@securitydept/client 0.3.0-beta.3 → 0.3.0-beta.6

package/dist/index-DmIapvr-.d.mts

@@ -0,0 +1,1669 @@
+import { $ as ErrorPresentationDescriptor, B as WritableSignalTrait, C as IdleCallbackTrait, D as ComputedSignalTrait, E as TimestampProviderTrait, F as ResourceSnapshot, G as ClientError, Ht as SecuritydeptInjectionToken, J as ClientErrorKind, L as ResourceTrait, O as ReadableSignalTrait, R as ResourceWhenValueOptions, St as DisposableTrait, T as TimeTrait, Tt as SYMBOL_DISPOSE, Ut as SecuritydeptInjectorTrait, W as CancellationTokenTrait, Wt as SecuritydeptProvider, ct as EventSubjectTrait, dt as InteropObservableTrait, nt as UserRecovery, rt as EventObserverTrait, st as EventStreamTrait, tt as ReadErrorPresentationDescriptorOptions, yt as SecuritydeptInjector, z as SignalOptions } from "./index-Cg_iY2yY.mjs";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/injection/destroy.d.ts
+declare abstract class SecuritydeptDestroyRef implements DisposableTrait {
+  abstract readonly destroyed: boolean;
+  abstract onDestroy(callback: () => void): () => void;
+  abstract dispose(): void;
+  [SYMBOL_DISPOSE](): void;
+}
+declare function createSecuritydeptDestroyRef(): SecuritydeptDestroyRef;
+//#endregion
+//#region src/compat/base64.d.ts
+declare const Base64CompatErrorCode: {
+  readonly EncoderUnavailable: "compat.base64.encoder_unavailable";
+  readonly DecoderUnavailable: "compat.base64.decoder_unavailable";
+};
+type Base64CompatErrorCode = (typeof Base64CompatErrorCode)[keyof typeof Base64CompatErrorCode];
+declare function encodeUint8ArrayToBase64(value: Uint8Array): string;
+declare function decodeBase64ToUint8Array(value: string): Uint8Array;
+//#endregion
+//#region src/compat/generator.d.ts
+declare function promisesToRacedAsyncGenerator<T>(promises: Promise<T>[]): AsyncGenerator<T, void, unknown>;
+//#endregion
+//#region src/page/index.d.ts
+interface PageLifecycleTrait<TResumeEvent = unknown> {
+  resume: EventStreamTrait<TResumeEvent>;
+}
+declare const PAGE_LIFECYCLE_TRAIT_TOKEN: SecuritydeptInjectionToken<PageLifecycleTrait<unknown> | null>;
+//#endregion
+//#region src/errors/error-attributes.d.ts
+interface ErrorSummary {
+  errorName: string;
+  errorKind?: ClientErrorKind;
+  errorCode?: string;
+  recovery?: UserRecovery;
+}
+/** Extract secret-safe diagnostic attributes without copying runtime messages. */
+declare function describeError(error: unknown): ErrorSummary;
+//#endregion
+//#region src/errors/presentation-descriptor.d.ts
+declare function readErrorPresentationDescriptor(error: unknown, options?: ReadErrorPresentationDescriptorOptions): ErrorPresentationDescriptor;
+//#endregion
+//#region src/std/events/from-abort.d.ts
+type AbortSignalStdSource = Pick<AbortSignal, "aborted" | "reason"> & {
+  addEventListener?: (type: "abort", listener: EventListener) => void;
+  removeEventListener?: (type: "abort", listener: EventListener) => void;
+};
+/**
+ * Adapt an `AbortSignal`-like source into an event stream of abort reasons.
+ */
+declare function abortSignalToEventStream(signal: AbortSignalStdSource): EventStreamTrait<unknown>;
+//#endregion
+//#region src/events/create.d.ts
+/**
+ * Create a new event stream from a producer function.
+ *
+ * The producer receives an observer and should call `next()` to emit values,
+ * `error()` to signal an error, and `complete()` to signal completion.
+ * It may return a teardown function that will be called on unsubscribe.
+ */
+declare function createEventStream<T>(producer: (observer: EventObserverTrait<T>) => (() => void) | void): EventStreamTrait<T>;
+declare function createEventSubject<T>(): EventSubjectTrait<T>;
+declare function createEventReplaySubject<T>(bufferSize?: number): EventSubjectTrait<T>;
+declare function createEmptyEventStream<T>(): EventStreamTrait<T>;
+declare function createNeverEventStream<T>(): EventStreamTrait<T>;
+//#endregion
+//#region src/events/interop.d.ts
+type ToEventStreamInput<T> = InteropObservableTrait<T> | Promise<T> | AsyncIterable<T> | PromiseLike<T> | ArrayLike<T> | Iterable<T> | EventStreamTrait<T> | ReadableSignalTrait<T>;
+declare function toEventStream<T>(input: ToEventStreamInput<T>): EventStreamTrait<T>;
+//#endregion
+//#region src/protocol/json-rpc/types.d.ts
+declare const JsonRpcIdSchema: import("arktype").BaseType<string | number, {}>;
+type JsonRpcId = typeof JsonRpcIdSchema.infer;
+declare const JsonRpcErrorPayloadSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  code: number;
+  message: string;
+  data?: unknown;
+}, {}>;
+type JsonRpcErrorPayload = typeof JsonRpcErrorPayloadSchema.infer;
+declare const JsonRpcRequestMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  method: string;
+  params?: unknown;
+}, {}>;
+type JsonRpcRequestMessage = typeof JsonRpcRequestMessageSchema.infer;
+declare const JsonRpcNotificationMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  method: string;
+  params?: unknown;
+}, {}>;
+type JsonRpcNotificationMessage = typeof JsonRpcNotificationMessageSchema.infer;
+declare const JsonRpcSuccessResponseMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  result: unknown;
+}, {}>;
+type JsonRpcSuccessResponseMessage = typeof JsonRpcSuccessResponseMessageSchema.infer;
+declare const JsonRpcErrorResponseMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  error: {
+    code: number;
+    message: string;
+    data?: unknown;
+  };
+}, {}>;
+type JsonRpcErrorResponseMessage = typeof JsonRpcErrorResponseMessageSchema.infer;
+declare const JsonRpcMessageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+  jsonrpc: "2.0";
+  id: string | number;
+  method: string;
+  params?: unknown;
+} | {
+  jsonrpc: "2.0";
+  method: string;
+  params?: unknown;
+} | {
+  jsonrpc: "2.0";
+  id: string | number;
+  result: unknown;
+} | {
+  jsonrpc: "2.0";
+  id: string | number;
+  error: {
+    code: number;
+    message: string;
+    data?: unknown;
+  };
+}, {}>;
+type JsonRpcMessage = typeof JsonRpcMessageSchema.infer;
+interface JsonRpcRequestEvent {
+  id: JsonRpcId;
+  method: string;
+  params?: unknown;
+}
+interface JsonRpcNotificationEvent {
+  method: string;
+  params?: unknown;
+}
+interface JsonRpcRequestOptions {
+  timeoutMs?: number;
+}
+interface JsonRpcSendOptions {
+  send(message: JsonRpcMessage): void;
+}
+interface CreateJsonRpcClientOptions extends JsonRpcSendOptions {
+  time: TimeTrait;
+  defaultRequestTimeoutMs?: number;
+}
+interface CreateJsonRpcServerOptions extends JsonRpcSendOptions {}
+interface CreateJsonRpcServerAndClientOptions extends JsonRpcSendOptions {
+  time: TimeTrait;
+  defaultRequestTimeoutMs?: number;
+}
+interface JsonRpcClientTrait extends DisposableTrait {
+  readonly onNotification: EventStreamTrait<JsonRpcNotificationEvent>;
+  request<TResult = unknown>(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<TResult>;
+  notify(method: string, params?: unknown): void;
+  receive(message: unknown): void;
+  rejectAllPendingRequests(reason: unknown): void;
+}
+interface JsonRpcServerTrait extends DisposableTrait {
+  readonly onRequest: EventStreamTrait<JsonRpcRequestEvent>;
+  readonly onNotification: EventStreamTrait<JsonRpcNotificationEvent>;
+  notify(method: string, params?: unknown): void;
+  receive(message: unknown): void;
+  respondSuccess(id: JsonRpcId, result: unknown): void;
+  respondError(id: JsonRpcId, error: JsonRpcErrorPayload): void;
+}
+interface JsonRpcServerAndClientTrait extends JsonRpcClientTrait, JsonRpcServerTrait {}
+//#endregion
+//#region src/protocol/json-rpc/create.d.ts
+declare function createJsonRpcClient(options: CreateJsonRpcClientOptions): JsonRpcClientTrait;
+declare function createJsonRpcServer(options: CreateJsonRpcServerOptions): JsonRpcServerTrait;
+declare function createJsonRpcServerAndClient(options: CreateJsonRpcServerAndClientOptions): JsonRpcServerAndClientTrait;
+//#endregion
+//#region src/signals/computed.d.ts
+/**
+ * Create a lazy computed signal.
+ *
+ * Dependencies are collected dynamically while `compute()` runs.
