildPlan}, step 1, then loop step 2 until
+	* settled or a terminal outcome (`blocked`, `redirect`, or a never-settling
+	* action).
+	*/
+	async runUntilSettled() {
+		const plan = await this.buildPlan();
+		return this.runUntilSettledWithPlan(plan);
+	}
+	async runUntilSettledWithPlan(plan) {
+		while (true) {
+			const step = await this.runStep(plan);
+			if (step.outcome === PipelineOutcome.Settled) return {
+				outcome: PipelineOutcome.Settled,
+				resolutions: plan.resolutionList
+			};
+			if (step.outcome === PipelineOutcome.Resolved) continue;
+			if (step.outcome === PipelineOutcome.Blocked) return step;
+			if (step.outcome === PipelineOutcome.Redirect) return step;
+		}
+	}
+	async *createCandidateStream(plan) {
+		const context = {
+			planContext: this.planContext,
+			requirements: plan.requirements,
+			resolutionList: plan.resolutionList,
+			environment: plan.environment
+		};
+		const checked = plan.requirements.filter((requirement) => !plan.resolutionList.some((resolution) => resolution.requirementId === requirement.id)).map(async (requirement) => {
+			return {
+				requirement,
+				satisfied: await plan.checkAuthenticated(requirement, context)
+			};
+		});
+		for await (const { requirement, satisfied } of promisesToRacedAsyncGenerator(checked)) {
+			if (satisfied) {
+				this.recordFulfilled(plan, requirement);
+				continue;
+			}
+			yield requirement;
+		}
+	}
+	recordFulfilled(plan, requirement) {
+		if (plan.resolutionList.some((resolution) => resolution.requirementId === requirement.id)) return;
+		plan.resolutionList.push(Object.freeze({
+			requirementId: requirement.id,
+			status: ResolutionStatus.Fulfilled
+		}));
+	}
+};
+//#endregion
+//#region src/auth-coordination/planner/merge-planner.ts
 /**
-* Create a read-only view of a writable signal.
+* A planner whose effective requirements are the ordered union of its source
+* planners. Overlapping ids follow Map semantics (later source wins).
+*
+* @example
+* ```ts
+* const planner = MergeRequirementPlanner.fromPlanners(host, [
+*   sessionPlanner,
+*   oidcPlanner,
+* ]);
+* ```
 */
-function readonlySignal(signal) {
-	return {
-		get: () => signal.get(),
-		subscribe: (listener) => signal.subscribe(listener)
-	};
-}
+var MergeRequirementPlanner = class MergeRequirementPlanner extends BaseRequirementPlanner {
+	sources;
+	get planContext() {
+		return Object.assign({}, ...this.sources.map((source) => source.planContext));
+	}
+	constructor(host, sources) {
+		super(host);
+		this.sources = sources;
+	}
+	/** Create a merge planner from an ordered list of source planners. */
+	static fromPlanners(host, planners) {
+		return new MergeRequirementPlanner(host, planners);
+	}
+	async buildRequirementList() {
+		const map = /* @__PURE__ */ new Map();
+		for (const source of this.sources) for (const requirement of await source.resolveRequirementList()) map.set(requirement.id, requirement);
+		return map;
+	}
+};
 //#endregion
-//#region src/validation/index.ts
+//#region src/auth-coordination/planner/route-composition-planner.ts
+/** Fold a matched route chain into its effective requirement list. */
+function foldSegments(segments) {
+	const effective = /* @__PURE__ */ new Map();
+	for (const segment of segments) resolveEffectiveRequirements({
+		composition: segment.composition ?? RequirementsComposition.Merge,
+		requirements: segment.requirements
+	}, effective);
+	return [...effective.values()];
+}
+/** Length of the shared requirement-id prefix between two effective lists. */
+function sharedPrefixLength(previous, next) {
+	const limit = Math.min(previous.length, next.length);
+	let shared = 0;
+	while (shared < limit && previous[shared].id === next[shared].id) shared += 1;
+	return shared;
+}
 /**
-* Validate an unknown input against a `@standard-schema`-compatible schema.
+* A planner driven by a matched route chain with composition semantics.
