@securitydept/client 0.3.0-beta.7 → 0.3.0-beta.8

package/dist/{index-BjCFWcmV.d.mts → index-Bo1BtjZH.d.mts}

@@ -1,5 +1,5 @@
 import { Ct as EventStreamTrait } from "./index-CFAJ969E.mjs";
-import { Bt as EnvironmentValidators, Hn as RouterTrait, Mn as WithTraitInputValidator, Oi as PageLifecycleTrait, Vn as RouterNavigationRequest, ar as UriReferenceString } from "./index-B9SEJGU2.mjs";
+import { Bt as EnvironmentValidators, Hn as RouterTrait, Mn as WithTraitInputValidator, Oi as PageLifecycleTrait, Vn as RouterNavigationRequest, ar as UriReferenceString } from "./index-CbeZ3AfB.mjs";
 //#region src/web/events/from-storage.d.ts
 interface StorageEventTarget {
   addEventListener(type: "storage", listener: EventListener): void;
@@ -129,4 +129,4 @@ declare class WebLegacyRouter extends NativeWebRouterBase {
 }
 //#endregion
 export { createPageResumeSource as _, NativeWebWindowLike as a, fromStorageEvent as b, WebNavigationRouter as c, createPageLifecycleForNativeWeb as d, CreatePageResumeSourceOptions as f, PageResumeWindowTarget as g, PageResumeTriggerKind as h, NativeWebRouter as i, createRouterForNativeWeb as l, PageResumeEvent as m, NativeWebLocationLike as n, RouterForNativeWebCreateOptions as o, PageResumeDocumentTarget as p, NativeWebNavigationLike as r, WebLegacyRouter as s, NativeWebHistoryLike as t, PageLifecycleForNativeWebCreateOptions as u, FromStorageEventOptions as v, StorageEventTarget as y };
-//# sourceMappingURL=index-BjCFWcmV.d.mts.map
+//# sourceMappingURL=index-Bo1BtjZH.d.mts.map

package/dist/{index-B9SEJGU2.d.mts → index-CbeZ3AfB.d.mts}

@@ -1,5 +1,4 @@
 import { B as WritableSignalTrait, C as IdleCallbackTrait, Ct as EventStreamTrait, D as ComputedSignalTrait, Dt as InteropObservableTrait, E as TimestampProviderTrait, F as ResourceSnapshot, Ft as SecuritydeptInjector, L as ResourceTrait, O as ReadableSignalTrait, R as ResourceWhenValueOptions, Rt as DisposableTrait, T as TimeTrait, Vt as SYMBOL_DISPOSE, W as CancellationTokenTrait, X as ClientError, an as SecuritydeptInjectorTrait, gt as SpanNodeAttributes, ht as SpanCreateOptions, in as SecuritydeptInjectionToken, it as ErrorPresentationDescriptor, mt as SpanAttributes, on as SecuritydeptProvider, st as ReadErrorPresentationDescriptorOptions, ut as MutableSpanTrait, v as RxEventSubject, vt as SpanTrait, wt as EventSubjectTrait, yt as EventObserverTrait, z as SignalOptions } from "./index-CFAJ969E.mjs";
-import { Queue } from "mnemonist";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/injection/destroy.d.ts
 declare abstract class SecuritydeptDestroyRef implements DisposableTrait {
@@ -1626,6 +1625,20 @@ declare class ConsoleTracingSubscriber implements TracingSubscriberTrait {
 }
 declare function createConsoleTracingSubscriber(): ConsoleTracingSubscriber;
 //#endregion
+//#region src/struct/ring-buffer.d.ts
+declare class FixedCapacityRingBuffer<T> {
+  readonly capacity: number;
+  private readonly values;
+  private head;
+  private tail;
+  private _size;
+  constructor(capacity: number);
+  get size(): number;
+  append(value: T): void;
+  toArray(): T[];
+  clear(): void;
+}
+//#endregion
 //#region src/tracing/subscriber/timeline-store.d.ts
 interface TraceTimelineEntry extends Omit<TracingEvent, "span"> {
   id: number;
@@ -1646,7 +1659,7 @@ interface TraceTimelineEntry extends Omit<TracingEvent, "span"> {
 declare class TraceTimelineStore implements TracingSubscriberTrait {
   protected readonly limit: number;
   protected nextId: number;
-  protected readonly timeline: Queue<TraceTimelineEntry>;
+  protected readonly timeline: FixedCapacityRingBuffer<TraceTimelineEntry>;
   protected readonly latestEntrySubject: RxEventSubject<TraceTimelineEntry | null>;
   constructor(limit?: number);
   get latestEntry(): EventStreamTrait<TraceTimelineEntry | null>;
@@ -1664,4 +1677,4 @@ declare function createTraceTimelineStore(limit?: number): TraceTimelineStore;
 declare function isLoopbackHttpUrl(url: URL): boolean;
 //#endregion
 export { RequirementPlan as $, appendOrReplaceCompatFragment as $n, createJsonRpcServerAndClient as $r, Codec as $t, abortSignalToCancellationToken as A, Base64CompatErrorCode as Ai, ValidationResult as An, readPopupErrorPresentationDescriptor as Ar, SelectCandidate as At, JwtAudienceClaim as B, RouterNavigationMode as Bn, ResourceSnapshotUpdateKind as Br, EnvironmentValidators as Bt, OnceAsyncLockState as C, createEventStream as Ci, CreateAuthorizationInterceptedFetchOptions as Cn, PopupAttachResult as Cr, RequirementResolution as Ct, createJsonCodec as D, PAGE_LIFECYCLE_TRAIT_TOKEN as Di, TraitInputValidator as Dn, CreatePopupClientSessionOptions as Dr, RouteRequirementsDeclaration as Dt, createInMemoryRecordStore as E, abortSignalToEventStream as Ei, createTimeForStd as En, PopupTrait as Er, RouteBehaviourContextExtra as Et, parseDurationToMs as F, validateTraitInput as Fn, PopupServerWindowHandleTrait as Fr, isRouteStateSnapshotTrait as Ft, parseIdentityPrincipalWire as G, AppendOrReplaceCompatFragmentOptions as Gn, ResourceStreamContext as Gr, TracingSubscriberTrait as Gt, IdentityPrincipalSchema as H, RouterTrait as Hn, reduceResourceSnapshot as Hr, ServiceWorkerEnvironment as Ht, JwtDecodeError as I, validateWithSchema as In, PopupWindowHandleTrait as Ir, resolveEffectiveRequirements as It, ProjectIdentityPrincipalOptions as J, CompatFragmentParameters as Jn, ResourceErrorCode as Jr, TRACING_SPAN_ATTRIBUTE_PROVIDER_ID as Jt, projectIdentityPrincipal as K, AppendOrReplaceCompatFragmentResult as Kn, createResource as Kr, OperationSpanTrait as Kt, JwtDecodeErrorCode as L, validateWithSchemaSync as Ln, createSignal as Lr, CreateFoundationEnvironmentOptions as Lt, normalizeAbortError as M, encodeUint8ArrayToBase64 as Mi, WithTraitInputValidator as Mn, PopupClientWindowHandleTrait as Mr, StaticAttrsAuthRequirementInput as Mt, createRootSpan as N, SecuritydeptDestroyRef as Ni, formatValidationFailure as Nn, PopupMessageChannelTrait as Nr, UnauthenticatedAction as Nt, createEphemeralFlowStore as O, PageLifecycleTrait as Oi, ValidateTraitInputOptions as On, CreatePopupServerSessionOptions as Or, RouteStateSnapshotTrait as Ot, SpanSharedAttributeName as P, createSecuritydeptDestroyRef as Pi, throwValidationClientError as Pn, PopupServerWindowHandle as Pr, isRouteBehaviourContextExtra as Pt, BaseRequirementPlanner as Q, UpdateUriFragmentHash as Qn, createJsonRpcServer as Qr, TracingTrait as Qt, decodeJwtPayload as R, ROUTER_TRAIT_TOKEN as Rn, readonlySignal as Rr, createFoundationEnvironment as Rt, OnceAsyncLockRunning as S, createEventReplaySubject as Si, AuthorizationSignal as Sn, PopupAttachFailureReason as Sr, RequirementPlannerError as St, createOnceAsyncLockCallable as T, createNeverEventStream as Ti, TimeForStdCreateOptions as Tn, PopupOpenOptions as Tr, ResolutionStatus as Tt, IdentityPrincipalWireSchema as U, TakeCompatFragmentFromRouterOptions as Un, whenResourceSnapshotValue as Ur, TracingCreateOptions as Ut, JwtClaimsSet as V, RouterNavigationRequest as Vn, flattenResourceSnapshot as Vr, FoundationEnvironment as Vt, parseIdentityPrincipal as W, takeCompatFragmentFromRouter as Wn, CreateResourceOptions as Wr, createTracing as Wt, RouteCompositionRequirementPlanner as X, TakeCompatFragmentOptions as Xn, createComputed as Xr, TracingEvent as Xt, StaticRequirementPlanner as Y, SECURITYDEPT_COMPAT_FRAGMENT_VERSION as Yn, ResourceValueUnavailableErrorOptions as Yr, TRACING_TRAIT_TOKEN as Yt, MergeRequirementPlanner as Z, TakeCompatFragmentResult as Zn, createJsonRpcClient as Zr, TracingLevel as Zt, runOperation as _, toEventStream as _i, HttpResponse as _n, UriReferenceStringSchema as _r, RequirementBehaviour as _t, ConsoleTracingSubscriber as a, JsonRpcErrorResponseMessage as ai, RecoverableStateStore as an, UriReferenceString as ar, RequirementPlannerHostOptions as at, OnceAsyncLockError as b, isClientErrorEvent as bi, TransportErrorCode as bn, POPUP_TRAIT_TOKEN as br, RequirementCandidateGenerator as bt, DefineInstrumentMethodDecoratorFactory as c, JsonRpcNotificationEvent as ci, StorageChangeEventOrigin as cn, UriRelativeParts as cr, provideRequirementPlannerHost as ct, InstrumentMethodThisResolver as d, JsonRpcRequestMessage as di, SyncStorageTrait as dn, UriString as dr, CheckAuthenticated as dt, CreateJsonRpcClientOptions as ei, EphemeralFlowStore as en, isCompatFragmentBlock as er, InjectRequirementPlannerHostOptions as et, defineInstrumentMethodDecorator as f, JsonRpcRequestOptions as fi, BaseTransportForStdFetchCreateOptions as fn, SECURITYDEPT_ROUTE_METADATA_KEY as fr, OnUnauthenticated as ft, RunOperationOptionsBase as g, ToEventStreamInput as gi, HttpRequest as gn, BaseURIStringSchema as gr, PlanStatus as gt, RunOperationOptions as h, JsonRpcSuccessResponseMessage as hi, BaseTransportTrait as hn, writeSecuritydeptRouteMetadata as hr, PipelineStepResult as ht, createTraceTimelineStore as i, JsonRpcErrorPayload as ii, REALM_STORAGE_TRAIT_TOKEN as in, UriParseError as ir, RequirementPlannerHostBehaviour as it, cancellationTokenToAbortSignal as j, decodeBase64ToUint8Array as ji, ValidationSuccess as jn, PopupClientWindowHandle as jr, StaticAttrsAuthRequirement as jt, createKeyedEphemeralFlowStore as k, promisesToRacedAsyncGenerator as ki, ValidationFailure as kn, PopupErrorCode as kr, RouteTreeSegment as kt, InstrumentMethodResolvedOptions as l, JsonRpcNotificationMessage as li, StorageTrait as ln, UriRelativeString as lr, AuthRequirement as lt, RunOperationEnvironment as m, JsonRpcServerTrait as mi, createBaseTransportForStdFetch as mn, readSecuritydeptRouteMetadata as mr, PipelineRunResult as mt, TraceTimelineEntry as n, CreateJsonRpcServerOptions as ni, PERSISTENT_STORAGE_TRAIT_TOKEN as nn, takeCompatFragment as nr, REQUIREMENT_PLANNER_HOST as nt, createConsoleTracingSubscriber as o, JsonRpcId as oi, SESSION_STORAGE_TRAIT_TOKEN as on, UriReferenceStringInput as or, defaultSelectCandidate as ot, OperationSpan as p, JsonRpcServerAndClientTrait as pi, FetchTransportRedirectKind as pn, SecuritydeptRouteMetadata as pr, PipelineOutcome as pt, IdentityPrincipal as q, CompatFragment as qn, ResourceError as qr, OperationTraceEventType as qt, TraceTimelineStore as r, JsonRpcClientTrait as ri, PersistentAuthStore as rn, UriFragmentPart as rr, RequirementPlannerHost as rt, DefineInstrumentMethodDecoratorContext as s, JsonRpcMessage as si, StorageChangeEvent as sn, UriReferenceStringLike as sr, injectRequirementPlannerHost as st, isLoopbackHttpUrl as t, CreateJsonRpcServerAndClientOptions as ti, KeyedEphemeralFlowStore as tn, parseCompatFragment as tr, ProvideRequirementPlannerHostOptions as tt, InstrumentMethodThisContext as u, JsonRpcRequestEvent as ui, StoredEnvelope as un, UriSearchParamsInit as ur, AuthenticatedCheck as ut, OnceAsyncLock as v, ClientErrorEvent as vi, HttpResponseJsonBody as vn, UriRelativeStringSchema as vr, RequirementBehaviourContext as vt, OnceAsyncLockSuccess as w, createEventSubject as wi, createAuthorizationInterceptedFetch as wn, PopupAttachSuccess as wr, RequirementsComposition as wt, OnceAsyncLockInit as x, createEmptyEventStream as xi, AuthorizationInterceptedFetchPredicate as xn, PopupAttachFailure as xr, RequirementCandidateSelectionContext as xt, OnceAsyncLockCallable as y, ExtractClientErrorEvent as yi, TRANSPORT_TRAIT_TOKEN as yn, UriStringSchema as yr, RequirementBehaviourWithRouteContext as yt, DecodeJwtPayloadOptions as z, RouterNavigationIntent as zn, ResourceSnapshotUpdate as zr, ENVIRONMENT_TOKEN as zt };
-//# sourceMappingURL=index-B9SEJGU2.d.mts.map
+//# sourceMappingURL=index-CbeZ3AfB.d.mts.map

package/dist/index.d.mts

@@ -1,3 +1,3 @@
 import { $ as ClientErrorContextFormatter, $t as SecuritydeptClassProvider, A as ResourceIdleSnapshot, At as SubscribableTrait, B as WritableSignalTrait, Bt as SYMBOL_DISPOSABLE_STACK, C as IdleCallbackTrait, Ct as EventStreamTrait, D as ComputedSignalTrait, Dt as InteropObservableTrait, E as TimestampProviderTrait, Et as RuntimeEventEnvelope, F as ResourceSnapshot, Ft as SecuritydeptInjector, G as formatClientErrorContext, Gt as injectDisposableStackFrom, H as CancellationTokenOptions, Ht as SimpleDisposableStack, I as ResourceStatus, It as AsyncDisposableTrait, J as describeError, Jt as inject, K as readErrorPresentationDescriptor, Kt as withDisposableStack, L as ResourceTrait, Lt as DisposableStackTrait, M as ResourceLoadingSnapshot, Mt as WithInteropObservableTraitCompat, N as ResourceReloadingSnapshot, Nt as isInteropObservableTrait, O as ReadableSignalTrait, Ot as ObserverTrait, P as ResourceResolvedSnapshot, Pt as INJECTOR_TOKEN, Q as ClientErrorFromUnknownOptions, Qt as SecuritydeptAbstractType, R as ResourceWhenValueOptions, Rt as DisposableTrait, S as IDLE_CALLBACK_TRAIT_TOKEN, St as EventSourceKind, T as TimeTrait, Tt as EventSubscriptionTrait, U as CancellationTokenSourceTrait, Ut as StdDisposableStack, V as CancelableHandle, Vt as SYMBOL_DISPOSE, W as CancellationTokenTrait, Wt as createDisposableStack, X as ClientError, Xt as tryInjectInInjectionContext, Y as CLIENT_ERROR_SPAN_ATTRIBUTE_PROVIDER_ID, Yt as runInInjectionContext, Z as ClientErrorFromHttpResponseOptions, Zt as SecurityDeptOptional, _t as SpanPathOptions, a as resourceFromSnapshots, an as SecuritydeptInjectorTrait, at as ErrorPresentationTone, b as createCancellationTokenSource, bt as EventOperatorFunction, cn as SecuritydeptValueProvider, ct as ServerErrorPresentation, dn as getSecuritydeptProviderToken, dt as SPAN_TRAIT_TOKEN, en as SecuritydeptDependencyDescriptor, et as ClientErrorKind, fn as notMissingProvider, ft as SpanAttributeReadOptions, gt as SpanNodeAttributes, ht as SpanCreateOptions, i as mapResource, in as SecuritydeptInjectionToken, it as ErrorPresentationDescriptor, j as ResourceLoadingErrorSnapshot, jt as SubscriptionTrait, k as ResourceErrorSnapshot, kt as SYMBOL_OBSERVABLE, ln as WithTraitDeps, lt as UserRecovery, mt as SpanAttributes, nn as SecuritydeptExistingProvider, nt as ClientErrorSpanContext, on as SecuritydeptProvider, ot as ErrorRecoveryActionDescriptor, pt as SpanAttributeValue, q as ErrorSummary, qt as SecuritydeptInjectOptions, rn as SecuritydeptFactoryProvider, rt as ErrorCodePresentation, sn as SecuritydeptTypeProvider, st as ReadErrorPresentationDescriptorOptions, tn as SecuritydeptDependencyToken, tt as ClientErrorSource, un as createProviderIfTokenMissing, ut as MutableSpanTrait, vt as SpanTrait, w as TIME_TRAIT_TOKEN, wt as EventSubjectTrait, x as isCancellationTokenTrait, xt as EventSource, y as createLinkedCancellationToken, yt as EventObserverTrait, zt as SYMBOL_ASYNC_DISPOSE } from "./index-CFAJ969E.mjs";
-import { $ as RequirementPlan, $n as appendOrReplaceCompatFragment, $r as createJsonRpcServerAndClient, $t as Codec, A as abortSignalToCancellationToken, Ai as Base64CompatErrorCode, An as ValidationResult, Ar as readPopupErrorPresentationDescriptor, At as SelectCandidate, B as JwtAudienceClaim, Bn as RouterNavigationMode, Br as ResourceSnapshotUpdateKind, Bt as EnvironmentValidators, C as OnceAsyncLockState, Ci as createEventStream, Cn as CreateAuthorizationInterceptedFetchOptions, Cr as PopupAttachResult, Ct as RequirementResolution, D as createJsonCodec, Di as PAGE_LIFECYCLE_TRAIT_TOKEN, Dn as TraitInputValidator, Dr as CreatePopupClientSessionOptions, Dt as RouteRequirementsDeclaration, E as createInMemoryRecordStore, Ei as abortSignalToEventStream, En as createTimeForStd, Er as PopupTrait, Et as RouteBehaviourContextExtra, F as parseDurationToMs, Fn as validateTraitInput, Fr as PopupServerWindowHandleTrait, Ft as isRouteStateSnapshotTrait, G as parseIdentityPrincipalWire, Gn as AppendOrReplaceCompatFragmentOptions, Gr as ResourceStreamContext, Gt as TracingSubscriberTrait, H as IdentityPrincipalSchema, Hn as RouterTrait, Hr as reduceResourceSnapshot, Ht as ServiceWorkerEnvironment, I as JwtDecodeError, In as validateWithSchema, Ir as PopupWindowHandleTrait, It as resolveEffectiveRequirements, J as ProjectIdentityPrincipalOptions, Jn as CompatFragmentParameters, Jr as ResourceErrorCode, Jt as TRACING_SPAN_ATTRIBUTE_PROVIDER_ID, K as projectIdentityPrincipal, Kn as AppendOrReplaceCompatFragmentResult, Kr as createResource, Kt as OperationSpanTrait, L as JwtDecodeErrorCode, Ln as validateWithSchemaSync, Lr as createSignal, Lt as CreateFoundationEnvironmentOptions, M as normalizeAbortError, Mi as encodeUint8ArrayToBase64, Mn as WithTraitInputValidator, Mr as PopupClientWindowHandleTrait, Mt as StaticAttrsAuthRequirementInput, N as createRootSpan, Ni as SecuritydeptDestroyRef, Nn as formatValidationFailure, Nr as PopupMessageChannelTrait, Nt as UnauthenticatedAction, O as createEphemeralFlowStore, Oi as PageLifecycleTrait, On as ValidateTraitInputOptions, Or as CreatePopupServerSessionOptions, Ot as RouteStateSnapshotTrait, P as SpanSharedAttributeName, Pi as createSecuritydeptDestroyRef, Pn as throwValidationClientError, Pr as PopupServerWindowHandle, Pt as isRouteBehaviourContextExtra, Q as BaseRequirementPlanner, Qn as UpdateUriFragmentHash, Qr as createJsonRpcServer, Qt as TracingTrait, R as decodeJwtPayload, Rn as ROUTER_TRAIT_TOKEN, Rr as readonlySignal, Rt as createFoundationEnvironment, S as OnceAsyncLockRunning, Si as createEventReplaySubject, Sn as AuthorizationSignal, Sr as PopupAttachFailureReason, St as RequirementPlannerError, T as createOnceAsyncLockCallable, Ti as createNeverEventStream, Tn as TimeForStdCreateOptions, Tr as PopupOpenOptions, Tt as ResolutionStatus, U as IdentityPrincipalWireSchema, Un as TakeCompatFragmentFromRouterOptions, Ur as whenResourceSnapshotValue, Ut as TracingCreateOptions, V as JwtClaimsSet, Vn as RouterNavigationRequest, Vr as flattenResourceSnapshot, Vt as FoundationEnvironment, W as parseIdentityPrincipal, Wn as takeCompatFragmentFromRouter, Wr as CreateResourceOptions, Wt as createTracing, X as RouteCompositionRequirementPlanner, Xn as TakeCompatFragmentOptions, Xr as createComputed, Xt as TracingEvent, Y as StaticRequirementPlanner, Yn as SECURITYDEPT_COMPAT_FRAGMENT_VERSION, Yr as ResourceValueUnavailableErrorOptions, Yt as TRACING_TRAIT_TOKEN, Z as MergeRequirementPlanner, Zn as TakeCompatFragmentResult, Zr as createJsonRpcClient, Zt as TracingLevel, _ as runOperation, _i as toEventStream, _n as HttpResponse, _r as UriReferenceStringSchema, _t as RequirementBehaviour, a as ConsoleTracingSubscriber, ai as JsonRpcErrorResponseMessage, an as RecoverableStateStore, ar as UriReferenceString, at as RequirementPlannerHostOptions, b as OnceAsyncLockError, bi as isClientErrorEvent, bn as TransportErrorCode, br as POPUP_TRAIT_TOKEN, bt as RequirementCandidateGenerator, c as DefineInstrumentMethodDecoratorFactory, ci as JsonRpcNotificationEvent, cn as StorageChangeEventOrigin, cr as UriRelativeParts, ct as provideRequirementPlannerHost, d as InstrumentMethodThisResolver, di as JsonRpcRequestMessage, dn as SyncStorageTrait, dr as UriString, dt as CheckAuthenticated, ei as CreateJsonRpcClientOptions, en as EphemeralFlowStore, er as isCompatFragmentBlock, et as InjectRequirementPlannerHostOptions, f as defineInstrumentMethodDecorator, fi as JsonRpcRequestOptions, fn as BaseTransportForStdFetchCreateOptions, fr as SECURITYDEPT_ROUTE_METADATA_KEY, ft as OnUnauthenticated, g as RunOperationOptionsBase, gi as ToEventStreamInput, gn as HttpRequest, gr as BaseURIStringSchema, gt as PlanStatus, h as RunOperationOptions, hi as JsonRpcSuccessResponseMessage, hn as BaseTransportTrait, hr as writeSecuritydeptRouteMetadata, ht as PipelineStepResult, i as createTraceTimelineStore, ii as JsonRpcErrorPayload, in as REALM_STORAGE_TRAIT_TOKEN, ir as UriParseError, it as RequirementPlannerHostBehaviour, j as cancellationTokenToAbortSignal, ji as decodeBase64ToUint8Array, jn as ValidationSuccess, jr as PopupClientWindowHandle, jt as StaticAttrsAuthRequirement, k as createKeyedEphemeralFlowStore, ki as promisesToRacedAsyncGenerator, kn as ValidationFailure, kr as PopupErrorCode, kt as RouteTreeSegment, l as InstrumentMethodResolvedOptions, li as JsonRpcNotificationMessage, ln as StorageTrait, lr as UriRelativeString, lt as AuthRequirement, m as RunOperationEnvironment, mi as JsonRpcServerTrait, mn as createBaseTransportForStdFetch, mr as readSecuritydeptRouteMetadata, mt as PipelineRunResult, n as TraceTimelineEntry, ni as CreateJsonRpcServerOptions, nn as PERSISTENT_STORAGE_TRAIT_TOKEN, nr as takeCompatFragment, nt as REQUIREMENT_PLANNER_HOST, o as createConsoleTracingSubscriber, oi as JsonRpcId, on as SESSION_STORAGE_TRAIT_TOKEN, or as UriReferenceStringInput, ot as defaultSelectCandidate, p as OperationSpan, pi as JsonRpcServerAndClientTrait, pn as FetchTransportRedirectKind, pr as SecuritydeptRouteMetadata, pt as PipelineOutcome, q as IdentityPrincipal, qn as CompatFragment, qr as ResourceError, qt as OperationTraceEventType, r as TraceTimelineStore, ri as JsonRpcClientTrait, rn as PersistentAuthStore, rr as UriFragmentPart, rt as RequirementPlannerHost, s as DefineInstrumentMethodDecoratorContext, si as JsonRpcMessage, sn as StorageChangeEvent, sr as UriReferenceStringLike, st as injectRequirementPlannerHost, t as isLoopbackHttpUrl, ti as CreateJsonRpcServerAndClientOptions, tn as KeyedEphemeralFlowStore, tr as parseCompatFragment, tt as ProvideRequirementPlannerHostOptions, u as InstrumentMethodThisContext, ui as JsonRpcRequestEvent, un as StoredEnvelope, ur as UriSearchParamsInit, ut as AuthenticatedCheck, v as OnceAsyncLock, vi as ClientErrorEvent, vn as HttpResponseJsonBody, vr as UriRelativeStringSchema, vt as RequirementBehaviourContext, w as OnceAsyncLockSuccess, wi as createEventSubject, wn as createAuthorizationInterceptedFetch, wr as PopupAttachSuccess, wt as RequirementsComposition, x as OnceAsyncLockInit, xi as createEmptyEventStream, xn as AuthorizationInterceptedFetchPredicate, xr as PopupAttachFailure, xt as RequirementCandidateSelectionContext, y as OnceAsyncLockCallable, yi as ExtractClientErrorEvent, yn as TRANSPORT_TRAIT_TOKEN, yr as UriStringSchema, yt as RequirementBehaviourWithRouteContext, z as DecodeJwtPayloadOptions, zn as RouterNavigationIntent, zr as ResourceSnapshotUpdate, zt as ENVIRONMENT_TOKEN } from "./index-B9SEJGU2.mjs";
+import { $ as RequirementPlan, $n as appendOrReplaceCompatFragment, $r as createJsonRpcServerAndClient, $t as Codec, A as abortSignalToCancellationToken, Ai as Base64CompatErrorCode, An as ValidationResult, Ar as readPopupErrorPresentationDescriptor, At as SelectCandidate, B as JwtAudienceClaim, Bn as RouterNavigationMode, Br as ResourceSnapshotUpdateKind, Bt as EnvironmentValidators, C as OnceAsyncLockState, Ci as createEventStream, Cn as CreateAuthorizationInterceptedFetchOptions, Cr as PopupAttachResult, Ct as RequirementResolution, D as createJsonCodec, Di as PAGE_LIFECYCLE_TRAIT_TOKEN, Dn as TraitInputValidator, Dr as CreatePopupClientSessionOptions, Dt as RouteRequirementsDeclaration, E as createInMemoryRecordStore, Ei as abortSignalToEventStream, En as createTimeForStd, Er as PopupTrait, Et as RouteBehaviourContextExtra, F as parseDurationToMs, Fn as validateTraitInput, Fr as PopupServerWindowHandleTrait, Ft as isRouteStateSnapshotTrait, G as parseIdentityPrincipalWire, Gn as AppendOrReplaceCompatFragmentOptions, Gr as ResourceStreamContext, Gt as TracingSubscriberTrait, H as IdentityPrincipalSchema, Hn as RouterTrait, Hr as reduceResourceSnapshot, Ht as ServiceWorkerEnvironment, I as JwtDecodeError, In as validateWithSchema, Ir as PopupWindowHandleTrait, It as resolveEffectiveRequirements, J as ProjectIdentityPrincipalOptions, Jn as CompatFragmentParameters, Jr as ResourceErrorCode, Jt as TRACING_SPAN_ATTRIBUTE_PROVIDER_ID, K as projectIdentityPrincipal, Kn as AppendOrReplaceCompatFragmentResult, Kr as createResource, Kt as OperationSpanTrait, L as JwtDecodeErrorCode, Ln as validateWithSchemaSync, Lr as createSignal, Lt as CreateFoundationEnvironmentOptions, M as normalizeAbortError, Mi as encodeUint8ArrayToBase64, Mn as WithTraitInputValidator, Mr as PopupClientWindowHandleTrait, Mt as StaticAttrsAuthRequirementInput, N as createRootSpan, Ni as SecuritydeptDestroyRef, Nn as formatValidationFailure, Nr as PopupMessageChannelTrait, Nt as UnauthenticatedAction, O as createEphemeralFlowStore, Oi as PageLifecycleTrait, On as ValidateTraitInputOptions, Or as CreatePopupServerSessionOptions, Ot as RouteStateSnapshotTrait, P as SpanSharedAttributeName, Pi as createSecuritydeptDestroyRef, Pn as throwValidationClientError, Pr as PopupServerWindowHandle, Pt as isRouteBehaviourContextExtra, Q as BaseRequirementPlanner, Qn as UpdateUriFragmentHash, Qr as createJsonRpcServer, Qt as TracingTrait, R as decodeJwtPayload, Rn as ROUTER_TRAIT_TOKEN, Rr as readonlySignal, Rt as createFoundationEnvironment, S as OnceAsyncLockRunning, Si as createEventReplaySubject, Sn as AuthorizationSignal, Sr as PopupAttachFailureReason, St as RequirementPlannerError, T as createOnceAsyncLockCallable, Ti as createNeverEventStream, Tn as TimeForStdCreateOptions, Tr as PopupOpenOptions, Tt as ResolutionStatus, U as IdentityPrincipalWireSchema, Un as TakeCompatFragmentFromRouterOptions, Ur as whenResourceSnapshotValue, Ut as TracingCreateOptions, V as JwtClaimsSet, Vn as RouterNavigationRequest, Vr as flattenResourceSnapshot, Vt as FoundationEnvironment, W as parseIdentityPrincipal, Wn as takeCompatFragmentFromRouter, Wr as CreateResourceOptions, Wt as createTracing, X as RouteCompositionRequirementPlanner, Xn as TakeCompatFragmentOptions, Xr as createComputed, Xt as TracingEvent, Y as StaticRequirementPlanner, Yn as SECURITYDEPT_COMPAT_FRAGMENT_VERSION, Yr as ResourceValueUnavailableErrorOptions, Yt as TRACING_TRAIT_TOKEN, Z as MergeRequirementPlanner, Zn as TakeCompatFragmentResult, Zr as createJsonRpcClient, Zt as TracingLevel, _ as runOperation, _i as toEventStream, _n as HttpResponse, _r as UriReferenceStringSchema, _t as RequirementBehaviour, a as ConsoleTracingSubscriber, ai as JsonRpcErrorResponseMessage, an as RecoverableStateStore, ar as UriReferenceString, at as RequirementPlannerHostOptions, b as OnceAsyncLockError, bi as isClientErrorEvent, bn as TransportErrorCode, br as POPUP_TRAIT_TOKEN, bt as RequirementCandidateGenerator, c as DefineInstrumentMethodDecoratorFactory, ci as JsonRpcNotificationEvent, cn as StorageChangeEventOrigin, cr as UriRelativeParts, ct as provideRequirementPlannerHost, d as InstrumentMethodThisResolver, di as JsonRpcRequestMessage, dn as SyncStorageTrait, dr as UriString, dt as CheckAuthenticated, ei as CreateJsonRpcClientOptions, en as EphemeralFlowStore, er as isCompatFragmentBlock, et as InjectRequirementPlannerHostOptions, f as defineInstrumentMethodDecorator, fi as JsonRpcRequestOptions, fn as BaseTransportForStdFetchCreateOptions, fr as SECURITYDEPT_ROUTE_METADATA_KEY, ft as OnUnauthenticated, g as RunOperationOptionsBase, gi as ToEventStreamInput, gn as HttpRequest, gr as BaseURIStringSchema, gt as PlanStatus, h as RunOperationOptions, hi as JsonRpcSuccessResponseMessage, hn as BaseTransportTrait, hr as writeSecuritydeptRouteMetadata, ht as PipelineStepResult, i as createTraceTimelineStore, ii as JsonRpcErrorPayload, in as REALM_STORAGE_TRAIT_TOKEN, ir as UriParseError, it as RequirementPlannerHostBehaviour, j as cancellationTokenToAbortSignal, ji as decodeBase64ToUint8Array, jn as ValidationSuccess, jr as PopupClientWindowHandle, jt as StaticAttrsAuthRequirement, k as createKeyedEphemeralFlowStore, ki as promisesToRacedAsyncGenerator, kn as ValidationFailure, kr as PopupErrorCode, kt as RouteTreeSegment, l as InstrumentMethodResolvedOptions, li as JsonRpcNotificationMessage, ln as StorageTrait, lr as UriRelativeString, lt as AuthRequirement, m as RunOperationEnvironment, mi as JsonRpcServerTrait, mn as createBaseTransportForStdFetch, mr as readSecuritydeptRouteMetadata, mt as PipelineRunResult, n as TraceTimelineEntry, ni as CreateJsonRpcServerOptions, nn as PERSISTENT_STORAGE_TRAIT_TOKEN, nr as takeCompatFragment, nt as REQUIREMENT_PLANNER_HOST, o as createConsoleTracingSubscriber, oi as JsonRpcId, on as SESSION_STORAGE_TRAIT_TOKEN, or as UriReferenceStringInput, ot as defaultSelectCandidate, p as OperationSpan, pi as JsonRpcServerAndClientTrait, pn as FetchTransportRedirectKind, pr as SecuritydeptRouteMetadata, pt as PipelineOutcome, q as IdentityPrincipal, qn as CompatFragment, qr as ResourceError, qt as OperationTraceEventType, r as TraceTimelineStore, ri as JsonRpcClientTrait, rn as PersistentAuthStore, rr as UriFragmentPart, rt as RequirementPlannerHost, s as DefineInstrumentMethodDecoratorContext, si as JsonRpcMessage, sn as StorageChangeEvent, sr as UriReferenceStringLike, st as injectRequirementPlannerHost, t as isLoopbackHttpUrl, ti as CreateJsonRpcServerAndClientOptions, tn as KeyedEphemeralFlowStore, tr as parseCompatFragment, tt as ProvideRequirementPlannerHostOptions, u as InstrumentMethodThisContext, ui as JsonRpcRequestEvent, un as StoredEnvelope, ur as UriSearchParamsInit, ut as AuthenticatedCheck, v as OnceAsyncLock, vi as ClientErrorEvent, vn as HttpResponseJsonBody, vr as UriRelativeStringSchema, vt as RequirementBehaviourContext, w as OnceAsyncLockSuccess, wi as createEventSubject, wn as createAuthorizationInterceptedFetch, wr as PopupAttachSuccess, wt as RequirementsComposition, x as OnceAsyncLockInit, xi as createEmptyEventStream, xn as AuthorizationInterceptedFetchPredicate, xr as PopupAttachFailure, xt as RequirementCandidateSelectionContext, y as OnceAsyncLockCallable, yi as ExtractClientErrorEvent, yn as TRANSPORT_TRAIT_TOKEN, yr as UriStringSchema, yt as RequirementBehaviourWithRouteContext, z as DecodeJwtPayloadOptions, zn as RouterNavigationIntent, zr as ResourceSnapshotUpdate, zt as ENVIRONMENT_TOKEN } from "./index-CbeZ3AfB.mjs";