+ */
+declare function createComputed<T>(compute: () => T, options?: SignalOptions<T>): ComputedSignalTrait<T>;
+//#endregion
+//#region src/signals/error.d.ts
+declare const ResourceErrorCode: {
+  readonly ValueUnavailable: "resource.value_unavailable";
+};
+type ResourceErrorCode = (typeof ResourceErrorCode)[keyof typeof ResourceErrorCode];
+interface ResourceValueUnavailableErrorOptions {
+  readonly status: string;
+}
+declare class ResourceError extends Error {
+  readonly name = "ResourceError";
+  readonly code: ResourceErrorCode;
+  readonly status?: string;
+  constructor(message: string, options: {
+    code: ResourceErrorCode;
+    status?: string;
+  });
+  static valueUnavailable(options: ResourceValueUnavailableErrorOptions): ResourceError;
+}
+//#endregion
+//#region src/signals/resource.d.ts
+interface ResourceStreamContext<T, R> {
+  readonly request: R;
+  readonly previous: ResourceSnapshot<T>;
+}
+interface CreateResourceOptions<T, R = undefined> {
+  readonly request?: ReadableSignalTrait<R | undefined> | (() => R | undefined);
+  readonly stream: (context: ResourceStreamContext<T, R>) => ToEventStreamInput<T>;
+}
+declare function createResource<T, R = undefined>(options: CreateResourceOptions<T, R>): ResourceTrait<T>;
+//#endregion
+//#region src/signals/resource-snapshot.d.ts
+declare function whenResourceSnapshotValue<T>(snapshotSignal: ReadableSignalTrait<ResourceSnapshot<T>>, options?: ResourceWhenValueOptions): Promise<T>;
+type AnyResourceSnapshotSelector = (value: any) => ReadableSignalTrait<ResourceSnapshot<unknown>>;
+declare function flattenResourceSnapshot<T1, T2>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>): ResourceSnapshot<T2>;
+declare function flattenResourceSnapshot<T1, T2, T3>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>, select2: (value: T2) => ReadableSignalTrait<ResourceSnapshot<T3>>): ResourceSnapshot<T3>;
+declare function flattenResourceSnapshot<T1, T2, T3, T4>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>, select2: (value: T2) => ReadableSignalTrait<ResourceSnapshot<T3>>, select3: (value: T3) => ReadableSignalTrait<ResourceSnapshot<T4>>): ResourceSnapshot<T4>;
+declare function flattenResourceSnapshot<T1, T2, T3, T4, T5>(sourceSnapshot: ResourceSnapshot<T1>, select1: (value: T1) => ReadableSignalTrait<ResourceSnapshot<T2>>, select2: (value: T2) => ReadableSignalTrait<ResourceSnapshot<T3>>, select3: (value: T3) => ReadableSignalTrait<ResourceSnapshot<T4>>, select4: (value: T4) => ReadableSignalTrait<ResourceSnapshot<T5>>): ResourceSnapshot<T5>;
+declare function flattenResourceSnapshot(sourceSnapshot: ResourceSnapshot<unknown>, select: AnyResourceSnapshotSelector, ...selectors: readonly AnyResourceSnapshotSelector[]): ResourceSnapshot<unknown>;
+declare const ResourceSnapshotUpdateKind: {
+  readonly Load: "load";
+  readonly Resolve: "resolve";
+  readonly Fail: "fail";
+  readonly FailWithValue: "fail_with_value";
+};
+type ResourceSnapshotUpdateKind = (typeof ResourceSnapshotUpdateKind)[keyof typeof ResourceSnapshotUpdateKind];
+type ResourceSnapshotUpdate<T> = {
+  readonly kind: typeof ResourceSnapshotUpdateKind.Load;
+} | {
+  readonly kind: typeof ResourceSnapshotUpdateKind.Resolve;
+  readonly value: T;
+} | {
+  readonly kind: typeof ResourceSnapshotUpdateKind.Fail;
+  readonly error: unknown;
+} | {
+  readonly kind: typeof ResourceSnapshotUpdateKind.FailWithValue;
+  readonly value: T;
+  readonly error: unknown;
+};
+declare function reduceResourceSnapshot<T>(previous: ResourceSnapshot<T>, update: ResourceSnapshotUpdate<T>): ResourceSnapshot<T>;
+//#endregion
+//#region src/signals/signal.d.ts
+/**
+ * Minimal writable signal implementation.
+ * `set()` always publishes a write. Equality-based value-version suppression is
+ * handled by the underlying Rx signal for computed dependency validation.
+ */
+declare function createSignal<T>(initial: T, options?: SignalOptions<T>): WritableSignalTrait<T>;
+/**
+ * Create a read-only view of a writable signal.
+ */
+declare function readonlySignal<T>(signal: WritableSignalTrait<T>): ReadableSignalTrait<T>;
+//#endregion
+//#region src/popup/handle.d.ts
+interface PopupMessageChannelTrait<TOutgoing = unknown, TIncoming = unknown> {
+  outgoing: EventSubjectTrait<TOutgoing>;
+  incoming: EventStreamTrait<TIncoming>;
+}
+interface PopupWindowHandleTrait extends DisposableTrait {
+  messaging: PopupMessageChannelTrait;
+  readonly onNotification: EventStreamTrait<JsonRpcNotificationEvent>;
+  close(): void;
+  dispose(): void;
+  notify(method: string, params?: unknown): Promise<void>;
+}
+interface PopupClientWindowHandleTrait extends PopupWindowHandleTrait {
+  readonly failure: ReadableSignalTrait<ClientError | null>;
+  readonly isActive: ReadableSignalTrait<boolean>;
+  request<TResult = unknown>(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<TResult>;
+}
+interface PopupServerWindowHandleTrait extends PopupWindowHandleTrait {}
+interface PopupClientWindowHandleOptions {
+  close(): void;
+  messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+  time: TimeTrait;
+  closedStream: EventStreamTrait<boolean>;
+}
+interface PopupServerWindowHandleOptions {
+  close(): void;
+  messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+}
+/**
+ * popup opener
+ */
+declare class PopupClientWindowHandle implements PopupClientWindowHandleTrait {
+  readonly messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+  private disposed;
+  private readonly jsonRpc;
+  private readonly session;
+  private readonly incomingSubscription;
+  private readonly closePopup;
+  constructor(options: PopupClientWindowHandleOptions);
+  get onNotification(): EventStreamTrait<JsonRpcNotificationEvent>;
+  get failure(): ReadableSignalTrait<ClientError | null>;
+  get isActive(): ReadableSignalTrait<boolean>;
+  notify(method: string, params?: unknown): Promise<void>;
+  request<TResult = unknown>(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<TResult>;
+  close(): void;
+  dispose(): void;
+  [SYMBOL_DISPOSE](): void;
+}
+/**
+ * popup target
+ */
+declare class PopupServerWindowHandle implements PopupServerWindowHandleTrait {
+  readonly messaging: PopupMessageChannelTrait<JsonRpcMessage, unknown>;
+  private disposed;
+  private readonly jsonRpc;
+  private readonly session;
+  private readonly incomingSubscription;
+  private readonly closePopup;
+  constructor(options: PopupServerWindowHandleOptions);
+  get onNotification(): EventStreamTrait<JsonRpcNotificationEvent>;
+  get onRequest(): EventStreamTrait<JsonRpcRequestEvent>;
+  notify(method: string, params?: unknown): Promise<void>;
+  close(): void;
+  dispose(): void;
+  [SYMBOL_DISPOSE](): void;
+}
+//#endregion
+//#region src/popup/errors.d.ts
+declare const PopupErrorCode: {
+  readonly Blocked: "popup.blocked";
+  readonly Closed: "popup.closed_by_user";
+};
+type PopupErrorCode = (typeof PopupErrorCode)[keyof typeof PopupErrorCode];
+declare function readPopupErrorPresentationDescriptor(error: unknown, options?: ReadErrorPresentationDescriptorOptions): ErrorPresentationDescriptor;
+//#endregion
+//#region src/popup/session.d.ts
+interface CreatePopupClientSessionOptions {
+  jsonRpc: JsonRpcClientTrait;
+  time: TimeTrait;
+  closedStream: EventStreamTrait<boolean>;
+  readyTimeoutMs?: number;
+  heartbeatIntervalMs?: number;
+  heartbeatTimeoutMs?: number;
+}
+interface CreatePopupServerSessionOptions {
+  jsonRpc: JsonRpcServerTrait;
+}
+//#endregion
+//#region src/popup/index.d.ts
+declare const PopupAttachFailureReason: {
+  readonly MissingOpener: "missing_opener";
+  readonly MissingOrigin: "missing_origin";
+};
+type PopupAttachFailureReason = (typeof PopupAttachFailureReason)[keyof typeof PopupAttachFailureReason];
+interface PopupAttachSuccess {
+  kind: "success";
+  handle: PopupServerWindowHandleTrait;
+}
+interface PopupAttachFailure {
+  kind: "failure";
+  reason: PopupAttachFailureReason;
+  error: ClientError;
+}
+type PopupAttachResult = PopupAttachSuccess | PopupAttachFailure;
+interface PopupOpenOptions {
+  target?: string;
+  width?: number;
+  height?: number;
+  expectedOrigin?: string;
+}
+interface PopupTrait {
+  open(url: string, options?: PopupOpenOptions): PopupClientWindowHandleTrait;
+  attach(): PopupAttachResult;
+}
+declare const POPUP_TRAIT_TOKEN: SecuritydeptInjectionToken<PopupTrait | null>;
+//#endregion
+//#region src/validation/schemas/uri.d.ts
+declare const UriStringSchema: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+declare const BaseURIStringSchema: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+declare const UriRelativeStringSchema: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+declare const UriReferenceStringSchema: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+//#endregion
+//#region src/router/metadata.d.ts
+/** Route-data key holding the SecurityDept metadata blob for a segment. */
+declare const SECURITYDEPT_ROUTE_METADATA_KEY = "__securitydept__";
+/** Serializable SecurityDept route metadata. */
+interface SecuritydeptRouteMetadata<TAuthRequirement extends AuthRequirement = AuthRequirement> {
+  requirements?: readonly TAuthRequirement[];
+  composition?: RequirementsComposition;
+}
+/** Read SecurityDept route metadata from a route `data` bag. */
+declare function readSecuritydeptRouteMetadata<TAuthRequirement extends AuthRequirement = AuthRequirement>(data: object | undefined): SecuritydeptRouteMetadata<TAuthRequirement> | undefined;
+/** Merge SecurityDept route metadata into a route `data` bag. */
+declare function writeSecuritydeptRouteMetadata<TAuthRequirement extends AuthRequirement = AuthRequirement>(base: object | undefined, patch: SecuritydeptRouteMetadata<TAuthRequirement>): Record<string, unknown>;
+//#endregion
+//#region src/struct/uri-string.d.ts
+/**
+ * Thrown when a string cannot be parsed into the requested URI variant.
+ */
+declare class UriParseError extends Error {
+  readonly input: string;
+  readonly kind: string;
+  constructor(input: string, kind: string, options?: ErrorOptions);
+}
+/**
+ * The relative components of a URL — pathname, search, and hash.
+ *
+ * All fields use the same format as the native `URL` accessors:
+ * - `pathname` starts with `/` (e.g. `"/path"`).
+ * - `search` includes the leading `?` when present (e.g. `"?q=1"`).
+ * - `hash` includes the leading `#` when present (e.g. `"#section"`).
+ */
+interface UriRelativeParts {
+  readonly pathname: string;
+  readonly search: string;
+  readonly hash: string;
+}
+/**
+ * Minimal structural type for URI fragment parsing.
+ *
+ * Matches any value that exposes a URL-style `hash` accessor — for example
+ * `URL`, `Location`, or {@link UriReferenceString}.
+ */
+interface UriFragmentPart {
+  readonly hash: string;
+}
+/**
+ * Minimal structural type for URI reference parsing.
+ *
+ * Matches any value that can be serialized via `toString()` — for example
+ * native `URL`, `Location`, or {@link UriReferenceString}.
+ */
+interface UriReferenceStringLike {
+  toString(): string;
+}
+type UriReferenceStringInput = string | UriReferenceStringLike;
+type UriSearchParamsInit = NonNullable<ConstructorParameters<typeof URLSearchParams>[0]>;
+/**
+ * Immutable wrapper around a URI-reference string.
+ *
+ * A URI-reference (RFC 3986 §4.1) is either an absolute URI or a relative
+ * reference.  Concrete subclasses {@link UriString} and
+ * {@link UriRelativeString} carry the additional type-level guarantee of
+ * which variant they hold.
+ *
+ * Instances created via `UriReferenceString.parse` / `.tryParse` are always
+ * one of the two subclasses, so {@link isAbsolute} and {@link isRelative}
+ * narrow correctly.
+ */
+declare class UriReferenceString {
+  /** The original, unmodified input string. */
+  protected readonly _raw: string;
+  /**
+   * Eagerly parsed URL helper.
+   *
+   * - Absolute URIs: `new URL(raw)`.
+   * - Relative URIs: `new URL(raw, RELATIVE_URI_SENTINEL_BASE)`.
