@securitydept/client 0.3.0-beta.3 → 0.3.0-beta.5

package/dist/planner-host-BTWie0lo.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"planner-host-BTWie0lo.mjs","names":[],"sources":["../src/auth-coordination/requirement-planner.ts","../src/auth-coordination/planner-host.ts"],"sourcesContent":["// Shared auth requirement planner — headless multi-requirement coordination\n//\n// Canonical location: @securitydept/client/auth-coordination\n//\n// Provides a mode-agnostic, framework-agnostic primitive for expressing\n// multi-requirement / multi-auth-context orchestration flows.\n//\n// Core concept:\n//   1. Define a list of AuthRequirements (e.g. \"need session\", \"need oidc token\")\n//   2. The RequirementPlanner tells you which requirement is pending next\n//   3. When a requirement is resolved, it advances to the next one\n//   4. When all are resolved, the plan is settled\n//\n// The planner is intentionally headless — it does NOT:\n//   - Know about specific auth modes or protocols\n//   - Render UI or manage popup/redirect flows\n//   - Own cross-tab state or leader election\n//\n// Owner rationale: This module does not depend on token-set domain objects\n// (token snapshots, bearer propagation, OIDC callback, refresh). Its\n// RequirementKind vocabulary covers session, OIDC, and custom — clearly\n// cross-auth-context. It is a shared coordination capability, not a\n// token-set product surface. Canonical owner is @securitydept/client.\n\n// ---------------------------------------------------------------------------\n// Requirement definition\n// ---------------------------------------------------------------------------\n\n/** A single auth requirement within an orchestration plan. */\nexport interface AuthRequirement {\n\t/** Unique identifier for this requirement within the plan. */\n\tid: string;\n\t/**\n\t * The kind of auth requirement.\n\t *\n\t * An opaque string. Each auth-context family (token-set, session, basic-auth)\n\t * or adopter project may define its own named constants.\n\t *\n\t * @example \"session\", \"frontend_oidc\", \"backend_oidc\", \"custom\"\n\t */\n\tkind: string;\n\t/** Human-readable label (for logging / debugging). */\n\tlabel?: string;\n\t/** Arbitrary metadata the adopter can attach. */\n\tattributes?: Record<string, unknown>;\n}\n\n// ---------------------------------------------------------------------------\n// Resolution\n// ---------------------------------------------------------------------------\n\n/** Outcome of resolving a single requirement. */\nexport const ResolutionStatus = {\n\tFulfilled: \"fulfilled\",\n\tFailed: \"failed\",\n\tSkipped: \"skipped\",\n} as const;\n\nexport type ResolutionStatus =\n\t(typeof ResolutionStatus)[keyof typeof ResolutionStatus];\n\n/** The resolution result for a single requirement. */\nexport interface RequirementResolution {\n\t/** The requirement ID this resolution applies to. */\n\trequirementId: string;\n\t/** Outcome status. */\n\tstatus: ResolutionStatus;\n\t/** Optional error or reason for failure/skip. */\n\treason?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Plan state\n// ---------------------------------------------------------------------------\n\n/** Overall plan status. */\nexport const PlanStatus = {\n\t/** There are still pending requirements. */\n\tPending: \"pending\",\n\t/** All requirements have been resolved. */\n\tSettled: \"settled\",\n} as const;\n\nexport type PlanStatus = (typeof PlanStatus)[keyof typeof PlanStatus];\n\n/** Internal state for a single requirement within the plan. */\ninterface RequirementState {\n\trequirement: AuthRequirement;\n\tresolution: RequirementResolution | null;\n}\n\n/** Read-only snapshot of the current plan state. */\nexport interface PlanSnapshot {\n\t/** Overall plan status. */\n\tstatus: PlanStatus;\n\t/** The next pending requirement, or `null` if settled. */\n\tnextPending: AuthRequirement | null;\n\t/** All resolutions collected so far (in order). */\n\tresolutions: readonly RequirementResolution[];\n\t/** Total requirement count. */\n\ttotal: number;\n\t/** Number of resolved requirements. */\n\tresolved: number;\n}\n\n// ---------------------------------------------------------------------------\n// Planner errors\n// ---------------------------------------------------------------------------\n\n/** Error thrown when a planner operation is invalid. */\nexport class RequirementPlannerError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"RequirementPlannerError\";\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// RequirementPlanner\n// ---------------------------------------------------------------------------\n\n/** Options for creating a {@link RequirementPlanner}. */\nexport interface CreateRequirementPlannerOptions {\n\t/** Ordered list of requirements to fulfill. */\n\trequirements: readonly AuthRequirement[];\n}\n\n/**\n * Headless multi-requirement planner.\n *\n * Drives a sequential requirement fulfillment flow:\n *   1. Call {@link snapshot} to see what's pending.\n *   2. Resolve the {@link PlanSnapshot.nextPending} requirement.\n *   3. Call {@link resolve} with the result.\n *   4. Repeat until {@link PlanSnapshot.status} is `\"settled\"`.\n *\n * @example\n * ```ts\n * import { createRequirementPlanner, PlanStatus, ResolutionStatus } from \"@securitydept/client/auth-coordination\";\n *\n * const planner = createRequirementPlanner({\n *   requirements: [\n *     { id: \"session\", kind: \"session\" },\n *     { id: \"api-token\", kind: \"backend_oidc\" },\n *   ],\n * });\n *\n * let snap = planner.snapshot();\n * while (snap.status === PlanStatus.Pending) {\n *   const req = snap.nextPending!;\n *   // ... perform auth action for req.kind ...\n *   planner.resolve({ requirementId: req.id, status: ResolutionStatus.Fulfilled });\n *   snap = planner.snapshot();\n * }\n * // snap.status === PlanStatus.Settled\n * ```\n */\nexport interface RequirementPlanner {\n\t/** Get a read-only snapshot of the current plan state. */\n\tsnapshot(): PlanSnapshot;\n\t/** Resolve the next pending requirement. */\n\tresolve(resolution: RequirementResolution): void;\n\t/** Reset the planner to its initial state. */\n\treset(): void;\n}\n\n/**\n * Create a headless requirement planner.\n *\n * @see {@link RequirementPlanner} for usage.