 export { type AppendOrReplaceCompatFragmentOptions, type AppendOrReplaceCompatFragmentResult, type AsyncDisposableTrait, type AuthRequirement, type AuthenticatedCheck, type AuthorizationInterceptedFetchPredicate, type AuthorizationSignal, Base64CompatErrorCode, BaseRequirementPlanner, type BaseTransportForStdFetchCreateOptions, type BaseTransportTrait, BaseURIStringSchema, CLIENT_ERROR_SPAN_ATTRIBUTE_PROVIDER_ID, type CancelableHandle, type CancellationTokenOptions, type CancellationTokenSourceTrait, type CancellationTokenTrait, type CheckAuthenticated, ClientError, type ClientErrorContextFormatter, type ClientErrorEvent, type ClientErrorFromHttpResponseOptions, type ClientErrorFromUnknownOptions, ClientErrorKind, ClientErrorSource, type ClientErrorSpanContext, type Codec, type CompatFragment, type CompatFragmentParameters, type ComputedSignalTrait, ConsoleTracingSubscriber, type CreateAuthorizationInterceptedFetchOptions, type CreateFoundationEnvironmentOptions, type CreateJsonRpcClientOptions, type CreateJsonRpcServerAndClientOptions, type CreateJsonRpcServerOptions, type CreatePopupClientSessionOptions, type CreatePopupServerSessionOptions, type CreateResourceOptions, type DecodeJwtPayloadOptions, type DefineInstrumentMethodDecoratorContext, type DefineInstrumentMethodDecoratorFactory, type DisposableStackTrait, type DisposableTrait, ENVIRONMENT_TOKEN, type EnvironmentValidators, type EphemeralFlowStore, type ErrorCodePresentation, type ErrorPresentationDescriptor, ErrorPresentationTone, type ErrorRecoveryActionDescriptor, type ErrorSummary, type EventObserverTrait, type EventOperatorFunction, type EventSource, EventSourceKind, type EventStreamTrait, type EventSubjectTrait, type EventSubscriptionTrait, type ExtractClientErrorEvent, FetchTransportRedirectKind, type FoundationEnvironment, type HttpRequest, type HttpResponse, type HttpResponseJsonBody, IDLE_CALLBACK_TRAIT_TOKEN, INJECTOR_TOKEN, type IdentityPrincipal, IdentityPrincipalSchema, IdentityPrincipalWireSchema, type IdleCallbackTrait, type InjectRequirementPlannerHostOptions, type InstrumentMethodResolvedOptions, type InstrumentMethodThisContext, type InstrumentMethodThisResolver, type InteropObservableTrait, type JsonRpcClientTrait, type JsonRpcErrorPayload, type JsonRpcErrorResponseMessage, type JsonRpcId, type JsonRpcMessage, type JsonRpcNotificationEvent, type JsonRpcNotificationMessage, type JsonRpcRequestEvent, type JsonRpcRequestMessage, type JsonRpcRequestOptions, type JsonRpcServerAndClientTrait, type JsonRpcServerTrait, type JsonRpcSuccessResponseMessage, type JwtAudienceClaim, type JwtClaimsSet, JwtDecodeError, JwtDecodeErrorCode, type KeyedEphemeralFlowStore, MergeRequirementPlanner, type MutableSpanTrait, type ObserverTrait, type OnUnauthenticated, type OnceAsyncLock, type OnceAsyncLockCallable, type OnceAsyncLockError, type OnceAsyncLockInit, type OnceAsyncLockRunning, OnceAsyncLockState, type OnceAsyncLockSuccess, OperationSpan, type OperationSpanTrait, OperationTraceEventType, PAGE_LIFECYCLE_TRAIT_TOKEN, PERSISTENT_STORAGE_TRAIT_TOKEN, POPUP_TRAIT_TOKEN, type PageLifecycleTrait, type PersistentAuthStore, PipelineOutcome, type PipelineRunResult, type PipelineStepResult, PlanStatus, type PopupAttachFailure, PopupAttachFailureReason, type PopupAttachResult, type PopupAttachSuccess, PopupClientWindowHandle, type PopupClientWindowHandleTrait, PopupErrorCode, type PopupMessageChannelTrait, type PopupOpenOptions, PopupServerWindowHandle, type PopupServerWindowHandleTrait, type PopupTrait, type PopupWindowHandleTrait, type ProjectIdentityPrincipalOptions, type ProvideRequirementPlannerHostOptions, REALM_STORAGE_TRAIT_TOKEN, REQUIREMENT_PLANNER_HOST, ROUTER_TRAIT_TOKEN, type ReadErrorPresentationDescriptorOptions, type ReadableSignalTrait, type RecoverableStateStore, type RequirementBehaviour, type RequirementBehaviourContext, type RequirementBehaviourWithRouteContext, type RequirementCandidateGenerator, type RequirementCandidateSelectionContext, type RequirementPlan, RequirementPlannerError, RequirementPlannerHost, type RequirementPlannerHostBehaviour, type RequirementPlannerHostOptions, type RequirementResolution, RequirementsComposition, ResolutionStatus, ResourceError, ResourceErrorCode, type ResourceErrorSnapshot, type ResourceIdleSnapshot, type ResourceLoadingErrorSnapshot, type ResourceLoadingSnapshot, type ResourceReloadingSnapshot, type ResourceResolvedSnapshot, type ResourceSnapshot, type ResourceSnapshotUpdate, ResourceSnapshotUpdateKind, ResourceStatus, type ResourceStreamContext, type ResourceTrait, type ResourceValueUnavailableErrorOptions, type ResourceWhenValueOptions, type RouteBehaviourContextExtra, RouteCompositionRequirementPlanner, type RouteRequirementsDeclaration, type RouteStateSnapshotTrait, type RouteTreeSegment, RouterNavigationIntent, RouterNavigationMode, type RouterNavigationRequest, type RouterTrait, type RunOperationEnvironment, type RunOperationOptions, type RunOperationOptionsBase, type RuntimeEventEnvelope, SECURITYDEPT_COMPAT_FRAGMENT_VERSION, SECURITYDEPT_ROUTE_METADATA_KEY, SESSION_STORAGE_TRAIT_TOKEN, SPAN_TRAIT_TOKEN, SYMBOL_ASYNC_DISPOSE, SYMBOL_DISPOSABLE_STACK, SYMBOL_DISPOSE, SYMBOL_OBSERVABLE, SecurityDeptOptional, type SecuritydeptAbstractType, type SecuritydeptClassProvider, type SecuritydeptDependencyDescriptor, type SecuritydeptDependencyToken, SecuritydeptDestroyRef, type SecuritydeptExistingProvider, type SecuritydeptFactoryProvider, type SecuritydeptInjectOptions, SecuritydeptInjectionToken, SecuritydeptInjector, type SecuritydeptInjectorTrait, type SecuritydeptProvider, type SecuritydeptRouteMetadata, type SecuritydeptTypeProvider, type SecuritydeptValueProvider, type SelectCandidate, type ServerErrorPresentation, type ServiceWorkerEnvironment, SimpleDisposableStack, type SpanAttributeReadOptions, type SpanAttributeValue, type SpanAttributes, type SpanCreateOptions, type SpanNodeAttributes, type SpanPathOptions, SpanSharedAttributeName, type SpanTrait, StaticAttrsAuthRequirement, type StaticAttrsAuthRequirementInput, StaticRequirementPlanner, StdDisposableStack, type StorageChangeEvent, StorageChangeEventOrigin, type StorageTrait, type StoredEnvelope, type SubscribableTrait, type SubscriptionTrait, type SyncStorageTrait, TIME_TRAIT_TOKEN, TRACING_SPAN_ATTRIBUTE_PROVIDER_ID, TRACING_TRAIT_TOKEN, TRANSPORT_TRAIT_TOKEN, type TakeCompatFragmentFromRouterOptions, type TakeCompatFragmentOptions, type TakeCompatFragmentResult, type TimeForStdCreateOptions, type TimeTrait, type TimestampProviderTrait, type ToEventStreamInput, type TraceTimelineEntry, TraceTimelineStore, type TracingCreateOptions, type TracingEvent, TracingLevel, type TracingSubscriberTrait, type TracingTrait, type TraitInputValidator, TransportErrorCode, type UnauthenticatedAction, type UpdateUriFragmentHash, type UriFragmentPart, UriParseError, UriReferenceString, type UriReferenceStringInput, type UriReferenceStringLike, UriReferenceStringSchema, type UriRelativeParts, UriRelativeString, UriRelativeStringSchema, type UriSearchParamsInit, UriString, UriStringSchema, UserRecovery, type ValidateTraitInputOptions, type ValidationFailure, type ValidationResult, type ValidationSuccess, type WithInteropObservableTraitCompat, type WithTraitDeps, type WithTraitInputValidator, type WritableSignalTrait, abortSignalToCancellationToken, abortSignalToEventStream, appendOrReplaceCompatFragment, cancellationTokenToAbortSignal, createAuthorizationInterceptedFetch, createBaseTransportForStdFetch, createCancellationTokenSource, createComputed, createConsoleTracingSubscriber, createDisposableStack, createEmptyEventStream, createEphemeralFlowStore, createEventReplaySubject, createEventStream, createEventSubject, createFoundationEnvironment, createInMemoryRecordStore, createJsonCodec, createJsonRpcClient, createJsonRpcServer, createJsonRpcServerAndClient, createKeyedEphemeralFlowStore, createLinkedCancellationToken, createNeverEventStream, createOnceAsyncLockCallable, createProviderIfTokenMissing, createResource, createRootSpan, createSecuritydeptDestroyRef, createSignal, createTimeForStd, createTraceTimelineStore, createTracing, decodeBase64ToUint8Array, decodeJwtPayload, defaultSelectCandidate, defineInstrumentMethodDecorator, describeError, encodeUint8ArrayToBase64, flattenResourceSnapshot, formatClientErrorContext, formatValidationFailure, getSecuritydeptProviderToken, inject, injectDisposableStackFrom, injectRequirementPlannerHost, isCancellationTokenTrait, isClientErrorEvent, isCompatFragmentBlock, isInteropObservableTrait, isLoopbackHttpUrl, isRouteBehaviourContextExtra, isRouteStateSnapshotTrait, mapResource, normalizeAbortError, notMissingProvider, parseCompatFragment, parseDurationToMs, parseIdentityPrincipal, parseIdentityPrincipalWire, projectIdentityPrincipal, promisesToRacedAsyncGenerator, provideRequirementPlannerHost, readErrorPresentationDescriptor, readPopupErrorPresentationDescriptor, readSecuritydeptRouteMetadata, readonlySignal, reduceResourceSnapshot, resolveEffectiveRequirements, resourceFromSnapshots, runInInjectionContext, runOperation, takeCompatFragment, takeCompatFragmentFromRouter, throwValidationClientError, toEventStream, tryInjectInInjectionContext, validateTraitInput, validateWithSchema, validateWithSchemaSync, whenResourceSnapshotValue, withDisposableStack, writeSecuritydeptRouteMetadata };

package/dist/index.mjs

@@ -7,7 +7,6 @@ import { inject as inject$1, runInInjectionContext as runInInjectionContext$1 }
 import { EMPTY, NEVER, ReplaySubject, filter, from, merge, take, takeUntil } from "rxjs";
 import { type } from "arktype";
 import { isPromise } from "es-toolkit/predicate";
-import { Queue } from "mnemonist";
 //#region src/auth-coordination/contract.ts
 var StaticAttrsAuthRequirement = class StaticAttrsAuthRequirement {
 	id;
@@ -472,6 +471,40 @@ function createConsoleTracingSubscriber() {
 	return new ConsoleTracingSubscriber();
 }
 //#endregion
+//#region src/struct/ring-buffer.ts
+var FixedCapacityRingBuffer = class {
+	capacity;
+	values;
+	head = 0;
+	tail = 0;
+	_size = 0;
+	constructor(capacity) {
+		this.capacity = capacity;
+		if (!Number.isInteger(capacity) || capacity <= 0) throw new RangeError("Ring buffer capacity must be a positive integer.");
+		this.values = new Array(capacity);
+	}
+	get size() {
+		return this._size;
+	}
+	append(value) {
+		this.values[this.tail] = value;
+		this.tail = (this.tail + 1) % this.capacity;
+		if (this._size === this.capacity) this.head = this.tail;
+		else this._size += 1;
+	}
+	toArray() {
+		const snapshot = new Array(this._size);
+		for (let index = 0; index < this._size; index += 1) snapshot[index] = this.values[(this.head + index) % this.capacity];
+		return snapshot;
+	}
+	clear() {
+		this.values.fill(void 0);
+		this.head = 0;
+		this.tail = 0;
+		this._size = 0;
+	}
+};
+//#endregion
 //#region src/tracing/subscriber/timeline-store.ts
 /**
 * Bounded subscriber-side trace timeline.
@@ -483,10 +516,11 @@ function createConsoleTracingSubscriber() {
 var TraceTimelineStore = class {
 	limit;
 	nextId = 1;
-	timeline = new Queue();
+	timeline;
 	latestEntrySubject = new RxEventSubject();
 	constructor(limit = 200) {
 		this.limit = limit;
+		this.timeline = new FixedCapacityRingBuffer(limit);
 	}
 	get latestEntry() {
 		return this.latestEntrySubject;
@@ -506,8 +540,7 @@ var TraceTimelineStore = class {
 			},
 			spanAttributes: span.getRootToNodeAttributes({ providerId: TRACING_SPAN_ATTRIBUTE_PROVIDER_ID })
 		};
-		this.timeline.enqueue(entry);
-		if (this.timeline.size > this.limit) this.timeline.dequeue();
+		this.timeline.append(entry);
 		this.latestEntrySubject.next(entry);
 	}
 	clear() {

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["uuidv7","runtimeInject","runtimeRunInInjectionContext","defineType","defineType"],"sources":["../src/auth-coordination/contract.ts","../src/errors/error-attributes.ts","../src/compat/base64.ts","../src/compat/generator.ts","../src/injection/context.ts","../src/injection/destroy.ts","../src/validation/schemas/uri.ts","../src/cancellation/linked.ts","../src/signals/computed.ts","../src/signals/resource.ts","../src/router/metadata.ts","../src/std/transport/authorization-interceptor.ts","../src/tracing/operation-runner.ts","../src/tracing/operation-method.ts","../src/tracing/subscriber/console.ts","../src/tracing/subscriber/timeline-store.ts","../src/auth-coordination/planner-host.ts","../src/auth-coordination/planner/base-planner.ts","../src/auth-coordination/planner/merge-planner.ts","../src/auth-coordination/planner/route-composition-planner.ts","../src/auth-coordination/planner/static-planner.ts","../src/events/create.ts","../src/events/error.ts","../src/events/interop.ts","../src/identity/schemas.ts","../src/identity/parsers.ts","../src/protocol/jwt/error.ts","../src/protocol/jwt/decode.ts","../src/scheduling/duration.ts","../src/storage/json-codec.ts","../src/storage/ephemeral-flow-store.ts","../src/struct/async-lock.ts","../src/transport/url.ts"],"sourcesContent":["// Auth coordination contracts — serializable types and pure composition helpers\n//\n// Canonical public export: @securitydept/client\n//\n// This module owns the headless, framework-agnostic vocabulary shared across\n// the requirement planner host and planner variants:\n//   - AuthRequirement declarations (serializable)\n//   - Resolution / status value domains\n//   - Behaviour callback signatures (implemented by RequirementPlannerHost)\n//   - Route composition strategy and the pure folding function\n//   - Pipeline result shapes\n//\n// It contains no runtime coordination logic — only types, value constants,\n// frozen factories, and the side-effect-free composition function.\n\nimport { v7 as uuidv7 } from \"uuid\";\nimport { type FoundationEnvironment } from \"../environment\";\n\n// ---------------------------------------------------------------------------\n// Requirement declaration\n// ---------------------------------------------------------------------------\nexport interface AuthRequirement {\n\t/** Unique entity id for this requirement within the plan. */\n\treadonly id: string;\n\t/** Human-readable label (for logging / debugging). */\n\treadonly label?: string;\n}\n\nexport interface StaticAttrsAuthRequirementInput<\n\tTAttributes = Record<string, unknown>,\n> {\n\treadonly id?: string;\n\treadonly label?: string;\n\treadonly attributes?: TAttributes;\n}\n\nexport class StaticAttrsAuthRequirement<TAttributes = Record<string, unknown>>\n\timplements AuthRequirement\n{\n\tprotected constructor(\n\t\treadonly id: string,\n\t\treadonly label: string | undefined,\n\t\treadonly attributes: TAttributes | undefined,\n\t) {\n\t\tObject.freeze(this);\n\t}\n\n\tpublic static create<TAttributes = Record<string, unknown>>(\n\t\tinput?: StaticAttrsAuthRequirementInput<TAttributes>,\n\t): StaticAttrsAuthRequirement<TAttributes> {\n\t\treturn new StaticAttrsAuthRequirement<TAttributes>(\n\t\t\tinput?.id ?? uuidv7(),\n\t\t\tinput?.label,\n\t\t\tinput?.attributes ? Object.freeze(input.attributes) : undefined,\n\t\t);\n\t}\n\n\tpublic static createList<TAttributes = Record<string, unknown>>(\n\t\tinputs: readonly StaticAttrsAuthRequirementInput<TAttributes>[],\n\t): readonly StaticAttrsAuthRequirement<TAttributes>[] {\n\t\treturn inputs.map((input) => StaticAttrsAuthRequirement.create(input));\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Resolution and status\n// ---------------------------------------------------------------------------\n\n/** Outcome of resolving a single requirement. */\nexport const ResolutionStatus = {\n\tFulfilled: \"fulfilled\",\n\tFailed: \"failed\",\n\tSkipped: \"skipped\",\n} as const;\n\nexport type ResolutionStatus =\n\t(typeof ResolutionStatus)[keyof typeof ResolutionStatus];\n\n/** The resolution result for a single requirement. */\nexport interface RequirementResolution {\n\t/** The requirement ID this resolution applies to. */\n\trequirementId: string;\n\t/** Outcome status. */\n\tstatus: ResolutionStatus;\n\t/** Optional error or reason for failure/skip. */\n\treason?: string;\n}\n\n/** Overall plan status. */\nexport const PlanStatus = {\n\t/** There are still pending requirements. */\n\tPending: \"pending\",\n\t/** All requirements have been resolved. */\n\tSettled: \"settled\",\n} as const;\n\nexport type PlanStatus = (typeof PlanStatus)[keyof typeof PlanStatus];\n\n/** Error thrown when a planner contract is violated (e.g. duplicate ids). */\nexport class RequirementPlannerError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"RequirementPlannerError\";\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Behaviour callbacks (implemented by RequirementPlannerHost)\n// ---------------------------------------------------------------------------\n\n/** Result of an authentication check. */\nexport type AuthenticatedCheck = boolean | Promise<boolean>;\n\n/**\n * Return value of an unauthenticated handler.\n *\n * - `true` — the requirement is now satisfied (resolved as fulfilled);\n *   the pipeline records the resolution and may continue.\n * - `false` — block: the requirement cannot proceed.\n * - `string` — redirect to the given location.\n * - A never-settling `Promise` — used when a full-page external redirect has\n *   started; the step intentionally never resolves so the host navigation is\n *   not finalized while the page is leaving.\n */\nexport type UnauthenticatedAction =\n\t| boolean\n\t| string\n\t| Promise<boolean | string>;\n\n/**\n * Behaviour evaluation context handed to every behaviour callback.\n *\n * Reflects the planner state at the moment the callback is invoked.\n */\nexport type RequirementBehaviourContext<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = {\n\treadonly planContext: TPlanContext;\n\treadonly environment: FoundationEnvironment;\n\t/** The full effective requirement list for the active plan. */\n\treadonly requirements: readonly TAuthRequirement[];\n\t/** Resolutions collected so far (in requirement order). */\n\treadonly resolutionList: readonly RequirementResolution[];\n};\n\n/** Stream of unauthenticated requirements discovered by the planner. */\nexport type RequirementCandidateGenerator<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> = AsyncGenerator<TAuthRequirement, void, unknown>;\n\n/**\n * Context handed to candidate selection.\n *\n * `candidateList` is intentionally a stream: selectors that can act on the\n * first available unauthenticated requirement do not need to wait for all\n * checks to complete, while chooser-style selectors can still collect the full\n * stream with `for await`.\n */\nexport type RequirementCandidateSelectionContext<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = RequirementBehaviourContext<TAuthRequirement, TPlanContext> & {\n\t/** Requirements not yet satisfied, yielded as their checks complete. */\n\treadonly candidateList: RequirementCandidateGenerator<TAuthRequirement>;\n};\n\n/** Decide whether a single requirement is already satisfied. */\nexport type CheckAuthenticated<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = (\n\trequirement: TAuthRequirement,\n\tcontext: RequirementBehaviourContext<TAuthRequirement, TPlanContext>,\n) => AuthenticatedCheck;\n\n/** Decide what to do when a selected requirement is unauthenticated. */\nexport type OnUnauthenticated<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = (\n\trequirement: TAuthRequirement,\n\tcontext: RequirementBehaviourContext<TAuthRequirement, TPlanContext>,\n) => UnauthenticatedAction;\n\n/**\n * Reduce the candidate set to the single requirement to act on next.\n *\n * The default strategy picks the first unauthenticated candidate yielded by the\n * stream. Chooser-style strategies may collect the full stream when they need\n * a complete candidate set.\n */\nexport type SelectCandidate<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = (\n\tcontext: RequirementCandidateSelectionContext<TAuthRequirement, TPlanContext>,\n) => TAuthRequirement | undefined | Promise<TAuthRequirement | undefined>;\n\n/** The full behaviour contract resolved by a planner host. */\nexport interface RequirementBehaviour<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> {\n\tcheckAuthenticated: CheckAuthenticated<TAuthRequirement, TPlanContext>;\n\tonUnauthenticated: OnUnauthenticated<TAuthRequirement, TPlanContext>;\n\tselectCandidate: SelectCandidate<TAuthRequirement, TPlanContext>;\n}\n\nexport interface RouteStateSnapshotTrait {\n\treadonly url: string;\n}\n\nexport interface RouteBehaviourContextExtra {\n\treadonly routeState: RouteStateSnapshotTrait;\n}\n\nexport function isRouteStateSnapshotTrait(\n\tvalue: unknown,\n): value is RouteStateSnapshotTrait {\n\treturn typeof value === \"object\" && value !== null && \"url\" in value;\n}\n\nexport function isRouteBehaviourContextExtra(\n\tvalue: unknown,\n): value is RouteBehaviourContextExtra {\n\treturn (\n\t\ttypeof value === \"object\" &&\n\t\tvalue !== null &&\n\t\t\"routeState\" in value &&\n\t\tisRouteStateSnapshotTrait(value.routeState)\n\t);\n}\n\nexport type RequirementBehaviourWithRouteContext<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> = RequirementBehaviour<TAuthRequirement, RouteBehaviourContextExtra>;\n\n// ---------------------------------------------------------------------------\n// Pipeline results\n// ---------------------------------------------------------------------------\n\n/** Outcome of a pipeline step or run. */\nexport const PipelineOutcome = {\n\t/** No candidates remain — the plan is satisfied. */\n\tSettled: \"settled\",\n\t/** A candidate was resolved as fulfilled; more may remain. */\n\tResolved: \"resolved\",\n\t/** A candidate's handler blocked progress. */\n\tBlocked: \"blocked\",\n\t/** A candidate's handler requested a redirect. */\n\tRedirect: \"redirect\",\n} as const;\n\nexport type PipelineOutcome =\n\t(typeof PipelineOutcome)[keyof typeof PipelineOutcome];\n\n/** Result of a single {@link BaseRequirementPlanner.runStep}. */\nexport type PipelineStepResult<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> =\n\t| { outcome: typeof PipelineOutcome.Settled }\n\t| { outcome: typeof PipelineOutcome.Resolved; requirement: TAuthRequirement }\n\t| { outcome: typeof PipelineOutcome.Blocked; requirement: TAuthRequirement }\n\t| {\n\t\t\toutcome: typeof PipelineOutcome.Redirect;\n\t\t\trequirement: TAuthRequirement;\n\t\t\tlocation: string;\n\t  };\n\n/** Result of {@link BaseRequirementPlanner.runUntilSettled}. */\nexport type PipelineRunResult<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> =\n\t| {\n\t\t\toutcome: typeof PipelineOutcome.Settled;\n\t\t\tresolutions: readonly RequirementResolution[];\n\t  }\n\t| { outcome: typeof PipelineOutcome.Blocked; requirement: TAuthRequirement }\n\t| {\n\t\t\toutcome: typeof PipelineOutcome.Redirect;\n\t\t\trequirement: TAuthRequirement;\n\t\t\tlocation: string;\n\t  };\n\n// ---------------------------------------------------------------------------\n// Route composition\n// ---------------------------------------------------------------------------\n\n/**\n * How a route segment's requirements compose with the inherited parent chain.\n *\n * - `inherit` — keep the parent requirements unchanged (segment adds nothing)\n * - `merge` — inherit parent requirements, then append/override with the\n *   segment's own (same-id entries replace the parent's)\n * - `replace` — discard the parent chain, use only the segment's requirements\n */\nexport const RequirementsComposition = {\n\tInherit: \"inherit\",\n\tMerge: \"merge\",\n\tReplace: \"replace\",\n} as const;\n\nexport type RequirementsComposition =\n\t(typeof RequirementsComposition)[keyof typeof RequirementsComposition];\n\n/** A single node in a matched route chain. */\nexport interface RouteTreeSegment<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> {\n\t/** Route segment identifier (e.g. route name or path pattern). */\n\trouteId: string;\n\t/** Auth requirements declared on this route segment. */\n\trequirements: readonly TAuthRequirement[];\n\t/** Composition strategy against the inherited chain. Defaults to `merge`. */\n\tcomposition?: RequirementsComposition;\n}\n\n/** A requirements declaration annotated with its composition strategy. */\nexport interface RouteRequirementsDeclaration<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> {\n\tcomposition: RequirementsComposition;\n\trequirements: readonly TAuthRequirement[];\n}\n\n/**\n * Apply a route requirements declaration onto an effective requirement map.\n *\n * Reuse `effective` across a route chain so merge/replace fold in O(total\n * requirements) without rebuilding parent state each segment. When omitted, a\n * fresh map is created for one-shot composition.\n */\nexport function resolveEffectiveRequirements<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n>(\n\tchild: RouteRequirementsDeclaration<TAuthRequirement>,\n\teffective: Map<string, TAuthRequirement> = new Map(),\n): Map<string, TAuthRequirement> {\n\tswitch (child.composition) {\n\t\tcase RequirementsComposition.Inherit:\n\t\t\treturn effective;\n\n\t\tcase RequirementsComposition.Merge:\n\t\t\tfor (const requirement of child.requirements) {\n\t\t\t\teffective.set(requirement.id, requirement);\n\t\t\t}\n\t\t\treturn effective;\n\n\t\tcase RequirementsComposition.Replace:\n\t\t\teffective.clear();\n\t\t\tfor (const requirement of child.requirements) {\n\t\t\t\teffective.set(requirement.id, requirement);\n\t\t\t}\n\t\t\treturn effective;\n\n\t\tdefault: {\n\t\t\tconst _exhaustive: never = child.composition;\n\t\t\tthrow new RequirementPlannerError(\n\t\t\t\t`Unknown requirements composition: ${String(_exhaustive)}`,\n\t\t\t);\n\t\t}\n\t}\n}\n","import { ClientError } from \"./client-error\";\nimport { type ClientErrorKind, type UserRecovery } from \"./types\";\n\nexport interface ErrorSummary {\n\terrorName: string;\n\terrorKind?: ClientErrorKind;\n\terrorCode?: string;\n\trecovery?: UserRecovery;\n}\n\n/** Extract secret-safe diagnostic attributes without copying runtime messages. */\nexport function describeError(error: unknown): ErrorSummary {\n\tif (error instanceof ClientError) {\n\t\treturn {\n\t\t\terrorName: error.name,\n\t\t\terrorKind: error.kind,\n\t\t\terrorCode: error.code,\n\t\t\trecovery: error.recovery,\n\t\t};\n\t}\n\n\treturn {\n\t\terrorName: error instanceof Error ? error.name : typeof error,\n\t};\n}\n","import { ClientError, ClientErrorKind } from \"../errors\";\n\nexport const Base64CompatErrorCode = {\n\tEncoderUnavailable: \"compat.base64.encoder_unavailable\",\n\tDecoderUnavailable: \"compat.base64.decoder_unavailable\",\n} as const;\n\nexport type Base64CompatErrorCode =\n\t(typeof Base64CompatErrorCode)[keyof typeof Base64CompatErrorCode];\n\ntype Uint8ArrayConstructorWithBase64 = typeof Uint8Array & {\n\treadonly prototype: Uint8Array & {\n\t\ttoBase64?: () => string;\n\t};\n\tfromBase64?: (value: string) => Uint8Array;\n};\n\ninterface BufferConstructorLike {\n\tfrom(value: Uint8Array): { toString(encoding: \"base64\"): string };\n\tfrom(value: string, encoding: \"base64\"): Uint8Array;\n}\n\nexport function encodeUint8ArrayToBase64(value: Uint8Array): string {\n\tconst Uint8ArrayConstructor =\n\t\tglobalThis.Uint8Array as Uint8ArrayConstructorWithBase64;\n\tconst toBase64 = Uint8ArrayConstructor.prototype.toBase64;\n\tif (typeof toBase64 === \"function\") {\n\t\treturn toBase64.call(value);\n\t}\n\n\tif (typeof globalThis.btoa === \"function\") {\n\t\tlet binary = \"\";\n\t\tfor (const byte of value) {\n\t\t\tbinary += String.fromCharCode(byte);\n\t\t}\n\t\treturn globalThis.btoa(binary);\n\t}\n\n\tconst BufferConstructor = Reflect.get(globalThis, \"Buffer\") as\n\t\t| BufferConstructorLike\n\t\t| undefined;\n\tif (typeof BufferConstructor?.from === \"function\") {\n\t\treturn BufferConstructor.from(value).toString(\"base64\");\n\t}\n\n\tthrow new ClientError({\n\t\tkind: ClientErrorKind.Configuration,\n\t\tcode: Base64CompatErrorCode.EncoderUnavailable,\n\t\tmessage: \"The current realm does not provide a Base64 encoder.