+   *
+   * For relative URIs the scheme and host originate from the sentinel and
+   * MUST NOT be used for origin-sensitive operations.
+   */
+  protected readonly _parsed: URL;
+  protected readonly _isAbsolute: boolean;
+  protected constructor(raw: string, parsed: URL, isAbsolute: boolean);
+  /**
+   * Parse any valid URI reference (absolute or relative).
+   *
+   * The returned instance is always a {@link UriString} or
+   * {@link UriRelativeString}.
+   *
+   * @throws {UriParseError} when the input is not a valid URI reference.
+   */
+  static parse(input: UriReferenceStringInput): UriReferenceString;
+  /**
+   * Try to parse a URI reference, returning `null` on failure.
+   *
+   * The returned instance is always a {@link UriString} or
+   * {@link UriRelativeString}.
+   */
+  static tryParse(input: UriReferenceStringInput): UriReferenceString | null;
+  /** Create from a native `URL`. Always produces a {@link UriString}. */
+  static fromURL(url: URL): UriString;
+  /**
+   * Create from the relative components of a URL.
+   * Always produces a {@link UriRelativeString}.
+   */
+  static fromURLRelative(parts: UriRelativeParts): UriRelativeString;
+  /** The original input string. */
+  get raw(): string;
+  get pathname(): string;
+  get hash(): string;
+  get search(): string;
+  get searchParams(): URLSearchParams;
+  /** Type-guard: narrows to {@link UriString} when the reference is absolute. */
+  isAbsolute(): this is UriString;
+  /** Type-guard: narrows to {@link UriRelativeString} when the reference is relative. */
+  isRelative(): this is UriRelativeString;
+  /** Narrow to {@link UriString} or return `null`. */
+  asAbsolute(): UriString | null;
+  /** Narrow to {@link UriRelativeString} or return `null`. */
+  asRelative(): UriRelativeString | null;
+  /**
+   * Returns a new instance with `hash` replaced.
+   *
+   * @param value URL-style hash, including a leading `#` when non-empty.
+   */
+  setHash(value: string): this;
+  /** Returns a new instance with the complete query parameter set replaced. */
+  setSearchParams(init?: UriSearchParamsInit): this;
+  /**
+   * Convert to a native `URL`.
+   *
+   * A `base` is required when the reference is relative; it is ignored
+   * for absolute references.
+   *
+   * @throws {TypeError} when the reference is relative and no base is provided.
+   */
+  toURL(base?: string | URL): URL;
+  toString(): string;
+  valueOf(): string;
+  toJSON(): string;
+}
+/**
+ * Immutable wrapper around an absolute URI string.
+ *
+ * An absolute URI (RFC 3986 §4.3) always starts with a scheme component
+ * (e.g. `https://example.com/path`).
+ */
+declare class UriString extends UriReferenceString {
+  protected constructor(raw: string, parsed: URL);
+  /**
+   * Parse an absolute URI string.
+   *
+   * @throws {UriParseError} when the input is not a valid absolute URI.
+   */
+  static parse(input: string): UriString;
+  /**
+   * Try to parse an absolute URI, returning `null` if the input is not
+   * a valid absolute URI.
+   */
+  static tryParse(input: string | UriString): UriString | null;
+  /** Create from a native `URL`, using its `href` as the raw string. */
+  static fromURL(url: URL): UriString;
+  /**
+   * Not supported — relative parts cannot produce an absolute URI.
+   *
+   * @throws {TypeError} unconditionally.
+   */
+  static fromURLRelative(_parts: UriRelativeParts): never;
+  get host(): string;
+  get hostname(): string;
+  get origin(): string;
+  get password(): string;
+  get port(): string;
+  get protocol(): string;
+  get username(): string;
+  /** Convert to a native `URL`. No base is required for absolute URIs. */
+  toURL(): URL;
+}
+/**
+ * Immutable wrapper around a relative URI reference string.
+ *
+ * A relative reference (RFC 3986 §4.2) has no scheme and must be resolved
+ * against a base URI to obtain an absolute URI.
+ *
+ * Internally, the raw string is parsed against a sentinel base
+ * (`http://localhost`) to enable eager validation and URL-component
+ * extraction.  The sentinel origin is never leaked through the public API.
+ */
+declare class UriRelativeString extends UriReferenceString {
+  protected constructor(raw: string, parsed: URL);
+  /**
+   * Parse a relative URI reference.
+   *
+   * @throws {UriParseError} when the input is absolute or not a valid
+   *   relative URI reference.
+   */
+  static parse(input: string): UriRelativeString;
+  /**
+   * Try to parse a relative URI reference, returning `null` if the input
+   * is an absolute URI or otherwise invalid.
+   */
+  static tryParse(input: string | UriRelativeString): UriRelativeString | null;
+  /**
+   * Not supported — a native `URL` is always absolute and cannot be
+   * represented as a relative URI reference.
+   *
+   * @throws {TypeError} unconditionally.
+   */
+  static fromURL(_url: URL): never;
+  /**
+   * Create from the relative components of a URL.
+   *
+   * Concatenates `pathname + search + hash` into a relative URI string.
+   */
+  static fromURLRelative(parts: UriRelativeParts): UriRelativeString;
+  /**
+   * Convert to a native `URL` by resolving against the given base.
+   *
+   * @param base - The base URL to resolve against (required).
+   */
+  toURL(base: string | URL): URL;
+}
+//#endregion
+//#region src/protocol/compat-fragment.d.ts
+declare const SECURITYDEPT_COMPAT_FRAGMENT_VERSION = "v1";
+type CompatFragmentParameters = Record<string, string>;
+interface CompatFragment {
+  payload: string;
+  parameters: CompatFragmentParameters;
+}
+interface AppendOrReplaceCompatFragmentOptions {
+  payload: string | URLSearchParams | CompatFragmentParameters;
+}
+interface TakeCompatFragmentResult<T> {
+  compatFragment: CompatFragment | null;
+  fragment: string;
+  url: UpdatedUriFragment<T>;
+}
+interface TakeCompatFragmentOptions<T> {
+  condition?: (compatFragment: CompatFragment) => boolean;
+  update: UpdateUriFragmentHash<T>;
+}
+interface AppendOrReplaceCompatFragmentResult<T> {
+  fragment: string;
+  url: UpdatedUriFragment<T>;
+}
+type UpdatedUriFragment<T> = T extends string ? string : T;
+type UpdateUriFragmentHash<T> = (input: T, hash: string) => UpdatedUriFragment<T>;
+declare function appendOrReplaceCompatFragment<T extends string | UriFragmentPart>(input: T, options: AppendOrReplaceCompatFragmentOptions, update: UpdateUriFragmentHash<T>): AppendOrReplaceCompatFragmentResult<T>;
+declare function parseCompatFragment(input: string | UriFragmentPart): CompatFragment | null;
+declare function takeCompatFragment<T extends string | UriFragmentPart>(input: T, options: TakeCompatFragmentOptions<T>): TakeCompatFragmentResult<T>;
+declare function isCompatFragmentBlock(block: string): boolean;
+//#endregion
+//#region src/router/router.d.ts
+declare const RouterNavigationIntent: {
+  readonly AuthRedirect: "auth_redirect";
+  readonly PostAuthRedirect: "post_auth_redirect";
+  readonly CallbackCleanup: "callback_cleanup";
+  readonly ExternalOpen: "external_open";
+};
+type RouterNavigationIntent = (typeof RouterNavigationIntent)[keyof typeof RouterNavigationIntent];
+declare const RouterNavigationMode: {
+  readonly Push: "push";
+  readonly Replace: "replace";
+  readonly External: "external";
+};
+type RouterNavigationMode = (typeof RouterNavigationMode)[keyof typeof RouterNavigationMode];
+interface RouterNavigationRequest {
+  url: UriReferenceString;
+  intent: RouterNavigationIntent;
+  mode: RouterNavigationMode;
+  state?: unknown;
+}
+interface RouterTrait {
+  currentUrl(): UriReferenceString | null;
+  navigate(request: RouterNavigationRequest): void | Promise<void>;
+}
+interface TakeCompatFragmentFromRouterOptions {
+  condition?: (compatFragment: CompatFragment) => boolean;
+}
+declare function takeCompatFragmentFromRouter(router: RouterTrait, options?: TakeCompatFragmentFromRouterOptions): Promise<CompatFragment | null>;
+declare const ROUTER_TRAIT_TOKEN: SecuritydeptInjectionToken<RouterTrait | null>;
+//#endregion
+//#region src/span/types.d.ts
+interface SpanCreateOptions {
+  idFactory?: () => string;
+  attributes?: Record<string, unknown>;
+  mutable?: false;
+}
+interface MutableSpanCreateOptions extends Omit<SpanCreateOptions, "mutable"> {
+  mutable: true;
+}
+interface SpanTrait {
+  readonly id: string;
+  readonly parent?: SpanTrait;
+  readonly attributes: Readonly<Record<string, unknown>>;
+  fork(options: MutableSpanCreateOptions): MutableSpanTrait;
+  fork(options?: SpanCreateOptions): SpanTrait;
+  fork(options?: SpanCreateOptions | MutableSpanCreateOptions): SpanTrait | MutableSpanTrait;
+}
+interface MutableSpanTrait extends SpanTrait {
+  setAttributes(attributes: Record<string, unknown>): void;
+}
+declare const SPAN_TRAIT_TOKEN: SecuritydeptInjectionToken<SpanTrait>;
+interface OperationSpanTrait extends MutableSpanTrait {
+  addEvent(type: string, attributes?: Record<string, unknown>): void;
+  recordError(error: unknown, attributes?: Record<string, unknown>): void;
+}
+//#endregion
+//#region src/validation/validator.d.ts
+/**
+ * Successful validation result.
+ *
+ * Contains the parsed, typed output value from the schema.
+ */
+interface ValidationSuccess<T> {
+  readonly success: true;
+  readonly value: T;
+}
+/**
+ * Failed validation result.
+ *
+ * Contains the list of issues reported by the schema.
+ */
+interface ValidationFailure {
+  readonly success: false;
+  readonly issues: ReadonlyArray<StandardSchemaV1.Issue>;
+}
+/**
+ * Discriminated union of validation outcomes.
+ *
+ * Consumers can narrow on `success` to access either the typed value
+ * or the issue list.
+ */
+type ValidationResult<T> = ValidationSuccess<T> | ValidationFailure;
+type TraitInputValidator = StandardSchemaV1<unknown, unknown>;
+type TraitInputBundledSchema = StandardSchemaV1<unknown, unknown>;
+interface WithTraitInputValidator<TValidator = TraitInputValidator> {
+  validators?: TValidator;
+}
+interface ValidateTraitInputOptions {
+  value: unknown;
+  bundledSchema: TraitInputBundledSchema;
+  validator?: TraitInputValidator;
+  optional?: boolean;
+  onInvalid(failure: ValidationFailure): never;
+}
+declare function formatValidationFailure(failure: ValidationFailure | undefined): string | null;
+declare function throwValidationClientError(options: {
+  code: string;
+  source: string;
+  messagePrefix: string;
+  failure?: ValidationFailure;
+}): never;
+/**
+ * Validate an unknown input against a `@standard-schema`-compatible schema.
