@securitydept/client 0.3.0-beta.3 → 0.3.0-beta.5

package/dist/index-D5mW18cM.d.mts

@@ -0,0 +1,1648 @@
+import { B as SignalOptions, D as TimestampProviderTrait, E as TimeTrait, G as CancellationTokenTrait, Gt as SecuritydeptInjectionToken, I as ResourceSnapshot, K as ClientError, Kt as SecuritydeptInjectorTrait, O as ComputedSignalTrait, Ot as SYMBOL_DISPOSE, R as ResourceTrait, Tt as DisposableTrait, V as WritableSignalTrait, Y as ClientErrorKind, bt as SecuritydeptInjector, ct as EventStreamTrait, et as ErrorPresentationDescriptor, ft as InteropObservableTrait, it as EventObserverTrait, k as ReadableSignalTrait, lt as EventSubjectTrait, nt as ReadErrorPresentationDescriptorOptions, qt as SecuritydeptProvider, rt as UserRecovery, w as IdleCallbackTrait, z as ResourceWhenValueOptions } from "./index-Ch8lrE44.mjs";
+import * as _$arktype from "arktype";
+import * as _$arktype_internal_variants_object_ts0 from "arktype/internal/variants/object.ts";
+import * as _$arktype_internal_variants_string_ts0 from "arktype/internal/variants/string.ts";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+
+//#region src/compat/base64.d.ts
+declare const Base64CompatErrorCode: {
+  readonly EncoderUnavailable: "compat.base64.encoder_unavailable";
+  readonly DecoderUnavailable: "compat.base64.decoder_unavailable";
+};
+type Base64CompatErrorCode = (typeof Base64CompatErrorCode)[keyof typeof Base64CompatErrorCode];
+declare function encodeUint8ArrayToBase64(value: Uint8Array): string;
+declare function decodeBase64ToUint8Array(value: string): Uint8Array;
+//#endregion
+//#region src/compat/generator.d.ts
+declare function promisesToRacedAsyncGenerator<T>(promises: Promise<T>[]): AsyncGenerator<T, void, unknown>;
+//#endregion
+//#region src/page/index.d.ts
+interface PageLifecycleTrait<TResumeEvent = unknown> {
+  resume: EventStreamTrait<TResumeEvent>;
+}
+declare const PAGE_LIFECYCLE_TRAIT_TOKEN: SecuritydeptInjectionToken<PageLifecycleTrait<unknown> | null>;
+//#endregion
+//#region src/errors/error-attributes.d.ts
+interface ErrorSummary {
+  errorName: string;
+  errorKind?: ClientErrorKind;
+  errorCode?: string;
+  recovery?: UserRecovery;
+}
+/** Extract secret-safe diagnostic attributes without copying runtime messages. */
+declare function describeError(error: unknown): ErrorSummary;
+//#endregion
+//#region src/errors/presentation-descriptor.d.ts
+declare function readErrorPresentationDescriptor(error: unknown, options?: ReadErrorPresentationDescriptorOptions): ErrorPresentationDescriptor;
+//#endregion
+//#region src/std/events/from-abort.d.ts
+type AbortSignalStdSource = Pick<AbortSignal, "aborted" | "reason"> & {
+  addEventListener?: (type: "abort", listener: EventListener) => void;
+  removeEventListener?: (type: "abort", listener: EventListener) => void;
+};
+/**
+ * Adapt an `AbortSignal`-like source into an event stream of abort reasons.
+ */
+declare function abortSignalToEventStream(signal: AbortSignalStdSource): EventStreamTrait<unknown>;
+//#endregion
+//#region src/events/create.d.ts
+/**
+ * Create a new event stream from a producer function.
+ *
+ * The producer receives an observer and should call `next()` to emit values,
+ * `error()` to signal an error, and `complete()` to signal completion.
+ * It may return a teardown function that will be called on unsubscribe.
+ */
+declare function createEventStream<T>(producer: (observer: EventObserverTrait<T>) => (() => void) | void): EventStreamTrait<T>;
+declare function createEventSubject<T>(): EventSubjectTrait<T>;
+declare function createEventReplaySubject<T>(bufferSize?: number): EventSubjectTrait<T>;
+declare function createEmptyEventStream<T>(): EventStreamTrait<T>;
+declare function createNeverEventStream<T>(): EventStreamTrait<T>;
+//#endregion
+//#region src/events/interop.d.ts
+type ToEventStreamInput<T> = InteropObservableTrait<T> | Promise<T> | AsyncIterable<T> | PromiseLike<T> | ArrayLike<T> | Iterable<T> | EventStreamTrait<T> | ReadableSignalTrait<T>;
+declare function toEventStream<T>(input: ToEventStreamInput<T>): EventStreamTrait<T>;
+//#endregion
+//#region src/protocol/json-rpc/types.d.ts
+declare const JsonRpcIdSchema: _$arktype.BaseType<string | number, {}>;
+type JsonRpcId = typeof JsonRpcIdSchema.infer;
+declare const JsonRpcErrorPayloadSchema: _$arktype_internal_variants_object_ts0.ObjectType<{
+  code: number;
+  message: string;
+  data?: unknown;
+}, {}>;
+type JsonRpcErrorPayload = typeof JsonRpcErrorPayloadSchema.infer;
+declare const JsonRpcRequestMessageSchema: _$arktype_internal_variants_object_ts0.ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  method: string;
+  params?: unknown;
+}, {}>;
+type JsonRpcRequestMessage = typeof JsonRpcRequestMessageSchema.infer;
+declare const JsonRpcNotificationMessageSchema: _$arktype_internal_variants_object_ts0.ObjectType<{
+  jsonrpc: "2.0";
+  method: string;
+  params?: unknown;
+}, {}>;
+type JsonRpcNotificationMessage = typeof JsonRpcNotificationMessageSchema.infer;
+declare const JsonRpcSuccessResponseMessageSchema: _$arktype_internal_variants_object_ts0.ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  result: unknown;
+}, {}>;
+type JsonRpcSuccessResponseMessage = typeof JsonRpcSuccessResponseMessageSchema.infer;
+declare const JsonRpcErrorResponseMessageSchema: _$arktype_internal_variants_object_ts0.ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  error: {
+    code: number;
+    message: string;
+    data?: unknown;
+  };
+}, {}>;
+type JsonRpcErrorResponseMessage = typeof JsonRpcErrorResponseMessageSchema.infer;
+declare const JsonRpcMessageSchema: _$arktype_internal_variants_object_ts0.ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  method: string;
+  params?: unknown;
+} | {
+  jsonrpc: "2.0";
+  method: string;
+  params?: unknown;
+} | {
+  jsonrpc: "2.0";
+  id: string | number;
+  result: unknown;
+} | {
+  jsonrpc: "2.0";
+  id: string | number;
+  error: {
+    code: number;
+    message: string;
+    data?: unknown;
+  };
+}, {}>;
+type JsonRpcMessage = typeof JsonRpcMessageSchema.infer;
+interface JsonRpcRequestEvent {
+  id: JsonRpcId;
+  method: string;
+  params?: unknown;
+}
+interface JsonRpcNotificationEvent {
+  method: string;
+  params?: unknown;
+}
+interface JsonRpcRequestOptions {
+  timeoutMs?: number;
+}
+interface JsonRpcSendOptions {
+  send(message: JsonRpcMessage): void;
+}
+interface CreateJsonRpcClientOptions extends JsonRpcSendOptions {
+  time: TimeTrait;
+  defaultRequestTimeoutMs?: number;
+}
+interface CreateJsonRpcServerOptions extends JsonRpcSendOptions {}
+interface CreateJsonRpcServerAndClientOptions extends JsonRpcSendOptions {
+  time: TimeTrait;
+  defaultRequestTimeoutMs?: number;
+}
+interface JsonRpcClientTrait extends DisposableTrait {
+  readonly onNotification: EventStreamTrait<JsonRpcNotificationEvent>;
+  request<TResult = unknown>(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<TResult>;
+  notify(method: string, params?: unknown): void;
+  receive(message: unknown): void;
+  rejectAllPendingRequests(reason: unknown): void;
+}
+interface JsonRpcServerTrait extends DisposableTrait {
+  readonly onRequest: EventStreamTrait<JsonRpcRequestEvent>;
+  readonly onNotification: EventStreamTrait<JsonRpcNotificationEvent>;
+  notify(method: string, params?: unknown): void;
+  receive(message: unknown): void;
+  respondSuccess(id: JsonRpcId, result: unknown): void;
+  respondError(id: JsonRpcId, error: JsonRpcErrorPayload): void;
+}
+interface JsonRpcServerAndClientTrait extends JsonRpcClientTrait, JsonRpcServerTrait {}
+//#endregion
+//#region src/protocol/json-rpc/create.d.ts
+declare function createJsonRpcClient(options: CreateJsonRpcClientOptions): JsonRpcClientTrait;
+declare function createJsonRpcServer(options: CreateJsonRpcServerOptions): JsonRpcServerTrait;
+declare function createJsonRpcServerAndClient(options: CreateJsonRpcServerAndClientOptions): JsonRpcServerAndClientTrait;
+//#endregion
+//#region src/signals/computed.d.ts
+/**
+ * Create a lazy computed signal.
+ *
+ * Dependencies are collected dynamically while `compute()` runs.