\n */\nexport function createRequirementPlanner(\n\toptions: CreateRequirementPlannerOptions,\n): RequirementPlanner {\n\tif (options.requirements.length === 0) {\n\t\tthrow new RequirementPlannerError(\n\t\t\t\"Cannot create a planner with zero requirements\",\n\t\t);\n\t}\n\n\t// Validate uniqueness of requirement IDs.\n\tconst ids = new Set<string>();\n\tfor (const req of options.requirements) {\n\t\tif (ids.has(req.id)) {\n\t\t\tthrow new RequirementPlannerError(\n\t\t\t\t`Duplicate requirement ID: \"${req.id}\"`,\n\t\t\t);\n\t\t}\n\t\tids.add(req.id);\n\t}\n\n\tlet states: RequirementState[] = [];\n\n\t/** Shallow-clone a requirement to prevent external mutation. */\n\tfunction cloneRequirement(r: AuthRequirement): AuthRequirement {\n\t\treturn {\n\t\t\t...r,\n\t\t\tattributes: r.attributes ? { ...r.attributes } : undefined,\n\t\t};\n\t}\n\n\tfunction initStates(): void {\n\t\tstates = options.requirements.map((r) => ({\n\t\t\trequirement: cloneRequirement(r),\n\t\t\tresolution: null,\n\t\t}));\n\t}\n\n\tinitStates();\n\n\tfunction findNextPending(): RequirementState | null {\n\t\treturn states.find((s) => s.resolution === null) ?? null;\n\t}\n\n\treturn {\n\t\tsnapshot(): PlanSnapshot {\n\t\t\tconst next = findNextPending();\n\t\t\tconst resolutions: RequirementResolution[] = [];\n\t\t\tfor (const s of states) {\n\t\t\t\tif (s.resolution !== null) resolutions.push({ ...s.resolution });\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: next === null ? PlanStatus.Settled : PlanStatus.Pending,\n\t\t\t\tnextPending: next ? cloneRequirement(next.requirement) : null,\n\t\t\t\tresolutions,\n\t\t\t\ttotal: states.length,\n\t\t\t\tresolved: resolutions.length,\n\t\t\t};\n\t\t},\n\n\t\tresolve(resolution: RequirementResolution): void {\n\t\t\tconst next = findNextPending();\n\t\t\tif (next === null) {\n\t\t\t\tthrow new RequirementPlannerError(\n\t\t\t\t\t\"Cannot resolve: all requirements are already settled\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (resolution.requirementId !== next.requirement.id) {\n\t\t\t\tthrow new RequirementPlannerError(\n\t\t\t\t\t`Cannot resolve requirement \"${resolution.requirementId}\": ` +\n\t\t\t\t\t\t`the next pending requirement is \"${next.requirement.id}\"`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tnext.resolution = resolution;\n\t\t},\n\n\t\treset(): void {\n\t\t\tinitStates();\n\t\t},\n\t};\n}\n","// Shared planner-host — route-scoped auth coordination host layer\n//\n// Canonical location: @securitydept/client/auth-coordination\n//\n// Provides the host-layer contract for multi-requirement auth guards:\n//   - AuthGuardClientOption: a single requirement candidate with its\n//     authentication check and unauthenticated action\n//   - RequirementsClientSet / ScopedRequirementsClientSet: composable\n//     requirement client collections with inherit/merge/replace semantics\n//   - PlannerHost: the coordination contract that selects which pending\n//     candidate to act on, built on RequirementPlanner for sequential\n//     resolution discipline\n//\n// The planner-host is intentionally headless and framework-agnostic.\n// Framework-specific provider/lookup (Angular DI, React Context) is handled\n// by the framework adapter packages (@securitydept/client-angular,\n// @securitydept/client-react).\n//\n// Architecture:\n//   PlannerHost.evaluate() uses createRequirementPlanner() internally:\n//   1. Build AuthRequirement[] from candidates' requirementId/kind/label/attributes\n//   2. Auto-resolve already-authenticated requirements as Fulfilled\n//   3. Ask the planner for nextPending — respects declaration order and\n//      skips already-satisfied requirements\n//   4. Among candidates still unauthenticated, use selectCandidate() to\n//      pick the one to act on (default: the one matching nextPending first)\n//\n// Owner rationale: This module does not depend on token-set, session, or\n// basic-auth domain objects. It is a shared coordination capability.\n// Canonical owner is @securitydept/client.\n\nimport {\n\ttype AuthRequirement,\n\tcreateRequirementPlanner,\n\tPlanStatus,\n\tResolutionStatus,\n} from \"./requirement-planner\";\n\n// ---------------------------------------------------------------------------\n// Auth guard client option — a single requirement candidate\n// ---------------------------------------------------------------------------\n\n/**\n * A single requirement candidate that a guard submits to the planner-host.\n *\n * Each option describes:\n * 1. What auth requirement it represents (id, kind, label)\n * 2. How to check whether it's already satisfied\n * 3. What to do when the planner selects it as the next pending action\n */\nexport interface AuthGuardClientOption {\n\t/** Unique identifier for this requirement candidate. */\n\trequirementId: string;\n\n\t/**\n\t * The kind of auth requirement (opaque string).\n\t * @example \"session\", \"frontend_oidc\", \"backend_oidc\"\n\t */\n\trequirementKind: string;\n\n\t/** Human-readable label (for logging / debugging / chooser UI). */\n\tlabel?: string;\n\n\t/** Arbitrary metadata the adopter can attach. */\n\tattributes?: Record<string, unknown>;\n\n\t/**\n\t * Check whether this requirement candidate is already authenticated.\n\t * Called synchronously by the planner-host during evaluation.\n\t */\n\tcheckAuthenticated: () => boolean;\n\n\t/**\n\t * Action to execute when this candidate is selected as the pending\n\t * requirement by the planner-host.\n\t *\n\t * Return value semantics:\n\t * - `true` — allow navigation (requirement will be resolved externally)\n\t * - `false` — block navigation\n\t * - `string` — redirect to the given URL\n\t * - `Promise<...>` — async version of the above\n\t */\n\tonUnauthenticated: () => boolean | string | Promise<boolean | string>;\n}\n\n// ---------------------------------------------------------------------------\n// Requirements client set — composable requirement collections\n// ---------------------------------------------------------------------------\n\n/** A flat collection of requirement candidates. */\nexport interface RequirementsClientSet {\n\treadonly options: readonly AuthGuardClientOption[];\n}\n\n/**\n * How a child scope's requirements client set relates to its parent.