+ *
+ * This is the foundation-level entry point for SDK validation. It accepts
+ * any schema implementing `StandardSchemaV1` and returns a discriminated
+ * `ValidationResult`.
+ *
+ * @example
+ * ```ts
+ * import { validateWithSchema } from "@securitydept/client";
+ * import { z } from "zod";
+ *
+ * const UserSchema = z.object({ name: z.string() });
+ * const result = await validateWithSchema(UserSchema, { name: "Alice" });
+ * if (result.success) {
+ *   console.log(result.value.name);
+ * } else {
+ *   console.error(result.issues);
+ * }
+ * ```
+ */
+declare function validateWithSchema<I, O>(schema: StandardSchemaV1<I, O>, input: unknown): Promise<ValidationResult<O>>;
+/**
+ * Validate an unknown input synchronously against a `@standard-schema`-compatible schema.
+ *
+ * Only use this when you know the schema's validate function returns synchronously.
+ * Throws if the schema returns a Promise.
+ */
+declare function validateWithSchemaSync<I, O>(schema: StandardSchemaV1<I, O>, input: unknown): ValidationResult<O>;
+declare function validateTraitInput(options: ValidateTraitInputOptions): void;
+//#endregion
+//#region src/std/time.d.ts
+interface TimeTraitStdHost {
+  Date: Pick<DateConstructor, "now">;
+  setTimeout(handler: () => void, delayMs: number): unknown;
+  clearTimeout(handle: unknown): void;
+}
+interface TimeForStdCreateOptions {
+  host?: TimeTraitStdHost;
+}
+declare function createTimeForStd(options?: TimeForStdCreateOptions & WithTraitInputValidator<TraitInputValidator>): TimeTrait;
+//#endregion
+//#region src/std/transport/authorization-interceptor.d.ts
+type AuthorizationSignal = ReadableSignalTrait<string | null | undefined> | ResourceTrait<string | null | undefined>;
+type AuthorizationInterceptedFetchPredicate = (input: RequestInfo | URL, init: RequestInit | undefined) => boolean | Promise<boolean>;
+interface CreateAuthorizationInterceptedFetchOptions {
+  readonly predicate: AuthorizationInterceptedFetchPredicate;
+  readonly authorization: AuthorizationSignal;
+}
+declare function createAuthorizationInterceptedFetch(fetchImpl: typeof fetch, options: CreateAuthorizationInterceptedFetchOptions): typeof fetch;
+//#endregion
+//#region src/transport/types.d.ts
+declare const TransportErrorCode: {
+  readonly RequestFailed: "transport.request_failed";
+  readonly ResponseDecodeFailed: "transport.response_decode_failed";
+  readonly InvalidStdFetchOptions: "transport.invalid_std_fetch_options";
+  readonly InvalidAngularOptions: "transport.invalid_angular_options";
+};
+type TransportErrorCode = (typeof TransportErrorCode)[keyof typeof TransportErrorCode];
+/** Neutral HTTP request representation. */
+interface HttpRequest {
+  url: string;
+  method: string;
+  headers: Record<string, string>;
+  body?: unknown;
+  cancellationToken?: CancellationTokenTrait;
+}
+/** Neutral HTTP response representation. */
+interface HttpResponse {
+  status: number;
+  headers: Record<string, string>;
+  body?: unknown;
+}
+type HttpResponseJsonBody = Record<string, unknown>;
+/** Neutral request executor trait. */
+interface BaseTransportTrait {
+  execute(request: HttpRequest): Promise<HttpResponse>;
+}
+declare const TRANSPORT_TRAIT_TOKEN: SecuritydeptInjectionToken<BaseTransportTrait>;
+//#endregion
+//#region src/std/transport/base-transport.d.ts
+declare const FetchTransportRedirectKind: {
+  readonly Follow: "follow";
+  readonly Manual: "manual";
+};
+type FetchTransportRedirectKind = (typeof FetchTransportRedirectKind)[keyof typeof FetchTransportRedirectKind];
+interface BaseTransportForStdFetchCreateOptions {
+  redirect?: FetchTransportRedirectKind;
+  fetch?: typeof fetch;
+  baseUrl?: string | URL;
+}
+/**
+ * Default `BaseTransportTrait` backed by the global `fetch` API.
+ *
+ * The caller is responsible for ensuring `fetch` is available in the runtime.
+ * No polyfill is injected.
+ */
+declare function createBaseTransportForStdFetch(options?: BaseTransportForStdFetchCreateOptions & WithTraitInputValidator<TraitInputValidator>): BaseTransportTrait;
+//#endregion
+//#region src/storage/types.d.ts
+declare const StorageChangeEventOrigin: {
+  readonly Local: "local";
+  readonly External: "external";
+};
+type StorageChangeEventOrigin = (typeof StorageChangeEventOrigin)[keyof typeof StorageChangeEventOrigin];
+interface StorageChangeEvent {
+  readonly origin: StorageChangeEventOrigin;
+  readonly key: string | null;
+  readonly oldValue: string | null;
+  readonly newValue: string | null;
+}
+/** Low-level key-value storage trait. */
+interface StorageTrait {
+  readonly storageEvent?: EventStreamTrait<StorageChangeEvent>;
+  get(key: string): string | null | Promise<string | null>;
+  set(key: string, value: string): void | Promise<void>;
+  /**
+   * Atomically read and remove a record within the store's consistency domain.
+   */
+  take?(key: string): string | null | Promise<string | null>;
+  remove(key: string): void | Promise<void>;
+}
+/** Storage whose operations complete synchronously in the current realm. */
+interface SyncStorageTrait extends StorageTrait {
+  get(key: string): string | null;
+  set(key: string, value: string): void;
+  take?(key: string): string | null;
+  remove(key: string): void;
+}
+declare const REALM_STORAGE_TRAIT_TOKEN: SecuritydeptInjectionToken<SyncStorageTrait>;
+declare const PERSISTENT_STORAGE_TRAIT_TOKEN: SecuritydeptInjectionToken<StorageTrait | null>;
+declare const SESSION_STORAGE_TRAIT_TOKEN: SecuritydeptInjectionToken<StorageTrait | null>;
+/** Serialization codec for typed values. */
+interface Codec<T> {
+  encode(value: T): string;
+  decode(raw: string): T;
+}
+/** Semantic store for long-lived auth state. */
+interface PersistentAuthStore<T> {
+  load(): Promise<T | null>;
+  save(value: T): Promise<void>;
+  clear(): Promise<void>;
+}
+/** Semantic store for recoverable state (survives page reload). */
+interface RecoverableStateStore<T> {
+  load(): Promise<T | null>;
+  save(value: T): Promise<void>;
+  clear(): Promise<void>;
+}
+/** Semantic store for ephemeral flow state (one-time-use). */
+interface EphemeralFlowStore<T> {
+  load(): Promise<T | null>;
+  save(value: T): Promise<void>;
+  consume(): Promise<T | null>;
+  clear(): Promise<void>;
+}
+/** Semantic store for keyed ephemeral flow state (one-time-use per key). */
+interface KeyedEphemeralFlowStore<T> {
+  load(key: string): Promise<T | null>;
+  save(key: string, value: T): Promise<void>;
+  take(key: string): Promise<T | null>;
+  clear(key: string): Promise<void>;
+}
+/** Versioned storage envelope — first-version migration support. */
+interface StoredEnvelope<T> {
+  version: number;
+  storedAt: number;
+  expiresAt?: number;
+  value: T;
+}
+//#endregion
+//#region src/tracing/types.d.ts
+declare const TracingLevel: {
+  readonly Debug: "debug";
+  readonly Info: "info";
+  readonly Warn: "warn";
+  readonly Error: "error";
+};
+type TracingLevel = (typeof TracingLevel)[keyof typeof TracingLevel];
+declare const OperationTraceEventType: {
+  readonly Started: "operation.started";
+  readonly Event: "operation.event";
+  readonly Error: "operation.error";
+  readonly Ended: "operation.ended";
+};
+type OperationTraceEventType = (typeof OperationTraceEventType)[keyof typeof OperationTraceEventType];
+interface TracingEvent {
+  name: string;
+  at: number;
+  span: SpanTrait;
+  level: TracingLevel;
+  target: string;
+  fields?: Record<string, unknown>;
+}
+interface TracingTrait extends DisposableTrait {
+  record(event: TracingEvent): void;
+  readonly events: EventStreamTrait<TracingEvent>;
+}
+declare const TRACING_TRAIT_TOKEN: SecuritydeptInjectionToken<TracingTrait>;
+//#endregion
+//#region src/tracing/subscriber/types.d.ts
+interface TracingSubscriberTrait {
+  record(event: TracingEvent): void;
+}
+//#endregion
+//#region src/tracing/create.d.ts
+interface TracingCreateOptions {
+  subscribers?: readonly TracingSubscriberTrait[];
+}
+declare function createTracing(options?: TracingCreateOptions & WithTraitInputValidator<TraitInputValidator>): TracingTrait;
+//#endregion
+//#region src/environment/types.d.ts
+/**
+ * Foundation dependency environment injected into client-side auth runtimes
+ * via explicit wiring at the composition root.
+ *
+ * `transport`, `time`, `realmStorage`, `span`, and `tracing` are the required baseline
+ * capabilities. Optional page/router/popup/storage traits stay explicit.
+ * Raw host-material inputs such as `window`, `location`, or browser storage
+ * handles are intentionally outside this contract and should be resolved by
+ * host-specific creators before a `FoundationEnvironment` is assembled.
+ */
+interface FoundationEnvironment {
+  injector: SecuritydeptInjector;
+  transport: BaseTransportTrait;
+  time: TimeTrait;
+  realmStorage: SyncStorageTrait;
+  idleCallback?: IdleCallbackTrait;
+  persistentStorage?: StorageTrait;
+  sessionStorage?: StorageTrait;
+  span: SpanTrait;
+  tracing: TracingTrait;
+  router?: RouterTrait;
+  pageLifecycle?: PageLifecycleTrait;
+  popup?: PopupTrait;
+}
+interface ServiceWorkerEnvironment extends FoundationEnvironment {}
+declare const ENVIRONMENT_TOKEN: SecuritydeptInjectionToken<FoundationEnvironment>;
+interface EnvironmentValidators {
+  transport?: TraitInputValidator;
+  transportForStdFetchCreateOptions?: TraitInputValidator;
+  time?: TraitInputValidator;
+  timeForStdCreateOptions?: TraitInputValidator;
+  realmStorage?: TraitInputValidator;
+  idleCallback?: TraitInputValidator;
+  persistentStorage?: TraitInputValidator;
+  sessionStorage?: TraitInputValidator;
+  span?: TraitInputValidator;
+  spanCreateOptions?: TraitInputValidator;
+  tracing?: TraitInputValidator;
+  tracingCreateOptions?: TraitInputValidator;
+  router?: TraitInputValidator;
+  pageLifecycle?: TraitInputValidator;
+  popup?: TraitInputValidator;
+}
+//#endregion
+//#region src/environment/create.d.ts
+interface CreateFoundationEnvironmentOptions {
+  providers?: readonly SecuritydeptProvider[];
+  transport?: BaseTransportTrait;
+  transportForStdFetchCreateOptions?: BaseTransportForStdFetchCreateOptions;
+  time?: TimeTrait;
+  timeForStdCreateOptions?: TimeForStdCreateOptions;
+  realmStorage?: SyncStorageTrait;
+  span?: SpanTrait;
+  spanCreateOptions?: SpanCreateOptions;
+  tracing?: TracingTrait;
+  tracingCreateOptions?: TracingCreateOptions;
+  idleCallback?: IdleCallbackTrait | null;
+  persistentStorage?: StorageTrait | null;
+  sessionStorage?: StorageTrait | null;
+  router?: RouterTrait | null;
+  pageLifecycle?: PageLifecycleTrait | null;
+  popup?: PopupTrait | null;
+  validators?: EnvironmentValidators;
+}
+/**
+ * Create a `FoundationEnvironment` from explicit trait units and defaults.