+ */
+declare function createComputed<T>(compute: () => T, options?: SignalOptions<T>): ComputedSignalTrait<T>;
+//#endregion
+//#region src/signals/error.d.ts
+declare const ResourceErrorCode: {
+  readonly ValueUnavailable: "resource.value_unavailable";
+};
+type ResourceErrorCode = (typeof ResourceErrorCode)[keyof typeof ResourceErrorCode];
+interface ResourceValueUnavailableErrorOptions {
+  readonly status: string;
+}
+declare class ResourceError extends Error {
+  readonly name = "ResourceError";
+  readonly code: ResourceErrorCode;
+  readonly status?: string;
+  constructor(message: string, options: {
+    code: ResourceErrorCode;
+    status?: string;
+  });
+  static valueUnavailable(options: ResourceValueUnavailableErrorOptions): ResourceError;
+}
+//#endregion
+//#region src/signals/resource.d.ts
+interface ResourceStreamContext<T, R> {
+  readonly request: R;
+  readonly previous: ResourceSnapshot<T>;
+}
+interface CreateResourceOptions<T, R = undefined> {
+  readonly request?: ReadableSignalTrait<R | undefined> | (() => R | undefined);
+  readonly stream: (context: ResourceStreamContext<T, R>) => ToEventStreamInput<T>;
+}
+declare function createResource<T, R = undefined>(options: CreateResourceOptions<T, R>): ResourceTrait<T>;
+//#endregion
+//#region src/signals/resource-snapshot.d.ts
+declare function whenResourceSnapshotValue<T>(snapshotSignal: ReadableSignalTrait<ResourceSnapshot<T>>, options?: ResourceWhenValueOptions): Promise<T>;
+type AnyResourceSnapshotSelector = (value: any) => ReadableSignalTrait<ResourceSnapshot<unknown>>;
+declare function flattenResourceSnapshot<T1, T2>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>): ResourceSnapshot<T2>;
+declare function flattenResourceSnapshot<T1, T2, T3>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>, select2: (value: T2) => ReadableSignalTrait<ResourceSnapshot<T3>>): ResourceSnapshot<T3>;
+declare function flattenResourceSnapshot<T1, T2, T3, T4>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>, select2: (value: T2) => ReadableSignalTrait<ResourceSnapshot<T3>>, select3: (value: T3) => ReadableSignalTrait<ResourceSnapshot<T4>>): ResourceSnapshot<T4>;
+declare function flattenResourceSnapshot<T1, T2, T3, T4, T5>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>, select2: (value: T2) => ReadableSignalTrait<ResourceSnapshot<T3>>, select3: (value: T3) => ReadableSignalTrait<ResourceSnapshot<T4>>, select4: (value: T4) => ReadableSignalTrait<ResourceSnapshot<T5>>): ResourceSnapshot<T5>;
+declare function flattenResourceSnapshot(sourceSnapshot: ResourceSnapshot<unknown>, select: AnyResourceSnapshotSelector, ...selectors: readonly AnyResourceSnapshotSelector[]): ResourceSnapshot<unknown>;
+declare const ResourceSnapshotUpdateKind: {
+  readonly Load: "load";
+  readonly Resolve: "resolve";
+  readonly Fail: "fail";
+  readonly FailWithValue: "fail_with_value";
+};
+type ResourceSnapshotUpdateKind = (typeof ResourceSnapshotUpdateKind)[keyof typeof ResourceSnapshotUpdateKind];
+type ResourceSnapshotUpdate<T> = {
+  readonly kind: typeof ResourceSnapshotUpdateKind.Load;
+} | {
+  readonly kind: typeof ResourceSnapshotUpdateKind.Resolve;
+  readonly value: T;
+} | {
+  readonly kind: typeof ResourceSnapshotUpdateKind.Fail;
+  readonly error: unknown;
+} | {
+  readonly kind: typeof ResourceSnapshotUpdateKind.FailWithValue;
+  readonly value: T;
+  readonly error: unknown;
+};
+declare function reduceResourceSnapshot<T>(previous: ResourceSnapshot<T>, update: ResourceSnapshotUpdate<T>): ResourceSnapshot<T>;
+//#endregion
+//#region src/signals/signal.d.ts
+/**
+ * Minimal writable signal implementation.
+ * `set()` always publishes a write. Equality-based value-version suppression is
+ * handled by the underlying Rx signal for computed dependency validation.
+ */
+declare function createSignal<T>(initial: T, options?: SignalOptions<T>): WritableSignalTrait<T>;
+/**
+ * Create a read-only view of a writable signal.
+ */
+declare function readonlySignal<T>(signal: WritableSignalTrait<T>): ReadableSignalTrait<T>;
+//#endregion
+//#region src/popup/handle.d.ts
+interface PopupMessageChannelTrait<TOutgoing = unknown, TIncoming = unknown> {
+  outgoing: EventSubjectTrait<TOutgoing>;
+  incoming: EventStreamTrait<TIncoming>;
+}
+interface PopupWindowHandleTrait extends DisposableTrait {
+  messaging: PopupMessageChannelTrait;
+  readonly onNotification: EventStreamTrait<JsonRpcNotificationEvent>;
+  close(): void;
+  dispose(): void;
+  notify(method: string, params?: unknown): Promise<void>;
+}
+interface PopupClientWindowHandleTrait extends PopupWindowHandleTrait {
+  readonly failure: ReadableSignalTrait<ClientError | null>;
+  readonly isActive: ReadableSignalTrait<boolean>;
+  request<TResult = unknown>(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<TResult>;
+}
+interface PopupServerWindowHandleTrait extends PopupWindowHandleTrait {}
+interface PopupClientWindowHandleOptions {
+  close(): void;
+  messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+  time: TimeTrait;
+  closedStream: EventStreamTrait<boolean>;
+}
+interface PopupServerWindowHandleOptions {
+  close(): void;
+  messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+}
+/**
+ * popup opener
+ */
+declare class PopupClientWindowHandle implements PopupClientWindowHandleTrait {
+  readonly messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+  private disposed;
+  private readonly jsonRpc;
+  private readonly session;
+  private readonly incomingSubscription;
+  private readonly closePopup;
+  constructor(options: PopupClientWindowHandleOptions);
+  get onNotification(): EventStreamTrait<JsonRpcNotificationEvent>;
+  get failure(): ReadableSignalTrait<ClientError | null>;
+  get isActive(): ReadableSignalTrait<boolean>;
+  notify(method: string, params?: unknown): Promise<void>;
+  request<TResult = unknown>(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<TResult>;
+  close(): void;
+  dispose(): void;
+  [SYMBOL_DISPOSE](): void;
+}
+/**
+ * popup target
+ */
+declare class PopupServerWindowHandle implements PopupServerWindowHandleTrait {
+  readonly messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+  private disposed;
+  private readonly jsonRpc;
+  private readonly session;
+  private readonly incomingSubscription;
+  private readonly closePopup;
+  constructor(options: PopupServerWindowHandleOptions);
+  get onNotification(): EventStreamTrait<JsonRpcNotificationEvent>;
+  get onRequest(): EventStreamTrait<JsonRpcRequestEvent>;
+  notify(method: string, params?: unknown): Promise<void>;
+  close(): void;
+  dispose(): void;
+  [SYMBOL_DISPOSE](): void;
+}
+//#endregion
+//#region src/popup/errors.d.ts
+declare const PopupErrorCode: {
+  readonly Blocked: "popup.blocked";
+  readonly Closed: "popup.closed_by_user";
+};
+type PopupErrorCode = (typeof PopupErrorCode)[keyof typeof PopupErrorCode];
+declare function readPopupErrorPresentationDescriptor(error: unknown, options?: ReadErrorPresentationDescriptorOptions): ErrorPresentationDescriptor;
+//#endregion
+//#region src/popup/session.d.ts
+interface CreatePopupClientSessionOptions {
+  jsonRpc: JsonRpcClientTrait;
+  time: TimeTrait;
+  closedStream: EventStreamTrait<boolean>;
+  readyTimeoutMs?: number;
+  heartbeatIntervalMs?: number;
+  heartbeatTimeoutMs?: number;
+}
+interface CreatePopupServerSessionOptions {
+  jsonRpc: JsonRpcServerTrait;
+}
+//#endregion
+//#region src/popup/index.d.ts
+declare const PopupAttachFailureReason: {
+  readonly MissingOpener: "missing_opener";
+  readonly MissingOrigin: "missing_origin";
+};
+type PopupAttachFailureReason = (typeof PopupAttachFailureReason)[keyof typeof PopupAttachFailureReason];
+interface PopupAttachSuccess {
+  kind: "success";
+  handle: PopupServerWindowHandleTrait;
+}
+interface PopupAttachFailure {
+  kind: "failure";
+  reason: PopupAttachFailureReason;
+  error: ClientError;
+}
+type PopupAttachResult = PopupAttachSuccess | PopupAttachFailure;
+interface PopupOpenOptions {
+  target?: string;
+  width?: number;
+  height?: number;
+  expectedOrigin?: string;
+}
+interface PopupTrait {
+  open(url: string, options?: PopupOpenOptions): PopupClientWindowHandleTrait;
+  attach(): PopupAttachResult;
+}
+declare const POPUP_TRAIT_TOKEN: SecuritydeptInjectionToken<PopupTrait | null>;
+//#endregion
+//#region src/validation/schemas/uri.d.ts
+declare const UriStringSchema: _$arktype_internal_variants_string_ts0.StringType<string, {}>;
+declare const BaseURIStringSchema: _$arktype_internal_variants_string_ts0.StringType<string, {}>;
+declare const UriRelativeStringSchema: _$arktype_internal_variants_string_ts0.StringType<string, {}>;
+declare const UriReferenceStringSchema: _$arktype_internal_variants_string_ts0.StringType<string, {}>;
+//#endregion
+//#region src/router/metadata.d.ts
+/** Route-data key holding the SecurityDept metadata blob for a segment. */
+declare const SECURITYDEPT_ROUTE_METADATA_KEY = "__securitydept__";
+/** Serializable SecurityDept route metadata. */
+interface SecuritydeptRouteMetadata<TAuthRequirement extends AuthRequirement = AuthRequirement> {
+  requirements?: readonly TAuthRequirement[];
+  composition?: RequirementsComposition;
+}
+/** Read SecurityDept route metadata from a route `data` bag. */
+declare function readSecuritydeptRouteMetadata<TAuthRequirement extends AuthRequirement = AuthRequirement>(data: object | undefined): SecuritydeptRouteMetadata<TAuthRequirement> | undefined;
+/** Merge SecurityDept route metadata into a route `data` bag. */
+declare function writeSecuritydeptRouteMetadata<TAuthRequirement extends AuthRequirement = AuthRequirement>(base: object | undefined, patch: SecuritydeptRouteMetadata<TAuthRequirement>): Record<string, unknown>;
+//#endregion
+//#region src/struct/uri-string.d.ts
+/**
+ * Thrown when a string cannot be parsed into the requested URI variant.
+ */
+declare class UriParseError extends Error {
+  readonly input: string;
+  readonly kind: string;
+  constructor(input: string, kind: string, options?: ErrorOptions);
+}
+/**
+ * The relative components of a URL — pathname, search, and hash.
+ *
+ * All fields use the same format as the native `URL` accessors:
+ * - `pathname` starts with `/` (e.g. `"/path"`).
+ * - `search` includes the leading `?` when present (e.g. `"?q=1"`).
+ * - `hash` includes the leading `#` when present (e.g. `"#section"`).
+ */
+interface UriRelativeParts {
+  readonly pathname: string;
+  readonly search: string;
+  readonly hash: string;
+}
+/**
+ * Minimal structural type for URI fragment parsing.
+ *
+ * Matches any value that exposes a URL-style `hash` accessor — for example
+ * `URL`, `Location`, or {@link UriReferenceString}.
+ */
+interface UriFragmentPart {
+  readonly hash: string;
+}
+/**
+ * Minimal structural type for URI reference parsing.
+ *
+ * Matches any value that can be serialized via `toString()` — for example
+ * native `URL`, `Location`, or {@link UriReferenceString}.
+ */
+interface UriReferenceStringLike {
+  toString(): string;
+}
+type UriReferenceStringInput = string | UriReferenceStringLike;
+type UriSearchParamsInit = NonNullable<ConstructorParameters<typeof URLSearchParams>[0]>;
+/**
+ * Immutable wrapper around a URI-reference string.
+ *
+ * A URI-reference (RFC 3986 §4.1) is either an absolute URI or a relative
+ * reference.  Concrete subclasses {@link UriString} and
+ * {@link UriRelativeString} carry the additional type-level guarantee of
+ * which variant they hold.
+ *
+ * Instances created via `UriReferenceString.parse` / `.tryParse` are always
+ * one of the two subclasses, so {@link isAbsolute} and {@link isRelative}
+ * narrow correctly.