\n *\n * - `inherit` — use the parent's set as-is (child adds nothing)\n * - `merge` — inherit parent's options, then append/override with child's\n *   (child options with the same `requirementId` replace parent ones)\n * - `replace` — discard parent's set entirely, use child's set only\n */\nexport const RequirementsClientSetComposition = {\n\tInherit: \"inherit\",\n\tMerge: \"merge\",\n\tReplace: \"replace\",\n} as const;\n\nexport type RequirementsClientSetComposition =\n\t(typeof RequirementsClientSetComposition)[keyof typeof RequirementsClientSetComposition];\n\n/** A requirements client set annotated with its composition strategy. */\nexport interface ScopedRequirementsClientSet {\n\t/** How this set composes with its parent scope. */\n\tcomposition: RequirementsClientSetComposition;\n\t/** The requirement candidates declared at this scope. */\n\toptions: readonly AuthGuardClientOption[];\n}\n\n// ---------------------------------------------------------------------------\n// Resolve effective client set (parent + child composition)\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the effective requirements client set by composing a parent set\n * with a child scope's declaration.\n *\n * @param parentOptions - The parent scope's resolved options (or empty).\n * @param child - The child scope's scoped set (with composition strategy).\n * @returns The effective options after composition.\n */\nexport function resolveEffectiveClientSet(\n\tparentOptions: readonly AuthGuardClientOption[],\n\tchild: ScopedRequirementsClientSet,\n): AuthGuardClientOption[] {\n\tswitch (child.composition) {\n\t\tcase RequirementsClientSetComposition.Inherit:\n\t\t\treturn [...parentOptions];\n\n\t\tcase RequirementsClientSetComposition.Merge: {\n\t\t\t// Start with parent options, then override/append with child options.\n\t\t\t// Child options with the same requirementId replace parent ones.\n\t\t\tconst merged = new Map<string, AuthGuardClientOption>();\n\t\t\tfor (const opt of parentOptions) {\n\t\t\t\tmerged.set(opt.requirementId, opt);\n\t\t\t}\n\t\t\tfor (const opt of child.options) {\n\t\t\t\tmerged.set(opt.requirementId, opt);\n\t\t\t}\n\t\t\treturn [...merged.values()];\n\t\t}\n\n\t\tcase RequirementsClientSetComposition.Replace:\n\t\t\treturn [...child.options];\n\n\t\tdefault: {\n\t\t\tconst _exhaustive: never = child.composition;\n\t\t\tthrow new Error(\n\t\t\t\t`[resolveEffectiveClientSet] Unknown composition: ${_exhaustive}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Planner-host result\n// ---------------------------------------------------------------------------\n\n/** Result of a planner-host evaluation. */\nexport interface PlannerHostResult {\n\t/** Whether all candidates are authenticated (route can activate). */\n\tallAuthenticated: boolean;\n\n\t/** All candidates that are not yet authenticated. */\n\tunauthenticatedCandidates: readonly AuthGuardClientOption[];\n\n\t/**\n\t * The candidate selected by the planner as the next one to act on.\n\t * `null` when `allAuthenticated` is true.\n\t *\n\t * Determined by the RequirementPlanner's sequential resolution discipline:\n\t * the first unresolved requirement in declaration order that is still\n\t * unauthenticated, then optionally further narrowed by `selectCandidate`.\n\t */\n\tpendingCandidate: AuthGuardClientOption | null;\n}\n\n// ---------------------------------------------------------------------------\n// Planner-host contract and factory\n// ---------------------------------------------------------------------------\n\n/**\n * A candidate selection strategy.\n *\n * Receives the list of unauthenticated candidates (in RequirementPlanner\n * declaration order) and returns the one that should be acted on next.\n * The default strategy picks the first one (matching the planner's\n * `nextPending` requirement).\n *\n * Async selectors are supported: return a `Promise<AuthGuardClientOption>`\n * to implement interactive chooser UIs (e.g. show a dialog and await the\n * user's pick before navigation continues).\n *\n * @example\n * ```ts\n * // Async chooser: show a dialog and await user's selection\n * const selectCandidate: CandidateSelector = async (candidates) => {\n *   const chosen = await showChooserDialog(candidates);\n *   return chosen;\n * };\n * ```\n */\nexport type CandidateSelector = (\n\tunauthenticated: readonly AuthGuardClientOption[],\n) => AuthGuardClientOption | Promise<AuthGuardClientOption>;\n\n/** The planner-host coordination contract. */\nexport interface PlannerHost {\n\t/**\n\t * Evaluate a set of requirement candidates using RequirementPlanner's\n\t * sequential resolution discipline.\n\t *\n\t * Always returns a Promise so that custom async selectors (e.g. chooser\n\t * dialog) are fully supported. Callers should always `await` the result.\n\t *\n\t * @param candidates - The resolved candidates from the guard's client options.\n\t * @returns Promise resolving to the evaluation result.\n\t */\n\tevaluate(\n\t\tcandidates: readonly AuthGuardClientOption[],\n\t): Promise<PlannerHostResult>;\n}\n\n/** Options for {@link createPlannerHost}. */\nexport interface CreatePlannerHostOptions {\n\t/**\n\t * Custom candidate selection strategy.\n\t *\n\t * The default strategy picks the candidate that corresponds to the\n\t * RequirementPlanner's `nextPending` requirement (first unauthenticated\n\t * in declaration order).\n\t *\n\t * A custom strategy can further filter or reorder the unauthenticated\n\t * candidates, e.g. to implement a chooser UI that lets the user pick.\n\t *\n\t * @default first-unauthenticated-matching-planner-nextPending\n\t *\n\t * @example\n\t * ```ts\n\t * // Async chooser: present all options and await user's pick\n\t * createPlannerHost({\n\t *   selectCandidate: async (candidates) => {\n\t *     return await showChooserDialog(candidates);\n\t *   },\n\t * })\n\t * ```\n\t */\n\tselectCandidate?: CandidateSelector;\n}\n\n/**\n * Default candidate selector: picks the first unauthenticated candidate\n * in declaration order (which aligns with RequirementPlanner's nextPending).\n */\nfunction defaultSelectCandidate(\n\tunauthenticated: readonly AuthGuardClientOption[],\n): AuthGuardClientOption {\n\treturn unauthenticated[0];\n}\n\n/**\n * Create a planner-host instance backed by {@link createRequirementPlanner}.\n *\n * **How it works:**\n *\n * 1. `evaluate()` builds an `AuthRequirement[]` from `candidates`\n *    (using each candidate's `requirementId`, `requirementKind`, `label`,\n *    and `attributes`).\n * 2. A `RequirementPlanner` is created for this evaluation cycle.\n * 3. Already-authenticated requirements are auto-resolved as `Fulfilled`,\n *    respecting the planner's sequential discipline.\n * 4. The planner's `nextPending` determines the first unresolved requirement\n *    in declaration order.