\",\n\t\tsource: \"compat.base64\",\n\t});\n}\n\nexport function decodeBase64ToUint8Array(value: string): Uint8Array {\n\tconst Uint8ArrayConstructor =\n\t\tglobalThis.Uint8Array as Uint8ArrayConstructorWithBase64;\n\tif (typeof Uint8ArrayConstructor.fromBase64 === \"function\") {\n\t\treturn Uint8ArrayConstructor.fromBase64(value);\n\t}\n\n\tif (typeof globalThis.atob === \"function\") {\n\t\tconst binary = globalThis.atob(value);\n\t\tconst bytes = new Uint8Array(binary.length);\n\t\tfor (let index = 0; index < binary.length; index += 1) {\n\t\t\tbytes[index] = binary.charCodeAt(index);\n\t\t}\n\t\treturn bytes;\n\t}\n\n\tconst BufferConstructor = Reflect.get(globalThis, \"Buffer\") as\n\t\t| BufferConstructorLike\n\t\t| undefined;\n\tif (typeof BufferConstructor?.from === \"function\") {\n\t\treturn Uint8ArrayConstructor.from(BufferConstructor.from(value, \"base64\"));\n\t}\n\n\tthrow new ClientError({\n\t\tkind: ClientErrorKind.Configuration,\n\t\tcode: Base64CompatErrorCode.DecoderUnavailable,\n\t\tmessage: \"The current realm does not provide a Base64 decoder.\",\n\t\tsource: \"compat.base64\",\n\t});\n}\n","export async function* promisesToRacedAsyncGenerator<T>(\n\tpromises: Promise<T>[],\n): AsyncGenerator<T, void, unknown> {\n\tconst pending = new Map(\n\t\tpromises.map((promise, index) => [\n\t\t\tindex,\n\t\t\tpromise.then((value) => ({ value, index }) as const),\n\t\t]),\n\t);\n\twhile (pending.size > 0) {\n\t\tconst next = await Promise.race(pending.values());\n\t\tpending.delete(next.index);\n\t\tyield next.value;\n\t}\n}\n","import {\n\tinject as runtimeInject,\n\trunInInjectionContext as runtimeRunInInjectionContext,\n} from \"injection-js\";\nimport { toRuntimeInjector } from \"./injector\";\nimport {\n\ttype SecuritydeptDependencyToken,\n\ttype SecuritydeptInjectorTrait,\n} from \"./types\";\n\nexport interface SecuritydeptInjectOptions {\n\toptional?: boolean;\n}\n\nexport function inject<T>(\n\ttoken: SecuritydeptDependencyToken<T>,\n\toptions?: SecuritydeptInjectOptions & { optional?: false },\n): T;\nexport function inject<T>(\n\ttoken: SecuritydeptDependencyToken<T>,\n\toptions?: SecuritydeptInjectOptions & { optional?: true },\n): T | null;\nexport function inject<T>(\n\ttoken: SecuritydeptDependencyToken<T>,\n\toptions?: SecuritydeptInjectOptions,\n): T | null {\n\tif (options?.optional === true) {\n\t\treturn runtimeInject(token, {\n\t\t\toptional: true,\n\t\t});\n\t}\n\n\treturn runtimeInject(token);\n}\n\nexport function tryInjectInInjectionContext<T>(\n\ttoken: SecuritydeptDependencyToken<T>,\n\toptions?: SecuritydeptInjectOptions,\n): T | null {\n\ttry {\n\t\tif (options?.optional === true) {\n\t\t\treturn inject(token, { optional: true });\n\t\t}\n\n\t\treturn inject(token);\n\t} catch (error) {\n\t\tif (isMissingInjectionContextError(error)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tthrow error;\n\t}\n}\n\nexport function runInInjectionContext<ReturnT>(\n\tinjector: SecuritydeptInjectorTrait,\n\tfn: () => ReturnT,\n): ReturnT {\n\treturn runtimeRunInInjectionContext(toRuntimeInjector(injector), fn);\n}\n\nfunction isMissingInjectionContextError(error: unknown): boolean {\n\treturn (\n\t\terror instanceof Error &&\n\t\terror.message.includes(\"can only be used within an injection context\")\n\t);\n}\n","import { filter, from, take } from \"rxjs\";\nimport { type DisposableTrait, SYMBOL_DISPOSE } from \"../compat/disposable\";\nimport { createSignal } from \"../signals/signal\";\n\nexport abstract class SecuritydeptDestroyRef implements DisposableTrait {\n\tabstract readonly destroyed: boolean;\n\tabstract onDestroy(callback: () => void): () => void;\n\tabstract dispose(): void;\n\n\t[SYMBOL_DISPOSE](): void {\n\t\tthis.dispose();\n\t}\n}\n\nclass ManagedSecuritydeptDestroyRef extends SecuritydeptDestroyRef {\n\tprivate readonly destroyedSignal = createSignal(false);\n\n\tget destroyed(): boolean {\n\t\treturn this.destroyedSignal.get();\n\t}\n\n\tonDestroy(callback: () => void): () => void {\n\t\tif (this.destroyedSignal.get()) {\n\t\t\tcallback();\n\t\t\treturn () => undefined;\n\t\t}\n\n\t\tconst subscription = from(this.destroyedSignal)\n\t\t\t.pipe(\n\t\t\t\tfilter((destroyed): destroyed is true => destroyed),\n\t\t\t\ttake(1),\n\t\t\t)\n\t\t\t.subscribe({\n\t\t\t\tnext: callback,\n\t\t\t});\n\t\treturn () => {\n\t\t\tsubscription.unsubscribe();\n\t\t};\n\t}\n\n\tdispose(): void {\n\t\tif (this.destroyedSignal.get()) {\n\t\t\treturn;\n\t\t}\n\n\t\tthis.destroyedSignal.set(true);\n\t}\n\n\tdestroy(): void {\n\t\tthis.dispose();\n\t}\n}\n\nexport function createSecuritydeptDestroyRef(): SecuritydeptDestroyRef {\n\treturn new ManagedSecuritydeptDestroyRef();\n}\n","import { type as defineType } from \"arktype\";\nimport {\n\tUriReferenceString,\n\tUriRelativeString,\n\tUriString,\n} from \"../../struct/uri-string\";\n\nexport const UriStringSchema = defineType(\"string\").narrow((value, context) =>\n\tUriString.tryParse(value) == null\n\t\t? context.reject(\"an absolute URI string\")\n\t\t: true,\n);\n\nexport const BaseURIStringSchema = UriStringSchema;\n\nexport const UriRelativeStringSchema = defineType(\"string\").narrow(\n\t(value, context) =>\n\t\tUriRelativeString.tryParse(value) == null\n\t\t\t? context.reject(\"a relative URI reference string\")\n\t\t\t: true,\n);\n\nexport const UriReferenceStringSchema = defineType(\"string\").narrow(\n\t(value, context) =>\n\t\tUriReferenceString.tryParse(value) == null\n\t\t\t? context.reject(\"a URI reference string\")\n\t\t\t: true,\n);\n","import { merge, ReplaySubject, take, takeUntil } from \"rxjs\";\nimport {\n\ttype DisposableTrait,\n\ttype SubscribableTrait,\n\tSYMBOL_DISPOSE,\n\tSYMBOL_OBSERVABLE,\n} from \"../compat\";\nimport { type ClientError } from \"../errors\";\nimport { CancellationToken } from \"./create\";\nimport {\n\ttype CancellationTokenErrorData,\n\ttype CancellationTokenTrait,\n} from \"./types\";\n\nexport class LinkedCancellationToken\n\timplements CancellationTokenTrait, DisposableTrait\n{\n\tdestoryed$ = new ReplaySubject<boolean>(1);\n\tprotected readonly token: CancellationTokenTrait;\n\n\tconstructor(protected readonly sources: CancellationTokenTrait[]) {\n\t\tif (sources.length === 0) {\n\t\t\tthis.token = new CancellationToken();\n\t\t}\n\n\t\t// One source — return directly; no allocation needed.\n\t\tif (sources.length === 1) {\n\t\t\tthis.token = sources[0];\n\t\t}\n\n\t\t// Fast-path: return the first already-cancelled source immediately.\n\t\tfor (const source of sources) {\n\t\t\tif (source.isCancellationRequested) {\n\t\t\t\tthis.token = source;\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\n\t\tconst newToken = new CancellationToken();\n\n\t\tmerge(...sources)\n\t\t\t.pipe(take(1), takeUntil(this.destoryed$))\n\t\t\t.subscribe(({ reason }) => {\n\t\t\t\tnewToken._cancel(reason);\n\t\t\t});\n\n\t\tthis.token = newToken;\n\t}\n\tget isCancellationRequested(): boolean {\n\t\treturn this.token.isCancellationRequested;\n\t}\n\tget cancellationError(): ClientError | undefined {\n\t\treturn this.token.cancellationError;\n\t}\n\tget reason(): unknown {\n\t\treturn this.token.reason;\n\t}\n\tonCancellationRequested(\n\t\tlistener: (data: CancellationTokenErrorData) => void,\n\t): DisposableTrait {\n\t\treturn this.token.onCancellationRequested(listener);\n\t}\n\tthrowIfCancellationRequested(): void {\n\t\tthis.token.throwIfCancellationRequested();\n\t}\n\n\tdispose() {\n\t\tthis.destoryed$.next(true);\n\t}\n\n\t[SYMBOL_DISPOSE]() {\n\t\tthis.dispose();\n\t}\n\n\t[SYMBOL_OBSERVABLE](): SubscribableTrait<CancellationTokenErrorData> {\n\t\treturn this.token[SYMBOL_OBSERVABLE]();\n\t}\n}\n\n/**\n * Create a cancellation token that fires when ANY of the given source tokens\n * is cancelled.\n *\n * - Zero sources → returns a token that is never cancelled.\n * - One source   → returns that source directly (no allocation).\n * - N sources    → creates a linked source, subscribes to all, and cleans up\n *   subscriptions once the linked token fires.\n *\n * @example\n * const cts = createCancellationTokenSource();\n * const linked = createLinkedCancellationToken(clientRoot.token, cts.token);\n * await transport.execute({ ..., cancellationToken: linked });\n */\nexport function createLinkedCancellationToken(\n\t...sources: readonly (CancellationTokenTrait | undefined | null)[]\n): CancellationTokenTrait & DisposableTrait {\n\treturn new LinkedCancellationToken(\n\t\tsources.filter((s): s is CancellationTokenTrait => !!s),\n\t);\n}\n","import { RxComputedSignal } from \"../rx/signal\";\nimport { type ComputedSignalTrait, type SignalOptions } from \"./types\";\n\n/**\n * Create a lazy computed signal.\n *\n * Dependencies are collected dynamically while `compute()` runs.\n */\nexport function createComputed<T>(\n\tcompute: () => T,\n\toptions?: SignalOptions<T>,\n): ComputedSignalTrait<T> {\n\treturn RxComputedSignal.computed(compute, options);\n}\n","import { from } from \"rxjs\";\nimport { type ToEventStreamInput } from \"../events/interop\";\nimport { mapResource, resourceFromSnapshots, rxResource } from \"../rx/resource\";\nimport {\n\ttype ReadableSignalTrait,\n\ttype ResourceSnapshot,\n\ttype ResourceTrait,\n} from \"./types\";\n\nexport interface ResourceStreamContext<T, R> {\n\treadonly request: R;\n\treadonly previous: ResourceSnapshot<T>;\n}\n\nexport interface CreateResourceOptions<T, R = undefined> {\n\treadonly request?: ReadableSignalTrait<R | undefined> | (() => R | undefined);\n\treadonly stream: (\n\t\tcontext: ResourceStreamContext<T, R>,\n\t) => ToEventStreamInput<T>;\n}\n\nexport function createResource<T, R = undefined>(\n\toptions: CreateResourceOptions<T, R>,\n): ResourceTrait<T> {\n\treturn rxResource({\n\t\t...options,\n\t\tstream: (context) => from(options.stream(context)),\n\t});\n}\n\nexport { mapResource, resourceFromSnapshots };\n","// Router metadata — framework-agnostic route security declaration storage\n//\n// Canonical public export: @securitydept/client\n//\n// Serializable auth requirement metadata for router integrations is stored\n// under a single namespaced key in each framework's route-data bag (Angular\n// `Route.data`, TanStack `staticData`, etc.). Adopters should read/write only\n// through {@link readSecuritydeptRouteMetadata} and\n// {@link writeSecuritydeptRouteMetadata}.\n\nimport {\n\ttype AuthRequirement,\n\ttype RequirementsComposition,\n} from \"../auth-coordination/contract\";\n\n/** Route-data key holding the SecurityDept metadata blob for a segment. */\nexport const SECURITYDEPT_ROUTE_METADATA_KEY = \"__securitydept__\";\n\n/** Serializable SecurityDept route metadata. */\nexport interface SecuritydeptRouteMetadata<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> {\n\trequirements?: readonly TAuthRequirement[];\n\tcomposition?: RequirementsComposition;\n}\n\n/** Read SecurityDept route metadata from a route `data` bag. */\nexport function readSecuritydeptRouteMetadata<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n>(\n\tdata: object | undefined,\n): SecuritydeptRouteMetadata<TAuthRequirement> | undefined {\n\tconst raw = (data as Record<string, unknown> | undefined)?.[\n\t\tSECURITYDEPT_ROUTE_METADATA_KEY\n\t];\n\tif (raw === undefined || raw === null) {\n\t\treturn undefined;\n\t}\n\treturn raw as SecuritydeptRouteMetadata<TAuthRequirement>;\n}\n\n/** Merge SecurityDept route metadata into a route `data` bag. */\nexport function writeSecuritydeptRouteMetadata<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n>(\n\tbase: object | undefined,\n\tpatch: SecuritydeptRouteMetadata<TAuthRequirement>,\n): Record<string, unknown> {\n\tconst data: Record<string, unknown> = { ...(base ?? {}) };\n\tconst previous =\n\t\t(data[SECURITYDEPT_ROUTE_METADATA_KEY] as\n\t\t\t| SecuritydeptRouteMetadata<TAuthRequirement>\n\t\t\t| undefined) ?? {};\n\tdata[SECURITYDEPT_ROUTE_METADATA_KEY] = { ...previous, ...patch };\n\treturn data;\n}\n","import { type ReadableSignalTrait, type ResourceTrait } from \"../../signals\";\n\nexport type AuthorizationSignal =\n\t| ReadableSignalTrait<string | null | undefined>\n\t| ResourceTrait<string | null | undefined>;\n\nexport type AuthorizationInterceptedFetchPredicate = (\n\tinput: RequestInfo | URL,\n\tinit: RequestInit | undefined,\n) => boolean | Promise<boolean>;\n\nexport interface CreateAuthorizationInterceptedFetchOptions {\n\treadonly predicate: AuthorizationInterceptedFetchPredicate;\n\treadonly authorization: AuthorizationSignal;\n}\n\nexport function createAuthorizationInterceptedFetch(\n\tfetchImpl: typeof fetch,\n\toptions: CreateAuthorizationInterceptedFetchOptions,\n): typeof fetch {\n\treturn async (input, init) => {\n\t\tif (!(await options.predicate(input, init))) {\n\t\t\treturn fetchImpl(input, init);\n\t\t}\n\t\tconst authorization =\n\t\t\t\"whenValue\" in options.authorization\n\t\t\t\t? await options.authorization.whenValue()\n\t\t\t\t: options.authorization.get();\n\t\tif (!authorization) {\n\t\t\treturn fetchImpl(input, init);\n\t\t}\n\t\tconst headers = new Headers(\n\t\t\ttypeof Request !== \"undefined\" && input instanceof Request\n\t\t\t\t? input.headers\n\t\t\t\t: undefined,\n\t\t);\n\t\tif (init?.headers) {\n\t\t\tnew Headers(init.headers).forEach((value, key) => {\n\t\t\t\theaders.set(key, value);\n\t\t\t});\n\t\t}\n\t\theaders.set(\"authorization\", authorization);\n\t\treturn fetchImpl(input, {\n\t\t\t...init,\n\t\t\theaders,\n\t\t});\n\t};\n}\n","import { isPromise } from \"es-toolkit/predicate\";\n\nimport { ClientError, describeError } from \"../errors\";\nimport { type TimestampProviderTrait } from \"../scheduling/types\";\nimport { SpanSharedAttributeName } from \"../span/attributes\";\nimport {\n\ttype MutableSpanTrait,\n\ttype SpanAttributes,\n\ttype SpanTrait,\n} from \"../span/types\";\nimport {\n\ttype OperationSpanTrait,\n\tOperationTraceEventType,\n\tTRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\tTracingLevel,\n\ttype TracingTrait,\n} from \"./types\";\n\nexport interface RunOperationEnvironment {\n\tenvironment: {\n\t\ttime: TimestampProviderTrait;\n\t\ttracing: TracingTrait;\n\t};\n}\nexport interface RunOperationOptionsBase extends RunOperationEnvironment {\n\tspan: SpanTrait;\n\tname: string;\n\ttarget: string;\n\ttraceAttributes?: SpanAttributes;\n\tidFactory?: () => string;\n\tclientErrorFromUnknown?: (\n\t\terror: unknown,\n\t\toptions: { span: SpanTrait },\n\t) => ClientError;\n}\n\nexport interface RunOperationOptions<T> extends RunOperationOptionsBase {\n\texecute: (span: OperationSpanTrait) => T;\n}\n\nexport class OperationSpan implements OperationSpanTrait {\n\tprivate constructor(\n\t\treadonly span: MutableSpanTrait,\n\t\tprivate readonly _environment: RunOperationEnvironment[\"environment\"],\n\t\tprivate readonly _target: string,\n\t) {}\n\n\tstatic start(options: RunOperationOptionsBase): OperationSpan {\n\t\tconst span = options.span.fork({\n\t\t\tmutable: true,\n\t\t\tidFactory: options.idFactory,\n\t\t\tattributes: {\n\t\t\t\t[SpanSharedAttributeName.OperationName]: options.name,\n\t\t\t},\n\t\t});\n\t\tif (options.traceAttributes) {\n\t\t\tspan.setAttributes(options.traceAttributes, {\n\t\t\t\tproviderId: TRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\t\t\t});\n\t\t}\n\t\tconst operationSpan = new OperationSpan(\n\t\t\tspan,\n\t\t\toptions.environment,\n\t\t\toptions.target,\n\t\t);\n\t\toperationSpan.recordStarted();\n\t\treturn operationSpan;\n\t}\n\n\tsetTraceAttributes(attributes: SpanAttributes): void {\n\t\tthis.span.setAttributes(attributes, {\n\t\t\tproviderId: TRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\t\t});\n\t}\n\n\taddEvent(name: string, fields?: SpanAttributes): void {\n\t\tthis._record(OperationTraceEventType.Event, TracingLevel.Info, {\n\t\t\teventName: name,\n\t\t\t...(fields ?? {}),\n\t\t});\n\t}\n\n\trecordError(error: unknown, fields?: SpanAttributes): void {\n\t\tthis._record(OperationTraceEventType.Error, TracingLevel.Error, {\n\t\t\t...describeError(error),\n\t\t\t...(fields ?? {}),\n\t\t});\n\t}\n\n\trecordStarted(): void {\n\t\tthis._record(OperationTraceEventType.Started, TracingLevel.Info);\n\t}\n\n\trecordEnded(outcome: \"succeeded\" | \"failed\"): void {\n\t\tthis._record(\n\t\t\tOperationTraceEventType.Ended,\n\t\t\toutcome === \"succeeded\" ? TracingLevel.Info : TracingLevel.Error,\n\t\t\t{ outcome },\n\t\t);\n\t}\n\n\tprivate _record(\n\t\tname: string,\n\t\tlevel: TracingLevel,\n\t\tfields?: SpanAttributes,\n\t): void {\n\t\tthis._environment.tracing.record({\n\t\t\tname,\n\t\t\tat: this._environment.time.now(),\n\t\t\tspan: this.span,\n\t\t\tlevel,\n\t\t\ttarget: this._target,\n\t\t\tfields,\n\t\t});\n\t}\n}\n\nexport function runOperation<T>(options: RunOperationOptions<T>): T;\nexport function runOperation<T>(\n\toptions: RunOperationOptions<Promise<T>>,\n): Promise<T>;\nexport function runOperation<T>(\n\toptions: RunOperationOptions<T | Promise<T>>,\n): T | Promise<T> {\n\tconst operationSpan = OperationSpan.start(options);\n\ttry {\n\t\tconst result = options.execute(operationSpan);\n\t\tif (isPromise(result)) {\n\t\t\treturn result.then(\n\t\t\t\t(value) => completeOperation(operationSpan, value),\n\t\t\t\t(error) =>\n\t\t\t\t\tfailOperation(operationSpan, error, options.clientErrorFromUnknown),\n\t\t\t);\n\t\t}\n\t\treturn completeOperation(operationSpan, result);\n\t} catch (error) {\n\t\treturn failOperation(operationSpan, error, options.clientErrorFromUnknown);\n\t}\n}\n\nfunction completeOperation<T>(operationSpan: OperationSpan, result: T): T {\n\toperationSpan.recordEnded(\"succeeded\");\n\treturn result;\n}\n\nfunction failOperation(\n\toperationSpan: OperationSpan,\n\terror: unknown,\n\tclientErrorFromUnknown: RunOperationOptionsBase[\"clientErrorFromUnknown\"],\n): never {\n\tconst clientError = clientErrorFromUnknown\n\t\t? clientErrorFromUnknown(error, { span: operationSpan.span })\n\t\t: error;\n\tif (clientError instanceof ClientError) {\n\t\tclientError.captureSpanContext(operationSpan.span);\n\t}\n\toperationSpan.recordError(clientError);\n\toperationSpan.recordEnded(\"failed\");\n\tthrow clientError;\n}\n","import { type RunOperationOptionsBase, runOperation } from \"./operation-runner\";\nimport { type OperationSpanTrait } from \"./types\";\n\nexport interface InstrumentMethodThisContext<TArgs extends unknown[]> {\n\targs: TArgs;\n\tmethodName: string;\n}\n\nexport interface InstrumentMethodResolvedOptions\n\textends Omit<RunOperationOptionsBase, \"name\"> {\n\tname?: string;\n}\n\nexport type InstrumentMethodThisResolver<\n\tTThis extends object,\n\tTArgs extends unknown[],\n> = (\n\tthis: TThis,\n\tcontext: InstrumentMethodThisContext<TArgs>,\n) => InstrumentMethodResolvedOptions;\n\nexport interface DefineInstrumentMethodDecoratorContext<\n\tTFactoryArgs extends unknown[],\n> {\n\tfactoryArgs: TFactoryArgs;\n\tmethodName: string;\n}\n\nexport type DefineInstrumentMethodDecoratorFactory<\n\tTFactoryArgs extends unknown[],\n\tTBaseThis extends object = object,\n> = <TThis extends TBaseThis, TArgs extends unknown[]>(\n\tcontext: DefineInstrumentMethodDecoratorContext<TFactoryArgs>,\n) => InstrumentMethodThisResolver<TThis, TArgs>;\n\nexport function defineInstrumentMethodDecorator<\n\tTFactoryArgs extends unknown[],\n\tTBaseThis extends object = object,\n>(factory: DefineInstrumentMethodDecoratorFactory<TFactoryArgs, TBaseThis>) {\n\treturn (...factoryArgs: TFactoryArgs) =>\n\t\t<TThis extends TBaseThis, TArgs extends unknown[], TReturn>(\n\t\t\ttarget: (this: TThis, ...args: TArgs) => TReturn,\n\t\t\tcontext: ClassMethodDecoratorContext<\n\t\t\t\tTThis,\n\t\t\t\t(this: TThis, ...args: TArgs) => TReturn\n\t\t\t>,\n\t\t) => {\n\t\t\tconst methodName = String(context.name);\n\t\t\tconst resolve = factory<TThis, TArgs>({\n\t\t\t\tfactoryArgs,\n\t\t\t\tmethodName,\n\t\t\t});\n\t\t\treturn function (this: TThis, ...args: TArgs): TReturn {\n\t\t\t\tconst resolvedOptions = resolve.call(this, {\n\t\t\t\t\targs,\n\t\t\t\t\tmethodName,\n\t\t\t\t});\n\t\t\t\treturn runOperation({\n\t\t\t\t\tenvironment: resolvedOptions.environment,\n\t\t\t\t\tspan: resolvedOptions.span,\n\t\t\t\t\tname: resolvedOptions.name ?? methodName,\n\t\t\t\t\ttarget: resolvedOptions.target,\n\t\t\t\t\ttraceAttributes: resolvedOptions.traceAttributes,\n\t\t\t\t\tidFactory: resolvedOptions.idFactory,\n\t\t\t\t\tclientErrorFromUnknown: resolvedOptions.clientErrorFromUnknown,\n\t\t\t\t\texecute: (span) =>\n\t\t\t\t\t\t(\n\t\t\t\t\t\t\ttarget as unknown as (\n\t\t\t\t\t\t\t\tthis: TThis,\n\t\t\t\t\t\t\t\t...args: [...TArgs, OperationSpanTrait]\n\t\t\t\t\t\t\t) => TReturn\n\t\t\t\t\t\t).call(this, ...args, span),\n\t\t\t\t}) as TReturn;\n\t\t\t};\n\t\t};\n}\n","import {\n\tTRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\ttype TracingEvent,\n} from \"../types\";\nimport { type TracingSubscriberTrait } from \"./types\";\n\nexport class ConsoleTracingSubscriber implements TracingSubscriberTrait {\n\trecord(event: TracingEvent): void {\n\t\tconst label = `[${event.target}] ${event.name}`;\n\t\tconst details = {\n\t\t\t...(event.fields ?? {}),\n\t\t\tspanAttributes: event.span.getRootToNodeAttributes({\n\t\t\t\tproviderId: TRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\t\t\t}),\n\t\t};\n\t\tswitch (event.level) {\n\t\t\tcase \"debug\":\n\t\t\t\tconsole.debug(label, details);\n\t\t\t\tbreak;\n\t\t\tcase \"info\":\n\t\t\t\tconsole.info(label, details);\n\t\t\t\tbreak;\n\t\t\tcase \"warn\":\n\t\t\t\tconsole.warn(label, details);\n\t\t\t\tbreak;\n\t\t\tcase \"error\":\n\t\t\t\tconsole.error(label, details);\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\nexport function createConsoleTracingSubscriber(): ConsoleTracingSubscriber {\n\treturn new ConsoleTracingSubscriber();\n}\n","import { Queue } from \"mnemonist\";\nimport { type EventStreamTrait } from \"../../events\";\nimport { RxEventSubject } from \"../../rx/event\";\nimport { type SpanNodeAttributes } from \"../../span\";\nimport {\n\tTRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\ttype TracingEvent,\n} from \"../types\";\nimport { type TracingSubscriberTrait } from \"./types\";\n\nexport interface TraceTimelineEntry extends Omit<TracingEvent, \"span\"> {\n\tid: number;\n\trecordedAtIso: string;\n\tspan: {\n\t\treadonly id: string;\n\t\treadonly parentId?: string;\n\t};\n\tspanAttributes: readonly SpanNodeAttributes[];\n}\n\n/**\n * Bounded subscriber-side trace timeline.\n *\n * This store consumes tracing events through `record(event)` and keeps a\n * bounded local timeline for tests and UI surfaces. It is not the tracing\n * runtime itself.\n */\nexport class TraceTimelineStore implements TracingSubscriberTrait {\n\tprotected nextId = 1;\n\tprotected readonly timeline = new Queue<TraceTimelineEntry>();\n\tprotected readonly latestEntrySubject =\n\t\tnew RxEventSubject<TraceTimelineEntry | null>();\n\n\tconstructor(protected readonly limit = 200) {}\n\n\tget latestEntry(): EventStreamTrait<TraceTimelineEntry | null> {\n\t\treturn this.latestEntrySubject;\n\t}\n\n\tget entries(): readonly TraceTimelineEntry[] {\n\t\treturn this.timeline.toArray();\n\t}\n\n\trecord(event: TracingEvent): void {\n\t\tconst { span, ...eventWithoutSpan } = event;\n\t\tconst entry: TraceTimelineEntry = {\n\t\t\t...eventWithoutSpan,\n\t\t\tid: this.nextId++,\n\t\t\trecordedAtIso: new Date(event.at).toISOString(),\n\t\t\tspan: {\n\t\t\t\tid: span.id,\n\t\t\t\t...(span.parent ? { parentId: span.parent.id } : {}),\n\t\t\t},\n\t\t\tspanAttributes: span.getRootToNodeAttributes({\n\t\t\t\tproviderId: TRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\t\t\t}),\n\t\t};\n\t\tthis.timeline.enqueue(entry);\n\t\tif (this.timeline.size > this.limit) {\n\t\t\tthis.timeline.dequeue();\n\t\t}\n\t\tthis.latestEntrySubject.next(entry);\n\t}\n\n\tclear(): void {\n\t\tif (this.timeline.size > 0) {\n\t\t\tthis.timeline.clear();\n\t\t\tthis.latestEntrySubject.next(null);\n\t\t}\n\t}\n}\n\nexport function createTraceTimelineStore(limit = 200): TraceTimelineStore {\n\treturn new TraceTimelineStore(limit);\n}\n","// Requirement planner host — non-serializable behaviour resolution\n//\n// Canonical public export: @securitydept/client\n//\n// A RequirementPlannerHost carries the runtime, typically non-serializable\n// behaviour for a coordination scope: how to check whether a requirement is\n// satisfied, how to react when it is not, and how to pick the next candidate\n// to act on.\n//\n// Hosts form a parent chain. A leaf host (e.g. a route scope) resolves each\n// behaviour by walking from itself toward the root and using the nearest\n// definition. This mirrors hierarchical route/DI scoping without depending on\n// any framework. Adapters map their DI containers onto this chain.\n//\n// Future global, behavioural (usually non-serializable) information can be\n// carried here as additional fields without touching the serializable\n// contract layer.\n\nimport { ENVIRONMENT_TOKEN, type FoundationEnvironment } from \"../environment\";\nimport {\n\tPARENT_INJECTOR_TOKEN,\n\tSecurityDeptOptional,\n\tSecuritydeptInjectionToken,\n\ttype SecuritydeptInjectorTrait,\n\ttype SecuritydeptProvider,\n} from \"../injection\";\nimport {\n\ttype AuthRequirement,\n\ttype RequirementBehaviour,\n\ttype RequirementCandidateSelectionContext,\n\ttype SelectCandidate,\n} from \"./contract\";\n\nexport const REQUIREMENT_PLANNER_HOST = new SecuritydeptInjectionToken<\n\tRequirementPlannerHost<unknown>\n>(\"REQUIREMENT_PLANNER_HOST\");\n\nexport type RequirementPlannerHostBehaviour<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n> = TBehaviour | (() => TBehaviour);\n\nexport interface ProvideRequirementPlannerHostOptions<\n\tTBehaviour = Partial<RequirementBehaviour>,\n> {\n\treadonly parent?: RequirementPlannerHost<TBehaviour>;\n\treadonly environment?: FoundationEnvironment;\n}\n\nexport interface InjectRequirementPlannerHostOptions {\n\treadonly injector: SecuritydeptInjectorTrait;\n}\n\n/**\n * Default candidate selector: first unauthenticated candidate as soon as it is\n * discovered.\n *\n * If every requirement is already fulfilled the stream completes and the\n * selector returns `undefined`.\n */\nexport function defaultSelectCandidate<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n>(): SelectCandidate<TAuthRequirement, TPlanContext> {\n\treturn async function selectFirstCandidate(\n\t\tcontext: RequirementCandidateSelectionContext<\n\t\t\tTAuthRequirement,\n\t\t\tTPlanContext\n\t\t>,\n\t): Promise<TAuthRequirement | undefined> {\n\t\tconst result = await context.candidateList.next();\n\t\treturn result.done ? undefined : result.value;\n\t};\n}\n\n/** Options for {@link RequirementPlannerHost.fromBehaviour}. */\nexport interface RequirementPlannerHostOptions<\n\tTRequirementBehaviour = Partial<RequirementBehaviour>,\n> {\n\t/** Parent host to inherit unspecified behaviour from. */\n\tparent?: RequirementPlannerHost<TRequirementBehaviour>;\n\tenvironment?: FoundationEnvironment;\n}\n\n/**\n * A coordination-scope host that resolves behaviour through a parent chain.\n *\n * Construct via {@link RequirementPlannerHost.fromBehaviour}. Each behaviour\n * field is optional at host construction time; missing required behaviour is\n * resolved from `parent` and fails fast during planner build if no host in the\n * chain provides it.\n *\n * @example\n * ```ts\n * const root = RequirementPlannerHost.fromBehaviour({\n *   checkAuthenticated: (req) => isAuthenticated(req),\n *   onUnauthenticated: (req) => `/login/${req.id}`,\n * });\n *\n * // Feature scope overrides only the chooser, inheriting the rest.\n * const feature = RequirementPlannerHost.fromBehaviour(\n *   { selectCandidate: async (ctx) => showChooser(ctx.candidateList) },\n *   { parent: root },\n * );\n * ```\n */\nexport class RequirementPlannerHost<\n\tTBehaviour = Partial<RequirementBehaviour>,\n> {\n\t/** The parent host, or undefined at the root. */\n\tprivate readonly _behaviour: TBehaviour;\n\n\tprotected constructor(\n\t\tbehaviour: TBehaviour,\n\t\treadonly environment: FoundationEnvironment | undefined,\n\t\treadonly parent: RequirementPlannerHost<TBehaviour> | undefined,\n\t) {\n\t\tthis._behaviour = behaviour;\n\t}\n\n\t/** Create a host scope from a partial behaviour and optional parent. */\n\tstatic fromBehaviour<TBehaviour = Partial<RequirementBehaviour>>(\n\t\tbehaviour: TBehaviour,\n\t\toptions: RequirementPlannerHostOptions<TBehaviour> = {},\n\t): RequirementPlannerHost<TBehaviour> {\n\t\treturn new RequirementPlannerHost(\n\t\t\tbehaviour,\n\t\t\toptions.environment,\n\t\t\toptions.parent,\n\t\t);\n\t}\n\n\tasync resolveBehaviourOptionFor<K extends keyof TBehaviour>(\n\t\tkey: K,\n\t): Promise<TBehaviour[K] | undefined> {\n\t\treturn (\n\t\t\tthis._behaviour[key] ??