+ */
+declare class UriReferenceString {
+  /** The original, unmodified input string. */
+  protected readonly _raw: string;
+  /**
+   * Eagerly parsed URL helper.
+   *
+   * - Absolute URIs: `new URL(raw)`.
+   * - Relative URIs: `new URL(raw, RELATIVE_URI_SENTINEL_BASE)`.
+   *
+   * For relative URIs the scheme and host originate from the sentinel and
+   * MUST NOT be used for origin-sensitive operations.
+   */
+  protected readonly _parsed: URL;
+  protected readonly _isAbsolute: boolean;
+  protected constructor(raw: string, parsed: URL, isAbsolute: boolean);
+  /**
+   * Parse any valid URI reference (absolute or relative).
+   *
+   * The returned instance is always a {@link UriString} or
+   * {@link UriRelativeString}.
+   *
+   * @throws {UriParseError} when the input is not a valid URI reference.
+   */
+  static parse(input: UriReferenceStringInput): UriReferenceString;
+  /**
+   * Try to parse a URI reference, returning `null` on failure.
+   *
+   * The returned instance is always a {@link UriString} or
+   * {@link UriRelativeString}.
+   */
+  static tryParse(input: UriReferenceStringInput): UriReferenceString | null;
+  /** Create from a native `URL`. Always produces a {@link UriString}. */
+  static fromURL(url: URL): UriString;
+  /**
+   * Create from the relative components of a URL.
+   * Always produces a {@link UriRelativeString}.
+   */
+  static fromURLRelative(parts: UriRelativeParts): UriRelativeString;
+  /** The original input string. */
+  get raw(): string;
+  get pathname(): string;
+  get hash(): string;
+  get search(): string;
+  get searchParams(): URLSearchParams;
+  /** Type-guard: narrows to {@link UriString} when the reference is absolute. */
+  isAbsolute(): this is UriString;
+  /** Type-guard: narrows to {@link UriRelativeString} when the reference is relative. */
+  isRelative(): this is UriRelativeString;
+  /** Narrow to {@link UriString} or return `null`. */
+  asAbsolute(): UriString | null;
+  /** Narrow to {@link UriRelativeString} or return `null`. */
+  asRelative(): UriRelativeString | null;
+  /**
+   * Returns a new instance with `hash` replaced.
+   *
+   * @param value URL-style hash, including a leading `#` when non-empty.
+   */
+  setHash(value: string): this;
+  /** Returns a new instance with the complete query parameter set replaced. */
+  setSearchParams(init?: UriSearchParamsInit): this;
+  /**
+   * Convert to a native `URL`.
+   *
+   * A `base` is required when the reference is relative; it is ignored
+   * for absolute references.
+   *
+   * @throws {TypeError} when the reference is relative and no base is provided.
+   */
+  toURL(base?: string | URL): URL;
+  toString(): string;
+  valueOf(): string;
+  toJSON(): string;
+}
+/**
+ * Immutable wrapper around an absolute URI string.
+ *
+ * An absolute URI (RFC 3986 §4.3) always starts with a scheme component
+ * (e.g. `https://example.com/path`).
+ */
+declare class UriString extends UriReferenceString {
+  protected constructor(raw: string, parsed: URL);
+  /**
+   * Parse an absolute URI string.
+   *
+   * @throws {UriParseError} when the input is not a valid absolute URI.
+   */
+  static parse(input: string): UriString;
+  /**
+   * Try to parse an absolute URI, returning `null` if the input is not
+   * a valid absolute URI.
+   */
+  static tryParse(input: string | UriString): UriString | null;
+  /** Create from a native `URL`, using its `href` as the raw string. */
+  static fromURL(url: URL): UriString;
+  /**
+   * Not supported — relative parts cannot produce an absolute URI.
+   *
+   * @throws {TypeError} unconditionally.
+   */
+  static fromURLRelative(_parts: UriRelativeParts): never;
+  get host(): string;
+  get hostname(): string;
+  get origin(): string;
+  get password(): string;
+  get port(): string;
+  get protocol(): string;
+  get username(): string;
+  /** Convert to a native `URL`. No base is required for absolute URIs. */
+  toURL(): URL;
+}
+/**
+ * Immutable wrapper around a relative URI reference string.
+ *
+ * A relative reference (RFC 3986 §4.2) has no scheme and must be resolved
+ * against a base URI to obtain an absolute URI.
+ *
+ * Internally, the raw string is parsed against a sentinel base
+ * (`http://localhost`) to enable eager validation and URL-component
+ * extraction.  The sentinel origin is never leaked through the public API.
+ */
+declare class UriRelativeString extends UriReferenceString {
+  protected constructor(raw: string, parsed: URL);
+  /**
+   * Parse a relative URI reference.
+   *
+   * @throws {UriParseError} when the input is absolute or not a valid
+   *   relative URI reference.
+   */
+  static parse(input: string): UriRelativeString;
+  /**
+   * Try to parse a relative URI reference, returning `null` if the input
+   * is an absolute URI or otherwise invalid.
+   */
+  static tryParse(input: string | UriRelativeString): UriRelativeString | null;
+  /**
+   * Not supported — a native `URL` is always absolute and cannot be
+   * represented as a relative URI reference.
+   *
+   * @throws {TypeError} unconditionally.
+   */
+  static fromURL(_url: URL): never;
+  /**
+   * Create from the relative components of a URL.
+   *
+   * Concatenates `pathname + search + hash` into a relative URI string.
+   */
+  static fromURLRelative(parts: UriRelativeParts): UriRelativeString;
+  /**
+   * Convert to a native `URL` by resolving against the given base.
+   *
+   * @param base - The base URL to resolve against (required).
+   */
+  toURL(base: string | URL): URL;
+}
+//#endregion
+//#region src/protocol/compat-fragment.d.ts
+declare const SECURITYDEPT_COMPAT_FRAGMENT_VERSION = "v1";
+type CompatFragmentParameters = Record<string, string>;
+interface CompatFragment {
+  payload: string;
+  parameters: CompatFragmentParameters;
+}
+interface AppendOrReplaceCompatFragmentOptions {
+  payload: string | URLSearchParams | CompatFragmentParameters;
+}
+interface TakeCompatFragmentResult<T> {
+  compatFragment: CompatFragment | null;
+  fragment: string;
+  url: UpdatedUriFragment<T>;
+}
+interface TakeCompatFragmentOptions<T> {
+  condition?: (compatFragment: CompatFragment) => boolean;
+  update: UpdateUriFragmentHash<T>;
+}
+interface AppendOrReplaceCompatFragmentResult<T> {
+  fragment: string;
+  url: UpdatedUriFragment<T>;
+}
+type UpdatedUriFragment<T> = T extends string ? string : T;
+type UpdateUriFragmentHash<T> = (input: T, hash: string) => UpdatedUriFragment<T>;
+declare function appendOrReplaceCompatFragment<T extends string | UriFragmentPart>(input: T, options: AppendOrReplaceCompatFragmentOptions, update: UpdateUriFragmentHash<T>): AppendOrReplaceCompatFragmentResult<T>;
+declare function parseCompatFragment(input: string | UriFragmentPart): CompatFragment | null;
+declare function takeCompatFragment<T extends string | UriFragmentPart>(input: T, options: TakeCompatFragmentOptions<T>): TakeCompatFragmentResult<T>;
+declare function isCompatFragmentBlock(block: string): boolean;
+//#endregion
+//#region src/router/router.d.ts
+declare const RouterNavigationIntent: {
+  readonly AuthRedirect: "auth_redirect";
+  readonly PostAuthRedirect: "post_auth_redirect";
+  readonly CallbackCleanup: "callback_cleanup";
+  readonly ExternalOpen: "external_open";
+};
+type RouterNavigationIntent = (typeof RouterNavigationIntent)[keyof typeof RouterNavigationIntent];
+declare const RouterNavigationMode: {
+  readonly Push: "push";
+  readonly Replace: "replace";
+  readonly External: "external";
+};
+type RouterNavigationMode = (typeof RouterNavigationMode)[keyof typeof RouterNavigationMode];
+interface RouterNavigationRequest {
+  url: UriReferenceString;
+  intent: RouterNavigationIntent;
+  mode: RouterNavigationMode;
+  state?: unknown;
+}
+interface RouterTrait {
+  currentUrl(): UriReferenceString | null;
+  navigate(request: RouterNavigationRequest): void | Promise<void>;
+}
+interface TakeCompatFragmentFromRouterOptions {
+  condition?: (compatFragment: CompatFragment) => boolean;
+}
+declare function takeCompatFragmentFromRouter(router: RouterTrait, options?: TakeCompatFragmentFromRouterOptions): Promise<CompatFragment | null>;
+declare const ROUTER_TRAIT_TOKEN: SecuritydeptInjectionToken<RouterTrait | null>;
+//#endregion
+//#region src/span/types.d.ts
+interface SpanCreateOptions {
+  idFactory?: () => string;
+  attributes?: Record<string, unknown>;
+  mutable?: false;
+}
+interface MutableSpanCreateOptions extends Omit<SpanCreateOptions, "mutable"> {
+  mutable: true;
+}
+interface SpanTrait {
+  readonly id: string;
+  readonly parent?: SpanTrait;
+  readonly attributes: Readonly<Record<string, unknown>>;
+  fork(options: MutableSpanCreateOptions): MutableSpanTrait;
+  fork(options?: SpanCreateOptions): SpanTrait;
+  fork(options?: SpanCreateOptions | MutableSpanCreateOptions): SpanTrait | MutableSpanTrait;
+}
+interface MutableSpanTrait extends SpanTrait {
+  setAttributes(attributes: Record<string, unknown>): void;
+}
+declare const SPAN_TRAIT_TOKEN: SecuritydeptInjectionToken<SpanTrait>;
+interface OperationSpanTrait extends MutableSpanTrait {
+  addEvent(type: string, attributes?: Record<string, unknown>): void;
+  recordError(error: unknown, attributes?: Record<string, unknown>): void;
+}
+//#endregion
+//#region src/validation/validator.d.ts
+/**
+ * Successful validation result.
+ *
+ * Contains the parsed, typed output value from the schema.
+ */
+interface ValidationSuccess<T> {
+  readonly success: true;
+  readonly value: T;
+}
+/**
+ * Failed validation result.
+ *
+ * Contains the list of issues reported by the schema.
+ */
+interface ValidationFailure {
+  readonly success: false;
+  readonly issues: ReadonlyArray<StandardSchemaV1.Issue>;
+}
+/**
+ * Discriminated union of validation outcomes.
+ *
+ * Consumers can narrow on `success` to access either the typed value
+ * or the issue list.