\n * 5. `selectCandidate` is called with all unauthenticated candidates so\n *    adopters can implement custom chooser strategies (e.g. UI dialog).\n *    The default strategy picks the first candidate (matching nextPending).\n *\n * `evaluate()` always returns a `Promise` to accommodate async selectors.\n * For synchronous selectors the Promise resolves in the same microtask tick.\n *\n * @example\n * ```ts\n * import { createPlannerHost } from \"@securitydept/client/auth-coordination\";\n *\n * // Default sequential strategy (sync selector, wrapped in Promise)\n * const host = createPlannerHost();\n * const result = await host.evaluate(candidates);\n *\n * // Async chooser strategy — show a dialog and await user's pick\n * const hostWithChooser = createPlannerHost({\n *   selectCandidate: async (candidates) => {\n *     return await showChooserDialog(candidates);\n *   },\n * });\n * ```\n */\nexport function createPlannerHost(\n\toptions?: CreatePlannerHostOptions,\n): PlannerHost {\n\tconst selector = options?.selectCandidate ?? defaultSelectCandidate;\n\n\treturn {\n\t\tasync evaluate(\n\t\t\tcandidates: readonly AuthGuardClientOption[],\n\t\t): Promise<PlannerHostResult> {\n\t\t\tif (candidates.length === 0) {\n\t\t\t\treturn {\n\t\t\t\t\tallAuthenticated: true,\n\t\t\t\t\tunauthenticatedCandidates: [],\n\t\t\t\t\tpendingCandidate: null,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Build AuthRequirement[] from candidates for the planner.\n\t\t\tconst requirements: AuthRequirement[] = candidates.map((c) => ({\n\t\t\t\tid: c.requirementId,\n\t\t\t\tkind: c.requirementKind,\n\t\t\t\tlabel: c.label,\n\t\t\t\tattributes: c.attributes,\n\t\t\t}));\n\n\t\t\t// Create a fresh planner for this evaluation cycle.\n\t\t\tconst planner = createRequirementPlanner({ requirements });\n\n\t\t\t// Auto-resolve already-authenticated requirements in declaration order.\n\t\t\t// The planner enforces sequential discipline: we must resolve in order.\n\t\t\tfor (const candidate of candidates) {\n\t\t\t\tconst snap = planner.snapshot();\n\t\t\t\tif (snap.status === PlanStatus.Settled) break;\n\n\t\t\t\t// Resolve the planner's current nextPending if it's authenticated.\n\t\t\t\t// Only advance the planner for requirements that are currently pending\n\t\t\t\t// in order — skip if the current nextPending doesn't match this candidate.\n\t\t\t\tif (\n\t\t\t\t\tsnap.nextPending?.id === candidate.requirementId &&\n\t\t\t\t\tcandidate.checkAuthenticated()\n\t\t\t\t) {\n\t\t\t\t\tplanner.resolve({\n\t\t\t\t\t\trequirementId: candidate.requirementId,\n\t\t\t\t\t\tstatus: ResolutionStatus.Fulfilled,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Check overall status after resolving all authenticated requirements.\n\t\t\tconst finalSnap = planner.snapshot();\n\n\t\t\t// Collect all unauthenticated candidates.\n\t\t\tconst unauthenticated = candidates.filter((c) => !c.checkAuthenticated());\n\n\t\t\tif (\n\t\t\t\tfinalSnap.status === PlanStatus.Settled ||\n\t\t\t\tunauthenticated.length === 0\n\t\t\t) {\n\t\t\t\treturn {\n\t\t\t\t\tallAuthenticated: true,\n\t\t\t\t\tunauthenticatedCandidates: [],\n\t\t\t\t\tpendingCandidate: null,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Await selection — supports both sync and async selectors.\n\t\t\t// The selector receives the unauthenticated candidates in declaration\n\t\t\t// order so adopters can implement any picking strategy.\n\t\t\tconst pendingCandidate = await selector(unauthenticated);\n\t\t\treturn {\n\t\t\t\tallAuthenticated: false,\n\t\t\t\tunauthenticatedCandidates: unauthenticated,\n\t\t\t\tpendingCandidate,\n\t\t\t};\n\t\t},\n\t};\n}\n"],"mappings":";;AAoDA,MAAa,mBAAmB;CAC/B,WAAW;CACX,QAAQ;CACR,SAAS;CACT;;AAoBD,MAAa,aAAa;;CAEzB,SAAS;;CAET,SAAS;CACT;;AA6BD,IAAa,0BAAb,cAA6C,MAAM;CAClD,YAAY,SAAiB;EAC5B,MAAM,QAAQ;EACd,KAAK,OAAO;;;;;;;;AA0Dd,SAAgB,yBACf,SACqB;CACrB,IAAI,QAAQ,aAAa,WAAW,GACnC,MAAM,IAAI,wBACT,iDACA;CAIF,MAAM,sBAAM,IAAI,KAAa;CAC7B,KAAK,MAAM,OAAO,QAAQ,cAAc;EACvC,IAAI,IAAI,IAAI,IAAI,GAAG,EAClB,MAAM,IAAI,wBACT,8BAA8B,IAAI,GAAG,GACrC;EAEF,IAAI,IAAI,IAAI,GAAG;;CAGhB,IAAI,SAA6B,EAAE;;CAGnC,SAAS,iBAAiB,GAAqC;EAC9D,OAAO;GACN,GAAG;GACH,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,GAAG,KAAA;GACjD;;CAGF,SAAS,aAAmB;EAC3B,SAAS,QAAQ,aAAa,KAAK,OAAO;GACzC,aAAa,iBAAiB,EAAE;GAChC,YAAY;GACZ,EAAE;;CAGJ,YAAY;CAEZ,SAAS,kBAA2C;EACnD,OAAO,OAAO,MAAM,MAAM,EAAE,eAAe,KAAK,IAAI;;CAGrD,OAAO;EACN,WAAyB;GACxB,MAAM,OAAO,iBAAiB;GAC9B,MAAM,cAAuC,EAAE;GAC/C,KAAK,MAAM,KAAK,QACf,IAAI,EAAE,eAAe,MAAM,YAAY,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC;GAEjE,OAAO;IACN,QAAQ,SAAS,OAAO,WAAW,UAAU,WAAW;IACxD,aAAa,OAAO,iBAAiB,KAAK,YAAY,GAAG;IACzD;IACA,OAAO,OAAO;IACd,UAAU,YAAY;IACtB;;EAGF,QAAQ,YAAyC;GAChD,MAAM,OAAO,iBAAiB;GAC9B,IAAI,SAAS,MACZ,MAAM,IAAI,wBACT,uDACA;GAEF,IAAI,WAAW,kBAAkB,KAAK,YAAY,IACjD,MAAM,IAAI,wBACT,+BAA+B,WAAW,cAAc,sCACnB,KAAK,YAAY,GAAG,GACzD;GAEF,KAAK,aAAa;;EAGnB,QAAc;GACb,YAAY;;EAEb;;;;;;;;;;;;ACnJF,MAAa,mCAAmC;CAC/C,SAAS;CACT,OAAO;CACP,SAAS;CACT;;;;;;;;;AAyBD,SAAgB,0BACf,eACA,OAC0B;CAC1B,QAAQ,MAAM,aAAd;EACC,KAAK,iCAAiC,SACrC,OAAO,CAAC,GAAG,cAAc;EAE1B,KAAK,iCAAiC,OAAO;GAG5C,MAAM,yBAAS,IAAI,KAAoC;GACvD,KAAK,MAAM,OAAO,eACjB,OAAO,IAAI,IAAI,eAAe,IAAI;GAEnC,KAAK,MAAM,OAAO,MAAM,SACvB,OAAO,IAAI,IAAI,eAAe,IAAI;GAEnC,OAAO,CAAC,GAAG,OAAO,QAAQ,CAAC;;EAG5B,KAAK,iCAAiC,SACrC,OAAO,CAAC,GAAG,MAAM,QAAQ;EAE1B,SAAS;GACR,MAAM,cAAqB,MAAM;GACjC,MAAM,IAAI,MACT,oDAAoD,cACpD;;;;;;;;AAyGJ,SAAS,uBACR,iBACwB;CACxB,OAAO,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCxB,SAAgB,kBACf,SACc;CACd,MAAM,WAAW,SAAS,mBAAmB;CAE7C,OAAO,EACN,MAAM,SACL,YAC6B;EAC7B,IAAI,WAAW,WAAW,GACzB,OAAO;GACN,kBAAkB;GAClB,2BAA2B,EAAE;GAC7B,kBAAkB;GAClB;EAYF,MAAM,UAAU,yBAAyB,EAAE,cARH,WAAW,KAAK,OAAO;GAC9D,IAAI,EAAE;GACN,MAAM,EAAE;GACR,OAAO,EAAE;GACT,YAAY,EAAE;GACd,EAGsD,EAAE,CAAC;EAI1D,KAAK,MAAM,aAAa,YAAY;GACnC,MAAM,OAAO,QAAQ,UAAU;GAC/B,IAAI,KAAK,WAAW,WAAW,SAAS;GAKxC,IACC,KAAK,aAAa,OAAO,UAAU,iBACnC,UAAU,oBAAoB,EAE9B,QAAQ,QAAQ;IACf,eAAe,UAAU;IACzB,QAAQ,iBAAiB;IACzB,CAAC;;EAKJ,MAAM,YAAY,QAAQ,UAAU;EAGpC,MAAM,kBAAkB,WAAW,QAAQ,MAAM,CAAC,EAAE,oBAAoB,CAAC;EAEzE,IACC,UAAU,WAAW,WAAW,WAChC,gBAAgB,WAAW,GAE3B,OAAO;GACN,kBAAkB;GAClB,2BAA2B,EAAE;GAC7B,kBAAkB;GAClB;EAOF,OAAO;GACN,kBAAkB;GAClB,2BAA2B;GAC3B,kBAAA,MAJ8B,SAAS,gBAAgB;GAKvD;IAEF"}

package/dist/planner-host-DN9dRsQx.d.mts

@@ -1,190 +0,0 @@
-//#region src/auth-coordination/planner-host.d.ts
-/**
- * A single requirement candidate that a guard submits to the planner-host.