\n\t\t\t(await this.parent?.resolveBehaviourOptionFor(key))\n\t\t);\n\t}\n\tasync resolveBehaviourFor<K extends keyof TBehaviour>(\n\t\tkey: K,\n\t\tdefaultValue: () =>\n\t\t\t| NonNullable<TBehaviour[K]>\n\t\t\t| Promise<NonNullable<TBehaviour[K]>>,\n\t): Promise<NonNullable<TBehaviour[K]>> {\n\t\treturn (\n\t\t\t(await this.resolveBehaviourOptionFor(key)) ?? (await defaultValue())\n\t\t);\n\t}\n\n\tasync resolveEnvironmentOption(): Promise<FoundationEnvironment | undefined> {\n\t\treturn this.environment ?? (await this.parent?.resolveEnvironmentOption());\n\t}\n\n\tasync resolveEnvironment(\n\t\tdefaultValue: () => FoundationEnvironment | Promise<FoundationEnvironment>,\n\t): Promise<FoundationEnvironment> {\n\t\treturn (await this.resolveEnvironmentOption()) ?? (await defaultValue());\n\t}\n}\n\nexport function provideRequirementPlannerHost<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n>(\n\tbehaviour: RequirementPlannerHostBehaviour<\n\t\tTAuthRequirement,\n\t\tTPlanContext,\n\t\tTBehaviour\n\t>,\n\toptions: ProvideRequirementPlannerHostOptions<TBehaviour> = {},\n): SecuritydeptProvider<RequirementPlannerHost<TBehaviour>> {\n\treturn {\n\t\tprovide: REQUIREMENT_PLANNER_HOST,\n\t\tuseFactory: (\n\t\t\tparentInjector: SecuritydeptInjectorTrait | null,\n\t\t\tenvironment: FoundationEnvironment | null,\n\t\t) => {\n\t\t\tconst parent =\n\t\t\t\toptions.parent ??\n\t\t\t\t(parentInjector?.get(\n\t\t\t\t\tREQUIREMENT_PLANNER_HOST,\n\t\t\t\t\tnull,\n\t\t\t\t) as RequirementPlannerHost<TBehaviour> | null) ??\n\t\t\t\tundefined;\n\t\t\tconst resolved =\n\t\t\t\ttypeof behaviour === \"function\" ? behaviour() : behaviour;\n\t\t\treturn RequirementPlannerHost.fromBehaviour(resolved, {\n\t\t\t\tparent,\n\t\t\t\tenvironment: options.environment ?? environment ?? undefined,\n\t\t\t});\n\t\t},\n\t\tdeps: [\n\t\t\t[new SecurityDeptOptional(), PARENT_INJECTOR_TOKEN],\n\t\t\t[new SecurityDeptOptional(), ENVIRONMENT_TOKEN],\n\t\t],\n\t};\n}\n\nexport function injectRequirementPlannerHost<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n>(\n\toptions: InjectRequirementPlannerHostOptions,\n): RequirementPlannerHost<TBehaviour> | null {\n\treturn options.injector.get(\n\t\tREQUIREMENT_PLANNER_HOST,\n\t\tnull,\n\t) as RequirementPlannerHost<TBehaviour> | null;\n}\n","// Base requirement planner — pipeline owner\n//\n// Canonical public export: @securitydept/client\n//\n// Pipeline:\n//   0. buildPlan() — resolve host behaviour + materialize requirements into a\n//      RequirementPlan (fixed for this run until the next buildPlan)\n//   1. runStep(plan) — race checkAuthenticated, select the first actionable\n//      unauthenticated candidate, then onUnauthenticated\n//   2. reduce — update plan.resolutionList\n//\n// runUntilSettled() calls buildPlan() then runUntilSettledWithPlan(plan).\n\nimport { promisesToRacedAsyncGenerator } from \"../../compat\";\nimport { type FoundationEnvironment } from \"../../environment\";\nimport {\n\ttype AuthRequirement,\n\tPipelineOutcome,\n\ttype PipelineRunResult,\n\ttype PipelineStepResult,\n\ttype RequirementBehaviour,\n\ttype RequirementCandidateGenerator,\n\tRequirementPlannerError,\n\ttype RequirementResolution,\n\tResolutionStatus,\n\ttype UnauthenticatedAction,\n} from \"../contract\";\nimport {\n\tdefaultSelectCandidate,\n\ttype RequirementPlannerHost,\n} from \"../planner-host\";\n\n/**\n * Mutable pipeline state for one run: bound behaviour plus requirement list\n * and evolving resolutions.\n */\nexport interface RequirementPlan<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> extends Readonly<RequirementBehaviour<TAuthRequirement, TPlanContext>> {\n\treadonly planContext: TPlanContext;\n\treadonly environment: FoundationEnvironment;\n\treadonly requirements: readonly TAuthRequirement[];\n\tresolutionList: RequirementResolution[];\n}\n\ninterface RequirementCheckResult<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> {\n\treadonly requirement: TAuthRequirement;\n\treadonly satisfied: boolean;\n}\n\n/**\n * Abstract base for all requirement planners.\n *\n * Subclasses supply requirements via {@link buildRequirementList}. Pipeline\n * state lives on {@link RequirementPlan}, produced by {@link buildPlan}.\n */\nexport abstract class BaseRequirementPlanner<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n> {\n\tprotected readonly host: RequirementPlannerHost<TBehaviour>;\n\tprotected initialResolutions: readonly RequirementResolution[];\n\n\tabstract get planContext(): TPlanContext;\n\n\tprotected constructor(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tinitialResolutions: readonly RequirementResolution[] = [],\n\t) {\n\t\tthis.host = host;\n\t\tthis.initialResolutions = initialResolutions.map((resolution) =>\n\t\t\tObject.freeze({ ...resolution }),\n\t\t);\n\t}\n\n\t// --- Pipeline step 0 -----------------------------------------------------\n\n\t/**\n\t * Pipeline step 0: resolve host behaviour and materialize requirements into\n\t * a {@link RequirementPlan}.\n\t *\n\t * Behaviour and the requirement list stay fixed on the returned plan until\n\t * the next `buildPlan()` call. Resolve host parent chains (and any\n\t * injection-context capture) here — not between async steps.\n\t */\n\tpublic async buildPlan(): Promise<\n\t\tRequirementPlan<TAuthRequirement, TPlanContext>\n\t> {\n\t\treturn {\n\t\t\tplanContext: this.planContext,\n\t\t\tenvironment: await this.host.resolveEnvironment(() => {\n\t\t\t\tthrow new RequirementPlannerError(\"No environment resolved\");\n\t\t\t}),\n\t\t\tcheckAuthenticated: await this.host.resolveBehaviourFor(\n\t\t\t\t\"checkAuthenticated\",\n\t\t\t\t() => {\n\t\t\t\t\tthrow new RequirementPlannerError(\"No checkAuthenticated resolved\");\n\t\t\t\t},\n\t\t\t),\n\t\t\tonUnauthenticated: await this.host.resolveBehaviourFor(\n\t\t\t\t\"onUnauthenticated\",\n\t\t\t\t() => {\n\t\t\t\t\tthrow new RequirementPlannerError(\n\t\t\t\t\t\t\"No onUnauthenticated behaviour resolved\",\n\t\t\t\t\t);\n\t\t\t\t},\n\t\t\t),\n\t\t\tselectCandidate: await this.host.resolveBehaviourFor(\n\t\t\t\t\"selectCandidate\",\n\t\t\t\tdefaultSelectCandidate<TAuthRequirement, TPlanContext>,\n\t\t\t),\n\t\t\trequirements: await this.resolveRequirementList(),\n\t\t\tresolutionList: [...this.initialResolutions],\n\t\t};\n\t}\n\n\t// --- Pipeline step 1 -----------------------------------------------------\n\n\t/**\n\t * Return the effective requirement map for this planner.\n\t *\n\t * Keys are requirement ids; {@link Map} insertion order defines evaluation\n\t * order. Subclasses own deduplication policy when folding multiple sources.\n\t */\n\tprotected abstract buildRequirementList():\n\t\t| Map<string, TAuthRequirement>\n\t\t| Promise<Map<string, TAuthRequirement>>;\n\n\t/**\n\t * Materialize the effective requirement list (also invoked by {@link buildPlan}).\n\t */\n\tpublic async resolveRequirementList(): Promise<readonly TAuthRequirement[]> {\n\t\tconst requirements = await this.buildRequirementList();\n\t\treturn [...requirements.values()];\n\t}\n\t/**\n\t * Pipeline step 1 — one loop iteration: select a candidate, run\n\t * `onUnauthenticated`, then reduce `plan` state.\n\t */\n\tasync runStep(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t): Promise<PipelineStepResult<TAuthRequirement>> {\n\t\tconst candidate = await plan.selectCandidate({\n\t\t\t...plan,\n\t\t\tcandidateList: this.createCandidateStream(plan),\n\t\t});\n\t\tif (!candidate) {\n\t\t\treturn { outcome: PipelineOutcome.Settled };\n\t\t}\n\t\tconst action = await plan.onUnauthenticated(candidate, plan);\n\n\t\treturn this.reduceFromAction(plan, candidate, action);\n\t}\n\n\tprotected reduceFromAction(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t\tcandidate: TAuthRequirement,\n\t\taction: Exclude<UnauthenticatedAction, Promise<unknown>>,\n\t): PipelineStepResult<TAuthRequirement> {\n\t\tif (action === true) {\n\t\t\tthis.recordFulfilled(plan, candidate);\n\t\t\treturn { outcome: PipelineOutcome.Resolved, requirement: candidate };\n\t\t}\n\t\tif (action === false) {\n\t\t\treturn { outcome: PipelineOutcome.Blocked, requirement: candidate };\n\t\t}\n\t\treturn {\n\t\t\toutcome: PipelineOutcome.Redirect,\n\t\t\trequirement: candidate,\n\t\t\tlocation: action,\n\t\t};\n\t}\n\n\t// --- Pipeline orchestration ---------------------------------------------\n\n\t/**\n\t * Run the full pipeline: {@link buildPlan}, step 1, then loop step 2 until\n\t * settled or a terminal outcome (`blocked`, `redirect`, or a never-settling\n\t * action).\n\t */\n\tasync runUntilSettled(): Promise<PipelineRunResult<TAuthRequirement>> {\n\t\tconst plan = await this.buildPlan();\n\t\treturn this.runUntilSettledWithPlan(plan);\n\t}\n\n\tasync runUntilSettledWithPlan(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t): Promise<PipelineRunResult<TAuthRequirement>> {\n\t\twhile (true) {\n\t\t\tconst step = await this.runStep(plan);\n\n\t\t\tif (step.outcome === PipelineOutcome.Settled) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: PipelineOutcome.Settled,\n\t\t\t\t\tresolutions: plan.resolutionList,\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (step.outcome === PipelineOutcome.Resolved) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (step.outcome === PipelineOutcome.Blocked) {\n\t\t\t\treturn step;\n\t\t\t}\n\t\t\tif (step.outcome === PipelineOutcome.Redirect) {\n\t\t\t\treturn step;\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async *createCandidateStream(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t): RequirementCandidateGenerator<TAuthRequirement> {\n\t\tconst context = {\n\t\t\tplanContext: this.planContext,\n\t\t\trequirements: plan.requirements,\n\t\t\tresolutionList: plan.resolutionList,\n\t\t\tenvironment: plan.environment,\n\t\t};\n\t\tconst checked = plan.requirements\n\t\t\t.filter(\n\t\t\t\t(requirement) =>\n\t\t\t\t\t!plan.resolutionList.some(\n\t\t\t\t\t\t(resolution) => resolution.requirementId === requirement.id,\n\t\t\t\t\t),\n\t\t\t)\n\t\t\t.map(\n\t\t\t\tasync (\n\t\t\t\t\trequirement,\n\t\t\t\t): Promise<RequirementCheckResult<TAuthRequirement>> => {\n\t\t\t\t\tconst satisfied = await plan.checkAuthenticated(requirement, context);\n\t\t\t\t\treturn { requirement, satisfied };\n\t\t\t\t},\n\t\t\t);\n\n\t\tfor await (const {\n\t\t\trequirement,\n\t\t\tsatisfied,\n\t\t} of promisesToRacedAsyncGenerator(checked)) {\n\t\t\tif (satisfied) {\n\t\t\t\tthis.recordFulfilled(plan, requirement);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tyield requirement;\n\t\t}\n\t}\n\n\tprivate recordFulfilled(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t\trequirement: TAuthRequirement,\n\t): void {\n\t\tif (\n\t\t\tplan.resolutionList.some(\n\t\t\t\t(resolution) => resolution.requirementId === requirement.id,\n\t\t\t)\n\t\t) {\n\t\t\treturn;\n\t\t}\n\t\tplan.resolutionList.push(\n\t\t\tObject.freeze({\n\t\t\t\trequirementId: requirement.id,\n\t\t\t\tstatus: ResolutionStatus.Fulfilled,\n\t\t\t}),\n\t\t);\n\t}\n}\n","// Merge requirement planner — concatenation of multiple planners\n//\n// Canonical public export: @securitydept/client\n//\n// Concatenates source planners in order. Overlapping ids follow Map semantics:\n// the later source wins for the same key.\n\nimport { type AuthRequirement, type RequirementBehaviour } from \"../contract\";\nimport { type RequirementPlannerHost } from \"../planner-host\";\nimport { BaseRequirementPlanner } from \"./base-planner\";\n\n/**\n * A planner whose effective requirements are the ordered union of its source\n * planners. Overlapping ids follow Map semantics (later source wins).\n *\n * @example\n * ```ts\n * const planner = MergeRequirementPlanner.fromPlanners(host, [\n *   sessionPlanner,\n *   oidcPlanner,\n * ]);\n * ```\n */\nexport class MergeRequirementPlanner<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n> extends BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour> {\n\tprivate readonly sources: readonly BaseRequirementPlanner<\n\t\tTAuthRequirement,\n\t\tTPlanContext,\n\t\tTBehaviour\n\t>[];\n\n\tget planContext(): TPlanContext {\n\t\treturn Object.assign(\n\t\t\t{},\n\t\t\t...this.sources.map((source) => source.planContext),\n\t\t);\n\t}\n\n\tprotected constructor(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tsources: readonly BaseRequirementPlanner<\n\t\t\tTAuthRequirement,\n\t\t\tTPlanContext,\n\t\t\tTBehaviour\n\t\t>[],\n\t) {\n\t\tsuper(host);\n\t\tthis.sources = sources;\n\t}\n\n\t/** Create a merge planner from an ordered list of source planners. */\n\tstatic fromPlanners<\n\t\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\t\tTPlanContext = {},\n\t\tTBehaviour extends Partial<\n\t\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n\t>(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tplanners: readonly BaseRequirementPlanner<\n\t\t\tTAuthRequirement,\n\t\t\tTPlanContext,\n\t\t\tTBehaviour\n\t\t>[],\n\t): MergeRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour> {\n\t\treturn new MergeRequirementPlanner(host, planners);\n\t}\n\n\tprotected async buildRequirementList(): Promise<\n\t\tMap<string, TAuthRequirement>\n\t> {\n\t\tconst map = new Map<string, TAuthRequirement>();\n\t\tfor (const source of this.sources) {\n\t\t\tfor (const requirement of await source.resolveRequirementList()) {\n\t\t\t\tmap.set(requirement.id, requirement);\n\t\t\t}\n\t\t}\n\t\treturn map;\n\t}\n}\n","// Route composition requirement planner — matched route chain folding\n//\n// Canonical public export: @securitydept/client\n//\n// Folds a matched route chain (root -> leaf) into a single effective\n// requirement list, applying each segment's inherit/merge/replace composition.\n//\n// Route transitions are modeled as immutable construction: there is no in-place\n// reset. A fresh instance is produced from the previous one, preserving the\n// resolutions for the shared requirement prefix so cross-navigation progress is\n// not lost while diverging requirements are re-planned.\n\nimport {\n\ttype AuthRequirement,\n\ttype RequirementBehaviourWithRouteContext,\n\ttype RequirementResolution,\n\tRequirementsComposition,\n\ttype RouteBehaviourContextExtra,\n\ttype RouteStateSnapshotTrait,\n\ttype RouteTreeSegment,\n\tresolveEffectiveRequirements,\n} from \"../contract\";\nimport { type RequirementPlannerHost } from \"../planner-host\";\nimport { BaseRequirementPlanner, type RequirementPlan } from \"./base-planner\";\n\n/** Fold a matched route chain into its effective requirement list. */\nfunction foldSegments<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n>(\n\tsegments: readonly RouteTreeSegment<TAuthRequirement>[],\n): readonly TAuthRequirement[] {\n\tconst effective = new Map<string, TAuthRequirement>();\n\tfor (const segment of segments) {\n\t\tresolveEffectiveRequirements(\n\t\t\t{\n\t\t\t\tcomposition: segment.composition ?? RequirementsComposition.Merge,\n\t\t\t\trequirements: segment.requirements,\n\t\t\t},\n\t\t\teffective,\n\t\t);\n\t}\n\treturn [...effective.values()];\n}\n\n/** Length of the shared requirement-id prefix between two effective lists. */\nfunction sharedPrefixLength(\n\tprevious: readonly AuthRequirement[],\n\tnext: readonly AuthRequirement[],\n): number {\n\tconst limit = Math.min(previous.length, next.length);\n\tlet shared = 0;\n\twhile (shared < limit && previous[shared].id === next[shared].id) {\n\t\tshared += 1;\n\t}\n\treturn shared;\n}\n\n/**\n * A planner driven by a matched route chain with composition semantics.\n *\n * Construct via {@link fromRouteSegments} for a matched route chain, or\n * {@link fromRouteTransition} for a transition that preserves shared-prefix\n * resolutions from the previous planner instance.\n */\nexport class RouteCompositionRequirementPlanner<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviourWithRouteContext<TAuthRequirement>\n\t> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>,\n> extends BaseRequirementPlanner<\n\tTAuthRequirement,\n\tRouteBehaviourContextExtra,\n\tTBehaviour\n> {\n\tprivate readonly _segments: readonly RouteTreeSegment<TAuthRequirement>[];\n\tprivate readonly _effective: readonly TAuthRequirement[];\n\tprivate readonly _planContext: RouteBehaviourContextExtra;\n\n\tprotected constructor(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tsegments: readonly RouteTreeSegment<TAuthRequirement>[],\n\t\trouteState: RouteStateSnapshotTrait,\n\t\tpreservedResolutions: readonly RequirementResolution[] = [],\n\t) {\n\t\tsuper(host, preservedResolutions);\n\t\tthis._segments = segments;\n\t\tthis._effective = foldSegments(segments);\n\t\tthis._planContext = Object.freeze({\n\t\t\trouteState: Object.freeze({ ...routeState }),\n\t\t});\n\t}\n\n\t/** Build a planner from a matched route chain. */\n\tstatic fromRouteSegments<\n\t\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\t\tTBehaviour extends Partial<\n\t\t\tRequirementBehaviourWithRouteContext<TAuthRequirement>\n\t\t> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>,\n\t>(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tsegments: readonly RouteTreeSegment<TAuthRequirement>[],\n\t\trouteState: RouteStateSnapshotTrait,\n\t): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour> {\n\t\treturn new RouteCompositionRequirementPlanner(host, segments, routeState);\n\t}\n\n\t/**\n\t * Build a planner for a route transition, preserving resolutions for the\n\t * shared requirement prefix carried over from `previousPlan`.\n\t */\n\tstatic fromRouteTransition<\n\t\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\t\tTBehaviour extends Partial<\n\t\t\tRequirementBehaviourWithRouteContext<TAuthRequirement>\n\t\t> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>,\n\t>(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tcurrentSegments: readonly RouteTreeSegment<TAuthRequirement>[],\n\t\trouteState: RouteStateSnapshotTrait,\n\t\tpreviousPlanner: RouteCompositionRequirementPlanner<\n\t\t\tTAuthRequirement,\n\t\t\tTBehaviour\n\t\t>,\n\t\tpreviousPlan: RequirementPlan<TAuthRequirement, RouteBehaviourContextExtra>,\n\t): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour> {\n\t\tconst nextEffective = foldSegments(currentSegments);\n\t\tconst shared = sharedPrefixLength(\n\t\t\tpreviousPlanner.effectiveRequirements,\n\t\t\tnextEffective,\n\t\t);\n\t\tconst sharedIds = new Set(\n\t\t\tnextEffective.slice(0, shared).map((requirement) => requirement.id),\n\t\t);\n\t\tconst preserved = previousPlan.resolutionList.filter((resolution) =>\n\t\t\tsharedIds.has(resolution.requirementId),\n\t\t);\n\t\treturn new RouteCompositionRequirementPlanner(\n\t\t\thost,\n\t\t\tcurrentSegments,\n\t\t\trouteState,\n\t\t\tpreserved,\n\t\t);\n\t}\n\n\tget planContext(): RouteBehaviourContextExtra {\n\t\treturn this._planContext;\n\t}\n\n\t/** The matched route chain backing this planner. */\n\tget segments(): readonly RouteTreeSegment<TAuthRequirement>[] {\n\t\treturn this._segments;\n\t}\n\n\t/** The folded effective requirement list (composition applied). */\n\tget effectiveRequirements(): readonly TAuthRequirement[] {\n\t\treturn this._effective;\n\t}\n\n\tprotected buildRequirementList(): Map<string, TAuthRequirement> {\n\t\treturn new Map(\n\t\t\tthis._effective.map((requirement) => [requirement.id, requirement]),\n\t\t);\n\t}\n}\n","// Static requirement planner — fixed requirement list\n//\n// Canonical public export: @securitydept/client\n\nimport { type AuthRequirement, type RequirementBehaviour } from \"../contract\";\nimport { type RequirementPlannerHost } from \"../planner-host\";\nimport { BaseRequirementPlanner } from \"./base-planner\";\n\n/**\n * A planner whose effective requirement list is a fixed array supplied at\n * construction time.\n *\n * @example\n * ```ts\n * const planner = StaticRequirementPlanner.fromRequirements(host, [\n *   StaticAttrsAuthRequirement.create({ id: \"session\" }),\n * ] as Readonly<AuthRequirement[]>);\n * const plan = await planner.buildPlan();\n * const step = await planner.runStep(plan);\n * // or: const result = await planner.runUntilSettled();\n * ```\n */\nexport class StaticRequirementPlanner<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTBehaviour extends Partial<RequirementBehaviour<TAuthRequirement>> = Partial<\n\t\tRequirementBehaviour<TAuthRequirement>\n\t>,\n> extends BaseRequirementPlanner<TAuthRequirement, {}, TBehaviour> {\n\tprivate readonly staticRequirements: readonly TAuthRequirement[];\n\n\tget planContext(): {} {\n\t\treturn {};\n\t}\n\n\tprotected constructor(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\trequirements: readonly TAuthRequirement[],\n\t) {\n\t\tsuper(host);\n\t\tthis.staticRequirements = requirements;\n\t}\n\n\t/** Create a static planner from an ordered requirement list. */\n\tstatic fromRequirements<\n\t\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\t\tTBehaviour extends Partial<\n\t\t\tRequirementBehaviour<TAuthRequirement>\n\t\t> = Partial<RequirementBehaviour<TAuthRequirement>>,\n\t>(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\trequirements: readonly TAuthRequirement[],\n\t): StaticRequirementPlanner<TAuthRequirement, TBehaviour> {\n\t\treturn new StaticRequirementPlanner(host, requirements);\n\t}\n\n\tprotected buildRequirementList(): Map<string, TAuthRequirement> {\n\t\tconst map = new Map<string, TAuthRequirement>();\n\t\tfor (const requirement of this.staticRequirements) {\n\t\t\tmap.set(requirement.id, requirement);\n\t\t}\n\t\treturn map;\n\t}\n}\n","import { EMPTY, NEVER } from \"rxjs\";\nimport {\n\tRxEventReplaySubject,\n\tRxEventStream,\n\tRxEventSubject,\n} from \"../rx/event\";\nimport {\n\ttype EventObserverTrait,\n\ttype EventStreamTrait,\n\ttype EventSubjectTrait,\n} from \"./types\";\n\n/**\n * Create a new event stream from a producer function.\n *\n * The producer receives an observer and should call `next()` to emit values,\n * `error()` to signal an error, and `complete()` to signal completion.\n * It may return a teardown function that will be called on unsubscribe.\n */\nexport function createEventStream<T>(\n\tproducer: (observer: EventObserverTrait<T>) => (() => void) | void,\n): EventStreamTrait<T> {\n\treturn new RxEventStream(producer);\n}\n\nexport function createEventSubject<T>(): EventSubjectTrait<T> {\n\treturn new RxEventSubject<T>();\n}\n\nexport function createEventReplaySubject<T>(\n\tbufferSize = Infinity,\n): EventSubjectTrait<T> {\n\treturn new RxEventReplaySubject<T>(bufferSize);\n}\n\nexport function createEmptyEventStream<T>(): EventStreamTrait<T> {\n\treturn RxEventStream.fromObservableInput(EMPTY);\n}\n\nexport function createNeverEventStream<T>(): EventStreamTrait<T> {\n\treturn RxEventStream.fromObservableInput(NEVER);\n}\n","import { ClientError } from \"../errors\";\n\nexport type ClientErrorEvent =\n\t| { readonly error: ClientError }\n\t| { readonly payload: { readonly error: ClientError } };\n\nexport type ExtractClientErrorEvent<TEvent> = Extract<TEvent, ClientErrorEvent>;\n\nexport function isClientErrorEvent<TEvent>(\n\tevent: TEvent,\n): event is ExtractClientErrorEvent<TEvent> {\n\tif (typeof event !== \"object\" || event === null) {\n\t\treturn false;\n\t}\n\tif (\"error\" in event && event.error instanceof ClientError) {\n\t\treturn true;\n\t}\n\treturn (\n\t\t\"payload\" in event &&\n\t\ttypeof event.payload === \"object\" &&\n\t\tevent.payload !== null &&\n\t\t\"error\" in event.payload &&\n\t\tevent.payload.error instanceof ClientError\n\t);\n}\n","import { from } from \"rxjs\";\nimport { type InteropObservableTrait } from \"../compat\";\nimport { RxEventStream } from \"../rx/event\";\nimport { type ReadableSignalTrait } from \"../signals/types\";\nimport { type EventStreamTrait, isEventStreamTrait } from \"./types\";\n\nexport type ToEventStreamInput<T> =\n\t| InteropObservableTrait<T>\n\t| Promise<T>\n\t| AsyncIterable<T>\n\t| PromiseLike<T>\n\t| ArrayLike<T>\n\t| Iterable<T>\n\t| EventStreamTrait<T>\n\t| ReadableSignalTrait<T>;\n\nexport function toEventStream<T>(\n\tinput: ToEventStreamInput<T>,\n): EventStreamTrait<T> {\n\tif (isEventStreamTrait(input)) {\n\t\treturn input;\n\t}\n\treturn RxEventStream.fromObservableInput(from(input));\n}\n","import { type as defineType } from \"arktype\";\nimport { type IdentityPrincipal } from \"./contracts\";\n\nexport const IdentityPrincipalSchema = defineType({\n\tsubject: \"string > 0\",\n\t\"displayName?\": \"string | null | undefined\",\n\t\"picture?\": \"string | null | undefined\",\n\t\"issuer?\": \"string | null | undefined\",\n\t\"claims?\": \"object | null | undefined\",\n}).pipe(\n\t(input): IdentityPrincipal => ({\n\t\tsubject: input.subject,\n\t\tdisplayName:\n\t\t\ttypeof input.displayName === \"string\" &&\n\t\t\tinput.displayName.trim().length > 0\n\t\t\t\t? input.displayName\n\t\t\t\t: input.subject,\n\t\tpicture: input.picture ?? undefined,\n\t\tissuer: input.issuer ?? undefined,\n\t\tclaims: (input.claims ?? undefined) as Record<string, unknown> | undefined,\n\t}),\n);\n\nexport const IdentityPrincipalWireSchema = defineType({\n\tsubject: \"string > 0\",\n\t\"display_name?\": \"string | null | undefined\",\n\t\"picture?\": \"string | null | undefined\",\n\t\"issuer?\": \"string | null | undefined\",\n\t\"claims?\": \"object | null | undefined\",\n}).pipe(\n\t(input): IdentityPrincipal => ({\n\t\tsubject: input.subject,\n\t\tdisplayName:\n\t\t\ttypeof input.display_name === \"string\" &&\n\t\t\tinput.display_name.trim().length > 0\n\t\t\t\t? input.display_name\n\t\t\t\t: input.subject,\n\t\tpicture: input.picture ?? undefined,\n\t\tissuer: input.issuer ?? undefined,\n\t\tclaims: (input.claims ?? undefined) as Record<string, unknown> | undefined,\n\t}),\n);\n","import { ClientError, ClientErrorKind } from \"../errors\";\nimport {\n\tformatValidationFailure,\n\ttype ValidationFailure,\n\tvalidateWithSchemaSync,\n} from \"../validation\";\nimport {\n\ttype IdentityPrincipal,\n\ttype ProjectIdentityPrincipalOptions,\n} from \"./contracts\";\nimport {\n\tIdentityPrincipalSchema,\n\tIdentityPrincipalWireSchema,\n} from \"./schemas\";\n\nfunction throwIdentityPrincipalParseError(options: {\n\tcode: string;\n\tmessagePrefix: string;\n\tfailure: ValidationFailure;\n}): never {\n\tthrow new ClientError({\n\t\tkind: ClientErrorKind.Protocol,\n\t\tcode: options.code,\n\t\tmessage: `${options.messagePrefix}: ${formatValidationFailure(options.failure) ?? \"schema validation failed\"}.`,\n\t\tsource: \"identity\",\n\t\tcause: options.failure.issues,\n\t});\n}\n\nexport function parseIdentityPrincipal(input: unknown): IdentityPrincipal {\n\tconst result = validateWithSchemaSync(IdentityPrincipalSchema, input);\n\tif (result.success) {\n\t\treturn result.value;\n\t}\n\tthrowIdentityPrincipalParseError({\n\t\tcode: \"identity.invalid_principal\",\n\t\tmessagePrefix: \"Identity principal payload is invalid\",\n\t\tfailure: result,\n\t});\n}\n\nexport function parseIdentityPrincipalWire(input: unknown): IdentityPrincipal {\n\tconst result = validateWithSchemaSync(IdentityPrincipalWireSchema, input);\n\tif (result.success) {\n\t\treturn result.value;\n\t}\n\tthrowIdentityPrincipalParseError({\n\t\tcode: \"identity.invalid_principal_wire\",\n\t\tmessagePrefix: \"Identity principal wire payload is invalid\",\n\t\tfailure: result,\n\t});\n}\n\nexport function projectIdentityPrincipal(\n\toptions: ProjectIdentityPrincipalOptions,\n): IdentityPrincipal {\n\tconst principal = options.principal;\n\tconst subject =\n\t\tprincipal?.subject ?? options.fallbackSubject ?? \"context.anonymous\";\n\tconst displayName =\n\t\tprincipal?.displayName?.trim() || options.fallbackDisplayName || subject;\n\n\treturn {\n\t\tsubject,\n\t\tdisplayName,\n\t\tpicture: principal?.picture,\n\t\tissuer: principal?.issuer ?? options.fallbackIssuer,\n\t\tclaims: principal?.claims ?? options.fallbackClaims,\n\t};\n}\n","import { ClientError, ClientErrorKind } from \"../../errors\";\n\nexport const JwtDecodeErrorCode = {\n\tInvalidFormat: \"protocol.jwt.invalid_format\",\n\tInvalidPayload: \"protocol.jwt.invalid_payload\",\n\tInvalidClaim: \"protocol.jwt.invalid_claim\",\n} as const;\n\nexport type JwtDecodeErrorCode =\n\t(typeof JwtDecodeErrorCode)[keyof typeof JwtDecodeErrorCode];\n\nexport class JwtDecodeError extends ClientError {\n\toverride readonly code: JwtDecodeErrorCode;\n\n\tconstructor(options: {\n\t\tcode: JwtDecodeErrorCode;\n\t\tmessage: string;\n\t\tcause?: unknown;\n\t}) {\n\t\tsuper({\n\t\t\tkind: ClientErrorKind.Protocol,\n\t\t\tcode: options.code,\n\t\t\tmessage: options.message,\n\t\t\tsource: \"protocol.jwt\",\n\t\t\tcause: options.cause,\n\t\t});\n\t\tthis.name = \"JwtDecodeError\";\n\t\tthis.code = options.code;\n\t}\n}\n","import { JwtDecodeError, JwtDecodeErrorCode } from \"./error\";\nimport { type DecodeJwtPayloadOptions, type JwtClaimsSet } from \"./types\";\n\nexport function decodeJwtPayload(\n\tjwt: string,\n\toptions: DecodeJwtPayloadOptions = {},\n): JwtClaimsSet {\n\tconst label = options.label ?? \"JWT\";\n\tconst parts = jwt.split(\".