+ */
+type ValidationResult<T> = ValidationSuccess<T> | ValidationFailure;
+type TraitInputValidator = StandardSchemaV1<unknown, unknown>;
+type TraitInputBundledSchema = StandardSchemaV1<unknown, unknown>;
+interface WithTraitInputValidator<TValidator = TraitInputValidator> {
+  validators?: TValidator;
+}
+interface ValidateTraitInputOptions {
+  value: unknown;
+  bundledSchema: TraitInputBundledSchema;
+  validator?: TraitInputValidator;
+  optional?: boolean;
+  onInvalid(failure: ValidationFailure): never;
+}
+declare function formatValidationFailure(failure: ValidationFailure | undefined): string | null;
+declare function throwValidationClientError(options: {
+  code: string;
+  source: string;
+  messagePrefix: string;
+  failure?: ValidationFailure;
+}): never;
+/**
+ * Validate an unknown input against a `@standard-schema`-compatible schema.
+ *
+ * This is the foundation-level entry point for SDK validation. It accepts
+ * any schema implementing `StandardSchemaV1` and returns a discriminated
+ * `ValidationResult`.
+ *
+ * @example
+ * ```ts
+ * import { validateWithSchema } from "@securitydept/client";
+ * import { z } from "zod";
+ *
+ * const UserSchema = z.object({ name: z.string() });
+ * const result = await validateWithSchema(UserSchema, { name: "Alice" });
+ * if (result.success) {
+ *   console.log(result.value.name);
+ * } else {
+ *   console.error(result.issues);
+ * }
+ * ```
+ */
+declare function validateWithSchema<I, O>(schema: StandardSchemaV1<I, O>, input: unknown): Promise<ValidationResult<O>>;
+/**
+ * Validate an unknown input synchronously against a `@standard-schema`-compatible schema.
+ *
+ * Only use this when you know the schema's validate function returns synchronously.
+ * Throws if the schema returns a Promise.
+ */
+declare function validateWithSchemaSync<I, O>(schema: StandardSchemaV1<I, O>, input: unknown): ValidationResult<O>;
+declare function validateTraitInput(options: ValidateTraitInputOptions): void;
+//#endregion
+//#region src/std/time.d.ts
+interface TimeTraitStdHost {
+  Date: Pick<DateConstructor, "now">;
+  setTimeout(handler: () => void, delayMs: number): unknown;
+  clearTimeout(handle: unknown): void;
+}
+interface TimeForStdCreateOptions {
+  host?: TimeTraitStdHost;
+}
+declare function createTimeForStd(options?: TimeForStdCreateOptions & WithTraitInputValidator<TraitInputValidator>): TimeTrait;
+//#endregion
+//#region src/std/transport/authorization-interceptor.d.ts
+type AuthorizationSignal = ReadableSignalTrait<string | null | undefined> | ResourceTrait<string | null | undefined>;
+type AuthorizationInterceptedFetchPredicate = (input: RequestInfo | URL, init: RequestInit | undefined) => boolean | Promise<boolean>;
+interface CreateAuthorizationInterceptedFetchOptions {
+  readonly predicate: AuthorizationInterceptedFetchPredicate;
+  readonly authorization: AuthorizationSignal;
+}
+declare function createAuthorizationInterceptedFetch(fetchImpl: typeof fetch, options: CreateAuthorizationInterceptedFetchOptions): typeof fetch;
+//#endregion
+//#region src/transport/types.d.ts
+declare const TransportErrorCode: {
+  readonly RequestFailed: "transport.request_failed";
+  readonly ResponseDecodeFailed: "transport.response_decode_failed";
+  readonly InvalidStdFetchOptions: "transport.invalid_std_fetch_options";
+  readonly InvalidAngularOptions: "transport.invalid_angular_options";
+};
+type TransportErrorCode = (typeof TransportErrorCode)[keyof typeof TransportErrorCode];
+/** Neutral HTTP request representation. */
+interface HttpRequest {
+  url: string;
+  method: string;
+  headers: Record<string, string>;
+  body?: unknown;
+  cancellationToken?: CancellationTokenTrait;
+}
+/** Neutral HTTP response representation. */
+interface HttpResponse {
+  status: number;
+  headers: Record<string, string>;
+  body?: unknown;
+}
+type HttpResponseJsonBody = Record<string, unknown>;
+/** Neutral request executor trait. */
+interface BaseTransportTrait {
+  execute(request: HttpRequest): Promise<HttpResponse>;
+}
+declare const TRANSPORT_TRAIT_TOKEN: SecuritydeptInjectionToken<BaseTransportTrait>;
+//#endregion
+//#region src/std/transport/base-transport.d.ts
+declare const FetchTransportRedirectKind: {
+  readonly Follow: "follow";
+  readonly Manual: "manual";
+};
+type FetchTransportRedirectKind = (typeof FetchTransportRedirectKind)[keyof typeof FetchTransportRedirectKind];
+interface BaseTransportForStdFetchCreateOptions {
+  redirect?: FetchTransportRedirectKind;
+  fetch?: typeof fetch;
+  baseUrl?: string | URL;
+}
+/**
+ * Default `BaseTransportTrait` backed by the global `fetch` API.
+ *
+ * The caller is responsible for ensuring `fetch` is available in the runtime.
+ * No polyfill is injected.
+ */
+declare function createBaseTransportForStdFetch(options?: BaseTransportForStdFetchCreateOptions & WithTraitInputValidator<TraitInputValidator>): BaseTransportTrait;
+//#endregion
+//#region src/storage/types.d.ts
+declare const StorageChangeEventOrigin: {
+  readonly Local: "local";
+  readonly External: "external";
+};
+type StorageChangeEventOrigin = (typeof StorageChangeEventOrigin)[keyof typeof StorageChangeEventOrigin];
+interface StorageChangeEvent {
+  readonly origin: StorageChangeEventOrigin;
+  readonly key: string | null;
+  readonly oldValue: string | null;
+  readonly newValue: string | null;
+}
+/** Low-level key-value storage trait. */
+interface StorageTrait {
+  readonly storageEvent?: EventStreamTrait<StorageChangeEvent>;
+  get(key: string): string | null | Promise<string | null>;
+  set(key: string, value: string): void | Promise<void>;
+  /**
+   * Atomically read and remove a record within the store's consistency domain.
+   */
+  take?(key: string): string | null | Promise<string | null>;
+  remove(key: string): void | Promise<void>;
+}
+/** Storage whose operations complete synchronously in the current realm. */
+interface SyncStorageTrait extends StorageTrait {
+  get(key: string): string | null;
+  set(key: string, value: string): void;
+  take?(key: string): string | null;
+  remove(key: string): void;
+}
+declare const REALM_STORAGE_TRAIT_TOKEN: SecuritydeptInjectionToken<SyncStorageTrait>;
+declare const PERSISTENT_STORAGE_TRAIT_TOKEN: SecuritydeptInjectionToken<StorageTrait | null>;
+declare const SESSION_STORAGE_TRAIT_TOKEN: SecuritydeptInjectionToken<StorageTrait | null>;
+/** Serialization codec for typed values. */
+interface Codec<T> {
+  encode(value: T): string;
+  decode(raw: string): T;
+}
+/** Semantic store for long-lived auth state. */
+interface PersistentAuthStore<T> {
+  load(): Promise<T | null>;
+  save(value: T): Promise<void>;
+  clear(): Promise<void>;
+}
+/** Semantic store for recoverable state (survives page reload). */
+interface RecoverableStateStore<T> {
+  load(): Promise<T | null>;
+  save(value: T): Promise<void>;
+  clear(): Promise<void>;
+}
+/** Semantic store for ephemeral flow state (one-time-use). */
+interface EphemeralFlowStore<T> {
+  load(): Promise<T | null>;
+  save(value: T): Promise<void>;
+  consume(): Promise<T | null>;
+  clear(): Promise<void>;
+}
+/** Semantic store for keyed ephemeral flow state (one-time-use per key). */
+interface KeyedEphemeralFlowStore<T> {
+  load(key: string): Promise<T | null>;
+  save(key: string, value: T): Promise<void>;
+  take(key: string): Promise<T | null>;
+  clear(key: string): Promise<void>;
+}
+/** Versioned storage envelope — first-version migration support. */
+interface StoredEnvelope<T> {
+  version: number;
+  storedAt: number;
+  expiresAt?: number;
+  value: T;
+}
+//#endregion
+//#region src/tracing/types.d.ts
+declare const TracingLevel: {
+  readonly Debug: "debug";
+  readonly Info: "info";
+  readonly Warn: "warn";
+  readonly Error: "error";
+};
+type TracingLevel = (typeof TracingLevel)[keyof typeof TracingLevel];
+declare const OperationTraceEventType: {
+  readonly Started: "operation.started";
+  readonly Event: "operation.event";
+  readonly Error: "operation.error";
+  readonly Ended: "operation.ended";
+};
+type OperationTraceEventType = (typeof OperationTraceEventType)[keyof typeof OperationTraceEventType];
+interface TracingEvent {
+  name: string;
+  at: number;
+  span: SpanTrait;
+  level: TracingLevel;
+  target: string;
+  fields?: Record<string, unknown>;
+}
+interface TracingTrait extends DisposableTrait {
+  record(event: TracingEvent): void;
+  readonly events: EventStreamTrait<TracingEvent>;
+}
+declare const TRACING_TRAIT_TOKEN: SecuritydeptInjectionToken<TracingTrait>;
+//#endregion
+//#region src/tracing/subscriber/types.d.ts
+interface TracingSubscriberTrait {
+  record(event: TracingEvent): void;
+}
+//#endregion
+//#region src/tracing/create.d.ts
+interface TracingCreateOptions {
+  subscribers?: readonly TracingSubscriberTrait[];
+}
+declare function createTracing(options?: TracingCreateOptions & WithTraitInputValidator<TraitInputValidator>): TracingTrait;
+//#endregion
+//#region src/environment/types.d.ts
+/**
+ * Foundation dependency environment injected into client-side auth runtimes
+ * via explicit wiring at the composition root.
+ *
+ * `transport`, `time`, `realmStorage`, `span`, and `tracing` are the required baseline
+ * capabilities. Optional page/router/popup/storage traits stay explicit.
+ * Raw host-material inputs such as `window`, `location`, or browser storage
+ * handles are intentionally outside this contract and should be resolved by
+ * host-specific creators before a `FoundationEnvironment` is assembled.