+ *
+ * This helper owns foundation-wide baseline resolution and trait-graph wiring.
+ *
+ * It may resolve:
+ *   - public std adapters such as
+ *     `transportForStdFetchCreateOptions -> transport` and `timeForStdCreateOptions -> time`
+ *   - public hostless baseline constructors such as
+ *     `spanCreateOptions -> span` and `tracingCreateOptions -> tracing`
+ *
+ * Host-material discovery such as resolving `window`, `location`, `history`,
+ * or browser storage handles belongs to explicit host adapters such as
+ * `@securitydept/client/web`, which must first resolve those inputs into
+ * concrete traits before calling this helper.
+ */
+declare function createFoundationEnvironment(overrides: CreateFoundationEnvironmentOptions): FoundationEnvironment;
+//#endregion
+//#region src/auth-coordination/contract.d.ts
+interface AuthRequirement {
+  /** Unique entity id for this requirement within the plan. */
+  readonly id: string;
+  /** Human-readable label (for logging / debugging). */
+  readonly label?: string;
+}
+interface StaticAttrsAuthRequirementInput<TAttributes = Record<string, unknown>> {
+  readonly id?: string;
+  readonly label?: string;
+  readonly attributes?: TAttributes;
+}
+declare class StaticAttrsAuthRequirement<TAttributes = Record<string, unknown>> implements AuthRequirement {
+  readonly id: string;
+  readonly label: string | undefined;
+  readonly attributes: TAttributes | undefined;
+  protected constructor(id: string, label: string | undefined, attributes: TAttributes | undefined);
+  static create<TAttributes = Record<string, unknown>>(input?: StaticAttrsAuthRequirementInput<TAttributes>): StaticAttrsAuthRequirement<TAttributes>;
+  static createList<TAttributes = Record<string, unknown>>(inputs: readonly StaticAttrsAuthRequirementInput<TAttributes>[]): readonly StaticAttrsAuthRequirement<TAttributes>[];
+}
+/** Outcome of resolving a single requirement. */
+declare const ResolutionStatus: {
+  readonly Fulfilled: "fulfilled";
+  readonly Failed: "failed";
+  readonly Skipped: "skipped";
+};
+type ResolutionStatus = (typeof ResolutionStatus)[keyof typeof ResolutionStatus];
+/** The resolution result for a single requirement. */
+interface RequirementResolution {
+  /** The requirement ID this resolution applies to. */
+  requirementId: string;
+  /** Outcome status. */
+  status: ResolutionStatus;
+  /** Optional error or reason for failure/skip. */
+  reason?: string;
+}
+/** Overall plan status. */
+declare const PlanStatus: {
+  /** There are still pending requirements. */
+  readonly Pending: "pending";
+  /** All requirements have been resolved. */
+  readonly Settled: "settled";
+};
+type PlanStatus = (typeof PlanStatus)[keyof typeof PlanStatus];
+/** Error thrown when a planner contract is violated (e.g. duplicate ids). */
+declare class RequirementPlannerError extends Error {
+  constructor(message: string);
+}
+/** Result of an authentication check. */
+type AuthenticatedCheck = boolean | Promise<boolean>;
+/**
+ * Return value of an unauthenticated handler.
+ *
+ * - `true` — the requirement is now satisfied (resolved as fulfilled);
+ *   the pipeline records the resolution and may continue.
+ * - `false` — block: the requirement cannot proceed.
+ * - `string` — redirect to the given location.
+ * - A never-settling `Promise` — used when a full-page external redirect has
+ *   started; the step intentionally never resolves so the host navigation is
+ *   not finalized while the page is leaving.
+ */
+type UnauthenticatedAction = boolean | string | Promise<boolean | string>;
+/**
+ * Behaviour evaluation context handed to every behaviour callback.
+ *
+ * Reflects the planner state at the moment the callback is invoked.
+ */
+type RequirementBehaviourContext<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = {
+  readonly planContext: TPlanContext;
+  readonly environment: FoundationEnvironment;
+  /** The full effective requirement list for the active plan. */
+  readonly requirements: readonly TAuthRequirement[];
+  /** Resolutions collected so far (in requirement order). */
+  readonly resolutionList: readonly RequirementResolution[];
+};
+/** Stream of unauthenticated requirements discovered by the planner. */
+type RequirementCandidateGenerator<TAuthRequirement extends AuthRequirement = AuthRequirement> = AsyncGenerator<TAuthRequirement, void, unknown>;
+/**
+ * Context handed to candidate selection.
+ *
+ * `candidateList` is intentionally a stream: selectors that can act on the
+ * first available unauthenticated requirement do not need to wait for all
+ * checks to complete, while chooser-style selectors can still collect the full
+ * stream with `for await`.
+ */
+type RequirementCandidateSelectionContext<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = RequirementBehaviourContext<TAuthRequirement, TPlanContext> & {
+  /** Requirements not yet satisfied, yielded as their checks complete. */
+  readonly candidateList: RequirementCandidateGenerator<TAuthRequirement>;
+};
+/** Decide whether a single requirement is already satisfied. */
+type CheckAuthenticated<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = (requirement: TAuthRequirement, context: RequirementBehaviourContext<TAuthRequirement, TPlanContext>) => AuthenticatedCheck;
+/** Decide what to do when a selected requirement is unauthenticated. */
+type OnUnauthenticated<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = (requirement: TAuthRequirement, context: RequirementBehaviourContext<TAuthRequirement, TPlanContext>) => UnauthenticatedAction;
+/**
+ * Reduce the candidate set to the single requirement to act on next.
+ *
+ * The default strategy picks the first unauthenticated candidate yielded by the
+ * stream. Chooser-style strategies may collect the full stream when they need
+ * a complete candidate set.
+ */
+type SelectCandidate<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> = (context: RequirementCandidateSelectionContext<TAuthRequirement, TPlanContext>) => TAuthRequirement | undefined | Promise<TAuthRequirement | undefined>;
+/** The full behaviour contract resolved by a planner host. */
+interface RequirementBehaviour<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> {
+  checkAuthenticated: CheckAuthenticated<TAuthRequirement, TPlanContext>;
+  onUnauthenticated: OnUnauthenticated<TAuthRequirement, TPlanContext>;
+  selectCandidate: SelectCandidate<TAuthRequirement, TPlanContext>;
+}
+interface RouteStateSnapshotTrait {
+  readonly url: string;
+}
+interface RouteBehaviourContextExtra {
+  readonly routeState: RouteStateSnapshotTrait;
+}
+declare function isRouteStateSnapshotTrait(value: unknown): value is RouteStateSnapshotTrait;
+declare function isRouteBehaviourContextExtra(value: unknown): value is RouteBehaviourContextExtra;
+type RequirementBehaviourWithRouteContext<TAuthRequirement extends AuthRequirement = AuthRequirement> = RequirementBehaviour<TAuthRequirement, RouteBehaviourContextExtra>;
+/** Outcome of a pipeline step or run. */
+declare const PipelineOutcome: {
+  /** No candidates remain — the plan is satisfied. */
+  readonly Settled: "settled";
+  /** A candidate was resolved as fulfilled; more may remain. */
+  readonly Resolved: "resolved";
+  /** A candidate's handler blocked progress. */
+  readonly Blocked: "blocked";
+  /** A candidate's handler requested a redirect. */
+  readonly Redirect: "redirect";
+};
+type PipelineOutcome = (typeof PipelineOutcome)[keyof typeof PipelineOutcome];
+/** Result of a single {@link BaseRequirementPlanner.runStep}. */
+type PipelineStepResult<TAuthRequirement extends AuthRequirement = AuthRequirement> = {
+  outcome: typeof PipelineOutcome.Settled;
+} | {
+  outcome: typeof PipelineOutcome.Resolved;
+  requirement: TAuthRequirement;
+} | {
+  outcome: typeof PipelineOutcome.Blocked;
+  requirement: TAuthRequirement;
+} | {
+  outcome: typeof PipelineOutcome.Redirect;
+  requirement: TAuthRequirement;
+  location: string;
+};
+/** Result of {@link BaseRequirementPlanner.runUntilSettled}. */
+type PipelineRunResult<TAuthRequirement extends AuthRequirement = AuthRequirement> = {
+  outcome: typeof PipelineOutcome.Settled;
+  resolutions: readonly RequirementResolution[];
+} | {
+  outcome: typeof PipelineOutcome.Blocked;
+  requirement: TAuthRequirement;
+} | {
+  outcome: typeof PipelineOutcome.Redirect;
+  requirement: TAuthRequirement;
+  location: string;
+};
+/**
+ * How a route segment's requirements compose with the inherited parent chain.
+ *
+ * - `inherit` — keep the parent requirements unchanged (segment adds nothing)
+ * - `merge` — inherit parent requirements, then append/override with the
+ *   segment's own (same-id entries replace the parent's)
+ * - `replace` — discard the parent chain, use only the segment's requirements
+ */
+declare const RequirementsComposition: {
+  readonly Inherit: "inherit";
+  readonly Merge: "merge";
+  readonly Replace: "replace";
+};
+type RequirementsComposition = (typeof RequirementsComposition)[keyof typeof RequirementsComposition];
+/** A single node in a matched route chain. */
+interface RouteTreeSegment<TAuthRequirement extends AuthRequirement = AuthRequirement> {
+  /** Route segment identifier (e.g. route name or path pattern). */
+  routeId: string;
+  /** Auth requirements declared on this route segment. */
+  requirements: readonly TAuthRequirement[];
+  /** Composition strategy against the inherited chain. Defaults to `merge`. */
+  composition?: RequirementsComposition;
+}
+/** A requirements declaration annotated with its composition strategy. */
+interface RouteRequirementsDeclaration<TAuthRequirement extends AuthRequirement = AuthRequirement> {
+  composition: RequirementsComposition;
+  requirements: readonly TAuthRequirement[];
+}
+/**
+ * Apply a route requirements declaration onto an effective requirement map.
+ *
+ * Reuse `effective` across a route chain so merge/replace fold in O(total
+ * requirements) without rebuilding parent state each segment. When omitted, a
+ * fresh map is created for one-shot composition.