\");\n\tif (parts.length !== 3) {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidFormat,\n\t\t\tmessage: `${label} must use compact JWS serialization`,\n\t\t});\n\t}\n\n\tconst claims = parseBase64UrlJsonObject(parts[1], `${label} payload`);\n\tvalidateRegisteredClaimTypes(claims, label);\n\treturn claims;\n}\n\nfunction parseBase64UrlJsonObject(value: string, label: string): JwtClaimsSet {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(decodeBase64UrlUtf8(value));\n\t} catch (cause) {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidPayload,\n\t\t\tmessage: `${label} must be base64url-encoded JSON`,\n\t\t\tcause,\n\t\t});\n\t}\n\n\tif (!isJsonObject(parsed)) {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidPayload,\n\t\t\tmessage: `${label} must be a JSON object`,\n\t\t});\n\t}\n\treturn parsed;\n}\n\nfunction decodeBase64UrlUtf8(value: string): string {\n\tconst base64 = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n\tconst padded = base64 + \"=\".repeat((4 - (base64.length % 4)) % 4);\n\tconst binary = atob(padded);\n\tconst bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));\n\treturn new TextDecoder().decode(bytes);\n}\n\nfunction validateRegisteredClaimTypes(\n\tclaims: JwtClaimsSet,\n\tlabel: string,\n): void {\n\tif (claims.exp !== undefined && typeof claims.exp !== \"number\") {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"exp\" claim must be a number`,\n\t\t});\n\t}\n\tif (claims.iat !== undefined && typeof claims.iat !== \"number\") {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"iat\" claim must be a number`,\n\t\t});\n\t}\n\tif (claims.nbf !== undefined && typeof claims.nbf !== \"number\") {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"nbf\" claim must be a number`,\n\t\t});\n\t}\n\tif (claims.iss !== undefined && typeof claims.iss !== \"string\") {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"iss\" claim must be a string`,\n\t\t});\n\t}\n\tif (\n\t\tclaims.aud !== undefined &&\n\t\ttypeof claims.aud !== \"string\" &&\n\t\t!isStringArray(claims.aud)\n\t) {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"aud\" claim must be a string or string array`,\n\t\t});\n\t}\n}\n\nfunction isJsonObject(value: unknown): value is JwtClaimsSet {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isStringArray(value: unknown): value is readonly string[] {\n\treturn (\n\t\tArray.isArray(value) && value.every((item) => typeof item === \"string\")\n\t);\n}\n","/**\n * Parse a human-readable duration string (for example `5m` or `300s`) into\n * milliseconds.\n */\nexport function parseDurationToMs(duration: string): number {\n\tconst match = duration.match(/^(\\d+(?:\\.\\d+)?)\\s*(s|ms|m|h)$/);\n\tif (!match) {\n\t\treturn 0;\n\t}\n\tconst value = Number(match[1]);\n\n\tswitch (match[2]) {\n\t\tcase \"ms\":\n\t\t\treturn value;\n\t\tcase \"s\":\n\t\t\treturn value * 1000;\n\t\tcase \"m\":\n\t\t\treturn value * 60 * 1000;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60 * 1000;\n\t\tdefault:\n\t\t\treturn 0;\n\t}\n}\n","import { type Codec } from \"./types\";\n\n/** Default JSON codec. */\nexport function createJsonCodec<T>(): Codec<T> {\n\treturn {\n\t\tencode(value: T): string {\n\t\t\treturn JSON.stringify(value);\n\t\t},\n\t\tdecode(raw: string): T {\n\t\t\treturn JSON.parse(raw) as T;\n\t\t},\n\t};\n}\n","import { createJsonCodec } from \"./json-codec\";\nimport {\n\ttype Codec,\n\ttype EphemeralFlowStore,\n\ttype KeyedEphemeralFlowStore,\n\ttype StorageTrait,\n} from \"./types\";\n\nexport interface CreateEphemeralFlowStoreOptions<T> {\n\tstore: StorageTrait;\n\tkey: string;\n\tcodec?: Codec<T>;\n}\n\nexport interface CreateKeyedEphemeralFlowStoreOptions<T> {\n\tstore: StorageTrait;\n\tkeyPrefix: string;\n\tcodec?: Codec<T>;\n}\n\nfunction resolveStorageKey(keyPrefix: string, key: string): string {\n\treturn keyPrefix.length > 0 ? `${keyPrefix}:${key}` : key;\n}\n\nfunction requireRecordStoreTake(\n\tstore: StorageTrait,\n): NonNullable<StorageTrait[\"take\"]> {\n\tif (!store.take) {\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\tcode: \"storage.ephemeral.take_unavailable\",\n\t\t\tmessage:\n\t\t\t\t\"Ephemeral flow stores require StorageTrait.take() for atomic single-consume semantics\",\n\t\t\tsource: \"storage.ephemeral\",\n\t\t});\n\t}\n\n\treturn store.take.bind(store);\n}\n\nasync function executeStorageOperation<T>(\n\toperation: () => T | Promise<T>,\n): Promise<T> {\n\ttry {\n\t\treturn await operation();\n\t} catch (error) {\n\t\tif (error instanceof ClientError) {\n\t\t\tthrow error;\n\t\t}\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Storage,\n\t\t\tcode: \"storage.ephemeral.io_failed\",\n\t\t\tmessage: \"The ephemeral flow store operation failed\",\n\t\t\tsource: \"storage.ephemeral\",\n\t\t\tcause: error,\n\t\t});\n\t}\n}\n\nfunction decodeStoredValue<T>(codec: Codec<T>, value: string): T {\n\ttry {\n\t\treturn codec.decode(value);\n\t} catch (error) {\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Protocol,\n\t\t\tcode: \"storage.ephemeral.invalid_payload\",\n\t\t\tmessage: \"The ephemeral flow store payload is invalid\",\n\t\t\tsource: \"storage.ephemeral\",\n\t\t\tcause: error,\n\t\t});\n\t}\n}\n\n/**\n * Create a typed ephemeral flow-state store backed by a low-level `StorageTrait`.\n *\n * Intended for short-lived browser/session coordination state such as pending\n * redirects or callback fragments.\n */\nexport function createEphemeralFlowStore<T>(\n\toptions: CreateEphemeralFlowStoreOptions<T>,\n): EphemeralFlowStore<T> {\n\tconst codec = options.codec ?? createJsonCodec<T>();\n\tconst storeTake = requireRecordStoreTake(options.store);\n\n\tasync function load(): Promise<T | null> {\n\t\tconst raw = await executeStorageOperation(() =>\n\t\t\toptions.store.get(options.key),\n\t\t);\n\t\treturn raw === null ? null : decodeStoredValue(codec, raw);\n\t}\n\n\tasync function save(value: T): Promise<void> {\n\t\tawait executeStorageOperation(() =>\n\t\t\toptions.store.set(options.key, codec.encode(value)),\n\t\t);\n\t}\n\n\tasync function consume(): Promise<T | null> {\n\t\tconst raw = await executeStorageOperation(() => storeTake(options.key));\n\t\treturn raw === null ? null : decodeStoredValue(codec, raw);\n\t}\n\n\tasync function clear(): Promise<void> {\n\t\tawait executeStorageOperation(() => options.store.remove(options.key));\n\t}\n\n\treturn {\n\t\tload,\n\t\tsave,\n\t\tconsume,\n\t\tclear,\n\t};\n}\n\n/**\n * Create a typed keyed ephemeral flow-state store backed by a low-level\n * `StorageTrait`.\n *\n * Intended for short-lived browser/session coordination state where multiple\n * pending records must coexist and be consumed independently.\n */\nexport function createKeyedEphemeralFlowStore<T>(\n\toptions: CreateKeyedEphemeralFlowStoreOptions<T>,\n): KeyedEphemeralFlowStore<T> {\n\tconst codec = options.codec ?? createJsonCodec<T>();\n\tconst storeTake = requireRecordStoreTake(options.store);\n\n\tasync function load(key: string): Promise<T | null> {\n\t\tconst raw = await executeStorageOperation(() =>\n\t\t\toptions.store.get(resolveStorageKey(options.keyPrefix, key)),\n\t\t);\n\t\treturn raw === null ? null : decodeStoredValue(codec, raw);\n\t}\n\n\tasync function save(key: string, value: T): Promise<void> {\n\t\tawait executeStorageOperation(() =>\n\t\t\toptions.store.set(\n\t\t\t\tresolveStorageKey(options.keyPrefix, key),\n\t\t\t\tcodec.encode(value),\n\t\t\t),\n\t\t);\n\t}\n\n\tasync function take(key: string): Promise<T | null> {\n\t\tconst raw = await executeStorageOperation(() =>\n\t\t\tstoreTake(resolveStorageKey(options.keyPrefix, key)),\n\t\t);\n\t\treturn raw === null ? null : decodeStoredValue(codec, raw);\n\t}\n\n\tasync function clear(key: string): Promise<void> {\n\t\tawait executeStorageOperation(() =>\n\t\t\toptions.store.remove(resolveStorageKey(options.keyPrefix, key)),\n\t\t);\n\t}\n\n\treturn {\n\t\tload,\n\t\tsave,\n\t\ttake,\n\t\tclear,\n\t};\n}\n\nimport { ClientError, ClientErrorKind } from \"../errors\";\n","import { SYMBOL_OBSERVABLE } from \"../compat\";\nimport { createSignal, type ReadableSignalTrait } from \"../signals\";\n\nexport const OnceAsyncLockState = {\n\tInit: \"init\",\n\tRunning: \"running\",\n\tSuccess: \"success\",\n\tError: \"error\",\n} as const;\n\nexport type OnceAsyncLockState =\n\t(typeof OnceAsyncLockState)[keyof typeof OnceAsyncLockState];\n\nexport type OnceAsyncLockInit = {\n\treadonly state: typeof OnceAsyncLockState.Init;\n\treadonly promise?: never;\n};\n\nexport type OnceAsyncLockRunning = {\n\treadonly state: typeof OnceAsyncLockState.Running;\n\treadonly promise: Promise<unknown>;\n};\n\nexport type OnceAsyncLockSuccess<T> = {\n\treadonly state: typeof OnceAsyncLockState.Success;\n\treadonly data: T;\n};\n\nexport type OnceAsyncLockError<E> = {\n\treadonly state: typeof OnceAsyncLockState.Error;\n\treadonly error: E;\n};\n\nexport type OnceAsyncLock<T, E> =\n\t| OnceAsyncLockInit\n\t| OnceAsyncLockRunning\n\t| OnceAsyncLockSuccess<T>\n\t| OnceAsyncLockError<E>;\n\nexport type OnceAsyncLockCallable<\n\tF extends (...args: any[]) => PromiseLike<any>,\n\tE = unknown,\n> = F &\n\tOnceAsyncLock<Awaited<ReturnType<F>>, E> &\n\tReadableSignalTrait<OnceAsyncLock<Awaited<ReturnType<F>>, E>>;\n\nexport function createOnceAsyncLockCallable<\n\tF extends (...args: any[]) => PromiseLike<any>,\n\tE = unknown,\n>(fn: F): OnceAsyncLockCallable<F, E> {\n\tconst internalStateSignal = createSignal({\n\t\tstate: OnceAsyncLockState.Init,\n\t} as OnceAsyncLock<Awaited<ReturnType<F>>, E>);\n\n\tconst coreFn = async function (\n\t\tthis: any,\n\t\t...args: Parameters<F>\n\t): Promise<Awaited<ReturnType<F>>> {\n\t\tconst internalState = internalStateSignal.get();\n\t\tif (internalState.state === OnceAsyncLockState.Running) {\n\t\t\treturn internalState.promise as Promise<Awaited<ReturnType<F>>>;\n\t\t}\n\t\tif (internalState.state === OnceAsyncLockState.Success) {\n\t\t\treturn internalState.data;\n\t\t}\n\n\t\tlet resolvePromise!: (value: Awaited<ReturnType<F>>) => void;\n\t\tlet rejectPromise!: (reason: any) => void;\n\n\t\tconst promise = new Promise<Awaited<ReturnType<F>>>((res, rej) => {\n\t\t\tresolvePromise = res;\n\t\t\trejectPromise = rej;\n\t\t});\n\t\tpromise.catch(() => undefined);\n\n\t\tinternalStateSignal.set({ state: OnceAsyncLockState.Running, promise });\n\n\t\ttry {\n\t\t\tconst result = await fn.apply(this, args);\n\t\t\tinternalStateSignal.set({\n\t\t\t\tstate: OnceAsyncLockState.Success,\n\t\t\t\tdata: result,\n\t\t\t});\n\t\t\tresolvePromise(result);\n\t\t\treturn result;\n\t\t} catch (err) {\n\t\t\tinternalStateSignal.set({\n\t\t\t\tstate: OnceAsyncLockState.Error,\n\t\t\t\terror: err as E,\n\t\t\t});\n\t\t\trejectPromise(err);\n\t\t\tthrow err;\n\t\t}\n\t};\n\n\treturn new Proxy(coreFn, {\n\t\tget(target, prop, receiver) {\n\t\t\t// if accessing state, promise, data, error, map directly from internalState\n\t\t\tconst internalState = internalStateSignal.get();\n\t\t\tif (prop in internalState) {\n\t\t\t\treturn Reflect.get(internalState, prop);\n\t\t\t}\n\t\t\tif (\n\t\t\t\tprop === \"get\" ||\n\t\t\t\tprop === \"watchStream\" ||\n\t\t\t\tprop === SYMBOL_OBSERVABLE\n\t\t\t) {\n\t\t\t\tconst value = Reflect.get(\n\t\t\t\t\tinternalStateSignal,\n\t\t\t\t\tprop,\n\t\t\t\t\tinternalStateSignal,\n\t\t\t\t);\n\t\t\t\treturn typeof value === \"function\"\n\t\t\t\t\t? value.bind(internalStateSignal)\n\t\t\t\t\t: value;\n\t\t\t}\n\t\t\t// other properties (like function's name, length, toString, etc.) retain original function behavior\n\t\t\treturn Reflect.get(target, prop, receiver);\n\t\t},\n\t\t// intercept assignment operations to ensure state is read-only and prevent malicious or accidental modifications from outside\n\t\tset() {\n\t\t\treturn false; // in strict mode, this will throw a TypeError, preventing modification\n\t\t},\n\t}) as unknown as OnceAsyncLockCallable<F, E>;\n}\n","/**\n * Returns `true` for loopback HTTP URLs that browsers and local tooling often\n * permit during development flows.\n */\nexport function isLoopbackHttpUrl(url: URL): boolean {\n\treturn (\n\t\turl.protocol === \"http:\" &&\n\t\t(url.hostname === \"localhost\" ||\n\t\t\turl.hostname === \"127.0.0.1\" ||\n\t\t\turl.hostname === \"::1\" ||\n\t\t\turl.hostname === \"[::1]\")\n\t);\n}\n"],"mappings":";;;;;;;;;;;AAoCA,IAAa,6BAAb,MAAa,2BAEb;CAEW;CACA;CACA;CAHV,YACC,IACA,OACA,YACC;EAHQ,KAAA,KAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;EAET,OAAO,OAAO,IAAI;CACnB;CAEA,OAAc,OACb,OAC0C;EAC1C,OAAO,IAAI,2BACV,OAAO,MAAMA,GAAO,GACpB,OAAO,OACP,OAAO,aAAa,OAAO,OAAO,MAAM,UAAU,IAAI,KAAA,CACvD;CACD;CAEA,OAAc,WACb,QACqD;EACrD,OAAO,OAAO,KAAK,UAAU,2BAA2B,OAAO,KAAK,CAAC;CACtE;AACD;;AAOA,MAAa,mBAAmB;CAC/B,WAAW;CACX,QAAQ;CACR,SAAS;AACV;;AAgBA,MAAa,aAAa;;CAEzB,SAAS;;CAET,SAAS;AACV;;AAKA,IAAa,0BAAb,cAA6C,MAAM;CAClD,YAAY,SAAiB;EAC5B,MAAM,OAAO;EACb,KAAK,OAAO;CACb;AACD;AAiHA,SAAgB,0BACf,OACmC;CACnC,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS;AAChE;AAEA,SAAgB,6BACf,OACsC;CACtC,OACC,OAAO,UAAU,YACjB,UAAU,QACV,gBAAgB,SAChB,0BAA0B,MAAM,UAAU;AAE5C;;AAWA,MAAa,kBAAkB;;CAE9B,SAAS;;CAET,UAAU;;CAEV,SAAS;;CAET,UAAU;AACX;;;;;;;;;AA6CA,MAAa,0BAA0B;CACtC,SAAS;CACT,OAAO;CACP,SAAS;AACV;;;;;;;;AAgCA,SAAgB,6BAGf,OACA,4BAA2C,IAAI,IAAI,GACnB;CAChC,QAAQ,MAAM,aAAd;EACC,KAAK,wBAAwB,SAC5B,OAAO;EAER,KAAK,wBAAwB;GAC5B,KAAK,MAAM,eAAe,MAAM,cAC/B,UAAU,IAAI,YAAY,IAAI,WAAW;GAE1C,OAAO;EAER,KAAK,wBAAwB;GAC5B,UAAU,MAAM;GAChB,KAAK,MAAM,eAAe,MAAM,cAC/B,UAAU,IAAI,YAAY,IAAI,WAAW;GAE1C,OAAO;EAER,SAAS;GACR,MAAM,cAAqB,MAAM;GACjC,MAAM,IAAI,wBACT,qCAAqC,OAAO,WAAW,GACxD;EACD;CACD;AACD;;;;AChWA,SAAgB,cAAc,OAA8B;CAC3D,IAAI,iBAAiB,aACpB,OAAO;EACN,WAAW,MAAM;EACjB,WAAW,MAAM;EACjB,WAAW,MAAM;EACjB,UAAU,MAAM;CACjB;CAGD,OAAO,EACN,WAAW,iBAAiB,QAAQ,MAAM,OAAO,OAAO,MACzD;AACD;;;ACtBA,MAAa,wBAAwB;CACpC,oBAAoB;CACpB,oBAAoB;AACrB;AAiBA,SAAgB,yBAAyB,OAA2B;CAGnE,MAAM,WADL,WAAW,WAC2B,UAAU;CACjD,IAAI,OAAO,aAAa,YACvB,OAAO,SAAS,KAAK,KAAK;CAG3B,IAAI,OAAO,WAAW,SAAS,YAAY;EAC1C,IAAI,SAAS;EACb,KAAK,MAAM,QAAQ,OAClB,UAAU,OAAO,aAAa,IAAI;EAEnC,OAAO,WAAW,KAAK,MAAM;CAC9B;CAEA,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;CAG1D,IAAI,OAAO,mBAAmB,SAAS,YACtC,OAAO,kBAAkB,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;CAGvD,MAAM,IAAI,YAAY;EACrB,MAAM,gBAAgB;EACtB,MAAM,sBAAsB;EAC5B,SAAS;EACT,QAAQ;CACT,CAAC;AACF;AAEA,SAAgB,yBAAyB,OAA2B;CACnE,MAAM,wBACL,WAAW;CACZ,IAAI,OAAO,sBAAsB,eAAe,YAC/C,OAAO,sBAAsB,WAAW,KAAK;CAG9C,IAAI,OAAO,WAAW,SAAS,YAAY;EAC1C,MAAM,SAAS,WAAW,KAAK,KAAK;EACpC,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;EAC1C,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,GACnD,MAAM,SAAS,OAAO,WAAW,KAAK;EAEvC,OAAO;CACR;CAEA,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;CAG1D,IAAI,OAAO,mBAAmB,SAAS,YACtC,OAAO,sBAAsB,KAAK,kBAAkB,KAAK,OAAO,QAAQ,CAAC;CAG1E,MAAM,IAAI,YAAY;EACrB,MAAM,gBAAgB;EACtB,MAAM,sBAAsB;EAC5B,SAAS;EACT,QAAQ;CACT,CAAC;AACF;;;AClFA,gBAAuB,8BACtB,UACmC;CACnC,MAAM,UAAU,IAAI,IACnB,SAAS,KAAK,SAAS,UAAU,CAChC,OACA,QAAQ,MAAM,WAAW;EAAE;EAAO;CAAM,EAAW,CACpD,CAAC,CACF;CACA,OAAO,QAAQ,OAAO,GAAG;EACxB,MAAM,OAAO,MAAM,QAAQ,KAAK,QAAQ,OAAO,CAAC;EAChD,QAAQ,OAAO,KAAK,KAAK;EACzB,MAAM,KAAK;CACZ;AACD;;;ACQA,SAAgB,OACf,OACA,SACW;CACX,IAAI,SAAS,aAAa,MACzB,OAAOC,SAAc,OAAO,EAC3B,UAAU,KACX,CAAC;CAGF,OAAOA,SAAc,KAAK;AAC3B;AAEA,SAAgB,4BACf,OACA,SACW;CACX,IAAI;EACH,IAAI,SAAS,aAAa,MACzB,OAAO,OAAO,OAAO,EAAE,UAAU,KAAK,CAAC;EAGxC,OAAO,OAAO,KAAK;CACpB,SAAS,OAAO;EACf,IAAI,+BAA+B,KAAK,GACvC,OAAO;EAGR,MAAM;CACP;AACD;AAEA,SAAgB,sBACf,UACA,IACU;CACV,OAAOC,wBAA6B,kBAAkB,QAAQ,GAAG,EAAE;AACpE;AAEA,SAAS,+BAA+B,OAAyB;CAChE,OACC,iBAAiB,SACjB,MAAM,QAAQ,SAAS,8CAA8C;AAEvE;;;AC9DA,IAAsB,yBAAtB,MAAwE;CAKvE,CAAC,kBAAwB;EACxB,KAAK,QAAQ;CACd;AACD;AAEA,IAAM,gCAAN,cAA4C,uBAAuB;CAClE,kBAAmC,aAAa,KAAK;CAErD,IAAI,YAAqB;EACxB,OAAO,KAAK,gBAAgB,IAAI;CACjC;CAEA,UAAU,UAAkC;EAC3C,IAAI,KAAK,gBAAgB,IAAI,GAAG;GAC/B,SAAS;GACT,aAAa,KAAA;EACd;EAEA,MAAM,eAAe,KAAK,KAAK,eAAe,CAAC,CAC7C,KACA,QAAQ,cAAiC,SAAS,GAClD,KAAK,CAAC,CACP,CAAC,CACA,UAAU,EACV,MAAM,SACP,CAAC;EACF,aAAa;GACZ,aAAa,YAAY;EAC1B;CACD;CAEA,UAAgB;EACf,IAAI,KAAK,gBAAgB,IAAI,GAC5B;EAGD,KAAK,gBAAgB,IAAI,IAAI;CAC9B;CAEA,UAAgB;EACf,KAAK,QAAQ;CACd;AACD;AAEA,SAAgB,+BAAuD;CACtE,OAAO,IAAI,8BAA8B;AAC1C;;;AChDA,MAAa,kBAAkBC,KAAW,QAAQ,CAAC,CAAC,QAAQ,OAAO,YAClE,UAAU,SAAS,KAAK,KAAK,OAC1B,QAAQ,OAAO,wBAAwB,IACvC,IACJ;AAEA,MAAa,sBAAsB;AAEnC,MAAa,0BAA0BA,KAAW,QAAQ,CAAC,CAAC,QAC1D,OAAO,YACP,kBAAkB,SAAS,KAAK,KAAK,OAClC,QAAQ,OAAO,iCAAiC,IAChD,IACL;AAEA,MAAa,2BAA2BA,KAAW,QAAQ,CAAC,CAAC,QAC3D,OAAO,YACP,mBAAmB,SAAS,KAAK,KAAK,OACnC,QAAQ,OAAO,wBAAwB,IACvC,IACL;;;ACbA,IAAa,0BAAb,MAEA;CAIgC;CAH/B,aAAa,IAAI,cAAuB,CAAC;CACzC;CAEA,YAAY,SAAsD;EAAnC,KAAA,UAAA;EAC9B,IAAI,QAAQ,WAAW,GACtB,KAAK,QAAQ,IAAI,kBAAkB;EAIpC,IAAI,QAAQ,WAAW,GACtB,KAAK,QAAQ,QAAQ;EAItB,KAAK,MAAM,UAAU,SACpB,IAAI,OAAO,yBAAyB;GACnC,KAAK,QAAQ;GACb;EACD;EAGD,MAAM,WAAW,IAAI,kBAAkB;EAEvC,MAAM,GAAG,OAAO,CAAC,CACf,KAAK,KAAK,CAAC,GAAG,UAAU,KAAK,UAAU,CAAC,CAAC,CACzC,WAAW,EAAE,aAAa;GAC1B,SAAS,QAAQ,MAAM;EACxB,CAAC;EAEF,KAAK,QAAQ;CACd;CACA,IAAI,0BAAmC;EACtC,OAAO,KAAK,MAAM;CACnB;CACA,IAAI,oBAA6C;EAChD,OAAO,KAAK,MAAM;CACnB;CACA,IAAI,SAAkB;EACrB,OAAO,KAAK,MAAM;CACnB;CACA,wBACC,UACkB;EAClB,OAAO,KAAK,MAAM,wBAAwB,QAAQ;CACnD;CACA,+BAAqC;EACpC,KAAK,MAAM,6BAA6B;CACzC;CAEA,UAAU;EACT,KAAK,WAAW,KAAK,IAAI;CAC1B;CAEA,CAAC,kBAAkB;EAClB,KAAK,QAAQ;CACd;CAEA,CAAC,qBAAoE;EACpE,OAAO,KAAK,MAAM,kBAAkB,CAAC;CACtC;AACD;;;;;;;;;;;;;;;AAgBA,SAAgB,8BACf,GAAG,SACwC;CAC3C,OAAO,IAAI,wBACV,QAAQ,QAAQ,MAAmC,CAAC,CAAC,CAAC,CACvD;AACD;;;;;;;;AC3FA,SAAgB,eACf,SACA,SACyB;CACzB,OAAO,iBAAiB,SAAS,SAAS,OAAO;AAClD;;;ACQA,SAAgB,eACf,SACmB;CACnB,OAAO,WAAW;EACjB,GAAG;EACH,SAAS,YAAY,KAAK,QAAQ,OAAO,OAAO,CAAC;CAClD,CAAC;AACF;;;;ACZA,MAAa,kCAAkC;;AAW/C,SAAgB,8BAGf,MAC0D;CAC1D,MAAM,MAAO,OACZ;CAED,IAAI,QAAQ,KAAA,KAAa,QAAQ,MAChC;CAED,OAAO;AACR;;AAGA,SAAgB,+BAGf,MACA,OAC0B;CAC1B,MAAM,OAAgC,EAAE,GAAI,QAAQ,CAAC,EAAG;CACxD,MAAM,WACJ,KAAA,uBAEgB,CAAC;CACnB,KAAK,mCAAmC;EAAE,GAAG;EAAU,GAAG;CAAM;CAChE,OAAO;AACR;;;ACvCA,SAAgB,oCACf,WACA,SACe;CACf,OAAO,OAAO,OAAO,SAAS;EAC7B,IAAI,CAAE,MAAM,QAAQ,UAAU,OAAO,IAAI,GACxC,OAAO,UAAU,OAAO,IAAI;EAE7B,MAAM,gBACL,eAAe,QAAQ,gBACpB,MAAM,QAAQ,cAAc,UAAU,IACtC,QAAQ,cAAc,IAAI;EAC9B,IAAI,CAAC,eACJ,OAAO,UAAU,OAAO,IAAI;EAE7B,MAAM,UAAU,IAAI,QACnB,OAAO,YAAY,eAAe,iBAAiB,UAChD,MAAM,UACN,KAAA,CACJ;EACA,IAAI,MAAM,SACT,IAAI,QAAQ,KAAK,OAAO,CAAC,CAAC,SAAS,OAAO,QAAQ;GACjD,QAAQ,IAAI,KAAK,KAAK;EACvB,CAAC;EAEF,QAAQ,IAAI,iBAAiB,aAAa;EAC1C,OAAO,UAAU,OAAO;GACvB,GAAG;GACH;EACD,CAAC;CACF;AACD;;;ACPA,IAAa,gBAAb,MAAa,cAA4C;CAE9C;CACQ;CACA;CAHlB,YACC,MACA,cACA,SACC;EAHQ,KAAA,OAAA;EACQ,KAAA,eAAA;EACA,KAAA,UAAA;CACf;CAEH,OAAO,MAAM,SAAiD;EAC7D,MAAM,OAAO,QAAQ,KAAK,KAAK;GAC9B,SAAS;GACT,WAAW,QAAQ;GACnB,YAAY,GACV,wBAAwB,gBAAgB,QAAQ,KAClD;EACD,CAAC;EACD,IAAI,QAAQ,iBACX,KAAK,cAAc,QAAQ,iBAAiB,EAC3C,YAAY,mCACb,CAAC;EAEF,MAAM,gBAAgB,IAAI,cACzB,MACA,QAAQ,aACR,QAAQ,MACT;EACA,cAAc,cAAc;EAC5B,OAAO;CACR;CAEA,mBAAmB,YAAkC;EACpD,KAAK,KAAK,cAAc,YAAY,EACnC,YAAY,mCACb,CAAC;CACF;CAEA,SAAS,MAAc,QAA+B;EACrD,KAAK,QAAQ,wBAAwB,OAAO,aAAa,MAAM;GAC9D,WAAW;GACX,GAAI,UAAU,CAAC;EAChB,CAAC;CACF;CAEA,YAAY,OAAgB,QAA+B;EAC1D,KAAK,QAAQ,wBAAwB,OAAO,aAAa,OAAO;GAC/D,GAAG,cAAc,KAAK;GACtB,GAAI,UAAU,CAAC;EAChB,CAAC;CACF;CAEA,gBAAsB;EACrB,KAAK,QAAQ,wBAAwB,SAAS,aAAa,IAAI;CAChE;CAEA,YAAY,SAAuC;EAClD,KAAK,QACJ,wBAAwB,OACxB,YAAY,cAAc,aAAa,OAAO,aAAa,OAC3D,EAAE,QAAQ,CACX;CACD;CAEA,QACC,MACA,OACA,QACO;EACP,KAAK,aAAa,QAAQ,OAAO;GAChC;GACA,IAAI,KAAK,aAAa,KAAK,IAAI;GAC/B,MAAM,KAAK;GACX;GACA,QAAQ,KAAK;GACb;EACD,CAAC;CACF;AACD;AAMA,SAAgB,aACf,SACiB;CACjB,MAAM,gBAAgB,cAAc,MAAM,OAAO;CACjD,IAAI;EACH,MAAM,SAAS,QAAQ,QAAQ,aAAa;EAC5C,IAAI,UAAU,MAAM,GACnB,OAAO,OAAO,MACZ,UAAU,kBAAkB,eAAe,KAAK,IAChD,UACA,cAAc,eAAe,OAAO,QAAQ,sBAAsB,CACpE;EAED,OAAO,kBAAkB,eAAe,MAAM;CAC/C,SAAS,OAAO;EACf,OAAO,cAAc,eAAe,OAAO,QAAQ,sBAAsB;CAC1E;AACD;AAEA,SAAS,kBAAqB,eAA8B,QAAc;CACzE,cAAc,YAAY,WAAW;CACrC,OAAO;AACR;AAEA,SAAS,cACR,eACA,OACA,wBACQ;CACR,MAAM,cAAc,yBACjB,uBAAuB,OAAO,EAAE,MAAM,cAAc,KAAK,CAAC,IAC1D;CACH,IAAI,uBAAuB,aAC1B,YAAY,mBAAmB,cAAc,IAAI;CAElD,cAAc,YAAY,WAAW;CACrC,cAAc,YAAY,QAAQ;CAClC,MAAM;AACP;;;AC5HA,SAAgB,gCAGd,SAA0E;CAC3E,QAAQ,GAAG,iBAET,QACA,YAII;EACJ,MAAM,aAAa,OAAO,QAAQ,IAAI;EACtC,MAAM,UAAU,QAAsB;GACrC;GACA;EACD,CAAC;EACD,OAAO,SAAuB,GAAG,MAAsB;GACtD,MAAM,kBAAkB,QAAQ,KAAK,MAAM;IAC1C;IACA;GACD,CAAC;GACD,OAAO,aAAa;IACnB,aAAa,gBAAgB;IAC7B,MAAM,gBAAgB;IACtB,MAAM,gBAAgB,QAAQ;IAC9B,QAAQ,gBAAgB;IACxB,iBAAiB,gBAAgB;IACjC,WAAW,gBAAgB;IAC3B,wBAAwB,gBAAgB;IACxC,UAAU,SAER,OAIC,KAAK,MAAM,GAAG,MAAM,IAAI;GAC5B,CAAC;EACF;CACD;AACF;;;ACrEA,IAAa,2BAAb,MAAwE;CACvE,OAAO,OAA2B;EACjC,MAAM,QAAQ,IAAI,MAAM,OAAO,IAAI,MAAM;EACzC,MAAM,UAAU;GACf,GAAI,MAAM,UAAU,CAAC;GACrB,gBAAgB,MAAM,KAAK,wBAAwB,EAClD,YAAY,mCACb,CAAC;EACF;EACA,QAAQ,MAAM,OAAd;GACC,KAAK;IACJ,QAAQ,MAAM,OAAO,OAAO;IAC5B;GACD,KAAK;IACJ,QAAQ,KAAK,OAAO,OAAO;IAC3B;GACD,KAAK;IACJ,QAAQ,KAAK,OAAO,OAAO;IAC3B;GACD,KAAK,SACJ,QAAQ,MAAM,OAAO,OAAO;EAE9B;CACD;AACD;AAEA,SAAgB,iCAA2D;CAC1E,OAAO,IAAI,yBAAyB;AACrC;;;;;;;;;;ACPA,IAAa,qBAAb,MAAkE;CAMlC;CAL/B,SAAmB;CACnB,WAA8B,IAAI,MAA0B;CAC5D,qBACC,IAAI,eAA0C;CAE/C,YAAY,QAA2B,KAAK;EAAb,KAAA,QAAA;CAAc;CAE7C,IAAI,cAA2D;EAC9D,OAAO,KAAK;CACb;CAEA,IAAI,UAAyC;EAC5C,OAAO,KAAK,SAAS,QAAQ;CAC9B;CAEA,OAAO,OAA2B;EACjC,MAAM,EAAE,MAAM,GAAG,qBAAqB;EACtC,MAAM,QAA4B;GACjC,GAAG;GACH,IAAI,KAAK;GACT,eAAe,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,YAAY;GAC9C,MAAM;IACL,IAAI,KAAK;IACT,GAAI,KAAK,SAAS,EAAE,UAAU,KAAK,OAAO,GAAG,IAAI,CAAC;GACnD;GACA,gBAAgB,KAAK,wBAAwB,EAC5C,YAAY,mCACb,CAAC;EACF;EACA,KAAK,SAAS,QAAQ,KAAK;EAC3B,IAAI,KAAK,SAAS,OAAO,KAAK,OAC7B,KAAK,SAAS,QAAQ;EAEvB,KAAK,mBAAmB,KAAK,KAAK;CACnC;CAEA,QAAc;EACb,IAAI,KAAK,SAAS,OAAO,GAAG;GAC3B,KAAK,SAAS,MAAM;GACpB,KAAK,mBAAmB,KAAK,IAAI;EAClC;CACD;AACD;AAEA,SAAgB,yBAAyB,QAAQ,KAAyB;CACzE,OAAO,IAAI,mBAAmB,KAAK;AACpC;;;ACzCA,MAAa,2BAA2B,IAAI,2BAE1C,0BAA0B;;;;;;;;AA4B5B,SAAgB,yBAGqC;CACpD,OAAO,eAAe,qBACrB,SAIwC;EACxC,MAAM,SAAS,MAAM,QAAQ,cAAc,KAAK;EAChD,OAAO,OAAO,OAAO,KAAA,IAAY,OAAO;CACzC;AACD;;;;;;;;;;;;;;;;;;;;;;;AAiCA,IAAa,yBAAb,MAAa,uBAEX;CAMS;CACA;;CALV;CAEA,YACC,WACA,aACA,QACC;EAFQ,KAAA,cAAA;EACA,KAAA,SAAA;EAET,KAAK,aAAa;CACnB;;CAGA,OAAO,cACN,WACA,UAAqD,CAAC,GACjB;EACrC,OAAO,IAAI,uBACV,WACA,QAAQ,aACR,QAAQ,MACT;CACD;CAEA,MAAM,0BACL,KACqC;EACrC,OACC,KAAK,WAAW,QACf,MAAM,KAAK,QAAQ,0BAA0B,GAAG;CAEnD;CACA,MAAM,oBACL,KACA,cAGsC;EACtC,OACE,MAAM,KAAK,0BAA0B,GAAG,KAAO,MAAM,aAAa;CAErE;CAEA,MAAM,2BAAuE;EAC5E,OAAO,KAAK,eAAgB,MAAM,KAAK,QAAQ,yBAAyB;CACzE;CAEA,MAAM,mBACL,cACiC;EACjC,OAAQ,MAAM,KAAK,yBAAyB,KAAO,MAAM,aAAa;CACvE;AACD;AAEA,SAAgB,8BAOf,WAKA,UAA4D,CAAC,GACF;CAC3D,OAAO;EACN,SAAS;EACT,aACC,gBACA,gBACI;GACJ,MAAM,SACL,QAAQ,UACP,gBAAgB,IAChB,0BACA,IACD,KACA,KAAA;GACD,MAAM,WACL,OAAO,cAAc,aAAa,UAAU,IAAI;GACjD,OAAO,uBAAuB,cAAc,UAAU;IACrD;IACA,aAAa,QAAQ,eAAe,eAAe,KAAA;GACpD,CAAC;EACF;EACA,MAAM,CACL,CAAC,IAAI,qBAAqB,GAAG,qBAAqB,GAClD,CAAC,IAAI,qBAAqB,GAAG,iBAAiB,CAC/C;CACD;AACD;AAEA,SAAgB,6BAOf,SAC4C;CAC5C,OAAO,QAAQ,SAAS,IACvB,0BACA,IACD;AACD;;;;;;;;;AChKA,IAAsB,yBAAtB,MAME;CACD;CACA;CAIA,YACC,MACA,qBAAuD,CAAC,GACvD;EACD,KAAK,OAAO;EACZ,KAAK,qBAAqB,mBAAmB,KAAK,eACjD,OAAO,OAAO,EAAE,GAAG,WAAW,CAAC,CAChC;CACD;;;;;;;;;CAYA,MAAa,YAEX;EACD,OAAO;GACN,aAAa,KAAK;GAClB,aAAa,MAAM,KAAK,KAAK,yBAAyB;IACrD,MAAM,IAAI,wBAAwB,yBAAyB;GAC5D,CAAC;GACD,oBAAoB,MAAM,KAAK,KAAK,oBACnC,4BACM;IACL,MAAM,IAAI,wBAAwB,gCAAgC;GACnE,CACD;GACA,mBAAmB,MAAM,KAAK,KAAK,oBAClC,2BACM;IACL,MAAM,IAAI,wBACT,yCACD;GACD,CACD;GACA,iBAAiB,MAAM,KAAK,KAAK,oBAChC,mBACA,sBACD;GACA,cAAc,MAAM,KAAK,uBAAuB;GAChD,gBAAgB,CAAC,GAAG,KAAK,kBAAkB;EAC5C;CACD;;;;CAiBA,MAAa,yBAA+D;EAE3E,OAAO,CAAC,IAAG,MADgB,KAAK,qBAAqB,EAAA,CAC7B,OAAO,CAAC;CACjC;;;;;CAKA,MAAM,QACL,MACgD;EAChD,MAAM,YAAY,MAAM,KAAK,gBAAgB;GAC5C,GAAG;GACH,eAAe,KAAK,sBAAsB,IAAI;EAC/C,CAAC;EACD,IAAI,CAAC,WACJ,OAAO,EAAE,SAAS,gBAAgB,QAAQ;EAE3C,MAAM,SAAS,MAAM,KAAK,kBAAkB,WAAW,IAAI;EAE3D,OAAO,KAAK,iBAAiB,MAAM,WAAW,MAAM;CACrD;CAEA,iBACC,MACA,WACA,QACuC;EACvC,IAAI,WAAW,MAAM;GACpB,KAAK,gBAAgB,MAAM,SAAS;GACpC,OAAO;IAAE,SAAS,gBAAgB;IAAU,aAAa;GAAU;EACpE;EACA,IAAI,WAAW,OACd,OAAO;GAAE,SAAS,gBAAgB;GAAS,aAAa;EAAU;EAEnE,OAAO;GACN,SAAS,gBAAgB;GACzB,aAAa;GACb,UAAU;EACX;CACD;;;;;;CASA,MAAM,kBAAgE;EACrE,MAAM,OAAO,MAAM,KAAK,UAAU;EAClC,OAAO,KAAK,wBAAwB,IAAI;CACzC;CAEA,MAAM,wBACL,MAC+C;EAC/C,OAAO,MAAM;GACZ,MAAM,OAAO,MAAM,KAAK,QAAQ,IAAI;GAEpC,IAAI,KAAK,YAAY,gBAAgB,SACpC,OAAO;IACN,SAAS,gBAAgB;IACzB,aAAa,KAAK;GACnB;GAED,IAAI,KAAK,YAAY,gBAAgB,UACpC;GAED,IAAI,KAAK,YAAY,gBAAgB,SACpC,OAAO;GAER,IAAI,KAAK,YAAY,gBAAgB,UACpC,OAAO;EAET;CACD;CAEA,OAAe,sBACd,MACkD;EAClD,MAAM,UAAU;GACf,aAAa,KAAK;GAClB,cAAc,KAAK;GACnB,gBAAgB,KAAK;GACrB,aAAa,KAAK;EACnB;EACA,MAAM,UAAU,KAAK,aACnB,QACC,gBACA,CAAC,KAAK,eAAe,MACnB,eAAe,WAAW,kBAAkB,YAAY,EAC1D,CACF,CAAC,CACA,IACA,OACC,gBACuD;GAEvD,OAAO;IAAE;IAAa,WAAA,MADE,KAAK,mBAAmB,aAAa,OAAO;GACpC;EACjC,CACD;EAED,WAAW,MAAM,EAChB,aACA,eACI,8BAA8B,OAAO,GAAG;GAC5C,IAAI,WAAW;IACd,KAAK,gBAAgB,MAAM,WAAW;IACtC;GACD;GACA,MAAM;EACP;CACD;CAEA,gBACC,MACA,aACO;EACP,IACC,KAAK,eAAe,MAClB,eAAe,WAAW,kBAAkB,YAAY,EAC1D,GAEA;EAED,KAAK,eAAe,KACnB,OAAO,OAAO;GACb,eAAe,YAAY;GAC3B,QAAQ,iBAAiB;EAC1B,CAAC,CACF;CACD;AACD;;;;;;;;;;;;;;;ACvPA,IAAa,0BAAb,MAAa,gCAMH,uBAAmE;CAC5E;CAMA,IAAI,cAA4B;EAC/B,OAAO,OAAO,OACb,CAAC,GACD,GAAG,KAAK,QAAQ,KAAK,WAAW,OAAO,WAAW,CACnD;CACD;CAEA,YACC,MACA,SAKC;EACD,MAAM,IAAI;EACV,KAAK,UAAU;CAChB;;CAGA,OAAO,aAON,MACA,UAKsE;EACtE,OAAO,IAAI,wBAAwB,MAAM,QAAQ;CAClD;CAEA,MAAgB,uBAEd;EACD,MAAM,sBAAM,IAAI,IAA8B;EAC9C,KAAK,MAAM,UAAU,KAAK,SACzB,KAAK,MAAM,eAAe,MAAM,OAAO,uBAAuB,GAC7D,IAAI,IAAI,YAAY,IAAI,WAAW;EAGrC,OAAO;CACR;AACD;;;;AC1DA,SAAS,aAGR,UAC8B;CAC9B,MAAM,4BAAY,IAAI,IAA8B;CACpD,KAAK,MAAM,WAAW,UACrB,6BACC;EACC,aAAa,QAAQ,eAAe,wBAAwB;EAC5D,cAAc,QAAQ;CACvB,GACA,SACD;CAED,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC;AAC9B;;AAGA,SAAS,mBACR,UACA,MACS;CACT,MAAM,QAAQ,KAAK,IAAI,SAAS,QAAQ,KAAK,MAAM;CACnD,IAAI,SAAS;CACb,OAAO,SAAS,SAAS,SAAS,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,IAC7D,UAAU;CAEX,OAAO;AACR;;;;;;;;AASA,IAAa,qCAAb,MAAa,2CAKH,uBAIR;CACD;CACA;CACA;CAEA,YACC,MACA,UACA,YACA,uBAAyD,CAAC,GACzD;EACD,MAAM,MAAM,oBAAoB;EAChC,KAAK,YAAY;EACjB,KAAK,aAAa,aAAa,QAAQ;EACvC,KAAK,eAAe,OAAO,OAAO,EACjC,YAAY,OAAO,OAAO,EAAE,GAAG,WAAW,CAAC,EAC5C,CAAC;CACF;;CAGA,OAAO,kBAMN,MACA,UACA,YACmE;EACnE,OAAO,IAAI,mCAAmC,MAAM,UAAU,UAAU;CACzE;;;;;CAMA,OAAO,oBAMN,MACA,iBACA,YACA,iBAIA,cACmE;EACnE,MAAM,gBAAgB,aAAa,eAAe;EAClD,MAAM,SAAS,mBACd,gBAAgB,uBAChB,aACD;EACA,MAAM,YAAY,IAAI,IACrB,cAAc,MAAM,GAAG,MAAM,CAAC,CAAC,KAAK,gBAAgB,YAAY,EAAE,CACnE;EACA,MAAM,YAAY,aAAa,eAAe,QAAQ,eACrD,UAAU,IAAI,WAAW,aAAa,CACvC;EACA,OAAO,IAAI,mCACV,MACA,iBACA,YACA,SACD;CACD;CAEA,IAAI,cAA0C;EAC7C,OAAO,KAAK;CACb;;CAGA,IAAI,WAA0D;EAC7D,OAAO,KAAK;CACb;;CAGA,IAAI,wBAAqD;EACxD,OAAO,KAAK;CACb;CAEA,uBAAgE;EAC/D,OAAO,IAAI,IACV,KAAK,WAAW,KAAK,gBAAgB,CAAC,YAAY,IAAI,WAAW,CAAC,CACnE;CACD;AACD;;;;;;;;;;;;;;;;;AC7IA,IAAa,2BAAb,MAAa,iCAKH,uBAAyD;CAClE;CAEA,IAAI,cAAkB;EACrB,OAAO,CAAC;CACT;CAEA,YACC,MACA,cACC;EACD,MAAM,IAAI;EACV,KAAK,qBAAqB;CAC3B;;CAGA,OAAO,iBAMN,MACA,cACyD;EACzD,OAAO,IAAI,yBAAyB,MAAM,YAAY;CACvD;CAEA,uBAAgE;EAC/D,MAAM,sBAAM,IAAI,IAA8B;EAC9C,KAAK,MAAM,eAAe,KAAK,oBAC9B,IAAI,IAAI,YAAY,IAAI,WAAW;EAEpC,OAAO;CACR;AACD;;;;;;;;;;AC3CA,SAAgB,kBACf,UACsB;CACtB,OAAO,IAAI,cAAc,QAAQ;AAClC;AAEA,SAAgB,qBAA8C;CAC7D,OAAO,IAAI,eAAkB;AAC9B;AAEA,SAAgB,yBACf,aAAa,UACU;CACvB,OAAO,IAAI,qBAAwB,UAAU;AAC9C;AAEA,SAAgB,yBAAiD;CAChE,OAAO,cAAc,oBAAoB,KAAK;AAC/C;AAEA,SAAgB,yBAAiD;CAChE,OAAO,cAAc,oBAAoB,KAAK;AAC/C;;;ACjCA,SAAgB,mBACf,OAC2C;CAC3C,IAAI,OAAO,UAAU,YAAY,UAAU,MAC1C,OAAO;CAER,IAAI,WAAW,SAAS,MAAM,iBAAiB,aAC9C,OAAO;CAER,OACC,aAAa,SACb,OAAO,MAAM,YAAY,YACzB,MAAM,YAAY,QAClB,WAAW,MAAM,WACjB,MAAM,QAAQ,iBAAiB;AAEjC;;;ACRA,SAAgB,cACf,OACsB;CACtB,IAAI,mBAAmB,KAAK,GAC3B,OAAO;CAER,OAAO,cAAc,oBAAoB,KAAK,KAAK,CAAC;AACrD;;;ACpBA,MAAa,0BAA0BC,KAAW;CACjD,SAAS;CACT,gBAAgB;CAChB,YAAY;CACZ,WAAW;CACX,WAAW;AACZ,CAAC,CAAC,CAAC,MACD,WAA8B;CAC9B,SAAS,MAAM;CACf,aACC,OAAO,MAAM,gBAAgB,YAC7B,MAAM,YAAY,KAAK,CAAC,CAAC,SAAS,IAC/B,MAAM,cACN,MAAM;CACV,SAAS,MAAM,WAAW,KAAA;CAC1B,QAAQ,MAAM,UAAU,KAAA;CACxB,QAAS,MAAM,UAAU,KAAA;AAC1B,EACD;AAEA,MAAa,8BAA8BA,KAAW;CACrD,SAAS;CACT,iBAAiB;CACjB,YAAY;CACZ,WAAW;CACX,WAAW;AACZ,CAAC,CAAC,CAAC,MACD,WAA8B;CAC9B,SAAS,MAAM;CACf,aACC,OAAO,MAAM,iBAAiB,YAC9B,MAAM,aAAa,KAAK,CAAC,CAAC,SAAS,IAChC,MAAM,eACN,MAAM;CACV,SAAS,MAAM,WAAW,KAAA;CAC1B,QAAQ,MAAM,UAAU,KAAA;CACxB,QAAS,MAAM,UAAU,KAAA;AAC1B,EACD;;;AC1BA,SAAS,iCAAiC,SAIhC;CACT,MAAM,IAAI,YAAY;EACrB,MAAM,gBAAgB;EACtB,MAAM,QAAQ;EACd,SAAS,GAAG,QAAQ,cAAc,IAAI,wBAAwB,QAAQ,OAAO,KAAK,2BAA2B;EAC7G,QAAQ;EACR,OAAO,QAAQ,QAAQ;CACxB,CAAC;AACF;AAEA,SAAgB,uBAAuB,OAAmC;CACzE,MAAM,SAAS,uBAAuB,yBAAyB,KAAK;CACpE,IAAI,OAAO,SACV,OAAO,OAAO;CAEf,iCAAiC;EAChC,MAAM;EACN,eAAe;EACf,SAAS;CACV,CAAC;AACF;AAEA,SAAgB,2BAA2B,OAAmC;CAC7E,MAAM,SAAS,uBAAuB,6BAA6B,KAAK;CACxE,IAAI,OAAO,SACV,OAAO,OAAO;CAEf,iCAAiC;EAChC,MAAM;EACN,eAAe;EACf,SAAS;CACV,CAAC;AACF;AAEA,SAAgB,yBACf,SACoB;CACpB,MAAM,YAAY,QAAQ;CAC1B,MAAM,UACL,WAAW,WAAW,QAAQ,mBAAmB;CAIlD,OAAO;EACN;EACA,aAJA,WAAW,aAAa,KAAK,KAAK,QAAQ,uBAAuB;EAKjE,SAAS,WAAW;EACpB,QAAQ,WAAW,UAAU,QAAQ;EACrC,QAAQ,WAAW,UAAU,QAAQ;CACtC;AACD;;;ACnEA,MAAa,qBAAqB;CACjC,eAAe;CACf,gBAAgB;CAChB,cAAc;AACf;AAKA,IAAa,iBAAb,cAAoC,YAAY;CAC/C;CAEA,YAAY,SAIT;EACF,MAAM;GACL,MAAM,gBAAgB;GACtB,MAAM,QAAQ;GACd,SAAS,QAAQ;GACjB,QAAQ;GACR,OAAO,QAAQ;EAChB,CAAC;EACD,KAAK,OAAO;EACZ,KAAK,OAAO,QAAQ;CACrB;AACD;;;AC1BA,SAAgB,iBACf,KACA,UAAmC,CAAC,GACrB;CACf,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAGF,MAAM,SAAS,yBAAyB,MAAM,IAAI,GAAG,MAAM,SAAS;CACpE,6BAA6B,QAAQ,KAAK;CAC1C,OAAO;AACR;AAEA,SAAS,yBAAyB,OAAe,OAA6B;CAC7E,IAAI;CACJ,IAAI;EACH,SAAS,KAAK,MAAM,oBAAoB,KAAK,CAAC;CAC/C,SAAS,OAAO;EACf,MAAM,IAAI,eAAe;GACxB,MAAM,mBAAmB;GACzB,SAAS,GAAG,MAAM;GAClB;EACD,CAAC;CACF;CAEA,IAAI,CAAC,aAAa,MAAM,GACvB,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,OAAO;AACR;AAEA,SAAS,oBAAoB,OAAuB;CACnD,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CACzD,MAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;CAChE,MAAM,SAAS,KAAK,MAAM;CAC1B,MAAM,QAAQ,WAAW,KAAK,SAAS,SAAS,KAAK,WAAW,CAAC,CAAC;CAClE,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK;AACtC;AAEA,SAAS,6BACR,QACA,OACO;CACP,IAAI,OAAO,QAAQ,KAAA,KAAa,OAAO,OAAO,QAAQ,UACrD,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,IAAI,OAAO,QAAQ,KAAA,KAAa,OAAO,OAAO,QAAQ,UACrD,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,IAAI,OAAO,QAAQ,KAAA,KAAa,OAAO,OAAO,QAAQ,UACrD,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,IAAI,OAAO,QAAQ,KAAA,KAAa,OAAO,OAAO,QAAQ,UACrD,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,IACC,OAAO,QAAQ,KAAA,KACf,OAAO,OAAO,QAAQ,YACtB,CAAC,cAAc,OAAO,GAAG,GAEzB,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;AAEH;AAEA,SAAS,aAAa,OAAuC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC3E;AAEA,SAAS,cAAc,OAA4C;CAClE,OACC,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,SAAS,OAAO,SAAS,QAAQ;AAExE;;;;;;;AC9FA,SAAgB,kBAAkB,UAA0B;CAC3D,MAAM,QAAQ,SAAS,MAAM,gCAAgC;CAC7D,IAAI,CAAC,OACJ,OAAO;CAER,MAAM,QAAQ,OAAO,MAAM,EAAE;CAE7B,QAAQ,MAAM,IAAd;EACC,KAAK,MACJ,OAAO;EACR,KAAK,KACJ,OAAO,QAAQ;EAChB,KAAK,KACJ,OAAO,QAAQ,KAAK;EACrB,KAAK,KACJ,OAAO,QAAQ,KAAK,KAAK;EAC1B,SACC,OAAO;CACT;AACD;;;;ACpBA,SAAgB,kBAA+B;CAC9C,OAAO;EACN,OAAO,OAAkB;GACxB,OAAO,KAAK,UAAU,KAAK;EAC5B;EACA,OAAO,KAAgB;GACtB,OAAO,KAAK,MAAM,GAAG;EACtB;CACD;AACD;;;ACQA,SAAS,kBAAkB,WAAmB,KAAqB;CAClE,OAAO,UAAU,SAAS,IAAI,GAAG,UAAU,GAAG,QAAQ;AACvD;AAEA,SAAS,uBACR,OACoC;CACpC,IAAI,CAAC,MAAM,MACV,MAAM,IAAI,YAAY;EACrB,MAAM,gBAAgB;EACtB,MAAM;EACN,SACC;EACD,QAAQ;CACT,CAAC;CAGF,OAAO,MAAM,KAAK,KAAK,KAAK;AAC7B;AAEA,eAAe,wBACd,WACa;CACb,IAAI;EACH,OAAO,MAAM,UAAU;CACxB,SAAS,OAAO;EACf,IAAI,iBAAiB,aACpB,MAAM;EAEP,MAAM,IAAI,YAAY;GACrB,MAAM,gBAAgB;GACtB,MAAM;GACN,SAAS;GACT,QAAQ;GACR,OAAO;EACR,CAAC;CACF;AACD;AAEA,SAAS,kBAAqB,OAAiB,OAAkB;CAChE,IAAI;EACH,OAAO,MAAM,OAAO,KAAK;CAC1B,SAAS,OAAO;EACf,MAAM,IAAI,YAAY;GACrB,MAAM,gBAAgB;GACtB,MAAM;GACN,SAAS;GACT,QAAQ;GACR,OAAO;EACR,CAAC;CACF;AACD;;;;;;;AAQA,SAAgB,yBACf,SACwB;CACxB,MAAM,QAAQ,QAAQ,SAAS,gBAAmB;CAClD,MAAM,YAAY,uBAAuB,QAAQ,KAAK;CAEtD,eAAe,OAA0B;EACxC,MAAM,MAAM,MAAM,8BACjB,QAAQ,MAAM,IAAI,QAAQ,GAAG,CAC9B;EACA,OAAO,QAAQ,OAAO,OAAO,kBAAkB,OAAO,GAAG;CAC1D;CAEA,eAAe,KAAK,OAAyB;EAC5C,MAAM,8BACL,QAAQ,MAAM,IAAI,QAAQ,KAAK,MAAM,OAAO,KAAK,CAAC,CACnD;CACD;CAEA,eAAe,UAA6B;EAC3C,MAAM,MAAM,MAAM,8BAA8B,UAAU,QAAQ,GAAG,CAAC;EACtE,OAAO,QAAQ,OAAO,OAAO,kBAAkB,OAAO,GAAG;CAC1D;CAEA,eAAe,QAAuB;EACrC,MAAM,8BAA8B,QAAQ,MAAM,OAAO,QAAQ,GAAG,CAAC;CACtE;CAEA,OAAO;EACN;EACA;EACA;EACA;CACD;AACD;;;;;;;;AASA,SAAgB,8BACf,SAC6B;CAC7B,MAAM,QAAQ,QAAQ,SAAS,gBAAmB;CAClD,MAAM,YAAY,uBAAuB,QAAQ,KAAK;CAEtD,eAAe,KAAK,KAAgC;EACnD,MAAM,MAAM,MAAM,8BACjB,QAAQ,MAAM,IAAI,kBAAkB,QAAQ,WAAW,GAAG,CAAC,CAC5D;EACA,OAAO,QAAQ,OAAO,OAAO,kBAAkB,OAAO,GAAG;CAC1D;CAEA,eAAe,KAAK,KAAa,OAAyB;EACzD,MAAM,8BACL,QAAQ,MAAM,IACb,kBAAkB,QAAQ,WAAW,GAAG,GACxC,MAAM,OAAO,KAAK,CACnB,CACD;CACD;CAEA,eAAe,KAAK,KAAgC;EACnD,MAAM,MAAM,MAAM,8BACjB,UAAU,kBAAkB,QAAQ,WAAW,GAAG,CAAC,CACpD;EACA,OAAO,QAAQ,OAAO,OAAO,kBAAkB,OAAO,GAAG;CAC1D;CAEA,eAAe,MAAM,KAA4B;EAChD,MAAM,8BACL,QAAQ,MAAM,OAAO,kBAAkB,QAAQ,WAAW,GAAG,CAAC,CAC/D;CACD;CAEA,OAAO;EACN;EACA;EACA;EACA;CACD;AACD;;;AChKA,MAAa,qBAAqB;CACjC,MAAM;CACN,SAAS;CACT,SAAS;CACT,OAAO;AACR;AAsCA,SAAgB,4BAGd,IAAoC;CACrC,MAAM,sBAAsB,aAAa,EACxC,OAAO,mBAAmB,KAC3B,CAA6C;CAE7C,MAAM,SAAS,eAEd,GAAG,MAC+B;EAClC,MAAM,gBAAgB,oBAAoB,IAAI;EAC9C,IAAI,cAAc,UAAU,mBAAmB,SAC9C,OAAO,cAAc;EAEtB,IAAI,cAAc,UAAU,mBAAmB,SAC9C,OAAO,cAAc;EAGtB,IAAI;EACJ,IAAI;EAEJ,MAAM,UAAU,IAAI,SAAiC,KAAK,QAAQ;GACjE,iBAAiB;GACjB,gBAAgB;EACjB,CAAC;EACD,QAAQ,YAAY,KAAA,CAAS;EAE7B,oBAAoB,IAAI;GAAE,OAAO,mBAAmB;GAAS;EAAQ,CAAC;EAEtE,IAAI;GACH,MAAM,SAAS,MAAM,GAAG,MAAM,MAAM,IAAI;GACxC,oBAAoB,IAAI;IACvB,OAAO,mBAAmB;IAC1B,MAAM;GACP,CAAC;GACD,eAAe,MAAM;GACrB,OAAO;EACR,SAAS,KAAK;GACb,oBAAoB,IAAI;IACvB,OAAO,mBAAmB;IAC1B,OAAO;GACR,CAAC;GACD,cAAc,GAAG;GACjB,MAAM;EACP;CACD;CAEA,OAAO,IAAI,MAAM,QAAQ;EACxB,IAAI,QAAQ,MAAM,UAAU;GAE3B,MAAM,gBAAgB,oBAAoB,IAAI;GAC9C,IAAI,QAAQ,eACX,OAAO,QAAQ,IAAI,eAAe,IAAI;GAEvC,IACC,SAAS,SACT,SAAS,iBACT,SAAS,mBACR;IACD,MAAM,QAAQ,QAAQ,IACrB,qBACA,MACA,mBACD;IACA,OAAO,OAAO,UAAU,aACrB,MAAM,KAAK,mBAAmB,IAC9B;GACJ;GAEA,OAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;EAC1C;EAEA,MAAM;GACL,OAAO;EACR;CACD,CAAC;AACF;;;;;;;ACxHA,SAAgB,kBAAkB,KAAmB;CACpD,OACC,IAAI,aAAa,YAChB,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa,SACjB,IAAI,aAAa;AAEpB"}
+{"version":3,"file":"index.mjs","names":["uuidv7","runtimeInject","runtimeRunInInjectionContext","defineType","defineType"],"sources":["../src/auth-coordination/contract.ts","../src/errors/error-attributes.ts","../src/compat/base64.ts","../src/compat/generator.ts","../src/injection/context.ts","../src/injection/destroy.ts","../src/validation/schemas/uri.ts","../src/cancellation/linked.ts","../src/signals/computed.ts","../src/signals/resource.ts","../src/router/metadata.ts","../src/std/transport/authorization-interceptor.ts","../src/tracing/operation-runner.ts","../src/tracing/operation-method.ts","../src/tracing/subscriber/console.ts","../src/struct/ring-buffer.ts","../src/tracing/subscriber/timeline-store.ts","../src/auth-coordination/planner-host.ts","../src/auth-coordination/planner/base-planner.ts","../src/auth-coordination/planner/merge-planner.ts","../src/auth-coordination/planner/route-composition-planner.ts","../src/auth-coordination/planner/static-planner.ts","../src/events/create.ts","../src/events/error.ts","../src/events/interop.ts","../src/identity/schemas.ts","../src/identity/parsers.ts","../src/protocol/jwt/error.ts","../src/protocol/jwt/decode.ts","../src/scheduling/duration.ts","../src/storage/json-codec.ts","../src/storage/ephemeral-flow-store.ts","../src/struct/async-lock.ts","../src/transport/url.ts"],"sourcesContent":["// Auth coordination contracts — serializable types and pure composition helpers\n//\n// Canonical public export: @securitydept/client\n//\n// This module owns the headless, framework-agnostic vocabulary shared across\n// the requirement planner host and planner variants:\n//   - AuthRequirement declarations (serializable)\n//   - Resolution / status value domains\n//   - Behaviour callback signatures (implemented by RequirementPlannerHost)\n//   - Route composition strategy and the pure folding function\n//   - Pipeline result shapes\n//\n// It contains no runtime coordination logic — only types, value constants,\n// frozen factories, and the side-effect-free composition function.\n\nimport { v7 as uuidv7 } from \"uuid\";\nimport { type FoundationEnvironment } from \"../environment\";\n\n// ---------------------------------------------------------------------------\n// Requirement declaration\n// ---------------------------------------------------------------------------\nexport interface AuthRequirement {\n\t/** Unique entity id for this requirement within the plan. */\n\treadonly id: string;\n\t/** Human-readable label (for logging / debugging). */\n\treadonly label?: string;\n}\n\nexport interface StaticAttrsAuthRequirementInput<\n\tTAttributes = Record<string, unknown>,\n> {\n\treadonly id?: string;\n\treadonly label?: string;\n\treadonly attributes?: TAttributes;\n}\n\nexport class StaticAttrsAuthRequirement<TAttributes = Record<string, unknown>>\n\timplements AuthRequirement\n{\n\tprotected constructor(\n\t\treadonly id: string,\n\t\treadonly label: string | undefined,\n\t\treadonly attributes: TAttributes | undefined,\n\t) {\n\t\tObject.freeze(this);\n\t}\n\n\tpublic static create<TAttributes = Record<string, unknown>>(\n\t\tinput?: StaticAttrsAuthRequirementInput<TAttributes>,\n\t): StaticAttrsAuthRequirement<TAttributes> {\n\t\treturn new StaticAttrsAuthRequirement<TAttributes>(\n\t\t\tinput?.id ?? uuidv7(),\n\t\t\tinput?.label,\n\t\t\tinput?.attributes ? Object.freeze(input.attributes) : undefined,\n\t\t);\n\t}\n\n\tpublic static createList<TAttributes = Record<string, unknown>>(\n\t\tinputs: readonly StaticAttrsAuthRequirementInput<TAttributes>[],\n\t): readonly StaticAttrsAuthRequirement<TAttributes>[] {\n\t\treturn inputs.map((input) => StaticAttrsAuthRequirement.create(input));\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Resolution and status\n// ---------------------------------------------------------------------------\n\n/** Outcome of resolving a single requirement. */\nexport const ResolutionStatus = {\n\tFulfilled: \"fulfilled\",\n\tFailed: \"failed\",\n\tSkipped: \"skipped\",\n} as const;\n\nexport type ResolutionStatus =\n\t(typeof ResolutionStatus)[keyof typeof ResolutionStatus];\n\n/** The resolution result for a single requirement. */\nexport interface RequirementResolution {\n\t/** The requirement ID this resolution applies to. */\n\trequirementId: string;\n\t/** Outcome status. */\n\tstatus: ResolutionStatus;\n\t/** Optional error or reason for failure/skip. */\n\treason?: string;\n}\n\n/** Overall plan status. */\nexport const PlanStatus = {\n\t/** There are still pending requirements. */\n\tPending: \"pending\",\n\t/** All requirements have been resolved. */\n\tSettled: \"settled\",\n} as const;\n\nexport type PlanStatus = (typeof PlanStatus)[keyof typeof PlanStatus];\n\n/** Error thrown when a planner contract is violated (e.g. duplicate ids). */\nexport class RequirementPlannerError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"RequirementPlannerError\";\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// Behaviour callbacks (implemented by RequirementPlannerHost)\n// ---------------------------------------------------------------------------\n\n/** Result of an authentication check. */\nexport type AuthenticatedCheck = boolean | Promise<boolean>;\n\n/**\n * Return value of an unauthenticated handler.\n *\n * - `true` — the requirement is now satisfied (resolved as fulfilled);\n *   the pipeline records the resolution and may continue.\n * - `false` — block: the requirement cannot proceed.\n * - `string` — redirect to the given location.\n * - A never-settling `Promise` — used when a full-page external redirect has\n *   started; the step intentionally never resolves so the host navigation is\n *   not finalized while the page is leaving.\n */\nexport type UnauthenticatedAction =\n\t| boolean\n\t| string\n\t| Promise<boolean | string>;\n\n/**\n * Behaviour evaluation context handed to every behaviour callback.\n *\n * Reflects the planner state at the moment the callback is invoked.\n */\nexport type RequirementBehaviourContext<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = {\n\treadonly planContext: TPlanContext;\n\treadonly environment: FoundationEnvironment;\n\t/** The full effective requirement list for the active plan. */\n\treadonly requirements: readonly TAuthRequirement[];\n\t/** Resolutions collected so far (in requirement order). */\n\treadonly resolutionList: readonly RequirementResolution[];\n};\n\n/** Stream of unauthenticated requirements discovered by the planner. */\nexport type RequirementCandidateGenerator<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> = AsyncGenerator<TAuthRequirement, void, unknown>;\n\n/**\n * Context handed to candidate selection.\n *\n * `candidateList` is intentionally a stream: selectors that can act on the\n * first available unauthenticated requirement do not need to wait for all\n * checks to complete, while chooser-style selectors can still collect the full\n * stream with `for await`.\n */\nexport type RequirementCandidateSelectionContext<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = RequirementBehaviourContext<TAuthRequirement, TPlanContext> & {\n\t/** Requirements not yet satisfied, yielded as their checks complete. */\n\treadonly candidateList: RequirementCandidateGenerator<TAuthRequirement>;\n};\n\n/** Decide whether a single requirement is already satisfied. */\nexport type CheckAuthenticated<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = (\n\trequirement: TAuthRequirement,\n\tcontext: RequirementBehaviourContext<TAuthRequirement, TPlanContext>,\n) => AuthenticatedCheck;\n\n/** Decide what to do when a selected requirement is unauthenticated. */\nexport type OnUnauthenticated<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = (\n\trequirement: TAuthRequirement,\n\tcontext: RequirementBehaviourContext<TAuthRequirement, TPlanContext>,\n) => UnauthenticatedAction;\n\n/**\n * Reduce the candidate set to the single requirement to act on next.\n *\n * The default strategy picks the first unauthenticated candidate yielded by the\n * stream. Chooser-style strategies may collect the full stream when they need\n * a complete candidate set.\n */\nexport type SelectCandidate<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> = (\n\tcontext: RequirementCandidateSelectionContext<TAuthRequirement, TPlanContext>,\n) => TAuthRequirement | undefined | Promise<TAuthRequirement | undefined>;\n\n/** The full behaviour contract resolved by a planner host. */\nexport interface RequirementBehaviour<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> {\n\tcheckAuthenticated: CheckAuthenticated<TAuthRequirement, TPlanContext>;\n\tonUnauthenticated: OnUnauthenticated<TAuthRequirement, TPlanContext>;\n\tselectCandidate: SelectCandidate<TAuthRequirement, TPlanContext>;\n}\n\nexport interface RouteStateSnapshotTrait {\n\treadonly url: string;\n}\n\nexport interface RouteBehaviourContextExtra {\n\treadonly routeState: RouteStateSnapshotTrait;\n}\n\nexport function isRouteStateSnapshotTrait(\n\tvalue: unknown,\n): value is RouteStateSnapshotTrait {\n\treturn typeof value === \"object\" && value !== null && \"url\" in value;\n}\n\nexport function isRouteBehaviourContextExtra(\n\tvalue: unknown,\n): value is RouteBehaviourContextExtra {\n\treturn (\n\t\ttypeof value === \"object\" &&\n\t\tvalue !== null &&\n\t\t\"routeState\" in value &&\n\t\tisRouteStateSnapshotTrait(value.routeState)\n\t);\n}\n\nexport type RequirementBehaviourWithRouteContext<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> = RequirementBehaviour<TAuthRequirement, RouteBehaviourContextExtra>;\n\n// ---------------------------------------------------------------------------\n// Pipeline results\n// ---------------------------------------------------------------------------\n\n/** Outcome of a pipeline step or run. */\nexport const PipelineOutcome = {\n\t/** No candidates remain — the plan is satisfied. */\n\tSettled: \"settled\",\n\t/** A candidate was resolved as fulfilled; more may remain. */\n\tResolved: \"resolved\",\n\t/** A candidate's handler blocked progress. */\n\tBlocked: \"blocked\",\n\t/** A candidate's handler requested a redirect. */\n\tRedirect: \"redirect\",\n} as const;\n\nexport type PipelineOutcome =\n\t(typeof PipelineOutcome)[keyof typeof PipelineOutcome];\n\n/** Result of a single {@link BaseRequirementPlanner.runStep}. */\nexport type PipelineStepResult<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> =\n\t| { outcome: typeof PipelineOutcome.Settled }\n\t| { outcome: typeof PipelineOutcome.Resolved; requirement: TAuthRequirement }\n\t| { outcome: typeof PipelineOutcome.Blocked; requirement: TAuthRequirement }\n\t| {\n\t\t\toutcome: typeof PipelineOutcome.Redirect;\n\t\t\trequirement: TAuthRequirement;\n\t\t\tlocation: string;\n\t  };\n\n/** Result of {@link BaseRequirementPlanner.runUntilSettled}. */\nexport type PipelineRunResult<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> =\n\t| {\n\t\t\toutcome: typeof PipelineOutcome.Settled;\n\t\t\tresolutions: readonly RequirementResolution[];\n\t  }\n\t| { outcome: typeof PipelineOutcome.Blocked; requirement: TAuthRequirement }\n\t| {\n\t\t\toutcome: typeof PipelineOutcome.Redirect;\n\t\t\trequirement: TAuthRequirement;\n\t\t\tlocation: string;\n\t  };\n\n// ---------------------------------------------------------------------------\n// Route composition\n// ---------------------------------------------------------------------------\n\n/**\n * How a route segment's requirements compose with the inherited parent chain.\n *\n * - `inherit` — keep the parent requirements unchanged (segment adds nothing)\n * - `merge` — inherit parent requirements, then append/override with the\n *   segment's own (same-id entries replace the parent's)\n * - `replace` — discard the parent chain, use only the segment's requirements\n */\nexport const RequirementsComposition = {\n\tInherit: \"inherit\",\n\tMerge: \"merge\",\n\tReplace: \"replace\",\n} as const;\n\nexport type RequirementsComposition =\n\t(typeof RequirementsComposition)[keyof typeof RequirementsComposition];\n\n/** A single node in a matched route chain. */\nexport interface RouteTreeSegment<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> {\n\t/** Route segment identifier (e.g. route name or path pattern). */\n\trouteId: string;\n\t/** Auth requirements declared on this route segment. */\n\trequirements: readonly TAuthRequirement[];\n\t/** Composition strategy against the inherited chain. Defaults to `merge`. */\n\tcomposition?: RequirementsComposition;\n}\n\n/** A requirements declaration annotated with its composition strategy. */\nexport interface RouteRequirementsDeclaration<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> {\n\tcomposition: RequirementsComposition;\n\trequirements: readonly TAuthRequirement[];\n}\n\n/**\n * Apply a route requirements declaration onto an effective requirement map.\n *\n * Reuse `effective` across a route chain so merge/replace fold in O(total\n * requirements) without rebuilding parent state each segment. When omitted, a\n * fresh map is created for one-shot composition.\n */\nexport function resolveEffectiveRequirements<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n>(\n\tchild: RouteRequirementsDeclaration<TAuthRequirement>,\n\teffective: Map<string, TAuthRequirement> = new Map(),\n): Map<string, TAuthRequirement> {\n\tswitch (child.composition) {\n\t\tcase RequirementsComposition.Inherit:\n\t\t\treturn effective;\n\n\t\tcase RequirementsComposition.Merge:\n\t\t\tfor (const requirement of child.requirements) {\n\t\t\t\teffective.set(requirement.id, requirement);\n\t\t\t}\n\t\t\treturn effective;\n\n\t\tcase RequirementsComposition.Replace:\n\t\t\teffective.clear();\n\t\t\tfor (const requirement of child.requirements) {\n\t\t\t\teffective.set(requirement.id, requirement);\n\t\t\t}\n\t\t\treturn effective;\n\n\t\tdefault: {\n\t\t\tconst _exhaustive: never = child.composition;\n\t\t\tthrow new RequirementPlannerError(\n\t\t\t\t`Unknown requirements composition: ${String(_exhaustive)}`,\n\t\t\t);\n\t\t}\n\t}\n}\n","import { ClientError } from \"./client-error\";\nimport { type ClientErrorKind, type UserRecovery } from \"./types\";\n\nexport interface ErrorSummary {\n\terrorName: string;\n\terrorKind?: ClientErrorKind;\n\terrorCode?: string;\n\trecovery?: UserRecovery;\n}\n\n/** Extract secret-safe diagnostic attributes without copying runtime messages. */\nexport function describeError(error: unknown): ErrorSummary {\n\tif (error instanceof ClientError) {\n\t\treturn {\n\t\t\terrorName: error.name,\n\t\t\terrorKind: error.kind,\n\t\t\terrorCode: error.code,\n\t\t\trecovery: error.recovery,\n\t\t};\n\t}\n\n\treturn {\n\t\terrorName: error instanceof Error ? error.name : typeof error,\n\t};\n}\n","import { ClientError, ClientErrorKind } from \"../errors\";\n\nexport const Base64CompatErrorCode = {\n\tEncoderUnavailable: \"compat.base64.encoder_unavailable\",\n\tDecoderUnavailable: \"compat.base64.decoder_unavailable\",\n} as const;\n\nexport type Base64CompatErrorCode =\n\t(typeof Base64CompatErrorCode)[keyof typeof Base64CompatErrorCode];\n\ntype Uint8ArrayConstructorWithBase64 = typeof Uint8Array & {\n\treadonly prototype: Uint8Array & {\n\t\ttoBase64?: () => string;\n\t};\n\tfromBase64?: (value: string) => Uint8Array;\n};\n\ninterface BufferConstructorLike {\n\tfrom(value: Uint8Array): { toString(encoding: \"base64\"): string };\n\tfrom(value: string, encoding: \"base64\"): Uint8Array;\n}\n\nexport function encodeUint8ArrayToBase64(value: Uint8Array): string {\n\tconst Uint8ArrayConstructor =\n\t\tglobalThis.Uint8Array as Uint8ArrayConstructorWithBase64;\n\tconst toBase64 = Uint8ArrayConstructor.prototype.toBase64;\n\tif (typeof toBase64 === \"function\") {\n\t\treturn toBase64.call(value);\n\t}\n\n\tif (typeof globalThis.btoa === \"function\") {\n\t\tlet binary = \"\";\n\t\tfor (const byte of value) {\n\t\t\tbinary += String.fromCharCode(byte);\n\t\t}\n\t\treturn globalThis.btoa(binary);\n\t}\n\n\tconst BufferConstructor = Reflect.get(globalThis, \"Buffer\") as\n\t\t| BufferConstructorLike\n\t\t| undefined;\n\tif (typeof BufferConstructor?.from === \"function\") {\n\t\treturn BufferConstructor.from(value).toString(\"base64\");\n\t}\n\n\tthrow new ClientError({\n\t\tkind: ClientErrorKind.Configuration,\n\t\tcode: Base64CompatErrorCode.EncoderUnavailable,\n\t\tmessage: \"The current realm does not provide a Base64 encoder.\",\n\t\tsource: \"compat.base64\",\n\t});\n}\n\nexport function decodeBase64ToUint8Array(value: string): Uint8Array {\n\tconst Uint8ArrayConstructor =\n\t\tglobalThis.Uint8Array as Uint8ArrayConstructorWithBase64;\n\tif (typeof Uint8ArrayConstructor.fromBase64 === \"function\") {\n\t\treturn Uint8ArrayConstructor.fromBase64(value);\n\t}\n\n\tif (typeof globalThis.atob === \"function\") {\n\t\tconst binary = globalThis.atob(value);\n\t\tconst bytes = new Uint8Array(binary.length);\n\t\tfor (let index = 0; index < binary.length; index += 1) {\n\t\t\tbytes[index] = binary.charCodeAt(index);\n\t\t}\n\t\treturn bytes;\n\t}\n\n\tconst BufferConstructor = Reflect.get(globalThis, \"Buffer\") as\n\t\t| BufferConstructorLike\n\t\t| undefined;\n\tif (typeof BufferConstructor?.from === \"function\") {\n\t\treturn Uint8ArrayConstructor.from(BufferConstructor.from(value, \"base64\"));\n\t}\n\n\tthrow new ClientError({\n\t\tkind: ClientErrorKind.Configuration,\n\t\tcode: Base64CompatErrorCode.DecoderUnavailable,\n\t\tmessage: \"The current realm does not provide a Base64 decoder.\",\n\t\tsource: \"compat.base64\",\n\t});\n}\n","export async function* promisesToRacedAsyncGenerator<T>(\n\tpromises: Promise<T>[],\n): AsyncGenerator<T, void, unknown> {\n\tconst pending = new Map(\n\t\tpromises.map((promise, index) => [\n\t\t\tindex,\n\t\t\tpromise.then((value) => ({ value, index }) as const),\n\t\t]),\n\t);\n\twhile (pending.size > 0) {\n\t\tconst next = await Promise.race(pending.values());\n\t\tpending.delete(next.index);\n\t\tyield next.value;\n\t}\n}\n","import {\n\tinject as runtimeInject,\n\trunInInjectionContext as runtimeRunInInjectionContext,\n} from \"injection-js\";\nimport { toRuntimeInjector } from \"./injector\";\nimport {\n\ttype SecuritydeptDependencyToken,\n\ttype SecuritydeptInjectorTrait,\n} from \"./types\";\n\nexport interface SecuritydeptInjectOptions {\n\toptional?: boolean;\n}\n\nexport function inject<T>(\n\ttoken: SecuritydeptDependencyToken<T>,\n\toptions?: SecuritydeptInjectOptions & { optional?: false },\n): T;\nexport function inject<T>(\n\ttoken: SecuritydeptDependencyToken<T>,\n\toptions?: SecuritydeptInjectOptions & { optional?: true },\n): T | null;\nexport function inject<T>(\n\ttoken: SecuritydeptDependencyToken<T>,\n\toptions?: SecuritydeptInjectOptions,\n): T | null {\n\tif (options?.optional === true) {\n\t\treturn runtimeInject(token, {\n\t\t\toptional: true,\n\t\t});\n\t}\n\n\treturn runtimeInject(token);\n}\n\nexport function tryInjectInInjectionContext<T>(\n\ttoken: SecuritydeptDependencyToken<T>,\n\toptions?: SecuritydeptInjectOptions,\n): T | null {\n\ttry {\n\t\tif (options?.optional === true) {\n\t\t\treturn inject(token, { optional: true });\n\t\t}\n\n\t\treturn inject(token);\n\t} catch (error) {\n\t\tif (isMissingInjectionContextError(error)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tthrow error;\n\t}\n}\n\nexport function runInInjectionContext<ReturnT>(\n\tinjector: SecuritydeptInjectorTrait,\n\tfn: () => ReturnT,\n): ReturnT {\n\treturn runtimeRunInInjectionContext(toRuntimeInjector(injector), fn);\n}\n\nfunction isMissingInjectionContextError(error: unknown): boolean {\n\treturn (\n\t\terror instanceof Error &&\n\t\terror.message.includes(\"can only be used within an injection context\")\n\t);\n}\n","import { filter, from, take } from \"rxjs\";\nimport { type DisposableTrait, SYMBOL_DISPOSE } from \"../compat/disposable\";\nimport { createSignal } from \"../signals/signal\";\n\nexport abstract class SecuritydeptDestroyRef implements DisposableTrait {\n\tabstract readonly destroyed: boolean;\n\tabstract onDestroy(callback: () => void): () => void;\n\tabstract dispose(): void;\n\n\t[SYMBOL_DISPOSE](): void {\n\t\tthis.dispose();\n\t}\n}\n\nclass ManagedSecuritydeptDestroyRef extends SecuritydeptDestroyRef {\n\tprivate readonly destroyedSignal = createSignal(false);\n\n\tget destroyed(): boolean {\n\t\treturn this.destroyedSignal.get();\n\t}\n\n\tonDestroy(callback: () => void): () => void {\n\t\tif (this.destroyedSignal.get()) {\n\t\t\tcallback();\n\t\t\treturn () => undefined;\n\t\t}\n\n\t\tconst subscription = from(this.destroyedSignal)\n\t\t\t.pipe(\n\t\t\t\tfilter((destroyed): destroyed is true => destroyed),\n\t\t\t\ttake(1),\n\t\t\t)\n\t\t\t.subscribe({\n\t\t\t\tnext: callback,\n\t\t\t});\n\t\treturn () => {\n\t\t\tsubscription.unsubscribe();\n\t\t};\n\t}\n\n\tdispose(): void {\n\t\tif (this.destroyedSignal.get()) {\n\t\t\treturn;\n\t\t}\n\n\t\tthis.destroyedSignal.set(true);\n\t}\n\n\tdestroy(): void {\n\t\tthis.dispose();\n\t}\n}\n\nexport function createSecuritydeptDestroyRef(): SecuritydeptDestroyRef {\n\treturn new ManagedSecuritydeptDestroyRef();\n}\n","import { type as defineType } from \"arktype\";\nimport {\n\tUriReferenceString,\n\tUriRelativeString,\n\tUriString,\n} from \"../../struct/uri-string\";\n\nexport const UriStringSchema = defineType(\"string\").narrow((value, context) =>\n\tUriString.tryParse(value) == null\n\t\t? context.reject(\"an absolute URI string\")\n\t\t: true,\n);\n\nexport const BaseURIStringSchema = UriStringSchema;\n\nexport const UriRelativeStringSchema = defineType(\"string\").narrow(\n\t(value, context) =>\n\t\tUriRelativeString.tryParse(value) == null\n\t\t\t? context.reject(\"a relative URI reference string\")\n\t\t\t: true,\n);\n\nexport const UriReferenceStringSchema = defineType(\"string\").narrow(\n\t(value, context) =>\n\t\tUriReferenceString.tryParse(value) == null\n\t\t\t? context.reject(\"a URI reference string\")\n\t\t\t: true,\n);\n","import { merge, ReplaySubject, take, takeUntil } from \"rxjs\";\nimport {\n\ttype DisposableTrait,\n\ttype SubscribableTrait,\n\tSYMBOL_DISPOSE,\n\tSYMBOL_OBSERVABLE,\n} from \"../compat\";\nimport { type ClientError } from \"../errors\";\nimport { CancellationToken } from \"./create\";\nimport {\n\ttype CancellationTokenErrorData,\n\ttype CancellationTokenTrait,\n} from \"./types\";\n\nexport class LinkedCancellationToken\n\timplements CancellationTokenTrait, DisposableTrait\n{\n\tdestoryed$ = new ReplaySubject<boolean>(1);\n\tprotected readonly token: CancellationTokenTrait;\n\n\tconstructor(protected readonly sources: CancellationTokenTrait[]) {\n\t\tif (sources.length === 0) {\n\t\t\tthis.token = new CancellationToken();\n\t\t}\n\n\t\t// One source — return directly; no allocation needed.\n\t\tif (sources.length === 1) {\n\t\t\tthis.token = sources[0];\n\t\t}\n\n\t\t// Fast-path: return the first already-cancelled source immediately.