+ */
+interface FoundationEnvironment {
+  injector: SecuritydeptInjector;
+  transport: BaseTransportTrait;
+  time: TimeTrait;
+  realmStorage: SyncStorageTrait;
+  idleCallback?: IdleCallbackTrait;
+  persistentStorage?: StorageTrait;
+  sessionStorage?: StorageTrait;
+  span: SpanTrait;
+  tracing: TracingTrait;
+  router?: RouterTrait;
+  pageLifecycle?: PageLifecycleTrait;
+  popup?: PopupTrait;
+}
+interface ServiceWorkerEnvironment extends FoundationEnvironment {}
+declare const ENVIRONMENT_TOKEN: SecuritydeptInjectionToken<FoundationEnvironment>;
+interface EnvironmentValidators {
+  transport?: TraitInputValidator;
+  transportForStdFetchCreateOptions?: TraitInputValidator;
+  time?: TraitInputValidator;
+  timeForStdCreateOptions?: TraitInputValidator;
+  realmStorage?: TraitInputValidator;
+  idleCallback?: TraitInputValidator;
+  persistentStorage?: TraitInputValidator;
+  sessionStorage?: TraitInputValidator;
+  span?: TraitInputValidator;
+  spanCreateOptions?: TraitInputValidator;
+  tracing?: TraitInputValidator;
+  tracingCreateOptions?: TraitInputValidator;
+  router?: TraitInputValidator;
+  pageLifecycle?: TraitInputValidator;
+  popup?: TraitInputValidator;
+}
+//#endregion
+//#region src/environment/create.d.ts
+interface CreateFoundationEnvironmentOptions {
+  providers?: readonly SecuritydeptProvider[];
+  transport?: BaseTransportTrait;
+  transportForStdFetchCreateOptions?: BaseTransportForStdFetchCreateOptions;
+  time?: TimeTrait;
+  timeForStdCreateOptions?: TimeForStdCreateOptions;
+  realmStorage?: SyncStorageTrait;
+  span?: SpanTrait;
+  spanCreateOptions?: SpanCreateOptions;
+  tracing?: TracingTrait;
+  tracingCreateOptions?: TracingCreateOptions;
+  idleCallback?: IdleCallbackTrait | null;
+  persistentStorage?: StorageTrait | null;
+  sessionStorage?: StorageTrait | null;
+  router?: RouterTrait | null;
+  pageLifecycle?: PageLifecycleTrait | null;
+  popup?: PopupTrait | null;
+  validators?: EnvironmentValidators;
+}
+/**
+ * Create a `FoundationEnvironment` from explicit trait units and defaults.
+ *
+ * This helper owns foundation-wide baseline resolution and trait-graph wiring.
+ *
+ * It may resolve:
+ *   - public std adapters such as
+ *     `transportForStdFetchCreateOptions -> transport` and `timeForStdCreateOptions -> time`
+ *   - public hostless baseline constructors such as
+ *     `spanCreateOptions -> span` and `tracingCreateOptions -> tracing`
+ *
+ * Host-material discovery such as resolving `window`, `location`, `history`,
+ * or browser storage handles belongs to explicit host adapters such as
+ * `@securitydept/client/web`, which must first resolve those inputs into
+ * concrete traits before calling this helper.
+ */
+declare function createFoundationEnvironment(overrides: CreateFoundationEnvironmentOptions): FoundationEnvironment;
+//#endregion
+//#region src/auth-coordination/contract.d.ts
+interface AuthRequirement {
+  /** Unique entity id for this requirement within the plan. */
+  readonly id: string;
+  /** Human-readable label (for logging / debugging). */
+  readonly label?: string;
+}
+interface StaticAttrsAuthRequirementInput<TAttributes = Record<string, unknown>> {
+  readonly id?: string;
+  readonly label?: string;
+  readonly attributes?: TAttributes;
+}
+declare class StaticAttrsAuthRequirement<TAttributes = Record<string, unknown>> implements AuthRequirement {
+  readonly id: string;
+  readonly label: string | undefined;
+  readonly attributes: TAttributes | undefined;
+  protected constructor(id: string, label: string | undefined, attributes: TAttributes | undefined);
+  static create<TAttributes = Record<string, unknown>>(input?: StaticAttrsAuthRequirementInput<TAttributes>): StaticAttrsAuthRequirement<TAttributes>;
+  static createList<TAttributes = Record<string, unknown>>(inputs: readonly StaticAttrsAuthRequirementInput<TAttributes>[]): readonly StaticAttrsAuthRequirement<TAttributes>[];
+}
+/** Outcome of resolving a single requirement. */
+declare const ResolutionStatus: {
+  readonly Fulfilled: "fulfilled";
+  readonly Failed: "failed";
+  readonly Skipped: "skipped";
+};
+type ResolutionStatus = (typeof ResolutionStatus)[keyof typeof ResolutionStatus];
+/** The resolution result for a single requirement. */
+interface RequirementResolution {
+  /** The requirement ID this resolution applies to. */
+  requirementId: string;
+  /** Outcome status. */
+  status: ResolutionStatus;
+  /** Optional error or reason for failure/skip. */
+  reason?: string;
+}
+/** Overall plan status. */
+declare const PlanStatus: {
+  /** There are still pending requirements. */readonly Pending: "pending"; /** All requirements have been resolved. */
+  readonly Settled: "settled";
+};
+type PlanStatus = (typeof PlanStatus)[keyof typeof PlanStatus];
+/** Error thrown when a planner contract is violated (e.g. duplicate ids). */
+declare class RequirementPlannerError extends Error {
+  constructor(message: string);
+}
+/** Result of an authentication check. */
+type AuthenticatedCheck = boolean | Promise<boolean>;
+/**
+ * Return value of an unauthenticated handler.
+ *
+ * - `true` — the requirement is now satisfied (resolved as fulfilled);
+ *   the pipeline records the resolution and may continue.
+ * - `false` — block: the requirement cannot proceed.
+ * - `string` — redirect to the given location.
+ * - A never-settling `Promise` — used when a full-page external redirect has
+ *   started; the step intentionally never resolves so the host navigation is
+ *   not finalized while the page is leaving.
+ */
+type UnauthenticatedAction = boolean | string | Promise<boolean | string>;
+/**
+ * Behaviour evaluation context handed to every behaviour callback.
+ *
+ * Reflects the planner state at the moment the callback is invoked.
+ */
+type RequirementBehaviourContext<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = {
+  readonly planContext: TPlanContext;
+  readonly environment: FoundationEnvironment; /** The full effective requirement list for the active plan. */
+  readonly requirements: readonly TAuthRequirement[]; /** Resolutions collected so far (in requirement order). */
+  readonly resolutionList: readonly RequirementResolution[];
+};
+/** Stream of unauthenticated requirements discovered by the planner. */
+type RequirementCandidateGenerator<TAuthRequirement extends AuthRequirement = AuthRequirement> = AsyncGenerator<TAuthRequirement, void, unknown>;
+/**
+ * Context handed to candidate selection.
+ *
+ * `candidateList` is intentionally a stream: selectors that can act on the
+ * first available unauthenticated requirement do not need to wait for all
+ * checks to complete, while chooser-style selectors can still collect the full
+ * stream with `for await`.
+ */
+type RequirementCandidateSelectionContext<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = RequirementBehaviourContext<TAuthRequirement, TPlanContext> & {
+  /** Requirements not yet satisfied, yielded as their checks complete. */readonly candidateList: RequirementCandidateGenerator<TAuthRequirement>;
+};
+/** Decide whether a single requirement is already satisfied. */
+type CheckAuthenticated<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = (requirement: TAuthRequirement, context: RequirementBehaviourContext<TAuthRequirement, TPlanContext>) => AuthenticatedCheck;
+/** Decide what to do when a selected requirement is unauthenticated. */
+type OnUnauthenticated<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = (requirement: TAuthRequirement, context: RequirementBehaviourContext<TAuthRequirement, TPlanContext>) => UnauthenticatedAction;
+/**
+ * Reduce the candidate set to the single requirement to act on next.
+ *
+ * The default strategy picks the first unauthenticated candidate yielded by the
+ * stream. Chooser-style strategies may collect the full stream when they need
+ * a complete candidate set.
+ */
+type SelectCandidate<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = (context: RequirementCandidateSelectionContext<TAuthRequirement, TPlanContext>) => TAuthRequirement | undefined | Promise<TAuthRequirement | undefined>;
+/** The full behaviour contract resolved by a planner host. */
+interface RequirementBehaviour<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> {
+  checkAuthenticated: CheckAuthenticated<TAuthRequirement, TPlanContext>;
+  onUnauthenticated: OnUnauthenticated<TAuthRequirement, TPlanContext>;
+  selectCandidate: SelectCandidate<TAuthRequirement, TPlanContext>;
+}
+interface RouteStateSnapshotTrait {
+  readonly url: string;
+}
+interface RouteBehaviourContextExtra {
+  readonly routeState: RouteStateSnapshotTrait;
+}
+declare function isRouteStateSnapshotTrait(value: unknown): value is RouteStateSnapshotTrait;
+declare function isRouteBehaviourContextExtra(value: unknown): value is RouteBehaviourContextExtra;
+type RequirementBehaviourWithRouteContext<TAuthRequirement extends AuthRequirement = AuthRequirement> = RequirementBehaviour<TAuthRequirement, RouteBehaviourContextExtra>;
+/** Outcome of a pipeline step or run. */
+declare const PipelineOutcome: {
+  /** No candidates remain — the plan is satisfied. */readonly Settled: "settled"; /** A candidate was resolved as fulfilled; more may remain. */
+  readonly Resolved: "resolved"; /** A candidate's handler blocked progress. */
+  readonly Blocked: "blocked"; /** A candidate's handler requested a redirect. */
+  readonly Redirect: "redirect";
+};
+type PipelineOutcome = (typeof PipelineOutcome)[keyof typeof PipelineOutcome];
+/** Result of a single {@link BaseRequirementPlanner.runStep}. */
+type PipelineStepResult<TAuthRequirement extends AuthRequirement = AuthRequirement> = {
+  outcome: typeof PipelineOutcome.Settled;
+} | {
+  outcome: typeof PipelineOutcome.Resolved;
+  requirement: TAuthRequirement;
+} | {
+  outcome: typeof PipelineOutcome.Blocked;
+  requirement: TAuthRequirement;
+} | {
+  outcome: typeof PipelineOutcome.Redirect;
+  requirement: TAuthRequirement;
+  location: string;
+};
+/** Result of {@link BaseRequirementPlanner.runUntilSettled}. */
+type PipelineRunResult<TAuthRequirement extends AuthRequirement = AuthRequirement> = {
+  outcome: typeof PipelineOutcome.Settled;
+  resolutions: readonly RequirementResolution[];
+} | {
+  outcome: typeof PipelineOutcome.Blocked;
+  requirement: TAuthRequirement;
+} | {
+  outcome: typeof PipelineOutcome.Redirect;
+  requirement: TAuthRequirement;
+  location: string;
+};
+/**
+ * How a route segment's requirements compose with the inherited parent chain.
+ *
+ * - `inherit` — keep the parent requirements unchanged (segment adds nothing)
+ * - `merge` — inherit parent requirements, then append/override with the
+ *   segment's own (same-id entries replace the parent's)
+ * - `replace` — discard the parent chain, use only the segment's requirements
+ */
+declare const RequirementsComposition: {
+  readonly Inherit: "inherit";
+  readonly Merge: "merge";
+  readonly Replace: "replace";
+};
+type RequirementsComposition = (typeof RequirementsComposition)[keyof typeof RequirementsComposition];
+/** A single node in a matched route chain. */
+interface RouteTreeSegment<TAuthRequirement extends AuthRequirement = AuthRequirement> {
+  /** Route segment identifier (e.g. route name or path pattern). */
+  routeId: string;
+  /** Auth requirements declared on this route segment. */
+  requirements: readonly TAuthRequirement[];
+  /** Composition strategy against the inherited chain. Defaults to `merge`. */
+  composition?: RequirementsComposition;
+}
+/** A requirements declaration annotated with its composition strategy. */
+interface RouteRequirementsDeclaration<TAuthRequirement extends AuthRequirement = AuthRequirement> {
+  composition: RequirementsComposition;
+  requirements: readonly TAuthRequirement[];
+}
+/**
+ * Apply a route requirements declaration onto an effective requirement map.