- *
- * Each option describes:
- * 1. What auth requirement it represents (id, kind, label)
- * 2. How to check whether it's already satisfied
- * 3. What to do when the planner selects it as the next pending action
- */
-interface AuthGuardClientOption {
-  /** Unique identifier for this requirement candidate. */
-  requirementId: string;
-  /**
-   * The kind of auth requirement (opaque string).
-   * @example "session", "frontend_oidc", "backend_oidc"
-   */
-  requirementKind: string;
-  /** Human-readable label (for logging / debugging / chooser UI). */
-  label?: string;
-  /** Arbitrary metadata the adopter can attach. */
-  attributes?: Record<string, unknown>;
-  /**
-   * Check whether this requirement candidate is already authenticated.
-   * Called synchronously by the planner-host during evaluation.
-   */
-  checkAuthenticated: () => boolean;
-  /**
-   * Action to execute when this candidate is selected as the pending
-   * requirement by the planner-host.
-   *
-   * Return value semantics:
-   * - `true` — allow navigation (requirement will be resolved externally)
-   * - `false` — block navigation
-   * - `string` — redirect to the given URL
-   * - `Promise<...>` — async version of the above
-   */
-  onUnauthenticated: () => boolean | string | Promise<boolean | string>;
-}
-/** A flat collection of requirement candidates. */
-interface RequirementsClientSet {
-  readonly options: readonly AuthGuardClientOption[];
-}
-/**
- * How a child scope's requirements client set relates to its parent.
- *
- * - `inherit` — use the parent's set as-is (child adds nothing)
- * - `merge` — inherit parent's options, then append/override with child's
- *   (child options with the same `requirementId` replace parent ones)
- * - `replace` — discard parent's set entirely, use child's set only
- */
-declare const RequirementsClientSetComposition: {
-  readonly Inherit: "inherit";
-  readonly Merge: "merge";
-  readonly Replace: "replace";
-};
-type RequirementsClientSetComposition = (typeof RequirementsClientSetComposition)[keyof typeof RequirementsClientSetComposition];
-/** A requirements client set annotated with its composition strategy. */
-interface ScopedRequirementsClientSet {
-  /** How this set composes with its parent scope. */
-  composition: RequirementsClientSetComposition;
-  /** The requirement candidates declared at this scope. */
-  options: readonly AuthGuardClientOption[];
-}
-/**
- * Resolve the effective requirements client set by composing a parent set
- * with a child scope's declaration.
- *
- * @param parentOptions - The parent scope's resolved options (or empty).
- * @param child - The child scope's scoped set (with composition strategy).
- * @returns The effective options after composition.
- */
-declare function resolveEffectiveClientSet(parentOptions: readonly AuthGuardClientOption[], child: ScopedRequirementsClientSet): AuthGuardClientOption[];
-/** Result of a planner-host evaluation. */
-interface PlannerHostResult {
-  /** Whether all candidates are authenticated (route can activate). */
-  allAuthenticated: boolean;
-  /** All candidates that are not yet authenticated. */
-  unauthenticatedCandidates: readonly AuthGuardClientOption[];
-  /**
-   * The candidate selected by the planner as the next one to act on.
-   * `null` when `allAuthenticated` is true.
-   *
-   * Determined by the RequirementPlanner's sequential resolution discipline:
-   * the first unresolved requirement in declaration order that is still
-   * unauthenticated, then optionally further narrowed by `selectCandidate`.
-   */
-  pendingCandidate: AuthGuardClientOption | null;
-}
-/**
- * A candidate selection strategy.
- *
- * Receives the list of unauthenticated candidates (in RequirementPlanner
- * declaration order) and returns the one that should be acted on next.
- * The default strategy picks the first one (matching the planner's
- * `nextPending` requirement).
- *
- * Async selectors are supported: return a `Promise<AuthGuardClientOption>`
- * to implement interactive chooser UIs (e.g. show a dialog and await the
- * user's pick before navigation continues).
- *
- * @example
- * ```ts
- * // Async chooser: show a dialog and await user's selection
- * const selectCandidate: CandidateSelector = async (candidates) => {
- *   const chosen = await showChooserDialog(candidates);
- *   return chosen;
- * };
- * ```
- */
-type CandidateSelector = (unauthenticated: readonly AuthGuardClientOption[]) => AuthGuardClientOption | Promise<AuthGuardClientOption>;
-/** The planner-host coordination contract. */
-interface PlannerHost {
-  /**
-   * Evaluate a set of requirement candidates using RequirementPlanner's
-   * sequential resolution discipline.
-   *
-   * Always returns a Promise so that custom async selectors (e.g. chooser
-   * dialog) are fully supported. Callers should always `await` the result.
-   *
-   * @param candidates - The resolved candidates from the guard's client options.
-   * @returns Promise resolving to the evaluation result.
-   */
-  evaluate(candidates: readonly AuthGuardClientOption[]): Promise<PlannerHostResult>;
-}
-/** Options for {@link createPlannerHost}. */
-interface CreatePlannerHostOptions {
-  /**
-   * Custom candidate selection strategy.
-   *
-   * The default strategy picks the candidate that corresponds to the
-   * RequirementPlanner's `nextPending` requirement (first unauthenticated
-   * in declaration order).
-   *
-   * A custom strategy can further filter or reorder the unauthenticated
-   * candidates, e.g. to implement a chooser UI that lets the user pick.
-   *
-   * @default first-unauthenticated-matching-planner-nextPending
-   *
-   * @example
-   * ```ts
-   * // Async chooser: present all options and await user's pick
-   * createPlannerHost({
-   *   selectCandidate: async (candidates) => {
-   *     return await showChooserDialog(candidates);
-   *   },
-   * })
-   * ```
-   */
-  selectCandidate?: CandidateSelector;
-}
-/**
- * Create a planner-host instance backed by {@link createRequirementPlanner}.
- *
- * **How it works:**
- *
- * 1. `evaluate()` builds an `AuthRequirement[]` from `candidates`
- *    (using each candidate's `requirementId`, `requirementKind`, `label`,
- *    and `attributes`).
- * 2. A `RequirementPlanner` is created for this evaluation cycle.
- * 3. Already-authenticated requirements are auto-resolved as `Fulfilled`,
- *    respecting the planner's sequential discipline.
- * 4. The planner's `nextPending` determines the first unresolved requirement
- *    in declaration order.
- * 5. `selectCandidate` is called with all unauthenticated candidates so
- *    adopters can implement custom chooser strategies (e.g. UI dialog).
- *    The default strategy picks the first candidate (matching nextPending).
- *
- * `evaluate()` always returns a `Promise` to accommodate async selectors.
- * For synchronous selectors the Promise resolves in the same microtask tick.