+ */
+declare function resolveEffectiveRequirements<TAuthRequirement extends AuthRequirement = AuthRequirement>(child: RouteRequirementsDeclaration<TAuthRequirement>, effective?: Map<string, TAuthRequirement>): Map<string, TAuthRequirement>;
+//#endregion
+//#region src/auth-coordination/planner-host.d.ts
+declare const REQUIREMENT_PLANNER_HOST: SecuritydeptInjectionToken<RequirementPlannerHost<unknown>>;
+type RequirementPlannerHostBehaviour<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>> = TBehaviour | (() => TBehaviour);
+interface ProvideRequirementPlannerHostOptions<TBehaviour = Partial<RequirementBehaviour>> {
+  readonly parent?: RequirementPlannerHost<TBehaviour>;
+  readonly environment?: FoundationEnvironment;
+}
+interface InjectRequirementPlannerHostOptions {
+  readonly injector: SecuritydeptInjectorTrait;
+}
+/**
+ * Default candidate selector: first unauthenticated candidate as soon as it is
+ * discovered.
+ *
+ * If every requirement is already fulfilled the stream completes and the
+ * selector returns `undefined`.
+ */
+declare function defaultSelectCandidate<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}>(): SelectCandidate<TAuthRequirement, TPlanContext>;
+/** Options for {@link RequirementPlannerHost.fromBehaviour}. */
+interface RequirementPlannerHostOptions<TRequirementBehaviour = Partial<RequirementBehaviour>> {
+  /** Parent host to inherit unspecified behaviour from. */
+  parent?: RequirementPlannerHost<TRequirementBehaviour>;
+  environment?: FoundationEnvironment;
+}
+/**
+ * A coordination-scope host that resolves behaviour through a parent chain.
+ *
+ * Construct via {@link RequirementPlannerHost.fromBehaviour}. Each behaviour
+ * field is optional at host construction time; missing required behaviour is
+ * resolved from `parent` and fails fast during planner build if no host in the
+ * chain provides it.
+ *
+ * @example
+ * ```ts
+ * const root = RequirementPlannerHost.fromBehaviour({
+ *   checkAuthenticated: (req) => isAuthenticated(req),
+ *   onUnauthenticated: (req) => `/login/${req.id}`,
+ * });
+ *
+ * // Feature scope overrides only the chooser, inheriting the rest.
+ * const feature = RequirementPlannerHost.fromBehaviour(
+ *   { selectCandidate: async (ctx) => showChooser(ctx.candidateList) },
+ *   { parent: root },
+ * );
+ * ```
+ */
+declare class RequirementPlannerHost<TBehaviour = Partial<RequirementBehaviour>> {
+  readonly environment: FoundationEnvironment | undefined;
+  readonly parent: RequirementPlannerHost<TBehaviour> | undefined;
+  /** The parent host, or undefined at the root. */
+  private readonly _behaviour;
+  protected constructor(behaviour: TBehaviour, environment: FoundationEnvironment | undefined, parent: RequirementPlannerHost<TBehaviour> | undefined);
+  /** Create a host scope from a partial behaviour and optional parent. */
+  static fromBehaviour<TBehaviour = Partial<RequirementBehaviour>>(behaviour: TBehaviour, options?: RequirementPlannerHostOptions<TBehaviour>): RequirementPlannerHost<TBehaviour>;
+  resolveBehaviourOptionFor<K extends keyof TBehaviour>(key: K): Promise<TBehaviour[K] | undefined>;
+  resolveBehaviourFor<K extends keyof TBehaviour>(key: K, defaultValue: () => NonNullable<TBehaviour[K]> | Promise<NonNullable<TBehaviour[K]>>): Promise<NonNullable<TBehaviour[K]>>;
+  resolveEnvironmentOption(): Promise<FoundationEnvironment | undefined>;
+  resolveEnvironment(defaultValue: () => FoundationEnvironment | Promise<FoundationEnvironment>): Promise<FoundationEnvironment>;
+}
+declare function provideRequirementPlannerHost<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>>(behaviour: RequirementPlannerHostBehaviour<TAuthRequirement, TPlanContext, TBehaviour>, options?: ProvideRequirementPlannerHostOptions<TBehaviour>): SecuritydeptProvider<RequirementPlannerHost<TBehaviour>>;
+declare function injectRequirementPlannerHost<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>>(options: InjectRequirementPlannerHostOptions): RequirementPlannerHost<TBehaviour> | null;
+//#endregion
+//#region src/auth-coordination/planner/base-planner.d.ts
+/**
+ * Mutable pipeline state for one run: bound behaviour plus requirement list
+ * and evolving resolutions.
+ */
+interface RequirementPlan<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}> extends Readonly<RequirementBehaviour<TAuthRequirement, TPlanContext>> {
+  readonly planContext: TPlanContext;
+  readonly environment: FoundationEnvironment;
+  readonly requirements: readonly TAuthRequirement[];
+  resolutionList: RequirementResolution[];
+}
+/**
+ * Abstract base for all requirement planners.
+ *
+ * Subclasses supply requirements via {@link buildRequirementList}. Pipeline
+ * state lives on {@link RequirementPlan}, produced by {@link buildPlan}.
+ */
+declare abstract class BaseRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>> {
+  protected readonly host: RequirementPlannerHost<TBehaviour>;
+  protected initialResolutions: readonly RequirementResolution[];
+  abstract get planContext(): TPlanContext;
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, initialResolutions?: readonly RequirementResolution[]);
+  /**
+   * Pipeline step 0: resolve host behaviour and materialize requirements into
+   * a {@link RequirementPlan}.
+   *
+   * Behaviour and the requirement list stay fixed on the returned plan until
+   * the next `buildPlan()` call. Resolve host parent chains (and any
+   * injection-context capture) here — not between async steps.
+   */
+  buildPlan(): Promise<RequirementPlan<TAuthRequirement, TPlanContext>>;
+  /**
+   * Return the effective requirement map for this planner.
+   *
+   * Keys are requirement ids; {@link Map} insertion order defines evaluation
+   * order. Subclasses own deduplication policy when folding multiple sources.
+   */
+  protected abstract buildRequirementList(): Map<string, TAuthRequirement> | Promise<Map<string, TAuthRequirement>>;
+  /**
+   * Materialize the effective requirement list (also invoked by {@link buildPlan}).
+   */
+  resolveRequirementList(): Promise<readonly TAuthRequirement[]>;
+  /**
+   * Pipeline step 1 — one loop iteration: select a candidate, run
+   * `onUnauthenticated`, then reduce `plan` state.
+   */
+  runStep(plan: RequirementPlan<TAuthRequirement, TPlanContext>): Promise<PipelineStepResult<TAuthRequirement>>;
+  protected reduceFromAction(plan: RequirementPlan<TAuthRequirement, TPlanContext>, candidate: TAuthRequirement, action: Exclude<UnauthenticatedAction, Promise<unknown>>): PipelineStepResult<TAuthRequirement>;
+  /**
+   * Run the full pipeline: {@link buildPlan}, step 1, then loop step 2 until
+   * settled or a terminal outcome (`blocked`, `redirect`, or a never-settling
+   * action).
+   */
+  runUntilSettled(): Promise<PipelineRunResult<TAuthRequirement>>;
+  runUntilSettledWithPlan(plan: RequirementPlan<TAuthRequirement, TPlanContext>): Promise<PipelineRunResult<TAuthRequirement>>;
+  private createCandidateStream;
+  private recordFulfilled;
+}
+//#endregion
+//#region src/auth-coordination/planner/merge-planner.d.ts
+/**
+ * A planner whose effective requirements are the ordered union of its source
+ * planners. Overlapping ids follow Map semantics (later source wins).
+ *
+ * @example
+ * ```ts
+ * const planner = MergeRequirementPlanner.fromPlanners(host, [
+ *   sessionPlanner,
+ *   oidcPlanner,
+ * ]);
+ * ```
+ */
+declare class MergeRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>> extends BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour> {
+  private readonly sources;
+  get planContext(): TPlanContext;
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, sources: readonly BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour>[]);
+  /** Create a merge planner from an ordered list of source planners. */
+  static fromPlanners<TAuthRequirement extends AuthRequirement = AuthRequirement, TPlanContext = {}, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>>(host: RequirementPlannerHost<TBehaviour>, planners: readonly BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour>[]): MergeRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour>;
+  protected buildRequirementList(): Promise<Map<string, TAuthRequirement>>;
+}
+//#endregion
+//#region src/auth-coordination/planner/route-composition-planner.d.ts
+/**
+ * A planner driven by a matched route chain with composition semantics.
+ *
+ * Construct via {@link fromRouteSegments} for a matched route chain, or
+ * {@link fromRouteTransition} for a transition that preserves shared-prefix
+ * resolutions from the previous planner instance.
+ */
+declare class RouteCompositionRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>> extends BaseRequirementPlanner<TAuthRequirement, RouteBehaviourContextExtra, TBehaviour> {
+  private readonly _segments;
+  private readonly _effective;
+  private readonly _planContext;
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, segments: readonly RouteTreeSegment<TAuthRequirement>[], routeState: RouteStateSnapshotTrait, preservedResolutions?: readonly RequirementResolution[]);
+  /** Build a planner from a matched route chain. */
+  static fromRouteSegments<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>>(host: RequirementPlannerHost<TBehaviour>, segments: readonly RouteTreeSegment<TAuthRequirement>[], routeState: RouteStateSnapshotTrait): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour>;
+  /**
+   * Build a planner for a route transition, preserving resolutions for the
+   * shared requirement prefix carried over from `previousPlan`.
+   */
+  static fromRouteTransition<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>>(host: RequirementPlannerHost<TBehaviour>, currentSegments: readonly RouteTreeSegment<TAuthRequirement>[], routeState: RouteStateSnapshotTrait, previousPlanner: RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour>, previousPlan: RequirementPlan<TAuthRequirement, RouteBehaviourContextExtra>): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour>;
+  get planContext(): RouteBehaviourContextExtra;
+  /** The matched route chain backing this planner. */
+  get segments(): readonly RouteTreeSegment<TAuthRequirement>[];
+  /** The folded effective requirement list (composition applied). */
+  get effectiveRequirements(): readonly TAuthRequirement[];
+  protected buildRequirementList(): Map<string, TAuthRequirement>;
+}
+//#endregion
+//#region src/auth-coordination/planner/static-planner.d.ts
+/**
+ * A planner whose effective requirement list is a fixed array supplied at
+ * construction time.