 *
-* This is the foundation-level entry point for SDK validation. It accepts
-* any schema implementing `StandardSchemaV1` and returns a discriminated
-* `ValidationResult`.
+* Construct via {@link fromRouteSegments} for a matched route chain, or
+* {@link fromRouteTransition} for a transition that preserves shared-prefix
+* resolutions from the previous planner instance.
+*/
+var RouteCompositionRequirementPlanner = class RouteCompositionRequirementPlanner extends BaseRequirementPlanner {
+	_segments;
+	_effective;
+	_planContext;
+	constructor(host, segments, routeState, preservedResolutions = []) {
+		super(host, preservedResolutions);
+		this._segments = segments;
+		this._effective = foldSegments(segments);
+		this._planContext = Object.freeze({ routeState: Object.freeze({ ...routeState }) });
+	}
+	/** Build a planner from a matched route chain. */
+	static fromRouteSegments(host, segments, routeState) {
+		return new RouteCompositionRequirementPlanner(host, segments, routeState);
+	}
+	/**
+	* Build a planner for a route transition, preserving resolutions for the
+	* shared requirement prefix carried over from `previousPlan`.
+	*/
+	static fromRouteTransition(host, currentSegments, routeState, previousPlanner, previousPlan) {
+		const nextEffective = foldSegments(currentSegments);
+		const shared = sharedPrefixLength(previousPlanner.effectiveRequirements, nextEffective);
+		const sharedIds = new Set(nextEffective.slice(0, shared).map((requirement) => requirement.id));
+		return new RouteCompositionRequirementPlanner(host, currentSegments, routeState, previousPlan.resolutionList.filter((resolution) => sharedIds.has(resolution.requirementId)));
+	}
+	get planContext() {
+		return this._planContext;
+	}
+	/** The matched route chain backing this planner. */
+	get segments() {
+		return this._segments;
+	}
+	/** The folded effective requirement list (composition applied). */
+	get effectiveRequirements() {
+		return this._effective;
+	}
+	buildRequirementList() {
+		return new Map(this._effective.map((requirement) => [requirement.id, requirement]));
+	}
+};
+//#endregion
+//#region src/auth-coordination/planner/static-planner.ts
+/**
+* A planner whose effective requirement list is a fixed array supplied at
+* construction time.
 *
 * @example
 * ```ts
-* import { validateWithSchema } from "@securitydept/client";
-* import { z } from "zod";
-*
-* const UserSchema = z.object({ name: z.string() });
-* const result = await validateWithSchema(UserSchema, { name: "Alice" });
-* if (result.success) {
-*   console.log(result.value.name);
-* } else {
-*   console.error(result.issues);
-* }
+* const planner = StaticRequirementPlanner.fromRequirements(host, [
+*   StaticAttrsAuthRequirement.create({ id: "session" }),
+* ] as Readonly<AuthRequirement[]>);
+* const plan = await planner.buildPlan();
+* const step = await planner.runStep(plan);
+* // or: const result = await planner.runUntilSettled();
 * ```
 */
-async function validateWithSchema(schema, input) {
-	const result = await schema["~standard"].validate(input);
-	if ("value" in result) return {
-		success: true,
-		value: result.value
+var StaticRequirementPlanner = class StaticRequirementPlanner extends BaseRequirementPlanner {
+	staticRequirements;
+	get planContext() {
+		return {};
+	}
+	constructor(host, requirements) {
+		super(host);
+		this.staticRequirements = requirements;
+	}
+	/** Create a static planner from an ordered requirement list. */
+	static fromRequirements(host, requirements) {
+		return new StaticRequirementPlanner(host, requirements);
+	}
+	buildRequirementList() {
+		const map = /* @__PURE__ */ new Map();
+		for (const requirement of this.staticRequirements) map.set(requirement.id, requirement);
+		return map;
+	}
+};
+//#endregion
+//#region src/events/create.ts
+/**
+* Create a new event stream from a producer function.
+*
+* The producer receives an observer and should call `next()` to emit values,
+* `error()` to signal an error, and `complete()` to signal completion.
+* It may return a teardown function that will be called on unsubscribe.