- *
- * @example
- * ```ts
- * import { createPlannerHost } from "@securitydept/client/auth-coordination";
- *
- * // Default sequential strategy (sync selector, wrapped in Promise)
- * const host = createPlannerHost();
- * const result = await host.evaluate(candidates);
- *
- * // Async chooser strategy — show a dialog and await user's pick
- * const hostWithChooser = createPlannerHost({
- *   selectCandidate: async (candidates) => {
- *     return await showChooserDialog(candidates);
- *   },
- * });
- * ```
- */
-declare function createPlannerHost(options?: CreatePlannerHostOptions): PlannerHost;
-//#endregion
-export { PlannerHostResult as a, ScopedRequirementsClientSet as c, PlannerHost as i, createPlannerHost as l, CandidateSelector as n, RequirementsClientSet as o, CreatePlannerHostOptions as r, RequirementsClientSetComposition as s, AuthGuardClientOption as t, resolveEffectiveClientSet as u };
-//# sourceMappingURL=planner-host-DN9dRsQx.d.mts.map

package/dist/types-BJqUdH2e.d.mts

@@ -1,32 +0,0 @@
-//#region src/signals/types.d.ts
-/**
- * Read-only signal interface.
- * Semantics align with TC39 Signals proposal, but uses an SDK-owned thin protocol
- * to avoid coupling to any specific polyfill or standard implementation.
- */
-interface ReadableSignalTrait<T> {
-  /** Return the current snapshot value. */
-  get(): T;
-  /**
-   * Subscribe to value changes.
-   * The listener is called whenever the value changes (not on subscribe).
-   * @returns An unsubscribe function.
-   */
-  subscribe(listener: () => void): () => void;
-}
-/**
- * Writable signal interface.
- * State transitions should be controlled by the client / service layer;
- * external consumers typically only see the read-only projection.
- */
-interface WritableSignalTrait<T> extends ReadableSignalTrait<T> {
-  set(value: T): void;
-}
-/**
- * Computed (derived) signal — always read-only, value is derived from
- * other signals automatically.
- */
-interface ComputedSignalTrait<T> extends ReadableSignalTrait<T> {}
-//#endregion
-export { ReadableSignalTrait as n, WritableSignalTrait as r, ComputedSignalTrait as t };
-//# sourceMappingURL=types-BJqUdH2e.d.mts.map

package/dist/types-BwcnUGNl.d.mts

@@ -1,52 +0,0 @@
-//#region src/persistence/types.d.ts
-/** Low-level key-value record store. */
-interface RecordStore {
-  get(key: string): Promise<string | null>;
-  set(key: string, value: string): Promise<void>;
-  /**
-   * Atomically read and remove a record within the store's consistency domain.
-   */
-  take?(key: string): Promise<string | null>;
-  remove(key: string): Promise<void>;
-}
-/** Serialization codec for typed values. */
-interface Codec<T> {
-  encode(value: T): string;
-  decode(raw: string): T;
-}
-/** Semantic store for long-lived auth state. */
-interface PersistentAuthStore<T> {
-  load(): Promise<T | null>;
-  save(value: T): Promise<void>;
-  clear(): Promise<void>;
-}
-/** Semantic store for recoverable state (survives page reload). */
-interface RecoverableStateStore<T> {
-  load(): Promise<T | null>;
-  save(value: T): Promise<void>;
-  clear(): Promise<void>;
-}
-/** Semantic store for ephemeral flow state (one-time-use). */
-interface EphemeralFlowStore<T> {
-  load(): Promise<T | null>;
-  save(value: T): Promise<void>;
-  consume(): Promise<T | null>;
-  clear(): Promise<void>;
-}
-/** Semantic store for keyed ephemeral flow state (one-time-use per key). */
-interface KeyedEphemeralFlowStore<T> {
-  load(key: string): Promise<T | null>;
-  save(key: string, value: T): Promise<void>;
-  take(key: string): Promise<T | null>;
-  clear(key: string): Promise<void>;
-}
-/** Versioned storage envelope — first-version migration support. */
-interface StoredEnvelope<T> {
-  version: number;
-  storedAt: number;
-  expiresAt?: number;
-  value: T;
-}
-//#endregion
-export { RecordStore as a, PersistentAuthStore as i, EphemeralFlowStore as n, RecoverableStateStore as o, KeyedEphemeralFlowStore as r, StoredEnvelope as s, Codec as t };
-//# sourceMappingURL=types-BwcnUGNl.d.mts.map

package/dist/web-DQmMqZnR.mjs

@@ -1,51 +0,0 @@
-//#region src/persistence/web/stores.ts
-/**
-* `RecordStore` backed by `localStorage`.
-* @param prefix Optional key prefix to isolate the keyspace.
-*/
-function createLocalStorageStore(prefix = "") {
-	return {
-		async get(key) {
-			return globalThis.localStorage.getItem(prefix + key);
-		},
-		async set(key, value) {
-			globalThis.localStorage.setItem(prefix + key, value);
-		},
-		async take(key) {
-			const storageKey = prefix + key;
-			const value = globalThis.localStorage.getItem(storageKey);
-			if (value !== null) globalThis.localStorage.removeItem(storageKey);
-			return value;
-		},
-		async remove(key) {
-			globalThis.localStorage.removeItem(prefix + key);
-		}
-	};
-}
-/**
-* `RecordStore` backed by `sessionStorage`.
-* @param prefix Optional key prefix to isolate the keyspace.