+ *
+ * @example
+ * ```ts
+ * const planner = StaticRequirementPlanner.fromRequirements(host, [
+ *   StaticAttrsAuthRequirement.create({ id: "session" }),
+ * ] as Readonly<AuthRequirement[]>);
+ * const plan = await planner.buildPlan();
+ * const step = await planner.runStep(plan);
+ * // or: const result = await planner.runUntilSettled();
+ * ```
+ */
+declare class StaticRequirementPlanner<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement>> = Partial<RequirementBehaviour<TAuthRequirement>>> extends BaseRequirementPlanner<TAuthRequirement, {}, TBehaviour> {
+  private readonly staticRequirements;
+  get planContext(): {};
+  protected constructor(host: RequirementPlannerHost<TBehaviour>, requirements: readonly TAuthRequirement[]);
+  /** Create a static planner from an ordered requirement list. */
+  static fromRequirements<TAuthRequirement extends AuthRequirement = AuthRequirement, TBehaviour extends Partial<RequirementBehaviour<TAuthRequirement>> = Partial<RequirementBehaviour<TAuthRequirement>>>(host: RequirementPlannerHost<TBehaviour>, requirements: readonly TAuthRequirement[]): StaticRequirementPlanner<TAuthRequirement, TBehaviour>;
+  protected buildRequirementList(): Map<string, TAuthRequirement>;
+}
+//#endregion
+//#region src/identity/contracts.d.ts
+interface IdentityPrincipal {
+  subject: string;
+  displayName: string;
+  picture?: string;
+  issuer?: string;
+  claims?: Record<string, unknown>;
+}
+interface ProjectIdentityPrincipalOptions {
+  principal?: IdentityPrincipal | null;
+  fallbackDisplayName?: string;
+  fallbackSubject?: string;
+  fallbackIssuer?: string;
+  fallbackClaims?: Record<string, unknown>;
+}
+//#endregion
+//#region src/identity/parsers.d.ts
+declare function parseIdentityPrincipal(input: unknown): IdentityPrincipal;
+declare function parseIdentityPrincipalWire(input: unknown): IdentityPrincipal;
+declare function projectIdentityPrincipal(options: ProjectIdentityPrincipalOptions): IdentityPrincipal;
+//#endregion
+//#region src/identity/schemas.d.ts
+declare const IdentityPrincipalSchema: import("arktype/internal/variants/object.ts").ObjectType<(In: {
+  subject: string;
+  displayName?: string | null | undefined;
+  picture?: string | null | undefined;
+  issuer?: string | null | undefined;
+  claims?: object | null | undefined;
+}) => import("arktype").Out<IdentityPrincipal>, {}>;
+declare const IdentityPrincipalWireSchema: import("arktype/internal/variants/object.ts").ObjectType<(In: {
+  subject: string;
+  display_name?: string | null | undefined;
+  picture?: string | null | undefined;
+  issuer?: string | null | undefined;
+  claims?: object | null | undefined;
+}) => import("arktype").Out<IdentityPrincipal>, {}>;
+//#endregion
+//#region src/protocol/jwt/types.d.ts
+type JwtAudienceClaim = string | readonly string[];
+interface JwtClaimsSet extends Record<string, unknown> {
+  iss?: string;
+  sub?: string;
+  aud?: JwtAudienceClaim;
+  exp?: number;
+  nbf?: number;
+  iat?: number;
+  jti?: string;
+}
+interface DecodeJwtPayloadOptions {
+  /**
+   * Optional label used in error messages. It does not affect parsing.
+   */
+  label?: string;
+}
+//#endregion
+//#region src/protocol/jwt/decode.d.ts
+declare function decodeJwtPayload(jwt: string, options?: DecodeJwtPayloadOptions): JwtClaimsSet;
+//#endregion
+//#region src/protocol/jwt/error.d.ts
+declare const JwtDecodeErrorCode: {
+  readonly InvalidFormat: "protocol.jwt.invalid_format";
+  readonly InvalidPayload: "protocol.jwt.invalid_payload";
+  readonly InvalidClaim: "protocol.jwt.invalid_claim";
+};
+type JwtDecodeErrorCode = (typeof JwtDecodeErrorCode)[keyof typeof JwtDecodeErrorCode];
+declare class JwtDecodeError extends ClientError {
+  readonly code: JwtDecodeErrorCode;
+  constructor(options: {
+    code: JwtDecodeErrorCode;
+    message: string;
+    cause?: unknown;
+  });
+}
+//#endregion
+//#region src/scheduling/duration.d.ts
+/**
+ * Parse a human-readable duration string (for example `5m` or `300s`) into
+ * milliseconds.
+ */
+declare function parseDurationToMs(duration: string): number;
+//#endregion
+//#region src/span/span.d.ts
+declare function createRootSpan(options?: SpanCreateOptions & WithTraitInputValidator<TraitInputValidator>): SpanTrait;
+//#endregion
+//#region src/std/cancellation/abort-signal.d.ts
+/**
+ * Bridge a web `AbortSignal` back into the foundation cancellation contract.
+ *
+ * This is the canonical consumer-side path for browser hosts that receive an
+ * `AbortSignal` from framework/runtime APIs (for example React Query queryFns)
+ * but need to call SDK surfaces that accept `CancellationTokenTrait`.
+ */
+declare function abortSignalToCancellationToken(signal: AbortSignal): CancellationTokenTrait;
+declare function abortSignalToCancellationToken(signal?: undefined): undefined;
+declare function abortSignalToCancellationToken(signal?: AbortSignal): CancellationTokenTrait | undefined;
+interface AbortSignalBridge extends DisposableTrait {
+  signal?: AbortSignal;
+}
+/**
+ * Bridge foundation cancellation to `AbortSignal` without exposing
+ * `AbortSignal` in core contracts.
+ */
+declare function cancellationTokenToAbortSignal(token: CancellationTokenTrait): AbortSignalBridge;
+declare function cancellationTokenToAbortSignal(token?: undefined): undefined;
+declare function cancellationTokenToAbortSignal(token?: CancellationTokenTrait): AbortSignalBridge | undefined;
+declare function normalizeAbortError(token: CancellationTokenTrait | undefined, error: unknown): unknown;
+//#endregion
+//#region src/storage/ephemeral-flow-store.d.ts
+interface CreateEphemeralFlowStoreOptions<T> {
+  store: StorageTrait;
+  key: string;
+  codec?: Codec<T>;
+}
+interface CreateKeyedEphemeralFlowStoreOptions<T> {
+  store: StorageTrait;
+  keyPrefix: string;
+  codec?: Codec<T>;
+}
+/**
+ * Create a typed ephemeral flow-state store backed by a low-level `StorageTrait`.
+ *
+ * Intended for short-lived browser/session coordination state such as pending
+ * redirects or callback fragments.
+ */
+declare function createEphemeralFlowStore<T>(options: CreateEphemeralFlowStoreOptions<T>): EphemeralFlowStore<T>;
+/**
+ * Create a typed keyed ephemeral flow-state store backed by a low-level
+ * `StorageTrait`.
+ *
+ * Intended for short-lived browser/session coordination state where multiple
+ * pending records must coexist and be consumed independently.
+ */
+declare function createKeyedEphemeralFlowStore<T>(options: CreateKeyedEphemeralFlowStoreOptions<T>): KeyedEphemeralFlowStore<T>;
+//#endregion
+//#region src/storage/json-codec.d.ts
+/** Default JSON codec. */
+declare function createJsonCodec<T>(): Codec<T>;
+//#endregion
+//#region src/storage/memory-store.d.ts
+/** In-memory `SyncStorageTrait` — useful for realm state, tests, and SSR. */
+declare function createInMemoryRecordStore(): SyncStorageTrait;
+//#endregion
+//#region src/struct/async-lock.d.ts
+declare const OnceAsyncLockState: {
+  readonly Init: "init";
+  readonly Running: "running";
+  readonly Success: "success";
+  readonly Error: "error";
+};
+type OnceAsyncLockState = (typeof OnceAsyncLockState)[keyof typeof OnceAsyncLockState];
+type OnceAsyncLockInit = {
+  readonly state: typeof OnceAsyncLockState.Init;
+  readonly promise?: never;
+};
+type OnceAsyncLockRunning = {
+  readonly state: typeof OnceAsyncLockState.Running;
+  readonly promise: Promise<unknown>;
+};
+type OnceAsyncLockSuccess<T> = {
+  readonly state: typeof OnceAsyncLockState.Success;
+  readonly data: T;
+};
+type OnceAsyncLockError<E> = {
+  readonly state: typeof OnceAsyncLockState.Error;
+  readonly error: E;
+};
+type OnceAsyncLock<T, E> = OnceAsyncLockInit | OnceAsyncLockRunning | OnceAsyncLockSuccess<T> | OnceAsyncLockError<E>;
+type OnceAsyncLockCallable<F extends (...args: any[]) => PromiseLike<any>, E = unknown> = F & OnceAsyncLock<Awaited<ReturnType<F>>, E> & ReadableSignalTrait<OnceAsyncLock<Awaited<ReturnType<F>>, E>>;
+declare function createOnceAsyncLockCallable<F extends (...args: any[]) => PromiseLike<any>, E = unknown>(fn: F): OnceAsyncLockCallable<F, E>;
+//#endregion
+//#region src/tracing/operation-runner.d.ts
+interface RunOperationEnvironment {
+  environment: {
+    time: TimestampProviderTrait;
+    tracing: TracingTrait;
+  };
+}
+interface RunOperationOptionsBase extends RunOperationEnvironment {
+  span: SpanTrait;
+  name: string;
+  target: string;
+  fields?: Record<string, unknown>;
+  idFactory?: () => string;
+  normalizeError?: (error: unknown) => unknown;
+}
+interface RunOperationOptions<T> extends RunOperationOptionsBase {
+  execute: (span: OperationSpanTrait) => T;
+}
+declare class OperationSpan implements OperationSpanTrait {
+  private readonly _span;
+  private readonly _environment;
+  private readonly _name;
+  private readonly _target;
+  private constructor();
+  static start(options: RunOperationOptionsBase): OperationSpan;
+  get id(): string;
+  get parent(): SpanTrait | undefined;
+  get attributes(): Readonly<Record<string, unknown>>;
+  fork(options: MutableSpanCreateOptions): MutableSpanTrait;
+  fork(options?: SpanCreateOptions): SpanTrait;
+  setAttributes(attributes: Record<string, unknown>): void;
+  addEvent(name: string, fields?: Record<string, unknown>): void;
+  recordError(error: unknown, fields?: Record<string, unknown>): void;
+  recordStarted(): void;
+  recordEnded(outcome: "succeeded" | "failed"): void;
+  private _record;
+}
+declare function runOperation<T>(options: RunOperationOptions<T>): T;
+declare function runOperation<T>(options: RunOperationOptions<Promise<T>>): Promise<T>;
+//#endregion
+//#region src/tracing/operation-method.d.ts
+interface InstrumentMethodThisContext<TArgs extends unknown[]> {
+  args: TArgs;
+  methodName: string;
+}
+interface InstrumentMethodResolvedOptions extends Omit<RunOperationOptionsBase, "name"> {
+  name?: string;
+}
+type InstrumentMethodThisResolver<TThis extends object, TArgs extends unknown[]> = (this: TThis, context: InstrumentMethodThisContext<TArgs>) => InstrumentMethodResolvedOptions;
+interface DefineInstrumentMethodDecoratorContext<TFactoryArgs extends unknown[]> {
+  factoryArgs: TFactoryArgs;
+  methodName: string;
+}
+type DefineInstrumentMethodDecoratorFactory<TFactoryArgs extends unknown[], TBaseThis extends object = object> = <TThis extends TBaseThis, TArgs extends unknown[]>(context: DefineInstrumentMethodDecoratorContext<TFactoryArgs>) => InstrumentMethodThisResolver<TThis, TArgs>;
+declare function defineInstrumentMethodDecorator<TFactoryArgs extends unknown[], TBaseThis extends object = object>(factory: DefineInstrumentMethodDecoratorFactory<TFactoryArgs, TBaseThis>): (...factoryArgs: TFactoryArgs) => <TThis extends TBaseThis, TArgs extends unknown[], TReturn>(target: (this: TThis, ...args: TArgs) => TReturn, context: ClassMethodDecoratorContext<TThis, (this: TThis, ...args: TArgs) => TReturn>) => (this: TThis, ...args: TArgs) => TReturn;
+//#endregion
+//#region src/tracing/subscriber/console.d.ts
+declare function createConsoleTracingSubscriber(): TracingSubscriberTrait;
+//#endregion
+//#region src/tracing/subscriber/timeline-store.d.ts
+interface TraceTimelineEntry extends TracingEvent {
+  id: number;
+  recordedAtIso: string;
+}
+interface TraceTimelineStore extends TracingSubscriberTrait {
+  get(): readonly TraceTimelineEntry[];
+  subscribe(listener: () => void): () => void;
+  clear(): void;
+}
+/**
+ * Create a subscriber-side trace timeline store.