+*/
+function createEventStream(producer) {
+	return new RxEventStream(producer);
+}
+function createEventSubject() {
+	return new RxEventSubject();
+}
+function createEventReplaySubject(bufferSize = Infinity) {
+	return new RxEventReplaySubject(bufferSize);
+}
+function createEmptyEventStream() {
+	return RxEventStream.fromObservableInput(EMPTY);
+}
+function createNeverEventStream() {
+	return RxEventStream.fromObservableInput(NEVER);
+}
+//#endregion
+//#region src/events/interop.ts
+function toEventStream(input) {
+	if (isEventStreamTrait(input)) return input;
+	return RxEventStream.fromObservableInput(from(input));
+}
+//#endregion
+//#region src/identity/schemas.ts
+const IdentityPrincipalSchema = type({
+	subject: "string > 0",
+	"displayName?": "string | null | undefined",
+	"picture?": "string | null | undefined",
+	"issuer?": "string | null | undefined",
+	"claims?": "object | null | undefined"
+}).pipe((input) => ({
+	subject: input.subject,
+	displayName: typeof input.displayName === "string" && input.displayName.trim().length > 0 ? input.displayName : input.subject,
+	picture: input.picture ?? void 0,
+	issuer: input.issuer ?? void 0,
+	claims: input.claims ?? void 0
+}));
+const IdentityPrincipalWireSchema = type({
+	subject: "string > 0",
+	"display_name?": "string | null | undefined",
+	"picture?": "string | null | undefined",
+	"issuer?": "string | null | undefined",
+	"claims?": "object | null | undefined"
+}).pipe((input) => ({
+	subject: input.subject,
+	displayName: typeof input.display_name === "string" && input.display_name.trim().length > 0 ? input.display_name : input.subject,
+	picture: input.picture ?? void 0,
+	issuer: input.issuer ?? void 0,
+	claims: input.claims ?? void 0
+}));
+//#endregion
+//#region src/identity/parsers.ts
+function throwIdentityPrincipalParseError(options) {
+	throw new ClientError({
+		kind: ClientErrorKind.Protocol,
+		code: options.code,
+		message: `${options.messagePrefix}: ${formatValidationFailure(options.failure) ?? "schema validation failed"}.`,
+		source: "identity",
+		cause: options.failure.issues
+	});
+}
+function parseIdentityPrincipal(input) {
+	const result = validateWithSchemaSync(IdentityPrincipalSchema, input);
+	if (result.success) return result.value;
+	throwIdentityPrincipalParseError({
+		code: "identity.invalid_principal",
+		messagePrefix: "Identity principal payload is invalid",
+		failure: result
+	});
+}
+function parseIdentityPrincipalWire(input) {
+	const result = validateWithSchemaSync(IdentityPrincipalWireSchema, input);
+	if (result.success) return result.value;
+	throwIdentityPrincipalParseError({
+		code: "identity.invalid_principal_wire",
+		messagePrefix: "Identity principal wire payload is invalid",
+		failure: result
+	});
+}
+function projectIdentityPrincipal(options) {
+	const principal = options.principal;
+	const subject = principal?.subject ?? options.fallbackSubject ?? "context.anonymous";
+	return {
+		subject,
+		displayName: principal?.displayName?.trim() || options.fallbackDisplayName || subject,
+		picture: principal?.picture,
+		issuer: principal?.issuer ?? options.fallbackIssuer,
+		claims: principal?.claims ?? options.fallbackClaims
 	};
+}
+//#endregion
+//#region src/protocol/jwt/error.ts
+const JwtDecodeErrorCode = {
+	InvalidFormat: "protocol.jwt.invalid_format",
+	InvalidPayload: "protocol.jwt.invalid_payload",
+	InvalidClaim: "protocol.jwt.invalid_claim"
+};
+var JwtDecodeError = class extends ClientError {
+	code;
+	constructor(options) {
+		super({
+			kind: ClientErrorKind.Protocol,
+			code: options.code,
+			message: options.message,
+			source: "protocol.jwt",
+			cause: options.cause
+		});
+		this.name = "JwtDecodeError";
+		this.code = options.code;
+	}
+};
+//#endregion
+//#region src/protocol/jwt/decode.ts
+function decodeJwtPayload(jwt, options = {}) {
+	const label = options.label ?? "JWT";
+	const parts = jwt.split(".");
+	if (parts.length !== 3) throw new JwtDecodeError({
+		code: JwtDecodeErrorCode.InvalidFormat,
+		message: `${label} must use compact JWS serialization`
+	});