-*/
-function createSessionStorageStore(prefix = "") {
-	return {
-		async get(key) {
-			return globalThis.sessionStorage.getItem(prefix + key);
-		},
-		async set(key, value) {
-			globalThis.sessionStorage.setItem(prefix + key, value);
-		},
-		async take(key) {
-			const storageKey = prefix + key;
-			const value = globalThis.sessionStorage.getItem(storageKey);
-			if (value !== null) globalThis.sessionStorage.removeItem(storageKey);
-			return value;
-		},
-		async remove(key) {
-			globalThis.sessionStorage.removeItem(prefix + key);
-		}
-	};
-}
-//#endregion
-export { createSessionStorageStore as n, createLocalStorageStore as t };
-
-//# sourceMappingURL=web-DQmMqZnR.mjs.map

package/dist/web-DQmMqZnR.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"web-DQmMqZnR.mjs","names":[],"sources":["../src/persistence/web/stores.ts"],"sourcesContent":["import type { RecordStore } from \"../types\";\n\n/**\n * `RecordStore` backed by `localStorage`.\n * @param prefix Optional key prefix to isolate the keyspace.\n */\nexport function createLocalStorageStore(prefix = \"\"): RecordStore {\n\treturn {\n\t\tasync get(key: string): Promise<string | null> {\n\t\t\treturn globalThis.localStorage.getItem(prefix + key);\n\t\t},\n\t\tasync set(key: string, value: string): Promise<void> {\n\t\t\tglobalThis.localStorage.setItem(prefix + key, value);\n\t\t},\n\t\tasync take(key: string): Promise<string | null> {\n\t\t\tconst storageKey = prefix + key;\n\t\t\tconst value = globalThis.localStorage.getItem(storageKey);\n\t\t\tif (value !== null) {\n\t\t\t\tglobalThis.localStorage.removeItem(storageKey);\n\t\t\t}\n\t\t\treturn value;\n\t\t},\n\t\tasync remove(key: string): Promise<void> {\n\t\t\tglobalThis.localStorage.removeItem(prefix + key);\n\t\t},\n\t};\n}\n\n/**\n * `RecordStore` backed by `sessionStorage`.\n * @param prefix Optional key prefix to isolate the keyspace.\n */\nexport function createSessionStorageStore(prefix = \"\"): RecordStore {\n\treturn {\n\t\tasync get(key: string): Promise<string | null> {\n\t\t\treturn globalThis.sessionStorage.getItem(prefix + key);\n\t\t},\n\t\tasync set(key: string, value: string): Promise<void> {\n\t\t\tglobalThis.sessionStorage.setItem(prefix + key, value);\n\t\t},\n\t\tasync take(key: string): Promise<string | null> {\n\t\t\tconst storageKey = prefix + key;\n\t\t\tconst value = globalThis.sessionStorage.getItem(storageKey);\n\t\t\tif (value !== null) {\n\t\t\t\tglobalThis.sessionStorage.removeItem(storageKey);\n\t\t\t}\n\t\t\treturn value;\n\t\t},\n\t\tasync remove(key: string): Promise<void> {\n\t\t\tglobalThis.sessionStorage.removeItem(prefix + key);\n\t\t},\n\t};\n}\n"],"mappings":";;;;;AAMA,SAAgB,wBAAwB,SAAS,IAAiB;CACjE,OAAO;EACN,MAAM,IAAI,KAAqC;GAC9C,OAAO,WAAW,aAAa,QAAQ,SAAS,IAAI;;EAErD,MAAM,IAAI,KAAa,OAA8B;GACpD,WAAW,aAAa,QAAQ,SAAS,KAAK,MAAM;;EAErD,MAAM,KAAK,KAAqC;GAC/C,MAAM,aAAa,SAAS;GAC5B,MAAM,QAAQ,WAAW,aAAa,QAAQ,WAAW;GACzD,IAAI,UAAU,MACb,WAAW,aAAa,WAAW,WAAW;GAE/C,OAAO;;EAER,MAAM,OAAO,KAA4B;GACxC,WAAW,aAAa,WAAW,SAAS,IAAI;;EAEjD;;;;;;AAOF,SAAgB,0BAA0B,SAAS,IAAiB;CACnE,OAAO;EACN,MAAM,IAAI,KAAqC;GAC9C,OAAO,WAAW,eAAe,QAAQ,SAAS,IAAI;;EAEvD,MAAM,IAAI,KAAa,OAA8B;GACpD,WAAW,eAAe,QAAQ,SAAS,KAAK,MAAM;;EAEvD,MAAM,KAAK,KAAqC;GAC/C,MAAM,aAAa,SAAS;GAC5B,MAAM,QAAQ,WAAW,eAAe,QAAQ,WAAW;GAC3D,IAAI,UAAU,MACb,WAAW,eAAe,WAAW,WAAW;GAEjD,OAAO;;EAER,MAAM,OAAO,KAA4B;GACxC,WAAW,eAAe,WAAW,SAAS,IAAI;;EAEnD"}

package/dist/web-router/index.d.mts

@@ -1,259 +0,0 @@
-import { i as PlannerHost, s as RequirementsClientSetComposition, t as AuthGuardClientOption } from "../planner-host-DN9dRsQx.mjs";
-
-//#region src/web-router/navigation-adapter.d.ts
-declare const NavigationAdapterKind: {
-  readonly NavigationApi: "navigation-api";
-  readonly History: "history";
-};
-type NavigationAdapterKind = (typeof NavigationAdapterKind)[keyof typeof NavigationAdapterKind];
-declare const NavigationCause: {
-  readonly Initial: "initial";
-  readonly Push: "push";
-  readonly Replace: "replace";
-  readonly Traverse: "traverse";
-};
-type NavigationCause = (typeof NavigationCause)[keyof typeof NavigationCause];
-interface NavigationIntent {
-  readonly url: URL;
-  readonly cause: NavigationCause;
-  readonly replace: boolean;
-  readonly state: unknown;
-  /** Abort this navigation before it commits. */
-  preventDefault(): void;
-  /** Cancel the current intent and navigate to the given URL instead. */
-  redirect(url: string | URL, options?: {
-    replace?: boolean;
-  }): void;
-}
-interface NavigationCommit {
-  readonly url: URL;
-}
-interface NavigateOptions {
-  /** When true, replace the current history entry instead of pushing. */
-  replace?: boolean;
-  /** Serializable state to attach to the history entry. */
-  state?: unknown;
-  /**
-   * Arbitrary per-navigation metadata. Passed through to `NavigateEvent.info`
-   * when the Navigation API adapter is active; ignored by the History
-   * adapter (no wire support).
-   */
-  info?: unknown;
-}
-interface NavigationAdapter {
-  readonly kind: NavigationAdapterKind;
-  currentUrl(): URL;
-  navigate(url: string | URL, options?: NavigateOptions): Promise<void>;
-  back(): void;
-  forward(): void;
-  /**
-   * Called *before* a navigation commits, so listeners can cancel or
-   * redirect. Both adapters forward synchronous and asynchronous handlers
-   * (adapters await the intent being fully processed before committing).
-   */
-  onBeforeNavigate(listener: (intent: NavigationIntent) => void | Promise<void>): () => void;
-  /** Called *after* a navigation commits. */
-  onNavigate(listener: (commit: NavigationCommit) => void): () => void;
-  destroy(): void;
-}
-declare function createNavigationApiAdapter(): NavigationAdapter;
-interface CreateHistoryAdapterOptions {
-  /**
-   * When true (default), the adapter captures clicks on in-document
-   * `<a href>` elements and routes them through `navigate()` so guards
-   * can intercept. Disable to handle anchor navigation manually.
-   */
-  captureAnchorClicks?: boolean;
-}
-declare function createHistoryAdapter(options?: CreateHistoryAdapterOptions): NavigationAdapter;
-interface CreateNavigationAdapterOptions {
-  /**
-   * Force a specific adapter kind. Useful for tests that need to exercise
-   * the fallback path in a Chromium environment that ships the Navigation
-   * API.
-   * @default "auto"
-   */
-  prefer?: "auto" | NavigationAdapterKind;
-  /**
-   * Options forwarded to {@link createHistoryAdapter} when the history
-   * adapter is selected.
-   */
-  history?: CreateHistoryAdapterOptions;
-}
-/**
- * Pick the best available navigation backend. Prefers the Web Navigation
- * API when `window.navigation` is defined; falls back to the History API
- * otherwise.
- */
-declare function createNavigationAdapter(options?: CreateNavigationAdapterOptions): NavigationAdapter;
-/**
- * Quick capability probe — true when the Web Navigation API is present.
- */
-declare function isNavigationApiAvailable(): boolean;
-//#endregion
-//#region src/web-router/web-router.d.ts
-interface WebRouteContext {
-  /** The URL being navigated to. */
-  url: URL;
-  /** Intent metadata. Null for programmatic `activate()` calls. */
-  intent: NavigationIntent | null;
-}
-type WebRouteMatcher = string | RegExp | ((url: URL) => Record<string, string> | null | undefined);
-interface WebRouteDefinition<TData = unknown> {
-  /** Opaque identifier. */
-  id: string;
-  /**
-   * Matcher for this route segment. Required on leaves — parents that
-   * only carry metadata for children may omit `match`.