\n\t\tfor (const source of sources) {\n\t\t\tif (source.isCancellationRequested) {\n\t\t\t\tthis.token = source;\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\n\t\tconst newToken = new CancellationToken();\n\n\t\tmerge(...sources)\n\t\t\t.pipe(take(1), takeUntil(this.destoryed$))\n\t\t\t.subscribe(({ reason }) => {\n\t\t\t\tnewToken._cancel(reason);\n\t\t\t});\n\n\t\tthis.token = newToken;\n\t}\n\tget isCancellationRequested(): boolean {\n\t\treturn this.token.isCancellationRequested;\n\t}\n\tget cancellationError(): ClientError | undefined {\n\t\treturn this.token.cancellationError;\n\t}\n\tget reason(): unknown {\n\t\treturn this.token.reason;\n\t}\n\tonCancellationRequested(\n\t\tlistener: (data: CancellationTokenErrorData) => void,\n\t): DisposableTrait {\n\t\treturn this.token.onCancellationRequested(listener);\n\t}\n\tthrowIfCancellationRequested(): void {\n\t\tthis.token.throwIfCancellationRequested();\n\t}\n\n\tdispose() {\n\t\tthis.destoryed$.next(true);\n\t}\n\n\t[SYMBOL_DISPOSE]() {\n\t\tthis.dispose();\n\t}\n\n\t[SYMBOL_OBSERVABLE](): SubscribableTrait<CancellationTokenErrorData> {\n\t\treturn this.token[SYMBOL_OBSERVABLE]();\n\t}\n}\n\n/**\n * Create a cancellation token that fires when ANY of the given source tokens\n * is cancelled.\n *\n * - Zero sources → returns a token that is never cancelled.\n * - One source   → returns that source directly (no allocation).\n * - N sources    → creates a linked source, subscribes to all, and cleans up\n *   subscriptions once the linked token fires.\n *\n * @example\n * const cts = createCancellationTokenSource();\n * const linked = createLinkedCancellationToken(clientRoot.token, cts.token);\n * await transport.execute({ ..., cancellationToken: linked });\n */\nexport function createLinkedCancellationToken(\n\t...sources: readonly (CancellationTokenTrait | undefined | null)[]\n): CancellationTokenTrait & DisposableTrait {\n\treturn new LinkedCancellationToken(\n\t\tsources.filter((s): s is CancellationTokenTrait => !!s),\n\t);\n}\n","import { RxComputedSignal } from \"../rx/signal\";\nimport { type ComputedSignalTrait, type SignalOptions } from \"./types\";\n\n/**\n * Create a lazy computed signal.\n *\n * Dependencies are collected dynamically while `compute()` runs.\n */\nexport function createComputed<T>(\n\tcompute: () => T,\n\toptions?: SignalOptions<T>,\n): ComputedSignalTrait<T> {\n\treturn RxComputedSignal.computed(compute, options);\n}\n","import { from } from \"rxjs\";\nimport { type ToEventStreamInput } from \"../events/interop\";\nimport { mapResource, resourceFromSnapshots, rxResource } from \"../rx/resource\";\nimport {\n\ttype ReadableSignalTrait,\n\ttype ResourceSnapshot,\n\ttype ResourceTrait,\n} from \"./types\";\n\nexport interface ResourceStreamContext<T, R> {\n\treadonly request: R;\n\treadonly previous: ResourceSnapshot<T>;\n}\n\nexport interface CreateResourceOptions<T, R = undefined> {\n\treadonly request?: ReadableSignalTrait<R | undefined> | (() => R | undefined);\n\treadonly stream: (\n\t\tcontext: ResourceStreamContext<T, R>,\n\t) => ToEventStreamInput<T>;\n}\n\nexport function createResource<T, R = undefined>(\n\toptions: CreateResourceOptions<T, R>,\n): ResourceTrait<T> {\n\treturn rxResource({\n\t\t...options,\n\t\tstream: (context) => from(options.stream(context)),\n\t});\n}\n\nexport { mapResource, resourceFromSnapshots };\n","// Router metadata — framework-agnostic route security declaration storage\n//\n// Canonical public export: @securitydept/client\n//\n// Serializable auth requirement metadata for router integrations is stored\n// under a single namespaced key in each framework's route-data bag (Angular\n// `Route.data`, TanStack `staticData`, etc.). Adopters should read/write only\n// through {@link readSecuritydeptRouteMetadata} and\n// {@link writeSecuritydeptRouteMetadata}.\n\nimport {\n\ttype AuthRequirement,\n\ttype RequirementsComposition,\n} from \"../auth-coordination/contract\";\n\n/** Route-data key holding the SecurityDept metadata blob for a segment. */\nexport const SECURITYDEPT_ROUTE_METADATA_KEY = \"__securitydept__\";\n\n/** Serializable SecurityDept route metadata. */\nexport interface SecuritydeptRouteMetadata<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> {\n\trequirements?: readonly TAuthRequirement[];\n\tcomposition?: RequirementsComposition;\n}\n\n/** Read SecurityDept route metadata from a route `data` bag. */\nexport function readSecuritydeptRouteMetadata<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n>(\n\tdata: object | undefined,\n): SecuritydeptRouteMetadata<TAuthRequirement> | undefined {\n\tconst raw = (data as Record<string, unknown> | undefined)?.[\n\t\tSECURITYDEPT_ROUTE_METADATA_KEY\n\t];\n\tif (raw === undefined || raw === null) {\n\t\treturn undefined;\n\t}\n\treturn raw as SecuritydeptRouteMetadata<TAuthRequirement>;\n}\n\n/** Merge SecurityDept route metadata into a route `data` bag. */\nexport function writeSecuritydeptRouteMetadata<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n>(\n\tbase: object | undefined,\n\tpatch: SecuritydeptRouteMetadata<TAuthRequirement>,\n): Record<string, unknown> {\n\tconst data: Record<string, unknown> = { ...(base ?? {}) };\n\tconst previous =\n\t\t(data[SECURITYDEPT_ROUTE_METADATA_KEY] as\n\t\t\t| SecuritydeptRouteMetadata<TAuthRequirement>\n\t\t\t| undefined) ?? {};\n\tdata[SECURITYDEPT_ROUTE_METADATA_KEY] = { ...previous, ...patch };\n\treturn data;\n}\n","import { type ReadableSignalTrait, type ResourceTrait } from \"../../signals\";\n\nexport type AuthorizationSignal =\n\t| ReadableSignalTrait<string | null | undefined>\n\t| ResourceTrait<string | null | undefined>;\n\nexport type AuthorizationInterceptedFetchPredicate = (\n\tinput: RequestInfo | URL,\n\tinit: RequestInit | undefined,\n) => boolean | Promise<boolean>;\n\nexport interface CreateAuthorizationInterceptedFetchOptions {\n\treadonly predicate: AuthorizationInterceptedFetchPredicate;\n\treadonly authorization: AuthorizationSignal;\n}\n\nexport function createAuthorizationInterceptedFetch(\n\tfetchImpl: typeof fetch,\n\toptions: CreateAuthorizationInterceptedFetchOptions,\n): typeof fetch {\n\treturn async (input, init) => {\n\t\tif (!(await options.predicate(input, init))) {\n\t\t\treturn fetchImpl(input, init);\n\t\t}\n\t\tconst authorization =\n\t\t\t\"whenValue\" in options.authorization\n\t\t\t\t? await options.authorization.whenValue()\n\t\t\t\t: options.authorization.get();\n\t\tif (!authorization) {\n\t\t\treturn fetchImpl(input, init);\n\t\t}\n\t\tconst headers = new Headers(\n\t\t\ttypeof Request !== \"undefined\" && input instanceof Request\n\t\t\t\t? input.headers\n\t\t\t\t: undefined,\n\t\t);\n\t\tif (init?.headers) {\n\t\t\tnew Headers(init.headers).forEach((value, key) => {\n\t\t\t\theaders.set(key, value);\n\t\t\t});\n\t\t}\n\t\theaders.set(\"authorization\", authorization);\n\t\treturn fetchImpl(input, {\n\t\t\t...init,\n\t\t\theaders,\n\t\t});\n\t};\n}\n","import { isPromise } from \"es-toolkit/predicate\";\n\nimport { ClientError, describeError } from \"../errors\";\nimport { type TimestampProviderTrait } from \"../scheduling/types\";\nimport { SpanSharedAttributeName } from \"../span/attributes\";\nimport {\n\ttype MutableSpanTrait,\n\ttype SpanAttributes,\n\ttype SpanTrait,\n} from \"../span/types\";\nimport {\n\ttype OperationSpanTrait,\n\tOperationTraceEventType,\n\tTRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\tTracingLevel,\n\ttype TracingTrait,\n} from \"./types\";\n\nexport interface RunOperationEnvironment {\n\tenvironment: {\n\t\ttime: TimestampProviderTrait;\n\t\ttracing: TracingTrait;\n\t};\n}\nexport interface RunOperationOptionsBase extends RunOperationEnvironment {\n\tspan: SpanTrait;\n\tname: string;\n\ttarget: string;\n\ttraceAttributes?: SpanAttributes;\n\tidFactory?: () => string;\n\tclientErrorFromUnknown?: (\n\t\terror: unknown,\n\t\toptions: { span: SpanTrait },\n\t) => ClientError;\n}\n\nexport interface RunOperationOptions<T> extends RunOperationOptionsBase {\n\texecute: (span: OperationSpanTrait) => T;\n}\n\nexport class OperationSpan implements OperationSpanTrait {\n\tprivate constructor(\n\t\treadonly span: MutableSpanTrait,\n\t\tprivate readonly _environment: RunOperationEnvironment[\"environment\"],\n\t\tprivate readonly _target: string,\n\t) {}\n\n\tstatic start(options: RunOperationOptionsBase): OperationSpan {\n\t\tconst span = options.span.fork({\n\t\t\tmutable: true,\n\t\t\tidFactory: options.idFactory,\n\t\t\tattributes: {\n\t\t\t\t[SpanSharedAttributeName.OperationName]: options.name,\n\t\t\t},\n\t\t});\n\t\tif (options.traceAttributes) {\n\t\t\tspan.setAttributes(options.traceAttributes, {\n\t\t\t\tproviderId: TRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\t\t\t});\n\t\t}\n\t\tconst operationSpan = new OperationSpan(\n\t\t\tspan,\n\t\t\toptions.environment,\n\t\t\toptions.target,\n\t\t);\n\t\toperationSpan.recordStarted();\n\t\treturn operationSpan;\n\t}\n\n\tsetTraceAttributes(attributes: SpanAttributes): void {\n\t\tthis.span.setAttributes(attributes, {\n\t\t\tproviderId: TRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\t\t});\n\t}\n\n\taddEvent(name: string, fields?: SpanAttributes): void {\n\t\tthis._record(OperationTraceEventType.Event, TracingLevel.Info, {\n\t\t\teventName: name,\n\t\t\t...(fields ?? {}),\n\t\t});\n\t}\n\n\trecordError(error: unknown, fields?: SpanAttributes): void {\n\t\tthis._record(OperationTraceEventType.Error, TracingLevel.Error, {\n\t\t\t...describeError(error),\n\t\t\t...(fields ?? {}),\n\t\t});\n\t}\n\n\trecordStarted(): void {\n\t\tthis._record(OperationTraceEventType.Started, TracingLevel.Info);\n\t}\n\n\trecordEnded(outcome: \"succeeded\" | \"failed\"): void {\n\t\tthis._record(\n\t\t\tOperationTraceEventType.Ended,\n\t\t\toutcome === \"succeeded\" ? TracingLevel.Info : TracingLevel.Error,\n\t\t\t{ outcome },\n\t\t);\n\t}\n\n\tprivate _record(\n\t\tname: string,\n\t\tlevel: TracingLevel,\n\t\tfields?: SpanAttributes,\n\t): void {\n\t\tthis._environment.tracing.record({\n\t\t\tname,\n\t\t\tat: this._environment.time.now(),\n\t\t\tspan: this.span,\n\t\t\tlevel,\n\t\t\ttarget: this._target,\n\t\t\tfields,\n\t\t});\n\t}\n}\n\nexport function runOperation<T>(options: RunOperationOptions<T>): T;\nexport function runOperation<T>(\n\toptions: RunOperationOptions<Promise<T>>,\n): Promise<T>;\nexport function runOperation<T>(\n\toptions: RunOperationOptions<T | Promise<T>>,\n): T | Promise<T> {\n\tconst operationSpan = OperationSpan.start(options);\n\ttry {\n\t\tconst result = options.execute(operationSpan);\n\t\tif (isPromise(result)) {\n\t\t\treturn result.then(\n\t\t\t\t(value) => completeOperation(operationSpan, value),\n\t\t\t\t(error) =>\n\t\t\t\t\tfailOperation(operationSpan, error, options.clientErrorFromUnknown),\n\t\t\t);\n\t\t}\n\t\treturn completeOperation(operationSpan, result);\n\t} catch (error) {\n\t\treturn failOperation(operationSpan, error, options.clientErrorFromUnknown);\n\t}\n}\n\nfunction completeOperation<T>(operationSpan: OperationSpan, result: T): T {\n\toperationSpan.recordEnded(\"succeeded\");\n\treturn result;\n}\n\nfunction failOperation(\n\toperationSpan: OperationSpan,\n\terror: unknown,\n\tclientErrorFromUnknown: RunOperationOptionsBase[\"clientErrorFromUnknown\"],\n): never {\n\tconst clientError = clientErrorFromUnknown\n\t\t? clientErrorFromUnknown(error, { span: operationSpan.span })\n\t\t: error;\n\tif (clientError instanceof ClientError) {\n\t\tclientError.captureSpanContext(operationSpan.span);\n\t}\n\toperationSpan.recordError(clientError);\n\toperationSpan.recordEnded(\"failed\");\n\tthrow clientError;\n}\n","import { type RunOperationOptionsBase, runOperation } from \"./operation-runner\";\nimport { type OperationSpanTrait } from \"./types\";\n\nexport interface InstrumentMethodThisContext<TArgs extends unknown[]> {\n\targs: TArgs;\n\tmethodName: string;\n}\n\nexport interface InstrumentMethodResolvedOptions\n\textends Omit<RunOperationOptionsBase, \"name\"> {\n\tname?: string;\n}\n\nexport type InstrumentMethodThisResolver<\n\tTThis extends object,\n\tTArgs extends unknown[],\n> = (\n\tthis: TThis,\n\tcontext: InstrumentMethodThisContext<TArgs>,\n) => InstrumentMethodResolvedOptions;\n\nexport interface DefineInstrumentMethodDecoratorContext<\n\tTFactoryArgs extends unknown[],\n> {\n\tfactoryArgs: TFactoryArgs;\n\tmethodName: string;\n}\n\nexport type DefineInstrumentMethodDecoratorFactory<\n\tTFactoryArgs extends unknown[],\n\tTBaseThis extends object = object,\n> = <TThis extends TBaseThis, TArgs extends unknown[]>(\n\tcontext: DefineInstrumentMethodDecoratorContext<TFactoryArgs>,\n) => InstrumentMethodThisResolver<TThis, TArgs>;\n\nexport function defineInstrumentMethodDecorator<\n\tTFactoryArgs extends unknown[],\n\tTBaseThis extends object = object,\n>(factory: DefineInstrumentMethodDecoratorFactory<TFactoryArgs, TBaseThis>) {\n\treturn (...factoryArgs: TFactoryArgs) =>\n\t\t<TThis extends TBaseThis, TArgs extends unknown[], TReturn>(\n\t\t\ttarget: (this: TThis, ...args: TArgs) => TReturn,\n\t\t\tcontext: ClassMethodDecoratorContext<\n\t\t\t\tTThis,\n\t\t\t\t(this: TThis, ...args: TArgs) => TReturn\n\t\t\t>,\n\t\t) => {\n\t\t\tconst methodName = String(context.name);\n\t\t\tconst resolve = factory<TThis, TArgs>({\n\t\t\t\tfactoryArgs,\n\t\t\t\tmethodName,\n\t\t\t});\n\t\t\treturn function (this: TThis, ...args: TArgs): TReturn {\n\t\t\t\tconst resolvedOptions = resolve.call(this, {\n\t\t\t\t\targs,\n\t\t\t\t\tmethodName,\n\t\t\t\t});\n\t\t\t\treturn runOperation({\n\t\t\t\t\tenvironment: resolvedOptions.environment,\n\t\t\t\t\tspan: resolvedOptions.span,\n\t\t\t\t\tname: resolvedOptions.name ?? methodName,\n\t\t\t\t\ttarget: resolvedOptions.target,\n\t\t\t\t\ttraceAttributes: resolvedOptions.traceAttributes,\n\t\t\t\t\tidFactory: resolvedOptions.idFactory,\n\t\t\t\t\tclientErrorFromUnknown: resolvedOptions.clientErrorFromUnknown,\n\t\t\t\t\texecute: (span) =>\n\t\t\t\t\t\t(\n\t\t\t\t\t\t\ttarget as unknown as (\n\t\t\t\t\t\t\t\tthis: TThis,\n\t\t\t\t\t\t\t\t...args: [...TArgs, OperationSpanTrait]\n\t\t\t\t\t\t\t) => TReturn\n\t\t\t\t\t\t).call(this, ...args, span),\n\t\t\t\t}) as TReturn;\n\t\t\t};\n\t\t};\n}\n","import {\n\tTRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\ttype TracingEvent,\n} from \"../types\";\nimport { type TracingSubscriberTrait } from \"./types\";\n\nexport class ConsoleTracingSubscriber implements TracingSubscriberTrait {\n\trecord(event: TracingEvent): void {\n\t\tconst label = `[${event.target}] ${event.name}`;\n\t\tconst details = {\n\t\t\t...(event.fields ?? {}),\n\t\t\tspanAttributes: event.span.getRootToNodeAttributes({\n\t\t\t\tproviderId: TRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\t\t\t}),\n\t\t};\n\t\tswitch (event.level) {\n\t\t\tcase \"debug\":\n\t\t\t\tconsole.debug(label, details);\n\t\t\t\tbreak;\n\t\t\tcase \"info\":\n\t\t\t\tconsole.info(label, details);\n\t\t\t\tbreak;\n\t\t\tcase \"warn\":\n\t\t\t\tconsole.warn(label, details);\n\t\t\t\tbreak;\n\t\t\tcase \"error\":\n\t\t\t\tconsole.error(label, details);\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\nexport function createConsoleTracingSubscriber(): ConsoleTracingSubscriber {\n\treturn new ConsoleTracingSubscriber();\n}\n","export class FixedCapacityRingBuffer<T> {\n\tprivate readonly values: Array<T | undefined>;\n\tprivate head = 0;\n\tprivate tail = 0;\n\tprivate _size = 0;\n\n\tconstructor(readonly capacity: number) {\n\t\tif (!Number.isInteger(capacity) || capacity <= 0) {\n\t\t\tthrow new RangeError(\"Ring buffer capacity must be a positive integer.\");\n\t\t}\n\t\tthis.values = new Array<T | undefined>(capacity);\n\t}\n\n\tget size(): number {\n\t\treturn this._size;\n\t}\n\n\tappend(value: T): void {\n\t\tthis.values[this.tail] = value;\n\t\tthis.tail = (this.tail + 1) % this.capacity;\n\n\t\tif (this._size === this.capacity) {\n\t\t\tthis.head = this.tail;\n\t\t} else {\n\t\t\tthis._size += 1;\n\t\t}\n\t}\n\n\ttoArray(): T[] {\n\t\tconst snapshot = new Array<T>(this._size);\n\t\tfor (let index = 0; index < this._size; index += 1) {\n\t\t\tsnapshot[index] = this.values[(this.head + index) % this.capacity] as T;\n\t\t}\n\t\treturn snapshot;\n\t}\n\n\tclear(): void {\n\t\tthis.values.fill(undefined);\n\t\tthis.head = 0;\n\t\tthis.tail = 0;\n\t\tthis._size = 0;\n\t}\n}\n","import { type EventStreamTrait } from \"../../events\";\nimport { RxEventSubject } from \"../../rx/event\";\nimport { type SpanNodeAttributes } from \"../../span\";\nimport { FixedCapacityRingBuffer } from \"../../struct/ring-buffer\";\nimport {\n\tTRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\ttype TracingEvent,\n} from \"../types\";\nimport { type TracingSubscriberTrait } from \"./types\";\n\nexport interface TraceTimelineEntry extends Omit<TracingEvent, \"span\"> {\n\tid: number;\n\trecordedAtIso: string;\n\tspan: {\n\t\treadonly id: string;\n\t\treadonly parentId?: string;\n\t};\n\tspanAttributes: readonly SpanNodeAttributes[];\n}\n\n/**\n * Bounded subscriber-side trace timeline.\n *\n * This store consumes tracing events through `record(event)` and keeps a\n * bounded local timeline for tests and UI surfaces. It is not the tracing\n * runtime itself.\n */\nexport class TraceTimelineStore implements TracingSubscriberTrait {\n\tprotected nextId = 1;\n\tprotected readonly timeline: FixedCapacityRingBuffer<TraceTimelineEntry>;\n\tprotected readonly latestEntrySubject =\n\t\tnew RxEventSubject<TraceTimelineEntry | null>();\n\n\tconstructor(protected readonly limit = 200) {\n\t\tthis.timeline = new FixedCapacityRingBuffer(limit);\n\t}\n\n\tget latestEntry(): EventStreamTrait<TraceTimelineEntry | null> {\n\t\treturn this.latestEntrySubject;\n\t}\n\n\tget entries(): readonly TraceTimelineEntry[] {\n\t\treturn this.timeline.toArray();\n\t}\n\n\trecord(event: TracingEvent): void {\n\t\tconst { span, ...eventWithoutSpan } = event;\n\t\tconst entry: TraceTimelineEntry = {\n\t\t\t...eventWithoutSpan,\n\t\t\tid: this.nextId++,\n\t\t\trecordedAtIso: new Date(event.at).toISOString(),\n\t\t\tspan: {\n\t\t\t\tid: span.id,\n\t\t\t\t...(span.parent ? { parentId: span.parent.id } : {}),\n\t\t\t},\n\t\t\tspanAttributes: span.getRootToNodeAttributes({\n\t\t\t\tproviderId: TRACING_SPAN_ATTRIBUTE_PROVIDER_ID,\n\t\t\t}),\n\t\t};\n\t\tthis.timeline.append(entry);\n\t\tthis.latestEntrySubject.next(entry);\n\t}\n\n\tclear(): void {\n\t\tif (this.timeline.size > 0) {\n\t\t\tthis.timeline.clear();\n\t\t\tthis.latestEntrySubject.next(null);\n\t\t}\n\t}\n}\n\nexport function createTraceTimelineStore(limit = 200): TraceTimelineStore {\n\treturn new TraceTimelineStore(limit);\n}\n","// Requirement planner host — non-serializable behaviour resolution\n//\n// Canonical public export: @securitydept/client\n//\n// A RequirementPlannerHost carries the runtime, typically non-serializable\n// behaviour for a coordination scope: how to check whether a requirement is\n// satisfied, how to react when it is not, and how to pick the next candidate\n// to act on.\n//\n// Hosts form a parent chain. A leaf host (e.g. a route scope) resolves each\n// behaviour by walking from itself toward the root and using the nearest\n// definition. This mirrors hierarchical route/DI scoping without depending on\n// any framework. Adapters map their DI containers onto this chain.\n//\n// Future global, behavioural (usually non-serializable) information can be\n// carried here as additional fields without touching the serializable\n// contract layer.\n\nimport { ENVIRONMENT_TOKEN, type FoundationEnvironment } from \"../environment\";\nimport {\n\tPARENT_INJECTOR_TOKEN,\n\tSecurityDeptOptional,\n\tSecuritydeptInjectionToken,\n\ttype SecuritydeptInjectorTrait,\n\ttype SecuritydeptProvider,\n} from \"../injection\";\nimport {\n\ttype AuthRequirement,\n\ttype RequirementBehaviour,\n\ttype RequirementCandidateSelectionContext,\n\ttype SelectCandidate,\n} from \"./contract\";\n\nexport const REQUIREMENT_PLANNER_HOST = new SecuritydeptInjectionToken<\n\tRequirementPlannerHost<unknown>\n>(\"REQUIREMENT_PLANNER_HOST\");\n\nexport type RequirementPlannerHostBehaviour<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n> = TBehaviour | (() => TBehaviour);\n\nexport interface ProvideRequirementPlannerHostOptions<\n\tTBehaviour = Partial<RequirementBehaviour>,\n> {\n\treadonly parent?: RequirementPlannerHost<TBehaviour>;\n\treadonly environment?: FoundationEnvironment;\n}\n\nexport interface InjectRequirementPlannerHostOptions {\n\treadonly injector: SecuritydeptInjectorTrait;\n}\n\n/**\n * Default candidate selector: first unauthenticated candidate as soon as it is\n * discovered.\n *\n * If every requirement is already fulfilled the stream completes and the\n * selector returns `undefined`.\n */\nexport function defaultSelectCandidate<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n>(): SelectCandidate<TAuthRequirement, TPlanContext> {\n\treturn async function selectFirstCandidate(\n\t\tcontext: RequirementCandidateSelectionContext<\n\t\t\tTAuthRequirement,\n\t\t\tTPlanContext\n\t\t>,\n\t): Promise<TAuthRequirement | undefined> {\n\t\tconst result = await context.candidateList.next();\n\t\treturn result.done ? undefined : result.value;\n\t};\n}\n\n/** Options for {@link RequirementPlannerHost.fromBehaviour}. */\nexport interface RequirementPlannerHostOptions<\n\tTRequirementBehaviour = Partial<RequirementBehaviour>,\n> {\n\t/** Parent host to inherit unspecified behaviour from. */\n\tparent?: RequirementPlannerHost<TRequirementBehaviour>;\n\tenvironment?: FoundationEnvironment;\n}\n\n/**\n * A coordination-scope host that resolves behaviour through a parent chain.\n *\n * Construct via {@link RequirementPlannerHost.fromBehaviour}. Each behaviour\n * field is optional at host construction time; missing required behaviour is\n * resolved from `parent` and fails fast during planner build if no host in the\n * chain provides it.\n *\n * @example\n * ```ts\n * const root = RequirementPlannerHost.fromBehaviour({\n *   checkAuthenticated: (req) => isAuthenticated(req),\n *   onUnauthenticated: (req) => `/login/${req.id}`,\n * });\n *\n * // Feature scope overrides only the chooser, inheriting the rest.\n * const feature = RequirementPlannerHost.fromBehaviour(\n *   { selectCandidate: async (ctx) => showChooser(ctx.candidateList) },\n *   { parent: root },\n * );\n * ```\n */\nexport class RequirementPlannerHost<\n\tTBehaviour = Partial<RequirementBehaviour>,\n> {\n\t/** The parent host, or undefined at the root. */\n\tprivate readonly _behaviour: TBehaviour;\n\n\tprotected constructor(\n\t\tbehaviour: TBehaviour,\n\t\treadonly environment: FoundationEnvironment | undefined,\n\t\treadonly parent: RequirementPlannerHost<TBehaviour> | undefined,\n\t) {\n\t\tthis._behaviour = behaviour;\n\t}\n\n\t/** Create a host scope from a partial behaviour and optional parent. */\n\tstatic fromBehaviour<TBehaviour = Partial<RequirementBehaviour>>(\n\t\tbehaviour: TBehaviour,\n\t\toptions: RequirementPlannerHostOptions<TBehaviour> = {},\n\t): RequirementPlannerHost<TBehaviour> {\n\t\treturn new RequirementPlannerHost(\n\t\t\tbehaviour,\n\t\t\toptions.environment,\n\t\t\toptions.parent,\n\t\t);\n\t}\n\n\tasync resolveBehaviourOptionFor<K extends keyof TBehaviour>(\n\t\tkey: K,\n\t): Promise<TBehaviour[K] | undefined> {\n\t\treturn (\n\t\t\tthis._behaviour[key] ??\n\t\t\t(await this.parent?.resolveBehaviourOptionFor(key))\n\t\t);\n\t}\n\tasync resolveBehaviourFor<K extends keyof TBehaviour>(\n\t\tkey: K,\n\t\tdefaultValue: () =>\n\t\t\t| NonNullable<TBehaviour[K]>\n\t\t\t| Promise<NonNullable<TBehaviour[K]>>,\n\t): Promise<NonNullable<TBehaviour[K]>> {\n\t\treturn (\n\t\t\t(await this.resolveBehaviourOptionFor(key)) ?? (await defaultValue())\n\t\t);\n\t}\n\n\tasync resolveEnvironmentOption(): Promise<FoundationEnvironment | undefined> {\n\t\treturn this.environment ?? (await this.parent?.resolveEnvironmentOption());\n\t}\n\n\tasync resolveEnvironment(\n\t\tdefaultValue: () => FoundationEnvironment | Promise<FoundationEnvironment>,\n\t): Promise<FoundationEnvironment> {\n\t\treturn (await this.resolveEnvironmentOption()) ?? (await defaultValue());\n\t}\n}\n\nexport function provideRequirementPlannerHost<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n>(\n\tbehaviour: RequirementPlannerHostBehaviour<\n\t\tTAuthRequirement,\n\t\tTPlanContext,\n\t\tTBehaviour\n\t>,\n\toptions: ProvideRequirementPlannerHostOptions<TBehaviour> = {},\n): SecuritydeptProvider<RequirementPlannerHost<TBehaviour>> {\n\treturn {\n\t\tprovide: REQUIREMENT_PLANNER_HOST,\n\t\tuseFactory: (\n\t\t\tparentInjector: SecuritydeptInjectorTrait | null,\n\t\t\tenvironment: FoundationEnvironment | null,\n\t\t) => {\n\t\t\tconst parent =\n\t\t\t\toptions.parent ??\n\t\t\t\t(parentInjector?.get(\n\t\t\t\t\tREQUIREMENT_PLANNER_HOST,\n\t\t\t\t\tnull,\n\t\t\t\t) as RequirementPlannerHost<TBehaviour> | null) ??\n\t\t\t\tundefined;\n\t\t\tconst resolved =\n\t\t\t\ttypeof behaviour === \"function\" ? behaviour() : behaviour;\n\t\t\treturn RequirementPlannerHost.fromBehaviour(resolved, {\n\t\t\t\tparent,\n\t\t\t\tenvironment: options.environment ?? environment ?? undefined,\n\t\t\t});\n\t\t},\n\t\tdeps: [\n\t\t\t[new SecurityDeptOptional(), PARENT_INJECTOR_TOKEN],\n\t\t\t[new SecurityDeptOptional(), ENVIRONMENT_TOKEN],\n\t\t],\n\t};\n}\n\nexport function injectRequirementPlannerHost<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n>(\n\toptions: InjectRequirementPlannerHostOptions,\n): RequirementPlannerHost<TBehaviour> | null {\n\treturn options.injector.get(\n\t\tREQUIREMENT_PLANNER_HOST,\n\t\tnull,\n\t) as RequirementPlannerHost<TBehaviour> | null;\n}\n","// Base requirement planner — pipeline owner\n//\n// Canonical public export: @securitydept/client\n//\n// Pipeline:\n//   0. buildPlan() — resolve host behaviour + materialize requirements into a\n//      RequirementPlan (fixed for this run until the next buildPlan)\n//   1. runStep(plan) — race checkAuthenticated, select the first actionable\n//      unauthenticated candidate, then onUnauthenticated\n//   2. reduce — update plan.resolutionList\n//\n// runUntilSettled() calls buildPlan() then runUntilSettledWithPlan(plan).\n\nimport { promisesToRacedAsyncGenerator } from \"../../compat\";\nimport { type FoundationEnvironment } from \"../../environment\";\nimport {\n\ttype AuthRequirement,\n\tPipelineOutcome,\n\ttype PipelineRunResult,\n\ttype PipelineStepResult,\n\ttype RequirementBehaviour,\n\ttype RequirementCandidateGenerator,\n\tRequirementPlannerError,\n\ttype RequirementResolution,\n\tResolutionStatus,\n\ttype UnauthenticatedAction,\n} from \"../contract\";\nimport {\n\tdefaultSelectCandidate,\n\ttype RequirementPlannerHost,\n} from \"../planner-host\";\n\n/**\n * Mutable pipeline state for one run: bound behaviour plus requirement list\n * and evolving resolutions.\n */\nexport interface RequirementPlan<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n> extends Readonly<RequirementBehaviour<TAuthRequirement, TPlanContext>> {\n\treadonly planContext: TPlanContext;\n\treadonly environment: FoundationEnvironment;\n\treadonly requirements: readonly TAuthRequirement[];\n\tresolutionList: RequirementResolution[];\n}\n\ninterface RequirementCheckResult<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n> {\n\treadonly requirement: TAuthRequirement;\n\treadonly satisfied: boolean;\n}\n\n/**\n * Abstract base for all requirement planners.\n *\n * Subclasses supply requirements via {@link buildRequirementList}. Pipeline\n * state lives on {@link RequirementPlan}, produced by {@link buildPlan}.\n */\nexport abstract class BaseRequirementPlanner<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n> {\n\tprotected readonly host: RequirementPlannerHost<TBehaviour>;\n\tprotected initialResolutions: readonly RequirementResolution[];\n\n\tabstract get planContext(): TPlanContext;\n\n\tprotected constructor(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tinitialResolutions: readonly RequirementResolution[] = [],\n\t) {\n\t\tthis.host = host;\n\t\tthis.initialResolutions = initialResolutions.map((resolution) =>\n\t\t\tObject.freeze({ ...resolution }),\n\t\t);\n\t}\n\n\t// --- Pipeline step 0 -----------------------------------------------------\n\n\t/**\n\t * Pipeline step 0: resolve host behaviour and materialize requirements into\n\t * a {@link RequirementPlan}.\n\t *\n\t * Behaviour and the requirement list stay fixed on the returned plan until\n\t * the next `buildPlan()` call. Resolve host parent chains (and any\n\t * injection-context capture) here — not between async steps.