+	const claims = parseBase64UrlJsonObject(parts[1], `${label} payload`);
+	validateRegisteredClaimTypes(claims, label);
+	return claims;
+}
+function parseBase64UrlJsonObject(value, label) {
+	let parsed;
+	try {
+		parsed = JSON.parse(decodeBase64UrlUtf8(value));
+	} catch (cause) {
+		throw new JwtDecodeError({
+			code: JwtDecodeErrorCode.InvalidPayload,
+			message: `${label} must be base64url-encoded JSON`,
+			cause
+		});
+	}
+	if (!isJsonObject(parsed)) throw new JwtDecodeError({
+		code: JwtDecodeErrorCode.InvalidPayload,
+		message: `${label} must be a JSON object`
+	});
+	return parsed;
+}
+function decodeBase64UrlUtf8(value) {
+	const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+	const binary = atob(padded);
+	const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+	return new TextDecoder().decode(bytes);
+}
+function validateRegisteredClaimTypes(claims, label) {
+	if (claims.exp !== void 0 && typeof claims.exp !== "number") throw new JwtDecodeError({
+		code: JwtDecodeErrorCode.InvalidClaim,
+		message: `${label} "exp" claim must be a number`
+	});
+	if (claims.iat !== void 0 && typeof claims.iat !== "number") throw new JwtDecodeError({
+		code: JwtDecodeErrorCode.InvalidClaim,
+		message: `${label} "iat" claim must be a number`
+	});
+	if (claims.nbf !== void 0 && typeof claims.nbf !== "number") throw new JwtDecodeError({
+		code: JwtDecodeErrorCode.InvalidClaim,
+		message: `${label} "nbf" claim must be a number`
+	});
+	if (claims.iss !== void 0 && typeof claims.iss !== "string") throw new JwtDecodeError({
+		code: JwtDecodeErrorCode.InvalidClaim,
+		message: `${label} "iss" claim must be a string`
+	});
+	if (claims.aud !== void 0 && typeof claims.aud !== "string" && !isStringArray(claims.aud)) throw new JwtDecodeError({
+		code: JwtDecodeErrorCode.InvalidClaim,
+		message: `${label} "aud" claim must be a string or string array`
+	});
+}
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+//#endregion
+//#region src/scheduling/duration.ts
+/**
+* Parse a human-readable duration string (for example `5m` or `300s`) into
+* milliseconds.
+*/
+function parseDurationToMs(duration) {
+	const match = duration.match(/^(\d+(?:\.\d+)?)\s*(s|ms|m|h)$/);
+	if (!match) return 0;
+	const value = Number(match[1]);
+	switch (match[2]) {
+		case "ms": return value;
+		case "s": return value * 1e3;
+		case "m": return value * 60 * 1e3;
+		case "h": return value * 60 * 60 * 1e3;
+		default: return 0;
+	}
+}
+//#endregion
+//#region src/storage/json-codec.ts
+/** Default JSON codec. */
+function createJsonCodec() {
 	return {
-		success: false,
-		issues: result.issues
+		encode(value) {
+			return JSON.stringify(value);
+		},
+		decode(raw) {
+			return JSON.parse(raw);
+		}
 	};
 }
+//#endregion
+//#region src/storage/ephemeral-flow-store.ts
+function resolveStorageKey(keyPrefix, key) {
+	return keyPrefix.length > 0 ? `${keyPrefix}:${key}` : key;
+}
+function requireRecordStoreTake(store) {
+	if (!store.take) throw new ClientError({
+		kind: ClientErrorKind.Configuration,
+		code: "storage.ephemeral.take_unavailable",
+		message: "Ephemeral flow stores require StorageTrait.take() for atomic single-consume semantics",
+		source: "storage.ephemeral"
+	});
+	return store.take.bind(store);
+}
+async function executeStorageOperation(operation) {
+	try {
+		return await operation();
+	} catch (error) {
+		if (error instanceof ClientError) throw error;
+		throw new ClientError({
+			kind: ClientErrorKind.Storage,
+			code: "storage.ephemeral.io_failed",
+			message: "The ephemeral flow store operation failed",
+			source: "storage.ephemeral",
+			cause: error
+		});
+	}
+}
+function decodeStoredValue(codec, value) {
+	try {
+		return codec.decode(value);
+	} catch (error) {
+		throw new ClientError({
+			kind: ClientErrorKind.Protocol,
+			code: "storage.ephemeral.invalid_payload",
+			message: "The ephemeral flow store payload is invalid",
+			source: "storage.ephemeral",
+			cause: error
+		});
+	}
+}
 /**
-* Validate an unknown input synchronously against a `@standard-schema`-compatible schema.