+ *
+ * Reuse `effective` across a route chain so merge/replace fold in O(total
+ * requirements) without rebuilding parent state each segment. When omitted, a
+ * fresh map is created for one-shot composition.
+ */
+declare function resolveEffectiveRequirements<TAuthRequirement extends AuthRequirement = AuthRequirement>(child: RouteRequirementsDeclaration<TAuthRequirement>, effective?: Map<string, TAuthRequirement>): Map<string, TAuthRequirement>;
+//#endregion
+//#region src/auth-coordination/planner-host.d.ts
+declare const REQUIREMENT_PLANNER_HOST: SecuritydeptInjectionToken<RequirementPlannerHost<unknown>>;
+type RequirementPlannerHostBehaviour<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>> = TBehaviour | (() => TBehaviour);
+interface ProvideRequirementPlannerHostOptions<TBehaviour = Partial<RequirementBehaviour>> {
+  readonly parent?: RequirementPlannerHost<TBehaviour>;
+  readonly environment?: FoundationEnvironment;
+}
+interface InjectRequirementPlannerHostOptions {
+  readonly injector: SecuritydeptInjectorTrait;
+}
+/**
+ * Default candidate selector: first unauthenticated candidate as soon as it is
+ * discovered.
+ *
+ * If every requirement is already fulfilled the stream completes and the
+ * selector returns `undefined`.
+ */
+declare function defaultSelectCandidate<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}>(): SelectCandidate<TAuthRequirement, TPlanContext>;
+/** Options for {@link RequirementPlannerHost.fromBehaviour}. */
+interface RequirementPlannerHostOptions<TRequirementBehaviour = Partial<RequirementBehaviour>> {
+  /** Parent host to inherit unspecified behaviour from. */
+  parent?: RequirementPlannerHost<TRequirementBehaviour>;
+  environment?: FoundationEnvironment;
+}
+/**
+ * A coordination-scope host that resolves behaviour through a parent chain.
+ *
+ * Construct via {@link RequirementPlannerHost.fromBehaviour}. Each behaviour
+ * field is optional at host construction time; missing required behaviour is
+ * resolved from `parent` and fails fast during planner build if no host in the
+ * chain provides it.
+ *
+ * @example
+ * ```ts
+ * const root = RequirementPlannerHost.fromBehaviour({
+ *   checkAuthenticated: (req) => isAuthenticated(req),
+ *   onUnauthenticated: (req) => `/login/${req.id}`,
+ * });
+ *
+ * // Feature scope overrides only the chooser, inheriting the rest.
+ * const feature = RequirementPlannerHost.fromBehaviour(
+ *   { selectCandidate: async (ctx) => showChooser(ctx.candidateList) },
+ *   { parent: root },
+ * );
+ * ```
+ */
+declare class RequirementPlannerHost<TBehaviour = Partial<RequirementBehaviour>> {
+  readonly environment: FoundationEnvironment | undefined;
+  readonly parent: RequirementPlannerHost<TBehaviour> | undefined;
+  /** The parent host, or undefined at the root. */
+  private readonly _behaviour;
+  protected constructor(behaviour: TBehaviour, environment: FoundationEnvironment | undefined, parent: RequirementPlannerHost<TBehaviour> | undefined);
+  /** Create a host scope from a partial behaviour and optional parent. */
+  static fromBehaviour<TBehaviour = Partial<RequirementBehaviour>>(behaviour: TBehaviour, options?: RequirementPlannerHostOptions<TBehaviour>): RequirementPlannerHost<TBehaviour>;
+  resolveBehaviourOptionFor<K extends keyof TBehaviour>(key: K): Promise<TBehaviour[K] | undefined>;
+  resolveBehaviourFor<K extends keyof TBehaviour>(key: K, defaultValue: () => NonNullable<TBehaviour[K]> | Promise<NonNullable<TBehaviour[K]>>): Promise<NonNullable<TBehaviour[K]>>;
+  resolveEnvironmentOption(): Promise<FoundationEnvironment | undefined>;
+  resolveEnvironment(defaultValue: () => FoundationEnvironment | Promise<FoundationEnvironment>): Promise<FoundationEnvironment>;
+}
+declare function provideRequirementPlannerHost<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>>(behaviour: RequirementPlannerHostBehaviour<TAuthRequirement, TPlanContext, TBehaviour>, options?: ProvideRequirementPlannerHostOptions<TBehaviour>): SecuritydeptProvider<RequirementPlannerHost<TBehaviour>>;
+declare function injectRequirementPlannerHost<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>>(options: InjectRequirementPlannerHostOptions): RequirementPlannerHost<TBehaviour> | null;
+//#endregion
+//#region src/auth-coordination/planner/base-planner.d.ts
+/**
+ * Mutable pipeline state for one run: bound behaviour plus requirement list
+ * and evolving resolutions.
+ */
+interface RequirementPlan<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> extends Readonly<RequirementBehaviour<TAuthRequirement, TPlanContext>> {
+  readonly planContext: TPlanContext;
+  readonly environment: FoundationEnvironment;
+  readonly requirements: readonly TAuthRequirement[];
+  resolutionList: RequirementResolution[];
+}
+/**
+ * Abstract base for all requirement planners.
+ *
+ * Subclasses supply requirements via {@link buildRequirementList}. Pipeline
+ * state lives on {@link RequirementPlan}, produced by {@link buildPlan}.
+ */
+declare abstract class BaseRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>> {
+  protected readonly host: RequirementPlannerHost<TBehaviour>;
+  protected initialResolutions: readonly RequirementResolution[];
+  abstract get planContext(): TPlanContext;
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, initialResolutions?: readonly RequirementResolution[]);
+  /**
+   * Pipeline step 0: resolve host behaviour and materialize requirements into
+   * a {@link RequirementPlan}.
+   *
+   * Behaviour and the requirement list stay fixed on the returned plan until
+   * the next `buildPlan()` call. Resolve host parent chains (and any
+   * injection-context capture) here — not between async steps.
+   */
+  buildPlan(): Promise<RequirementPlan<TAuthRequirement, TPlanContext>>;
+  /**
+   * Return the effective requirement map for this planner.
+   *
+   * Keys are requirement ids; {@link Map} insertion order defines evaluation
+   * order. Subclasses own deduplication policy when folding multiple sources.
+   */
+  protected abstract buildRequirementList(): Map<string, TAuthRequirement> | Promise<Map<string, TAuthRequirement>>;
+  /**
+   * Materialize the effective requirement list (also invoked by {@link buildPlan}).
+   */
+  resolveRequirementList(): Promise<readonly TAuthRequirement[]>;
+  /**
+   * Pipeline step 1 — one loop iteration: select a candidate, run
+   * `onUnauthenticated`, then reduce `plan` state.
+   */
+  runStep(plan: RequirementPlan<TAuthRequirement, TPlanContext>): Promise<PipelineStepResult<TAuthRequirement>>;
+  protected reduceFromAction(plan: RequirementPlan<TAuthRequirement, TPlanContext>, candidate: TAuthRequirement, action: Exclude<UnauthenticatedAction, Promise<unknown>>): PipelineStepResult<TAuthRequirement>;
+  /**
+   * Run the full pipeline: {@link buildPlan}, step 1, then loop step 2 until
+   * settled or a terminal outcome (`blocked`, `redirect`, or a never-settling
+   * action).
+   */
+  runUntilSettled(): Promise<PipelineRunResult<TAuthRequirement>>;
+  runUntilSettledWithPlan(plan: RequirementPlan<TAuthRequirement, TPlanContext>): Promise<PipelineRunResult<TAuthRequirement>>;
+  private createCandidateStream;
+  private recordFulfilled;
+}
+//#endregion
+//#region src/auth-coordination/planner/merge-planner.d.ts
+/**
+ * A planner whose effective requirements are the ordered union of its source
+ * planners. Overlapping ids follow Map semantics (later source wins).
+ *
+ * @example
+ * ```ts
+ * const planner = MergeRequirementPlanner.fromPlanners(host, [
+ *   sessionPlanner,
+ *   oidcPlanner,
+ * ]);
+ * ```
+ */
+declare class MergeRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>> extends BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour> {
+  private readonly sources;
+  get planContext(): TPlanContext;
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, sources: readonly BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour>[]);
+  /** Create a merge planner from an ordered list of source planners. */
+  static fromPlanners<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>>(host: RequirementPlannerHost<TBehaviour>, planners: readonly BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour>[]): MergeRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour>;
+  protected buildRequirementList(): Promise<Map<string, TAuthRequirement>>;
+}
+//#endregion
+//#region src/auth-coordination/planner/route-composition-planner.d.ts
+/**
+ * A planner driven by a matched route chain with composition semantics.
+ *
+ * Construct via {@link fromRouteSegments} for a matched route chain, or
+ * {@link fromRouteTransition} for a transition that preserves shared-prefix
+ * resolutions from the previous planner instance.
+ */
+declare class RouteCompositionRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>> extends BaseRequirementPlanner<TAuthRequirement, RouteBehaviourContextExtra, TBehaviour> {
+  private readonly _segments;
+  private readonly _effective;
+  private readonly _planContext;
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, segments: readonly RouteTreeSegment<TAuthRequirement>[], routeState: RouteStateSnapshotTrait, preservedResolutions?: readonly RequirementResolution[]);
+  /** Build a planner from a matched route chain. */
+  static fromRouteSegments<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>>(host: RequirementPlannerHost<TBehaviour>, segments: readonly RouteTreeSegment<TAuthRequirement>[], routeState: RouteStateSnapshotTrait): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour>;
+  /**
+   * Build a planner for a route transition, preserving resolutions for the
+   * shared requirement prefix carried over from `previousPlan`.
+   */
+  static fromRouteTransition<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>>(host: RequirementPlannerHost<TBehaviour>, currentSegments: readonly RouteTreeSegment<TAuthRequirement>[], routeState: RouteStateSnapshotTrait, previousPlanner: RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour>, previousPlan: RequirementPlan<TAuthRequirement, RouteBehaviourContextExtra>): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour>;
+  get planContext(): RouteBehaviourContextExtra;
+  /** The matched route chain backing this planner. */
+  get segments(): readonly RouteTreeSegment<TAuthRequirement>[];
+  /** The folded effective requirement list (composition applied). */
+  get effectiveRequirements(): readonly TAuthRequirement[];
+  protected buildRequirementList(): Map<string, TAuthRequirement>;
+}
+//#endregion
+//#region src/auth-coordination/planner/static-planner.d.ts
+/**
+ * A planner whose effective requirement list is a fixed array supplied at
+ * construction time.