-   *
-   * A string is treated as a path-with-params pattern
-   * (`"/users/:id/profile"` → `{ id: "123" }` for `/users/123/profile`).
-   * A RegExp uses `exec(pathname)` and passes named/indexed groups
-   * through as params. A function returns the parsed params or null.
-   */
-  match?: WebRouteMatcher;
-  /**
-   * Auth requirements declared at this route segment. The router walks
-   * the matched route chain from root to leaf and aggregates every
-   * segment's requirements via {@link extractFullRouteRequirements}
-   * before asking the planner-host to evaluate.
-   */
-  requirements?: readonly AuthGuardClientOption[];
-  /**
-   * Composition strategy with the parent segment in the matched chain.
-   *
-   * - `merge`   (default): parent requirements are kept, child requirements
-   *   append/override by `requirementId`.
-   * - `inherit`: child declares no additional requirements; parent set is
-   *   used as-is.
-   * - `replace`: parent requirements are discarded entirely; this child
-   *   contributes the full effective set (use for "public" subtrees of an
-   *   otherwise protected parent).
-   */
-  composition?: RequirementsClientSetComposition;
-  /**
-   * Nested child routes. When present, `match` on the parent is optional
-   * and is not consulted for matching leaves — only the leaves' matchers
-   * participate in URL resolution. The chain from root to leaf is what
-   * drives requirement aggregation.
-   */
-  children?: readonly WebRouteDefinition<TData>[];
-  /** Arbitrary data attached to matched routes. */
-  data?: TData;
-}
-interface WebRouteMatch<TData = unknown> {
-  /** The leaf route that matched. */
-  readonly route: WebRouteDefinition<TData>;
-  readonly url: URL;
-  readonly params: Record<string, string>;
-  /**
-   * The complete chain from root ancestor → leaf. A flat route without
-   * children produces a single-element chain.
-   */
-  readonly chain: readonly WebRouteDefinition<TData>[];
-}
-/**
- * Sugar for declaring a route segment. Enforces a consistent shape so
- * adopter code reads like the Angular / TanStack helpers without forcing
- * any particular DI or decorator style.
- */
-declare function defineWebRoute<TData = unknown>(definition: WebRouteDefinition<TData>): WebRouteDefinition<TData>;
-interface FullRouteRequirementsOptions {
-  /**
-   * Default composition for segments that do not set their own
-   * `composition` field. Defaults to `merge` to match the Angular helper
-   * and the TanStack adapter.
-   */
-  defaultComposition?: RequirementsClientSetComposition;
-}
-/**
- * Aggregate every segment's `requirements` across the matched chain into
- * a single {@link AuthGuardClientOption} list, honouring each segment's
- * composition strategy (`inherit` / `merge` / `replace`).
- *
- * This is the extraction counter-part to the nested `WebRouteDefinition`
- * tree — the router calls it once per matched navigation and forwards the
- * resulting flat list to the planner-host.
- */
-declare function extractFullRouteRequirements<TData = unknown>(chain: readonly WebRouteDefinition<TData>[], options?: FullRouteRequirementsOptions): AuthGuardClientOption[];
-interface CreateWebRouterOptions<TData = unknown> {
-  /**
-   * Initial routes. Nested `children` are supported: the router
-   * flattens the declared tree into matchable leaves and reconstructs
-   * the root→leaf chain on every match for full-route aggregation.
-   *
-   * More routes can be added via `router.addRoute(...)` at runtime.
-   */
-  routes?: readonly WebRouteDefinition<TData>[];
-  /** Planner-host for evaluating aggregated route requirements. */
-  plannerHost?: PlannerHost;
-  /**
-   * Options for the underlying navigation adapter. When omitted the
-   * router auto-selects the Navigation API if available.
-   */
-  navigationAdapter?: CreateNavigationAdapterOptions | NavigationAdapter;
-  /**
-   * Called after every committed navigation. Prefer `onNavigate` for
-   * reactivity; this option exists for convenience.
-   */
-  onNavigate?: (commit: NavigationCommit) => void;
-  /**
-   * Default requirement composition strategy applied when a route
-   * segment does not declare its own `composition`. Defaults to `merge`
-   * (the Angular / TanStack default).
-   */
-  defaultComposition?: RequirementsClientSetComposition;
-}
-interface WebRouter<TData = unknown> {
-  readonly adapter: NavigationAdapter;
-  /** Current URL (from the underlying adapter). */
-  currentUrl(): URL;
-  /** Current matched route (or null if no route matches). */
-  currentMatch(): WebRouteMatch<TData> | null;
-  /** Register an additional root-level route at runtime. */
-  addRoute(route: WebRouteDefinition<TData>): () => void;
-  /** All currently registered root-level routes. */
-  routes(): readonly WebRouteDefinition<TData>[];
-  /**
-   * Match a URL against the registered routes. Returns the first match in
-   * registration order, or `null` if none match. When a match is found,
-   * {@link WebRouteMatch.chain} contains the root→leaf route chain so
-   * adopters can feed it to {@link extractFullRouteRequirements}.
-   */
-  match(url: URL): WebRouteMatch<TData> | null;
-  /**
-   * Compute the effective aggregated requirements for a given match,
-   * honouring every segment's composition strategy.
-   */
-  extractRequirements(match: WebRouteMatch<TData>): AuthGuardClientOption[];
-  /** Programmatically navigate. */
-  navigate(url: string | URL, options?: {
-    replace?: boolean;
-    state?: unknown;
-  }): Promise<void>;
-  back(): void;
-  forward(): void;
-  /** Subscribe to committed navigations. */
-  onNavigate(listener: (commit: NavigationCommit) => void): () => void;
-  /** Tear down event listeners on the underlying adapter. */
-  destroy(): void;
-}
-/**
- * Create a {@link WebRouter} wired to the selected navigation backend and
- * optionally to a planner-host for aggregated route requirements evaluation.
- *
- * The router listens for pre-commit navigation intents, matches the
- * destination URL against the registered route tree, aggregates the full
- * root→leaf chain's requirements (respecting each segment's composition
- * strategy), and asks `plannerHost.evaluate()` to rule on the complete
- * candidate set. Depending on the host's decision it either:
- *
- * - lets the navigation commit (all requirements authenticated);
- * - redirects to the URL returned by `onUnauthenticated` (when a candidate
- *   picks a redirect); or
- * - cancels the navigation (when `onUnauthenticated` returns `false`).
- */
-declare function createWebRouter<TData = unknown>(options?: CreateWebRouterOptions<TData>): WebRouter<TData>;
-//#endregion
-export { type CreateHistoryAdapterOptions, type CreateNavigationAdapterOptions, type CreateWebRouterOptions, type FullRouteRequirementsOptions, type NavigateOptions, type NavigationAdapter, NavigationAdapterKind, type NavigationCause, type NavigationCommit, type NavigationIntent, RequirementsClientSetComposition, type WebRouteContext, type WebRouteDefinition, type WebRouteMatch, type WebRouteMatcher, type WebRouter, createHistoryAdapter, createNavigationAdapter, createNavigationApiAdapter, createWebRouter, defineWebRoute, extractFullRouteRequirements, isNavigationApiAvailable };
-//# sourceMappingURL=index.d.mts.map