+* Create a typed ephemeral flow-state store backed by a low-level `StorageTrait`.
 *
-* Only use this when you know the schema's validate function returns synchronously.
-* Throws if the schema returns a Promise.
+* Intended for short-lived browser/session coordination state such as pending
+* redirects or callback fragments.
 */
-function validateWithSchemaSync(schema, input) {
-	const result = schema["~standard"].validate(input);
-	if (result instanceof Promise) throw new Error("validateWithSchemaSync: schema returned a Promise. Use validateWithSchema instead.");
-	if ("value" in result) return {
-		success: true,
-		value: result.value
-	};
+function createEphemeralFlowStore(options) {
+	const codec = options.codec ?? createJsonCodec();
+	const storeTake = requireRecordStoreTake(options.store);
+	async function load() {
+		const raw = await executeStorageOperation(() => options.store.get(options.key));
+		return raw === null ? null : decodeStoredValue(codec, raw);
+	}
+	async function save(value) {
+		await executeStorageOperation(() => options.store.set(options.key, codec.encode(value)));
+	}
+	async function consume() {
+		const raw = await executeStorageOperation(() => storeTake(options.key));
+		return raw === null ? null : decodeStoredValue(codec, raw);
+	}
+	async function clear() {
+		await executeStorageOperation(() => options.store.remove(options.key));
+	}
 	return {
-		success: false,
-		issues: result.issues
+		load,
+		save,
+		consume,
+		clear
 	};
 }
 /**
-* Create a minimal `@standard-schema`-compatible schema without requiring
-* an external validation library.
-*
-* This is useful for SDK-internal schemas where pulling in zod/valibot
-* would be excessive. For adopter-facing schemas, prefer a real validation
-* library.
-*
-* @example
-* ```ts
-* import { createSchema, validateWithSchema } from "@securitydept/client";
+* Create a typed keyed ephemeral flow-state store backed by a low-level
+* `StorageTrait`.
 *
-* const NameSchema = createSchema<unknown, { name: string }>({
-*   validate(input) {
-*     if (typeof input === "object" && input !== null && "name" in input &&
-*         typeof (input as any).name === "string") {
-*       return { value: { name: (input as any).name } };
-*     }
-*     return { issues: [{ message: "Expected object with string 'name'" }] };
-*   },
-* });
-*
-* const result = await validateWithSchema(NameSchema, { name: "Alice" });
-* ```
+* Intended for short-lived browser/session coordination state where multiple
+* pending records must coexist and be consumed independently.