+ *
+ * @example
+ * ```ts
+ * const planner = StaticRequirementPlanner.fromRequirements(host, [
+ *   StaticAttrsAuthRequirement.create({ id: "session" }),
+ * ] as Readonly<AuthRequirement[]>);
+ * const plan = await planner.buildPlan();
+ * const step = await planner.runStep(plan);
+ * // or: const result = await planner.runUntilSettled();
+ * ```
+ */
+declare class StaticRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement>> = Partial<RequirementBehaviour<TAuthRequirement>>> extends BaseRequirementPlanner<TAuthRequirement, {}, TBehaviour> {
+  private readonly staticRequirements;
+  get planContext(): {};
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, requirements: readonly TAuthRequirement[]);
+  /** Create a static planner from an ordered requirement list. */
+  static fromRequirements<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement>> = Partial<RequirementBehaviour<TAuthRequirement>>>(host: RequirementPlannerHost<TBehaviour>, requirements: readonly TAuthRequirement[]): StaticRequirementPlanner<TAuthRequirement, TBehaviour>;
+  protected buildRequirementList(): Map<string, TAuthRequirement>;
+}
+//#endregion
+//#region src/identity/contracts.d.ts
+interface IdentityPrincipal {
+  subject: string;
+  displayName: string;
+  picture?: string;
+  issuer?: string;
+  claims?: Record<string, unknown>;
+}
+interface ProjectIdentityPrincipalOptions {
+  principal?: IdentityPrincipal | null;
+  fallbackDisplayName?: string;
+  fallbackSubject?: string;
+  fallbackIssuer?: string;
+  fallbackClaims?: Record<string, unknown>;
+}
+//#endregion
+//#region src/identity/parsers.d.ts
+declare function parseIdentityPrincipal(input: unknown): IdentityPrincipal;
+declare function parseIdentityPrincipalWire(input: unknown): IdentityPrincipal;
+declare function projectIdentityPrincipal(options: ProjectIdentityPrincipalOptions): IdentityPrincipal;
+//#endregion
+//#region src/identity/schemas.d.ts
+declare const IdentityPrincipalSchema: _$arktype_internal_variants_object_ts0.ObjectType<(In: {
+  subject: string;
+  displayName?: string | null | undefined;
+  picture?: string | null | undefined;
+  issuer?: string | null | undefined;
+  claims?: object | null | undefined;
+}) => _$arktype.Out<IdentityPrincipal>, {}>;
+declare const IdentityPrincipalWireSchema: _$arktype_internal_variants_object_ts0.ObjectType<(In: {
+  subject: string;
+  display_name?: string | null | undefined;
+  picture?: string | null | undefined;
+  issuer?: string | null | undefined;
+  claims?: object | null | undefined;
+}) => _$arktype.Out<IdentityPrincipal>, {}>;
+//#endregion
+//#region src/protocol/jwt/types.d.ts
+type JwtAudienceClaim = string | readonly string[];
+interface JwtClaimsSet extends Record<string, unknown> {
+  iss?: string;
+  sub?: string;
+  aud?: JwtAudienceClaim;
+  exp?: number;
+  nbf?: number;
+  iat?: number;
+  jti?: string;
+}
+interface DecodeJwtPayloadOptions {
+  /**
+   * Optional label used in error messages. It does not affect parsing.
+   */
+  label?: string;
+}
+//#endregion
+//#region src/protocol/jwt/decode.d.ts
+declare function decodeJwtPayload(jwt: string, options?: DecodeJwtPayloadOptions): JwtClaimsSet;
+//#endregion
+//#region src/protocol/jwt/error.d.ts
+declare const JwtDecodeErrorCode: {
+  readonly InvalidFormat: "protocol.jwt.invalid_format";
+  readonly InvalidPayload: "protocol.jwt.invalid_payload";
+  readonly InvalidClaim: "protocol.jwt.invalid_claim";
+};
+type JwtDecodeErrorCode = (typeof JwtDecodeErrorCode)[keyof typeof JwtDecodeErrorCode];
+declare class JwtDecodeError extends ClientError {
+  readonly code: JwtDecodeErrorCode;
+  constructor(options: {
+    code: JwtDecodeErrorCode;
+    message: string;
+    cause?: unknown;
+  });
+}
+//#endregion
+//#region src/span/span.d.ts
+declare function createRootSpan(options?: SpanCreateOptions & WithTraitInputValidator<TraitInputValidator>): SpanTrait;
+//#endregion
+//#region src/std/cancellation/abort-signal.d.ts
+/**
+ * Bridge a web `AbortSignal` back into the foundation cancellation contract.
+ *
+ * This is the canonical consumer-side path for browser hosts that receive an
+ * `AbortSignal` from framework/runtime APIs (for example React Query queryFns)
+ * but need to call SDK surfaces that accept `CancellationTokenTrait`.
+ */
+declare function abortSignalToCancellationToken(signal: AbortSignal): CancellationTokenTrait;
+declare function abortSignalToCancellationToken(signal?: undefined): undefined;
+declare function abortSignalToCancellationToken(signal?: AbortSignal): CancellationTokenTrait | undefined;
+interface AbortSignalBridge extends DisposableTrait {
+  signal?: AbortSignal;
+}
+/**
+ * Bridge foundation cancellation to `AbortSignal` without exposing
+ * `AbortSignal` in core contracts.
+ */
+declare function cancellationTokenToAbortSignal(token: CancellationTokenTrait): AbortSignalBridge;
+declare function cancellationTokenToAbortSignal(token?: undefined): undefined;
+declare function cancellationTokenToAbortSignal(token?: CancellationTokenTrait): AbortSignalBridge | undefined;
+declare function normalizeAbortError(token: CancellationTokenTrait | undefined, error: unknown): unknown;
+//#endregion
+//#region src/storage/ephemeral-flow-store.d.ts
+interface CreateEphemeralFlowStoreOptions<T> {
+  store: StorageTrait;
+  key: string;
+  codec?: Codec<T>;
+}
+interface CreateKeyedEphemeralFlowStoreOptions<T> {
+  store: StorageTrait;
+  keyPrefix: string;
+  codec?: Codec<T>;
+}
+/**
+ * Create a typed ephemeral flow-state store backed by a low-level `StorageTrait`.
+ *
+ * Intended for short-lived browser/session coordination state such as pending
+ * redirects or callback fragments.
+ */
+declare function createEphemeralFlowStore<T>(options: CreateEphemeralFlowStoreOptions<T>): EphemeralFlowStore<T>;
+/**
+ * Create a typed keyed ephemeral flow-state store backed by a low-level
+ * `StorageTrait`.
+ *
+ * Intended for short-lived browser/session coordination state where multiple
+ * pending records must coexist and be consumed independently.
+ */
+declare function createKeyedEphemeralFlowStore<T>(options: CreateKeyedEphemeralFlowStoreOptions<T>): KeyedEphemeralFlowStore<T>;
+//#endregion
+//#region src/storage/json-codec.d.ts
+/** Default JSON codec. */
+declare function createJsonCodec<T>(): Codec<T>;
+//#endregion
+//#region src/storage/memory-store.d.ts
+/** In-memory `SyncStorageTrait` — useful for realm state, tests, and SSR. */
+declare function createInMemoryRecordStore(): SyncStorageTrait;
+//#endregion
+//#region src/struct/async-lock.d.ts
+declare const OnceAsyncLockState: {
+  readonly Init: "init";
+  readonly Running: "running";
+  readonly Success: "success";
+  readonly Error: "error";
+};
+type OnceAsyncLockState = (typeof OnceAsyncLockState)[keyof typeof OnceAsyncLockState];
+type OnceAsyncLockInit = {
+  readonly state: typeof OnceAsyncLockState.Init;
+  readonly promise?: never;
+};
+type OnceAsyncLockRunning = {
+  readonly state: typeof OnceAsyncLockState.Running;
+  readonly promise: Promise<unknown>;
+};
+type OnceAsyncLockSuccess<T> = {
+  readonly state: typeof OnceAsyncLockState.Success;
+  readonly data: T;
+};
+type OnceAsyncLockError<E> = {
+  readonly state: typeof OnceAsyncLockState.Error;
+  readonly error: E;
+};
+type OnceAsyncLock<T, E> = OnceAsyncLockInit | OnceAsyncLockRunning | OnceAsyncLockSuccess<T> | OnceAsyncLockError<E>;
+type OnceAsyncLockCallable<F extends (...args: any[]) => PromiseLike<any>, E = unknown> = F & OnceAsyncLock<Awaited<ReturnType<F>>, E> & ReadableSignalTrait<OnceAsyncLock<Awaited<ReturnType<F>>, E>>;
+declare function createOnceAsyncLockCallable<F extends (...args: any[]) => PromiseLike<any>, E = unknown>(fn: F): OnceAsyncLockCallable<F, E>;
+//#endregion
+//#region src/tracing/operation-runner.d.ts
+interface RunOperationEnvironment {
+  environment: {
+    time: TimestampProviderTrait;
+    tracing: TracingTrait;
+  };
+}
+interface RunOperationOptionsBase extends RunOperationEnvironment {
+  span: SpanTrait;
+  name: string;
+  target: string;
+  fields?: Record<string, unknown>;
+  idFactory?: () => string;
+  normalizeError?: (error: unknown) => unknown;
+}
+interface RunOperationOptions<T> extends RunOperationOptionsBase {
+  execute: (span: OperationSpanTrait) => T;
+}
+declare class OperationSpan implements OperationSpanTrait {
+  private readonly _span;
+  private readonly _environment;
+  private readonly _name;
+  private readonly _target;
+  private constructor();
+  static start(options: RunOperationOptionsBase): OperationSpan;
+  get id(): string;
+  get parent(): SpanTrait | undefined;
+  get attributes(): Readonly<Record<string, unknown>>;
+  fork(options: MutableSpanCreateOptions): MutableSpanTrait;
+  fork(options?: SpanCreateOptions): SpanTrait;
+  setAttributes(attributes: Record<string, unknown>): void;
+  addEvent(name: string, fields?: Record<string, unknown>): void;
+  recordError(error: unknown, fields?: Record<string, unknown>): void;
+  recordStarted(): void;
+  recordEnded(outcome: "succeeded" | "failed"): void;
+  private _record;
+}
+declare function runOperation<T>(options: RunOperationOptions<T>): T;
+declare function runOperation<T>(options: RunOperationOptions<Promise<T>>): Promise<T>;
+//#endregion
+//#region src/tracing/operation-method.d.ts
+interface InstrumentMethodThisContext<TArgs extends unknown[]> {
+  args: TArgs;
+  methodName: string;
+}
+interface InstrumentMethodResolvedOptions extends Omit<RunOperationOptionsBase, "name"> {
+  name?: string;
+}
+type InstrumentMethodThisResolver<TThis extends object, TArgs extends unknown[]> = (this: TThis, context: InstrumentMethodThisContext<TArgs>) => InstrumentMethodResolvedOptions;
+interface DefineInstrumentMethodDecoratorContext<TFactoryArgs extends unknown[]> {
+  factoryArgs: TFactoryArgs;
+  methodName: string;
+}
+type DefineInstrumentMethodDecoratorFactory<TFactoryArgs extends unknown[], TBaseThis extends object = object> = <TThis extends TBaseThis, TArgs extends unknown[]>(context: DefineInstrumentMethodDecoratorContext<TFactoryArgs>) => InstrumentMethodThisResolver<TThis, TArgs>;
+declare function defineInstrumentMethodDecorator<TFactoryArgs extends unknown[], TBaseThis extends object = object>(factory: DefineInstrumentMethodDecoratorFactory<TFactoryArgs, TBaseThis>): (...factoryArgs: TFactoryArgs) => <TThis extends TBaseThis, TArgs extends unknown[], TReturn>(target: (this: TThis, ...args: TArgs) => TReturn, context: ClassMethodDecoratorContext<TThis, (this: TThis, ...args: TArgs) => TReturn>) => (this: TThis, ...args: TArgs) => TReturn;
+//#endregion
+//#region src/tracing/subscriber/console.d.ts
+declare function createConsoleTracingSubscriber(): TracingSubscriberTrait;
+//#endregion
+//#region src/tracing/subscriber/timeline-store.d.ts
+interface TraceTimelineEntry extends TracingEvent {
+  id: number;
+  recordedAtIso: string;
+}
+interface TraceTimelineStore extends TracingSubscriberTrait {
+  get(): readonly TraceTimelineEntry[];
+  subscribe(listener: () => void): () => void;
+  clear(): void;
+}
+/**
+ * Create a subscriber-side trace timeline store.