+ *
+ * This store consumes tracing events through `record(event)` and keeps a
+ * bounded local timeline for tests and UI surfaces. It is not the tracing
+ * runtime itself.
+ */
+declare function createTraceTimelineStore(limit?: number): TraceTimelineStore;
+//#endregion
+//#region src/transport/url.d.ts
+/**
+ * Returns `true` for loopback HTTP URLs that browsers and local tooling often
+ * permit during development flows.
+ */
+declare function isLoopbackHttpUrl(url: URL): boolean;
+//#endregion
+export { ProvideRequirementPlannerHostOptions as $, appendOrReplaceCompatFragment as $n, createJsonRpcServerAndClient as $r, PersistentAuthStore as $t, cancellationTokenToAbortSignal as A, Base64CompatErrorCode as Ai, throwValidationClientError as An, readPopupErrorPresentationDescriptor as Ar, StaticAttrsAuthRequirementInput as At, IdentityPrincipalSchema as B, RouterNavigationMode as Bn, ResourceSnapshotUpdateKind as Br, ServiceWorkerEnvironment as Bt, OnceAsyncLockSuccess as C, abortSignalToEventStream as Ci, TraitInputValidator as Cn, PopupAttachResult as Cr, ResolutionStatus as Ct, createEphemeralFlowStore as D, PAGE_LIFECYCLE_TRAIT_TOKEN as Di, ValidationSuccess as Dn, CreatePopupClientSessionOptions as Dr, RouteTreeSegment as Dt, createJsonCodec as E, describeError as Ei, ValidationResult as En, PopupTrait as Er, RouteStateSnapshotTrait as Et, JwtDecodeErrorCode as F, SPAN_TRAIT_TOKEN as Fn, PopupServerWindowHandleTrait as Fr, CreateFoundationEnvironmentOptions as Ft, IdentityPrincipal as G, AppendOrReplaceCompatFragmentOptions as Gn, ResourceStreamContext as Gr, TRACING_TRAIT_TOKEN as Gt, parseIdentityPrincipal as H, RouterTrait as Hn, reduceResourceSnapshot as Hr, createTracing as Ht, decodeJwtPayload as I, SpanCreateOptions as In, PopupWindowHandleTrait as Ir, createFoundationEnvironment as It, RouteCompositionRequirementPlanner as J, CompatFragmentParameters as Jn, ResourceErrorCode as Jr, TracingTrait as Jt, ProjectIdentityPrincipalOptions as K, AppendOrReplaceCompatFragmentResult as Kn, createResource as Kr, TracingEvent as Kt, DecodeJwtPayloadOptions as L, SpanTrait as Ln, createSignal as Lr, ENVIRONMENT_TOKEN as Lt, createRootSpan as M, encodeUint8ArrayToBase64 as Mi, validateWithSchema as Mn, PopupClientWindowHandleTrait as Mr, isRouteBehaviourContextExtra as Mt, parseDurationToMs as N, SecuritydeptDestroyRef as Ni, validateWithSchemaSync as Nn, PopupMessageChannelTrait as Nr, isRouteStateSnapshotTrait as Nt, createKeyedEphemeralFlowStore as O, PageLifecycleTrait as Oi, WithTraitInputValidator as On, CreatePopupServerSessionOptions as Or, SelectCandidate as Ot, JwtDecodeError as P, createSecuritydeptDestroyRef as Pi, OperationSpanTrait as Pn, PopupServerWindowHandle as Pr, resolveEffectiveRequirements as Pt, InjectRequirementPlannerHostOptions as Q, UpdateUriFragmentHash as Qn, createJsonRpcServer as Qr, PERSISTENT_STORAGE_TRAIT_TOKEN as Qt, JwtAudienceClaim as R, ROUTER_TRAIT_TOKEN as Rn, readonlySignal as Rr, EnvironmentValidators as Rt, OnceAsyncLockState as S, createNeverEventStream as Si, createTimeForStd as Sn, PopupAttachFailureReason as Sr, RequirementsComposition as St, createInMemoryRecordStore as T, ErrorSummary as Ti, ValidationFailure as Tn, PopupOpenOptions as Tr, RouteRequirementsDeclaration as Tt, parseIdentityPrincipalWire as U, TakeCompatFragmentFromRouterOptions as Un, whenResourceSnapshotValue as Ur, TracingSubscriberTrait as Ut, IdentityPrincipalWireSchema as V, RouterNavigationRequest as Vn, flattenResourceSnapshot as Vr, TracingCreateOptions as Vt, projectIdentityPrincipal as W, takeCompatFragmentFromRouter as Wn, CreateResourceOptions as Wr, OperationTraceEventType as Wt, BaseRequirementPlanner as X, TakeCompatFragmentOptions as Xn, createComputed as Xr, EphemeralFlowStore as Xt, MergeRequirementPlanner as Y, SECURITYDEPT_COMPAT_FRAGMENT_VERSION as Yn, ResourceValueUnavailableErrorOptions as Yr, Codec as Yt, RequirementPlan as Z, TakeCompatFragmentResult as Zn, createJsonRpcClient as Zr, KeyedEphemeralFlowStore as Zt, OnceAsyncLock as _, toEventStream as _i, AuthorizationInterceptedFetchPredicate as _n, UriReferenceStringSchema as _r, RequirementBehaviourWithRouteContext as _t, createConsoleTracingSubscriber as a, JsonRpcErrorResponseMessage as ai, StorageTrait as an, UriReferenceString as ar, injectRequirementPlannerHost as at, OnceAsyncLockInit as b, createEventStream as bi, createAuthorizationInterceptedFetch as bn, POPUP_TRAIT_TOKEN as br, RequirementPlannerError as bt, InstrumentMethodResolvedOptions as c, JsonRpcNotificationEvent as ci, BaseTransportForStdFetchCreateOptions as cn, UriRelativeParts as cr, AuthenticatedCheck as ct, defineInstrumentMethodDecorator as d, JsonRpcRequestMessage as di, BaseTransportTrait as dn, UriString as dr, PipelineOutcome as dt, CreateJsonRpcClientOptions as ei, REALM_STORAGE_TRAIT_TOKEN as en, isCompatFragmentBlock as er, REQUIREMENT_PLANNER_HOST as et, OperationSpan as f, JsonRpcRequestOptions as fi, HttpRequest as fn, SECURITYDEPT_ROUTE_METADATA_KEY as fr, PipelineRunResult as ft, runOperation as g, ToEventStreamInput as gi, TransportErrorCode as gn, BaseURIStringSchema as gr, RequirementBehaviourContext as gt, RunOperationOptionsBase as h, JsonRpcSuccessResponseMessage as hi, TRANSPORT_TRAIT_TOKEN as hn, writeSecuritydeptRouteMetadata as hr, RequirementBehaviour as ht, createTraceTimelineStore as i, JsonRpcErrorPayload as ii, StorageChangeEventOrigin as in, UriParseError as ir, defaultSelectCandidate as it, normalizeAbortError as j, decodeBase64ToUint8Array as ji, validateTraitInput as jn, PopupClientWindowHandle as jr, UnauthenticatedAction as jt, abortSignalToCancellationToken as k, promisesToRacedAsyncGenerator as ki, formatValidationFailure as kn, PopupErrorCode as kr, StaticAttrsAuthRequirement as kt, InstrumentMethodThisContext as l, JsonRpcNotificationMessage as li, FetchTransportRedirectKind as ln, UriRelativeString as lr, CheckAuthenticated as lt, RunOperationOptions as m, JsonRpcServerTrait as mi, HttpResponseJsonBody as mn, readSecuritydeptRouteMetadata as mr, PlanStatus as mt, TraceTimelineEntry as n, CreateJsonRpcServerOptions as ni, SESSION_STORAGE_TRAIT_TOKEN as nn, takeCompatFragment as nr, RequirementPlannerHostBehaviour as nt, DefineInstrumentMethodDecoratorContext as o, JsonRpcId as oi, StoredEnvelope as on, UriReferenceStringInput as or, provideRequirementPlannerHost as ot, RunOperationEnvironment as p, JsonRpcServerAndClientTrait as pi, HttpResponse as pn, SecuritydeptRouteMetadata as pr, PipelineStepResult as pt, StaticRequirementPlanner as q, CompatFragment as qn, ResourceError as qr, TracingLevel as qt, TraceTimelineStore as r, JsonRpcClientTrait as ri, StorageChangeEvent as rn, UriFragmentPart as rr, RequirementPlannerHostOptions as rt, DefineInstrumentMethodDecoratorFactory as s, JsonRpcMessage as si, SyncStorageTrait as sn, UriReferenceStringLike as sr, AuthRequirement as st, isLoopbackHttpUrl as t, CreateJsonRpcServerAndClientOptions as ti, RecoverableStateStore as tn, parseCompatFragment as tr, RequirementPlannerHost as tt, InstrumentMethodThisResolver as u, JsonRpcRequestEvent as ui, createBaseTransportForStdFetch as un, UriSearchParamsInit as ur, OnUnauthenticated as ut, OnceAsyncLockCallable as v, createEmptyEventStream as vi, AuthorizationSignal as vn, UriRelativeStringSchema as vr, RequirementCandidateGenerator as vt, createOnceAsyncLockCallable as w, readErrorPresentationDescriptor as wi, ValidateTraitInputOptions as wn, PopupAttachSuccess as wr, RouteBehaviourContextExtra as wt, OnceAsyncLockRunning as x, createEventSubject as xi, TimeForStdCreateOptions as xn, PopupAttachFailure as xr, RequirementResolution as xt, OnceAsyncLockError as y, createEventReplaySubject as yi, CreateAuthorizationInterceptedFetchOptions as yn, UriStringSchema as yr, RequirementCandidateSelectionContext as yt, JwtClaimsSet as z, RouterNavigationIntent as zn, ResourceSnapshotUpdate as zr, FoundationEnvironment as zt };
+//# sourceMappingURL=index-DmIapvr-.d.mts.map