 */
-function createSchema(options) {
-	return { "~standard": {
-		version: 1,
-		vendor: "securitydept",
-		validate: options.validate
-	} };
+function createKeyedEphemeralFlowStore(options) {
+	const codec = options.codec ?? createJsonCodec();
+	const storeTake = requireRecordStoreTake(options.store);
+	async function load(key) {
+		const raw = await executeStorageOperation(() => options.store.get(resolveStorageKey(options.keyPrefix, key)));
+		return raw === null ? null : decodeStoredValue(codec, raw);
+	}
+	async function save(key, value) {
+		await executeStorageOperation(() => options.store.set(resolveStorageKey(options.keyPrefix, key), codec.encode(value)));
+	}
+	async function take(key) {
+		const raw = await executeStorageOperation(() => storeTake(resolveStorageKey(options.keyPrefix, key)));
+		return raw === null ? null : decodeStoredValue(codec, raw);
+	}
+	async function clear(key) {
+		await executeStorageOperation(() => options.store.remove(resolveStorageKey(options.keyPrefix, key)));
+	}
+	return {
+		load,
+		save,
+		take,
+		clear
+	};
+}
+//#endregion
+//#region src/struct/async-lock.ts
+const OnceAsyncLockState = {
+	Init: "init",
+	Running: "running",
+	Success: "success",
+	Error: "error"
+};
+function createOnceAsyncLockCallable(fn) {
+	const internalStateSignal = createSignal({ state: OnceAsyncLockState.Init });
+	const coreFn = async function(...args) {
+		const internalState = internalStateSignal.get();
+		if (internalState.state === OnceAsyncLockState.Running) return internalState.promise;
+		if (internalState.state === OnceAsyncLockState.Success) return internalState.data;
+		let resolvePromise;
+		let rejectPromise;
+		const promise = new Promise((res, rej) => {
+			resolvePromise = res;
+			rejectPromise = rej;
+		});
+		promise.catch(() => void 0);
+		internalStateSignal.set({
+			state: OnceAsyncLockState.Running,
+			promise
+		});
+		try {
+			const result = await fn.apply(this, args);
+			internalStateSignal.set({
+				state: OnceAsyncLockState.Success,
+				data: result
+			});
+			resolvePromise(result);
+			return result;
+		} catch (err) {
+			internalStateSignal.set({
+				state: OnceAsyncLockState.Error,
+				error: err
+			});
+			rejectPromise(err);
+			throw err;
+		}
+	};
+	return new Proxy(coreFn, {
+		get(target, prop, receiver) {
+			const internalState = internalStateSignal.get();
+			if (prop in internalState) return Reflect.get(internalState, prop);
+			if (prop === "get" || prop === "watchStream" || prop === SYMBOL_OBSERVABLE) {
+				const value = Reflect.get(internalStateSignal, prop, internalStateSignal);
+				return typeof value === "function" ? value.bind(internalStateSignal) : value;
+			}
+			return Reflect.get(target, prop, receiver);
+		},
+		set() {
+			return false;
+		}
+	});
+}
+//#endregion
+//#region src/transport/url.ts
+/**
+* Returns `true` for loopback HTTP URLs that browsers and local tooling often
+* permit during development flows.
+*/
+function isLoopbackHttpUrl(url) {
+	return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1" || url.hostname === "[::1]");
 }
 //#endregion
-export { ClientError, ClientErrorKind, ClientErrorSource, ErrorPresentationTone, EventSourceKind, FetchTransportRedirectKind, LogLevel, OperationTraceEventType, PromiseSettlementKind, UserRecovery, concatMap, createCancellationTokenSource, createComputed, createConsoleLogger, createDefaultClock, createDefaultScheduler, createEphemeralFlowStore, createEventStream, createInMemoryRecordStore, createJsonCodec, createKeyedEphemeralFlowStore, createLinkedCancellationToken, createNoopLogger, createOperationTracer, createReplaySubject, createRuntime, createSchema, createSignal, createSubject, createTraceTimelineStore, debounceTime, exhaustMap, filter, finalize, fromEventPattern, fromPromise, fromRxObservable, fromSignal, interval, map, merge, normalizeAuthenticatedPrincipal, normalizeAuthenticatedPrincipalWire, pipe, projectAuthenticatedPrincipal, readErrorPresentationDescriptor, readonlySignal, scheduleAt, share, shareReplay, switchMap, takeUntil, tap, throttleTime, timer, toRxObservable, validateWithSchema, validateWithSchemaSync, withLatestFromSignal };