+ *
+ * This store consumes tracing events through `record(event)` and keeps a
+ * bounded local timeline for tests and UI surfaces. It is not the tracing
+ * runtime itself.
+ */
+declare function createTraceTimelineStore(limit?: number): TraceTimelineStore;
+//#endregion
+//#region src/transport/url.d.ts
+/**
+ * Returns `true` for loopback HTTP URLs that browsers and local tooling often
+ * permit during development flows.
+ */
+declare function isLoopbackHttpUrl(url: URL): boolean;
+//#endregion
+export { REQUIREMENT_PLANNER_HOST as $, isCompatFragmentBlock as $n, CreateJsonRpcClientOptions as $r, REALM_STORAGE_TRAIT_TOKEN as $t, cancellationTokenToAbortSignal as A, decodeBase64ToUint8Array as Ai, validateTraitInput as An, PopupClientWindowHandle as Ar, UnauthenticatedAction as At, IdentityPrincipalWireSchema as B, RouterNavigationRequest as Bn, flattenResourceSnapshot as Br, TracingCreateOptions as Bt, OnceAsyncLockSuccess as C, readErrorPresentationDescriptor as Ci, ValidateTraitInputOptions as Cn, PopupAttachSuccess as Cr, RouteBehaviourContextExtra as Ct, createEphemeralFlowStore as D, PageLifecycleTrait as Di, WithTraitInputValidator as Dn, CreatePopupServerSessionOptions as Dr, SelectCandidate as Dt, createJsonCodec as E, PAGE_LIFECYCLE_TRAIT_TOKEN as Ei, ValidationSuccess as En, CreatePopupClientSessionOptions as Er, RouteTreeSegment as Et, decodeJwtPayload as F, SpanCreateOptions as Fn, PopupWindowHandleTrait as Fr, createFoundationEnvironment as Ft, ProjectIdentityPrincipalOptions as G, AppendOrReplaceCompatFragmentResult as Gn, createResource as Gr, TracingEvent as Gt, parseIdentityPrincipalWire as H, TakeCompatFragmentFromRouterOptions as Hn, whenResourceSnapshotValue as Hr, TracingSubscriberTrait as Ht, DecodeJwtPayloadOptions as I, SpanTrait as In, createSignal as Ir, ENVIRONMENT_TOKEN as It, MergeRequirementPlanner as J, SECURITYDEPT_COMPAT_FRAGMENT_VERSION as Jn, ResourceValueUnavailableErrorOptions as Jr, Codec as Jt, StaticRequirementPlanner as K, CompatFragment as Kn, ResourceError as Kr, TracingLevel as Kt, JwtAudienceClaim as L, ROUTER_TRAIT_TOKEN as Ln, readonlySignal as Lr, EnvironmentValidators as Lt, createRootSpan as M, validateWithSchemaSync as Mn, PopupMessageChannelTrait as Mr, isRouteStateSnapshotTrait as Mt, JwtDecodeError as N, OperationSpanTrait as Nn, PopupServerWindowHandle as Nr, resolveEffectiveRequirements as Nt, createKeyedEphemeralFlowStore as O, promisesToRacedAsyncGenerator as Oi, formatValidationFailure as On, PopupErrorCode as Or, StaticAttrsAuthRequirement as Ot, JwtDecodeErrorCode as P, SPAN_TRAIT_TOKEN as Pn, PopupServerWindowHandleTrait as Pr, CreateFoundationEnvironmentOptions as Pt, ProvideRequirementPlannerHostOptions as Q, appendOrReplaceCompatFragment as Qn, createJsonRpcServerAndClient as Qr, PersistentAuthStore as Qt, JwtClaimsSet as R, RouterNavigationIntent as Rn, ResourceSnapshotUpdate as Rr, FoundationEnvironment as Rt, OnceAsyncLockState as S, abortSignalToEventStream as Si, TraitInputValidator as Sn, PopupAttachResult as Sr, ResolutionStatus as St, createInMemoryRecordStore as T, describeError as Ti, ValidationResult as Tn, PopupTrait as Tr, RouteStateSnapshotTrait as Tt, projectIdentityPrincipal as U, takeCompatFragmentFromRouter as Un, CreateResourceOptions as Ur, OperationTraceEventType as Ut, parseIdentityPrincipal as V, RouterTrait as Vn, reduceResourceSnapshot as Vr, createTracing as Vt, IdentityPrincipal as W, AppendOrReplaceCompatFragmentOptions as Wn, ResourceStreamContext as Wr, TRACING_TRAIT_TOKEN as Wt, RequirementPlan as X, TakeCompatFragmentResult as Xn, createJsonRpcClient as Xr, KeyedEphemeralFlowStore as Xt, BaseRequirementPlanner as Y, TakeCompatFragmentOptions as Yn, createComputed as Yr, EphemeralFlowStore as Yt, InjectRequirementPlannerHostOptions as Z, UpdateUriFragmentHash as Zn, createJsonRpcServer as Zr, PERSISTENT_STORAGE_TRAIT_TOKEN as Zt, OnceAsyncLock as _, createEmptyEventStream as _i, AuthorizationSignal as _n, UriRelativeStringSchema as _r, RequirementCandidateGenerator as _t, createConsoleTracingSubscriber as a, JsonRpcId as ai, StoredEnvelope as an, UriReferenceStringInput as ar, provideRequirementPlannerHost as at, OnceAsyncLockInit as b, createEventSubject as bi, TimeForStdCreateOptions as bn, PopupAttachFailure as br, RequirementResolution as bt, InstrumentMethodResolvedOptions as c, JsonRpcNotificationMessage as ci, FetchTransportRedirectKind as cn, UriRelativeString as cr, CheckAuthenticated as ct, defineInstrumentMethodDecorator as d, JsonRpcRequestOptions as di, HttpRequest as dn, SECURITYDEPT_ROUTE_METADATA_KEY as dr, PipelineRunResult as dt, CreateJsonRpcServerAndClientOptions as ei, RecoverableStateStore as en, parseCompatFragment as er, RequirementPlannerHost as et, OperationSpan as f, JsonRpcServerAndClientTrait as fi, HttpResponse as fn, SecuritydeptRouteMetadata as fr, PipelineStepResult as ft, runOperation as g, toEventStream as gi, AuthorizationInterceptedFetchPredicate as gn, UriReferenceStringSchema as gr, RequirementBehaviourWithRouteContext as gt, RunOperationOptionsBase as h, ToEventStreamInput as hi, TransportErrorCode as hn, BaseURIStringSchema as hr, RequirementBehaviourContext as ht, createTraceTimelineStore as i, JsonRpcErrorResponseMessage as ii, StorageTrait as in, UriReferenceString as ir, injectRequirementPlannerHost as it, normalizeAbortError as j, encodeUint8ArrayToBase64 as ji, validateWithSchema as jn, PopupClientWindowHandleTrait as jr, isRouteBehaviourContextExtra as jt, abortSignalToCancellationToken as k, Base64CompatErrorCode as ki, throwValidationClientError as kn, readPopupErrorPresentationDescriptor as kr, StaticAttrsAuthRequirementInput as kt, InstrumentMethodThisContext as l, JsonRpcRequestEvent as li, createBaseTransportForStdFetch as ln, UriSearchParamsInit as lr, OnUnauthenticated as lt, RunOperationOptions as m, JsonRpcSuccessResponseMessage as mi, TRANSPORT_TRAIT_TOKEN as mn, writeSecuritydeptRouteMetadata as mr, RequirementBehaviour as mt, TraceTimelineEntry as n, JsonRpcClientTrait as ni, StorageChangeEvent as nn, UriFragmentPart as nr, RequirementPlannerHostOptions as nt, DefineInstrumentMethodDecoratorContext as o, JsonRpcMessage as oi, SyncStorageTrait as on, UriReferenceStringLike as or, AuthRequirement as ot, RunOperationEnvironment as p, JsonRpcServerTrait as pi, HttpResponseJsonBody as pn, readSecuritydeptRouteMetadata as pr, PlanStatus as pt, RouteCompositionRequirementPlanner as q, CompatFragmentParameters as qn, ResourceErrorCode as qr, TracingTrait as qt, TraceTimelineStore as r, JsonRpcErrorPayload as ri, StorageChangeEventOrigin as rn, UriParseError as rr, defaultSelectCandidate as rt, DefineInstrumentMethodDecoratorFactory as s, JsonRpcNotificationEvent as si, BaseTransportForStdFetchCreateOptions as sn, UriRelativeParts as sr, AuthenticatedCheck as st, isLoopbackHttpUrl as t, CreateJsonRpcServerOptions as ti, SESSION_STORAGE_TRAIT_TOKEN as tn, takeCompatFragment as tr, RequirementPlannerHostBehaviour as tt, InstrumentMethodThisResolver as u, JsonRpcRequestMessage as ui, BaseTransportTrait as un, UriString as ur, PipelineOutcome as ut, OnceAsyncLockCallable as v, createEventReplaySubject as vi, CreateAuthorizationInterceptedFetchOptions as vn, UriStringSchema as vr, RequirementCandidateSelectionContext as vt, createOnceAsyncLockCallable as w, ErrorSummary as wi, ValidationFailure as wn, PopupOpenOptions as wr, RouteRequirementsDeclaration as wt, OnceAsyncLockRunning as x, createNeverEventStream as xi, createTimeForStd as xn, PopupAttachFailureReason as xr, RequirementsComposition as xt, OnceAsyncLockError as y, createEventStream as yi, createAuthorizationInterceptedFetch as yn, POPUP_TRAIT_TOKEN as yr, RequirementPlannerError as yt, IdentityPrincipalSchema as z, RouterNavigationMode as zn, ResourceSnapshotUpdateKind as zr, ServiceWorkerEnvironment as zt };
+//# sourceMappingURL=index-D5mW18cM.d.mts.map