+export { Base64CompatErrorCode, BaseRequirementPlanner, BaseURIStringSchema, ClientError, ClientErrorKind, ClientErrorSource, ENVIRONMENT_TOKEN, ErrorPresentationTone, EventSourceKind, FetchTransportRedirectKind, IDLE_CALLBACK_TRAIT_TOKEN, INJECTOR_TOKEN, IdentityPrincipalSchema, IdentityPrincipalWireSchema, JwtDecodeError, JwtDecodeErrorCode, MergeRequirementPlanner, OnceAsyncLockState, OperationSpan, OperationTraceEventType, PAGE_LIFECYCLE_TRAIT_TOKEN, PERSISTENT_STORAGE_TRAIT_TOKEN, POPUP_TRAIT_TOKEN, PipelineOutcome, PlanStatus, PopupAttachFailureReason, PopupClientWindowHandle, PopupErrorCode, PopupServerWindowHandle, REALM_STORAGE_TRAIT_TOKEN, REQUIREMENT_PLANNER_HOST, ROUTER_TRAIT_TOKEN, RequirementPlannerError, RequirementPlannerHost, RequirementsComposition, ResolutionStatus, ResourceError, ResourceErrorCode, ResourceSnapshotUpdateKind, ResourceStatus, RouteCompositionRequirementPlanner, RouterNavigationIntent, RouterNavigationMode, SECURITYDEPT_COMPAT_FRAGMENT_VERSION, SECURITYDEPT_ROUTE_METADATA_KEY, SESSION_STORAGE_TRAIT_TOKEN, SPAN_TRAIT_TOKEN, SYMBOL_ASYNC_DISPOSE, SYMBOL_DISPOSABLE_STACK, SYMBOL_DISPOSE, SYMBOL_OBSERVABLE, SecurityDeptOptional, SecuritydeptDestroyRef, SecuritydeptInjectionToken, SecuritydeptInjector, SimpleDisposableStack, StaticAttrsAuthRequirement, StaticRequirementPlanner, StdDisposableStack, StorageChangeEventOrigin, TIME_TRAIT_TOKEN, TRACING_TRAIT_TOKEN, TRANSPORT_TRAIT_TOKEN, TracingLevel, TransportErrorCode, UriParseError, UriReferenceString, UriReferenceStringSchema, UriRelativeString, UriRelativeStringSchema, UriString, UriStringSchema, UserRecovery, abortSignalToCancellationToken, abortSignalToEventStream, appendOrReplaceCompatFragment, cancellationTokenToAbortSignal, createAuthorizationInterceptedFetch, createBaseTransportForStdFetch, createCancellationTokenSource, createComputed, createConsoleTracingSubscriber, createDisposableStack, createEmptyEventStream, createEphemeralFlowStore, createEventReplaySubject, createEventStream, createEventSubject, createFoundationEnvironment, createInMemoryRecordStore, createJsonCodec, createJsonRpcClient, createJsonRpcServer, createJsonRpcServerAndClient, createKeyedEphemeralFlowStore, createLinkedCancellationToken, createNeverEventStream, createOnceAsyncLockCallable, createProviderIfTokenMissing, createResource, createRootSpan, createSecuritydeptDestroyRef, createSignal, createTimeForStd, createTraceTimelineStore, createTracing, decodeBase64ToUint8Array, decodeJwtPayload, defaultSelectCandidate, defineInstrumentMethodDecorator, describeError, encodeUint8ArrayToBase64, flattenResourceSnapshot, formatValidationFailure, getSecuritydeptProviderToken, inject, injectDisposableStackFrom, injectRequirementPlannerHost, isCancellationTokenTrait, isCompatFragmentBlock, isInteropObservableTrait, isLoopbackHttpUrl, isRouteBehaviourContextExtra, isRouteStateSnapshotTrait, mapResource, normalizeAbortError, notMissingProvider, parseCompatFragment, parseDurationToMs, parseIdentityPrincipal, parseIdentityPrincipalWire, projectIdentityPrincipal, promisesToRacedAsyncGenerator, provideRequirementPlannerHost, readErrorPresentationDescriptor, readPopupErrorPresentationDescriptor, readSecuritydeptRouteMetadata, readonlySignal, reduceResourceSnapshot, resolveEffectiveRequirements, resourceFromSnapshots, runInInjectionContext, runOperation, takeCompatFragment, takeCompatFragmentFromRouter, throwValidationClientError, toEventStream, tryInjectInInjectionContext, validateTraitInput, validateWithSchema, validateWithSchemaSync, whenResourceSnapshotValue, withDisposableStack, writeSecuritydeptRouteMetadata };
 
 //# sourceMappingURL=index.mjs.map