\n\t */\n\tpublic async buildPlan(): Promise<\n\t\tRequirementPlan<TAuthRequirement, TPlanContext>\n\t> {\n\t\treturn {\n\t\t\tplanContext: this.planContext,\n\t\t\tenvironment: await this.host.resolveEnvironment(() => {\n\t\t\t\tthrow new RequirementPlannerError(\"No environment resolved\");\n\t\t\t}),\n\t\t\tcheckAuthenticated: await this.host.resolveBehaviourFor(\n\t\t\t\t\"checkAuthenticated\",\n\t\t\t\t() => {\n\t\t\t\t\tthrow new RequirementPlannerError(\"No checkAuthenticated resolved\");\n\t\t\t\t},\n\t\t\t),\n\t\t\tonUnauthenticated: await this.host.resolveBehaviourFor(\n\t\t\t\t\"onUnauthenticated\",\n\t\t\t\t() => {\n\t\t\t\t\tthrow new RequirementPlannerError(\n\t\t\t\t\t\t\"No onUnauthenticated behaviour resolved\",\n\t\t\t\t\t);\n\t\t\t\t},\n\t\t\t),\n\t\t\tselectCandidate: await this.host.resolveBehaviourFor(\n\t\t\t\t\"selectCandidate\",\n\t\t\t\tdefaultSelectCandidate<TAuthRequirement, TPlanContext>,\n\t\t\t),\n\t\t\trequirements: await this.resolveRequirementList(),\n\t\t\tresolutionList: [...this.initialResolutions],\n\t\t};\n\t}\n\n\t// --- Pipeline step 1 -----------------------------------------------------\n\n\t/**\n\t * Return the effective requirement map for this planner.\n\t *\n\t * Keys are requirement ids; {@link Map} insertion order defines evaluation\n\t * order. Subclasses own deduplication policy when folding multiple sources.\n\t */\n\tprotected abstract buildRequirementList():\n\t\t| Map<string, TAuthRequirement>\n\t\t| Promise<Map<string, TAuthRequirement>>;\n\n\t/**\n\t * Materialize the effective requirement list (also invoked by {@link buildPlan}).\n\t */\n\tpublic async resolveRequirementList(): Promise<readonly TAuthRequirement[]> {\n\t\tconst requirements = await this.buildRequirementList();\n\t\treturn [...requirements.values()];\n\t}\n\t/**\n\t * Pipeline step 1 — one loop iteration: select a candidate, run\n\t * `onUnauthenticated`, then reduce `plan` state.\n\t */\n\tasync runStep(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t): Promise<PipelineStepResult<TAuthRequirement>> {\n\t\tconst candidate = await plan.selectCandidate({\n\t\t\t...plan,\n\t\t\tcandidateList: this.createCandidateStream(plan),\n\t\t});\n\t\tif (!candidate) {\n\t\t\treturn { outcome: PipelineOutcome.Settled };\n\t\t}\n\t\tconst action = await plan.onUnauthenticated(candidate, plan);\n\n\t\treturn this.reduceFromAction(plan, candidate, action);\n\t}\n\n\tprotected reduceFromAction(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t\tcandidate: TAuthRequirement,\n\t\taction: Exclude<UnauthenticatedAction, Promise<unknown>>,\n\t): PipelineStepResult<TAuthRequirement> {\n\t\tif (action === true) {\n\t\t\tthis.recordFulfilled(plan, candidate);\n\t\t\treturn { outcome: PipelineOutcome.Resolved, requirement: candidate };\n\t\t}\n\t\tif (action === false) {\n\t\t\treturn { outcome: PipelineOutcome.Blocked, requirement: candidate };\n\t\t}\n\t\treturn {\n\t\t\toutcome: PipelineOutcome.Redirect,\n\t\t\trequirement: candidate,\n\t\t\tlocation: action,\n\t\t};\n\t}\n\n\t// --- Pipeline orchestration ---------------------------------------------\n\n\t/**\n\t * Run the full pipeline: {@link buildPlan}, step 1, then loop step 2 until\n\t * settled or a terminal outcome (`blocked`, `redirect`, or a never-settling\n\t * action).\n\t */\n\tasync runUntilSettled(): Promise<PipelineRunResult<TAuthRequirement>> {\n\t\tconst plan = await this.buildPlan();\n\t\treturn this.runUntilSettledWithPlan(plan);\n\t}\n\n\tasync runUntilSettledWithPlan(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t): Promise<PipelineRunResult<TAuthRequirement>> {\n\t\twhile (true) {\n\t\t\tconst step = await this.runStep(plan);\n\n\t\t\tif (step.outcome === PipelineOutcome.Settled) {\n\t\t\t\treturn {\n\t\t\t\t\toutcome: PipelineOutcome.Settled,\n\t\t\t\t\tresolutions: plan.resolutionList,\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (step.outcome === PipelineOutcome.Resolved) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (step.outcome === PipelineOutcome.Blocked) {\n\t\t\t\treturn step;\n\t\t\t}\n\t\t\tif (step.outcome === PipelineOutcome.Redirect) {\n\t\t\t\treturn step;\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async *createCandidateStream(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t): RequirementCandidateGenerator<TAuthRequirement> {\n\t\tconst context = {\n\t\t\tplanContext: this.planContext,\n\t\t\trequirements: plan.requirements,\n\t\t\tresolutionList: plan.resolutionList,\n\t\t\tenvironment: plan.environment,\n\t\t};\n\t\tconst checked = plan.requirements\n\t\t\t.filter(\n\t\t\t\t(requirement) =>\n\t\t\t\t\t!plan.resolutionList.some(\n\t\t\t\t\t\t(resolution) => resolution.requirementId === requirement.id,\n\t\t\t\t\t),\n\t\t\t)\n\t\t\t.map(\n\t\t\t\tasync (\n\t\t\t\t\trequirement,\n\t\t\t\t): Promise<RequirementCheckResult<TAuthRequirement>> => {\n\t\t\t\t\tconst satisfied = await plan.checkAuthenticated(requirement, context);\n\t\t\t\t\treturn { requirement, satisfied };\n\t\t\t\t},\n\t\t\t);\n\n\t\tfor await (const {\n\t\t\trequirement,\n\t\t\tsatisfied,\n\t\t} of promisesToRacedAsyncGenerator(checked)) {\n\t\t\tif (satisfied) {\n\t\t\t\tthis.recordFulfilled(plan, requirement);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tyield requirement;\n\t\t}\n\t}\n\n\tprivate recordFulfilled(\n\t\tplan: RequirementPlan<TAuthRequirement, TPlanContext>,\n\t\trequirement: TAuthRequirement,\n\t): void {\n\t\tif (\n\t\t\tplan.resolutionList.some(\n\t\t\t\t(resolution) => resolution.requirementId === requirement.id,\n\t\t\t)\n\t\t) {\n\t\t\treturn;\n\t\t}\n\t\tplan.resolutionList.push(\n\t\t\tObject.freeze({\n\t\t\t\trequirementId: requirement.id,\n\t\t\t\tstatus: ResolutionStatus.Fulfilled,\n\t\t\t}),\n\t\t);\n\t}\n}\n","// Merge requirement planner — concatenation of multiple planners\n//\n// Canonical public export: @securitydept/client\n//\n// Concatenates source planners in order. Overlapping ids follow Map semantics:\n// the later source wins for the same key.\n\nimport { type AuthRequirement, type RequirementBehaviour } from \"../contract\";\nimport { type RequirementPlannerHost } from \"../planner-host\";\nimport { BaseRequirementPlanner } from \"./base-planner\";\n\n/**\n * A planner whose effective requirements are the ordered union of its source\n * planners. Overlapping ids follow Map semantics (later source wins).\n *\n * @example\n * ```ts\n * const planner = MergeRequirementPlanner.fromPlanners(host, [\n *   sessionPlanner,\n *   oidcPlanner,\n * ]);\n * ```\n */\nexport class MergeRequirementPlanner<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTPlanContext = {},\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n> extends BaseRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour> {\n\tprivate readonly sources: readonly BaseRequirementPlanner<\n\t\tTAuthRequirement,\n\t\tTPlanContext,\n\t\tTBehaviour\n\t>[];\n\n\tget planContext(): TPlanContext {\n\t\treturn Object.assign(\n\t\t\t{},\n\t\t\t...this.sources.map((source) => source.planContext),\n\t\t);\n\t}\n\n\tprotected constructor(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tsources: readonly BaseRequirementPlanner<\n\t\t\tTAuthRequirement,\n\t\t\tTPlanContext,\n\t\t\tTBehaviour\n\t\t>[],\n\t) {\n\t\tsuper(host);\n\t\tthis.sources = sources;\n\t}\n\n\t/** Create a merge planner from an ordered list of source planners. */\n\tstatic fromPlanners<\n\t\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\t\tTPlanContext = {},\n\t\tTBehaviour extends Partial<\n\t\t\tRequirementBehaviour<TAuthRequirement, TPlanContext>\n\t\t> = Partial<RequirementBehaviour<TAuthRequirement, TPlanContext>>,\n\t>(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tplanners: readonly BaseRequirementPlanner<\n\t\t\tTAuthRequirement,\n\t\t\tTPlanContext,\n\t\t\tTBehaviour\n\t\t>[],\n\t): MergeRequirementPlanner<TAuthRequirement, TPlanContext, TBehaviour> {\n\t\treturn new MergeRequirementPlanner(host, planners);\n\t}\n\n\tprotected async buildRequirementList(): Promise<\n\t\tMap<string, TAuthRequirement>\n\t> {\n\t\tconst map = new Map<string, TAuthRequirement>();\n\t\tfor (const source of this.sources) {\n\t\t\tfor (const requirement of await source.resolveRequirementList()) {\n\t\t\t\tmap.set(requirement.id, requirement);\n\t\t\t}\n\t\t}\n\t\treturn map;\n\t}\n}\n","// Route composition requirement planner — matched route chain folding\n//\n// Canonical public export: @securitydept/client\n//\n// Folds a matched route chain (root -> leaf) into a single effective\n// requirement list, applying each segment's inherit/merge/replace composition.\n//\n// Route transitions are modeled as immutable construction: there is no in-place\n// reset. A fresh instance is produced from the previous one, preserving the\n// resolutions for the shared requirement prefix so cross-navigation progress is\n// not lost while diverging requirements are re-planned.\n\nimport {\n\ttype AuthRequirement,\n\ttype RequirementBehaviourWithRouteContext,\n\ttype RequirementResolution,\n\tRequirementsComposition,\n\ttype RouteBehaviourContextExtra,\n\ttype RouteStateSnapshotTrait,\n\ttype RouteTreeSegment,\n\tresolveEffectiveRequirements,\n} from \"../contract\";\nimport { type RequirementPlannerHost } from \"../planner-host\";\nimport { BaseRequirementPlanner, type RequirementPlan } from \"./base-planner\";\n\n/** Fold a matched route chain into its effective requirement list. */\nfunction foldSegments<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n>(\n\tsegments: readonly RouteTreeSegment<TAuthRequirement>[],\n): readonly TAuthRequirement[] {\n\tconst effective = new Map<string, TAuthRequirement>();\n\tfor (const segment of segments) {\n\t\tresolveEffectiveRequirements(\n\t\t\t{\n\t\t\t\tcomposition: segment.composition ?? RequirementsComposition.Merge,\n\t\t\t\trequirements: segment.requirements,\n\t\t\t},\n\t\t\teffective,\n\t\t);\n\t}\n\treturn [...effective.values()];\n}\n\n/** Length of the shared requirement-id prefix between two effective lists. */\nfunction sharedPrefixLength(\n\tprevious: readonly AuthRequirement[],\n\tnext: readonly AuthRequirement[],\n): number {\n\tconst limit = Math.min(previous.length, next.length);\n\tlet shared = 0;\n\twhile (shared < limit && previous[shared].id === next[shared].id) {\n\t\tshared += 1;\n\t}\n\treturn shared;\n}\n\n/**\n * A planner driven by a matched route chain with composition semantics.\n *\n * Construct via {@link fromRouteSegments} for a matched route chain, or\n * {@link fromRouteTransition} for a transition that preserves shared-prefix\n * resolutions from the previous planner instance.\n */\nexport class RouteCompositionRequirementPlanner<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTBehaviour extends Partial<\n\t\tRequirementBehaviourWithRouteContext<TAuthRequirement>\n\t> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>,\n> extends BaseRequirementPlanner<\n\tTAuthRequirement,\n\tRouteBehaviourContextExtra,\n\tTBehaviour\n> {\n\tprivate readonly _segments: readonly RouteTreeSegment<TAuthRequirement>[];\n\tprivate readonly _effective: readonly TAuthRequirement[];\n\tprivate readonly _planContext: RouteBehaviourContextExtra;\n\n\tprotected constructor(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tsegments: readonly RouteTreeSegment<TAuthRequirement>[],\n\t\trouteState: RouteStateSnapshotTrait,\n\t\tpreservedResolutions: readonly RequirementResolution[] = [],\n\t) {\n\t\tsuper(host, preservedResolutions);\n\t\tthis._segments = segments;\n\t\tthis._effective = foldSegments(segments);\n\t\tthis._planContext = Object.freeze({\n\t\t\trouteState: Object.freeze({ ...routeState }),\n\t\t});\n\t}\n\n\t/** Build a planner from a matched route chain. */\n\tstatic fromRouteSegments<\n\t\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\t\tTBehaviour extends Partial<\n\t\t\tRequirementBehaviourWithRouteContext<TAuthRequirement>\n\t\t> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>,\n\t>(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tsegments: readonly RouteTreeSegment<TAuthRequirement>[],\n\t\trouteState: RouteStateSnapshotTrait,\n\t): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour> {\n\t\treturn new RouteCompositionRequirementPlanner(host, segments, routeState);\n\t}\n\n\t/**\n\t * Build a planner for a route transition, preserving resolutions for the\n\t * shared requirement prefix carried over from `previousPlan`.\n\t */\n\tstatic fromRouteTransition<\n\t\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\t\tTBehaviour extends Partial<\n\t\t\tRequirementBehaviourWithRouteContext<TAuthRequirement>\n\t\t> = Partial<RequirementBehaviourWithRouteContext<TAuthRequirement>>,\n\t>(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\tcurrentSegments: readonly RouteTreeSegment<TAuthRequirement>[],\n\t\trouteState: RouteStateSnapshotTrait,\n\t\tpreviousPlanner: RouteCompositionRequirementPlanner<\n\t\t\tTAuthRequirement,\n\t\t\tTBehaviour\n\t\t>,\n\t\tpreviousPlan: RequirementPlan<TAuthRequirement, RouteBehaviourContextExtra>,\n\t): RouteCompositionRequirementPlanner<TAuthRequirement, TBehaviour> {\n\t\tconst nextEffective = foldSegments(currentSegments);\n\t\tconst shared = sharedPrefixLength(\n\t\t\tpreviousPlanner.effectiveRequirements,\n\t\t\tnextEffective,\n\t\t);\n\t\tconst sharedIds = new Set(\n\t\t\tnextEffective.slice(0, shared).map((requirement) => requirement.id),\n\t\t);\n\t\tconst preserved = previousPlan.resolutionList.filter((resolution) =>\n\t\t\tsharedIds.has(resolution.requirementId),\n\t\t);\n\t\treturn new RouteCompositionRequirementPlanner(\n\t\t\thost,\n\t\t\tcurrentSegments,\n\t\t\trouteState,\n\t\t\tpreserved,\n\t\t);\n\t}\n\n\tget planContext(): RouteBehaviourContextExtra {\n\t\treturn this._planContext;\n\t}\n\n\t/** The matched route chain backing this planner. */\n\tget segments(): readonly RouteTreeSegment<TAuthRequirement>[] {\n\t\treturn this._segments;\n\t}\n\n\t/** The folded effective requirement list (composition applied). */\n\tget effectiveRequirements(): readonly TAuthRequirement[] {\n\t\treturn this._effective;\n\t}\n\n\tprotected buildRequirementList(): Map<string, TAuthRequirement> {\n\t\treturn new Map(\n\t\t\tthis._effective.map((requirement) => [requirement.id, requirement]),\n\t\t);\n\t}\n}\n","// Static requirement planner — fixed requirement list\n//\n// Canonical public export: @securitydept/client\n\nimport { type AuthRequirement, type RequirementBehaviour } from \"../contract\";\nimport { type RequirementPlannerHost } from \"../planner-host\";\nimport { BaseRequirementPlanner } from \"./base-planner\";\n\n/**\n * A planner whose effective requirement list is a fixed array supplied at\n * construction time.\n *\n * @example\n * ```ts\n * const planner = StaticRequirementPlanner.fromRequirements(host, [\n *   StaticAttrsAuthRequirement.create({ id: \"session\" }),\n * ] as Readonly<AuthRequirement[]>);\n * const plan = await planner.buildPlan();\n * const step = await planner.runStep(plan);\n * // or: const result = await planner.runUntilSettled();\n * ```\n */\nexport class StaticRequirementPlanner<\n\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\tTBehaviour extends Partial<RequirementBehaviour<TAuthRequirement>> = Partial<\n\t\tRequirementBehaviour<TAuthRequirement>\n\t>,\n> extends BaseRequirementPlanner<TAuthRequirement, {}, TBehaviour> {\n\tprivate readonly staticRequirements: readonly TAuthRequirement[];\n\n\tget planContext(): {} {\n\t\treturn {};\n\t}\n\n\tprotected constructor(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\trequirements: readonly TAuthRequirement[],\n\t) {\n\t\tsuper(host);\n\t\tthis.staticRequirements = requirements;\n\t}\n\n\t/** Create a static planner from an ordered requirement list. */\n\tstatic fromRequirements<\n\t\tTAuthRequirement extends AuthRequirement = AuthRequirement,\n\t\tTBehaviour extends Partial<\n\t\t\tRequirementBehaviour<TAuthRequirement>\n\t\t> = Partial<RequirementBehaviour<TAuthRequirement>>,\n\t>(\n\t\thost: RequirementPlannerHost<TBehaviour>,\n\t\trequirements: readonly TAuthRequirement[],\n\t): StaticRequirementPlanner<TAuthRequirement, TBehaviour> {\n\t\treturn new StaticRequirementPlanner(host, requirements);\n\t}\n\n\tprotected buildRequirementList(): Map<string, TAuthRequirement> {\n\t\tconst map = new Map<string, TAuthRequirement>();\n\t\tfor (const requirement of this.staticRequirements) {\n\t\t\tmap.set(requirement.id, requirement);\n\t\t}\n\t\treturn map;\n\t}\n}\n","import { EMPTY, NEVER } from \"rxjs\";\nimport {\n\tRxEventReplaySubject,\n\tRxEventStream,\n\tRxEventSubject,\n} from \"../rx/event\";\nimport {\n\ttype EventObserverTrait,\n\ttype EventStreamTrait,\n\ttype EventSubjectTrait,\n} from \"./types\";\n\n/**\n * Create a new event stream from a producer function.\n *\n * The producer receives an observer and should call `next()` to emit values,\n * `error()` to signal an error, and `complete()` to signal completion.\n * It may return a teardown function that will be called on unsubscribe.\n */\nexport function createEventStream<T>(\n\tproducer: (observer: EventObserverTrait<T>) => (() => void) | void,\n): EventStreamTrait<T> {\n\treturn new RxEventStream(producer);\n}\n\nexport function createEventSubject<T>(): EventSubjectTrait<T> {\n\treturn new RxEventSubject<T>();\n}\n\nexport function createEventReplaySubject<T>(\n\tbufferSize = Infinity,\n): EventSubjectTrait<T> {\n\treturn new RxEventReplaySubject<T>(bufferSize);\n}\n\nexport function createEmptyEventStream<T>(): EventStreamTrait<T> {\n\treturn RxEventStream.fromObservableInput(EMPTY);\n}\n\nexport function createNeverEventStream<T>(): EventStreamTrait<T> {\n\treturn RxEventStream.fromObservableInput(NEVER);\n}\n","import { ClientError } from \"../errors\";\n\nexport type ClientErrorEvent =\n\t| { readonly error: ClientError }\n\t| { readonly payload: { readonly error: ClientError } };\n\nexport type ExtractClientErrorEvent<TEvent> = Extract<TEvent, ClientErrorEvent>;\n\nexport function isClientErrorEvent<TEvent>(\n\tevent: TEvent,\n): event is ExtractClientErrorEvent<TEvent> {\n\tif (typeof event !== \"object\" || event === null) {\n\t\treturn false;\n\t}\n\tif (\"error\" in event && event.error instanceof ClientError) {\n\t\treturn true;\n\t}\n\treturn (\n\t\t\"payload\" in event &&\n\t\ttypeof event.payload === \"object\" &&\n\t\tevent.payload !== null &&\n\t\t\"error\" in event.payload &&\n\t\tevent.payload.error instanceof ClientError\n\t);\n}\n","import { from } from \"rxjs\";\nimport { type InteropObservableTrait } from \"../compat\";\nimport { RxEventStream } from \"../rx/event\";\nimport { type ReadableSignalTrait } from \"../signals/types\";\nimport { type EventStreamTrait, isEventStreamTrait } from \"./types\";\n\nexport type ToEventStreamInput<T> =\n\t| InteropObservableTrait<T>\n\t| Promise<T>\n\t| AsyncIterable<T>\n\t| PromiseLike<T>\n\t| ArrayLike<T>\n\t| Iterable<T>\n\t| EventStreamTrait<T>\n\t| ReadableSignalTrait<T>;\n\nexport function toEventStream<T>(\n\tinput: ToEventStreamInput<T>,\n): EventStreamTrait<T> {\n\tif (isEventStreamTrait(input)) {\n\t\treturn input;\n\t}\n\treturn RxEventStream.fromObservableInput(from(input));\n}\n","import { type as defineType } from \"arktype\";\nimport { type IdentityPrincipal } from \"./contracts\";\n\nexport const IdentityPrincipalSchema = defineType({\n\tsubject: \"string > 0\",\n\t\"displayName?\": \"string | null | undefined\",\n\t\"picture?\": \"string | null | undefined\",\n\t\"issuer?\": \"string | null | undefined\",\n\t\"claims?\": \"object | null | undefined\",\n}).pipe(\n\t(input): IdentityPrincipal => ({\n\t\tsubject: input.subject,\n\t\tdisplayName:\n\t\t\ttypeof input.displayName === \"string\" &&\n\t\t\tinput.displayName.trim().length > 0\n\t\t\t\t? input.displayName\n\t\t\t\t: input.subject,\n\t\tpicture: input.picture ?? undefined,\n\t\tissuer: input.issuer ?? undefined,\n\t\tclaims: (input.claims ?? undefined) as Record<string, unknown> | undefined,\n\t}),\n);\n\nexport const IdentityPrincipalWireSchema = defineType({\n\tsubject: \"string > 0\",\n\t\"display_name?\": \"string | null | undefined\",\n\t\"picture?\": \"string | null | undefined\",\n\t\"issuer?\": \"string | null | undefined\",\n\t\"claims?\": \"object | null | undefined\",\n}).pipe(\n\t(input): IdentityPrincipal => ({\n\t\tsubject: input.subject,\n\t\tdisplayName:\n\t\t\ttypeof input.display_name === \"string\" &&\n\t\t\tinput.display_name.trim().length > 0\n\t\t\t\t? input.display_name\n\t\t\t\t: input.subject,\n\t\tpicture: input.picture ?? undefined,\n\t\tissuer: input.issuer ?? undefined,\n\t\tclaims: (input.claims ?? undefined) as Record<string, unknown> | undefined,\n\t}),\n);\n","import { ClientError, ClientErrorKind } from \"../errors\";\nimport {\n\tformatValidationFailure,\n\ttype ValidationFailure,\n\tvalidateWithSchemaSync,\n} from \"../validation\";\nimport {\n\ttype IdentityPrincipal,\n\ttype ProjectIdentityPrincipalOptions,\n} from \"./contracts\";\nimport {\n\tIdentityPrincipalSchema,\n\tIdentityPrincipalWireSchema,\n} from \"./schemas\";\n\nfunction throwIdentityPrincipalParseError(options: {\n\tcode: string;\n\tmessagePrefix: string;\n\tfailure: ValidationFailure;\n}): never {\n\tthrow new ClientError({\n\t\tkind: ClientErrorKind.Protocol,\n\t\tcode: options.code,\n\t\tmessage: `${options.messagePrefix}: ${formatValidationFailure(options.failure) ?? \"schema validation failed\"}.`,\n\t\tsource: \"identity\",\n\t\tcause: options.failure.issues,\n\t});\n}\n\nexport function parseIdentityPrincipal(input: unknown): IdentityPrincipal {\n\tconst result = validateWithSchemaSync(IdentityPrincipalSchema, input);\n\tif (result.success) {\n\t\treturn result.value;\n\t}\n\tthrowIdentityPrincipalParseError({\n\t\tcode: \"identity.invalid_principal\",\n\t\tmessagePrefix: \"Identity principal payload is invalid\",\n\t\tfailure: result,\n\t});\n}\n\nexport function parseIdentityPrincipalWire(input: unknown): IdentityPrincipal {\n\tconst result = validateWithSchemaSync(IdentityPrincipalWireSchema, input);\n\tif (result.success) {\n\t\treturn result.value;\n\t}\n\tthrowIdentityPrincipalParseError({\n\t\tcode: \"identity.invalid_principal_wire\",\n\t\tmessagePrefix: \"Identity principal wire payload is invalid\",\n\t\tfailure: result,\n\t});\n}\n\nexport function projectIdentityPrincipal(\n\toptions: ProjectIdentityPrincipalOptions,\n): IdentityPrincipal {\n\tconst principal = options.principal;\n\tconst subject =\n\t\tprincipal?.subject ?? options.fallbackSubject ?? \"context.anonymous\";\n\tconst displayName =\n\t\tprincipal?.displayName?.trim() || options.fallbackDisplayName || subject;\n\n\treturn {\n\t\tsubject,\n\t\tdisplayName,\n\t\tpicture: principal?.picture,\n\t\tissuer: principal?.issuer ?? options.fallbackIssuer,\n\t\tclaims: principal?.claims ?? options.fallbackClaims,\n\t};\n}\n","import { ClientError, ClientErrorKind } from \"../../errors\";\n\nexport const JwtDecodeErrorCode = {\n\tInvalidFormat: \"protocol.jwt.invalid_format\",\n\tInvalidPayload: \"protocol.jwt.invalid_payload\",\n\tInvalidClaim: \"protocol.jwt.invalid_claim\",\n} as const;\n\nexport type JwtDecodeErrorCode =\n\t(typeof JwtDecodeErrorCode)[keyof typeof JwtDecodeErrorCode];\n\nexport class JwtDecodeError extends ClientError {\n\toverride readonly code: JwtDecodeErrorCode;\n\n\tconstructor(options: {\n\t\tcode: JwtDecodeErrorCode;\n\t\tmessage: string;\n\t\tcause?: unknown;\n\t}) {\n\t\tsuper({\n\t\t\tkind: ClientErrorKind.Protocol,\n\t\t\tcode: options.code,\n\t\t\tmessage: options.message,\n\t\t\tsource: \"protocol.jwt\",\n\t\t\tcause: options.cause,\n\t\t});\n\t\tthis.name = \"JwtDecodeError\";\n\t\tthis.code = options.code;\n\t}\n}\n","import { JwtDecodeError, JwtDecodeErrorCode } from \"./error\";\nimport { type DecodeJwtPayloadOptions, type JwtClaimsSet } from \"./types\";\n\nexport function decodeJwtPayload(\n\tjwt: string,\n\toptions: DecodeJwtPayloadOptions = {},\n): JwtClaimsSet {\n\tconst label = options.label ?? \"JWT\";\n\tconst parts = jwt.split(\".\");\n\tif (parts.length !== 3) {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidFormat,\n\t\t\tmessage: `${label} must use compact JWS serialization`,\n\t\t});\n\t}\n\n\tconst claims = parseBase64UrlJsonObject(parts[1], `${label} payload`);\n\tvalidateRegisteredClaimTypes(claims, label);\n\treturn claims;\n}\n\nfunction parseBase64UrlJsonObject(value: string, label: string): JwtClaimsSet {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(decodeBase64UrlUtf8(value));\n\t} catch (cause) {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidPayload,\n\t\t\tmessage: `${label} must be base64url-encoded JSON`,\n\t\t\tcause,\n\t\t});\n\t}\n\n\tif (!isJsonObject(parsed)) {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidPayload,\n\t\t\tmessage: `${label} must be a JSON object`,\n\t\t});\n\t}\n\treturn parsed;\n}\n\nfunction decodeBase64UrlUtf8(value: string): string {\n\tconst base64 = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n\tconst padded = base64 + \"=\".repeat((4 - (base64.length % 4)) % 4);\n\tconst binary = atob(padded);\n\tconst bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));\n\treturn new TextDecoder().decode(bytes);\n}\n\nfunction validateRegisteredClaimTypes(\n\tclaims: JwtClaimsSet,\n\tlabel: string,\n): void {\n\tif (claims.exp !== undefined && typeof claims.exp !== \"number\") {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"exp\" claim must be a number`,\n\t\t});\n\t}\n\tif (claims.iat !== undefined && typeof claims.iat !== \"number\") {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"iat\" claim must be a number`,\n\t\t});\n\t}\n\tif (claims.nbf !== undefined && typeof claims.nbf !== \"number\") {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"nbf\" claim must be a number`,\n\t\t});\n\t}\n\tif (claims.iss !== undefined && typeof claims.iss !== \"string\") {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"iss\" claim must be a string`,\n\t\t});\n\t}\n\tif (\n\t\tclaims.aud !== undefined &&\n\t\ttypeof claims.aud !== \"string\" &&\n\t\t!isStringArray(claims.aud)\n\t) {\n\t\tthrow new JwtDecodeError({\n\t\t\tcode: JwtDecodeErrorCode.InvalidClaim,\n\t\t\tmessage: `${label} \"aud\" claim must be a string or string array`,\n\t\t});\n\t}\n}\n\nfunction isJsonObject(value: unknown): value is JwtClaimsSet {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isStringArray(value: unknown): value is readonly string[] {\n\treturn (\n\t\tArray.isArray(value) && value.every((item) => typeof item === \"string\")\n\t);\n}\n","/**\n * Parse a human-readable duration string (for example `5m` or `300s`) into\n * milliseconds.\n */\nexport function parseDurationToMs(duration: string): number {\n\tconst match = duration.match(/^(\\d+(?:\\.\\d+)?)\\s*(s|ms|m|h)$/);\n\tif (!match) {\n\t\treturn 0;\n\t}\n\tconst value = Number(match[1]);\n\n\tswitch (match[2]) {\n\t\tcase \"ms\":\n\t\t\treturn value;\n\t\tcase \"s\":\n\t\t\treturn value * 1000;\n\t\tcase \"m\":\n\t\t\treturn value * 60 * 1000;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60 * 1000;\n\t\tdefault:\n\t\t\treturn 0;\n\t}\n}\n","import { type Codec } from \"./types\";\n\n/** Default JSON codec. */\nexport function createJsonCodec<T>(): Codec<T> {\n\treturn {\n\t\tencode(value: T): string {\n\t\t\treturn JSON.stringify(value);\n\t\t},\n\t\tdecode(raw: string): T {\n\t\t\treturn JSON.parse(raw) as T;\n\t\t},\n\t};\n}\n","import { createJsonCodec } from \"./json-codec\";\nimport {\n\ttype Codec,\n\ttype EphemeralFlowStore,\n\ttype KeyedEphemeralFlowStore,\n\ttype StorageTrait,\n} from \"./types\";\n\nexport interface CreateEphemeralFlowStoreOptions<T> {\n\tstore: StorageTrait;\n\tkey: string;\n\tcodec?: Codec<T>;\n}\n\nexport interface CreateKeyedEphemeralFlowStoreOptions<T> {\n\tstore: StorageTrait;\n\tkeyPrefix: string;\n\tcodec?: Codec<T>;\n}\n\nfunction resolveStorageKey(keyPrefix: string, key: string): string {\n\treturn keyPrefix.length > 0 ? `${keyPrefix}:${key}` : key;\n}\n\nfunction requireRecordStoreTake(\n\tstore: StorageTrait,\n): NonNullable<StorageTrait[\"take\"]> {\n\tif (!store.take) {\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Configuration,\n\t\t\tcode: \"storage.ephemeral.take_unavailable\",\n\t\t\tmessage:\n\t\t\t\t\"Ephemeral flow stores require StorageTrait.take() for atomic single-consume semantics\",\n\t\t\tsource: \"storage.ephemeral\",\n\t\t});\n\t}\n\n\treturn store.take.bind(store);\n}\n\nasync function executeStorageOperation<T>(\n\toperation: () => T | Promise<T>,\n): Promise<T> {\n\ttry {\n\t\treturn await operation();\n\t} catch (error) {\n\t\tif (error instanceof ClientError) {\n\t\t\tthrow error;\n\t\t}\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Storage,\n\t\t\tcode: \"storage.ephemeral.io_failed\",\n\t\t\tmessage: \"The ephemeral flow store operation failed\",\n\t\t\tsource: \"storage.ephemeral\",\n\t\t\tcause: error,\n\t\t});\n\t}\n}\n\nfunction decodeStoredValue<T>(codec: Codec<T>, value: string): T {\n\ttry {\n\t\treturn codec.decode(value);\n\t} catch (error) {\n\t\tthrow new ClientError({\n\t\t\tkind: ClientErrorKind.Protocol,\n\t\t\tcode: \"storage.ephemeral.invalid_payload\",\n\t\t\tmessage: \"The ephemeral flow store payload is invalid\",\n\t\t\tsource: \"storage.ephemeral\",\n\t\t\tcause: error,\n\t\t});\n\t}\n}\n\n/**\n * Create a typed ephemeral flow-state store backed by a low-level `StorageTrait`.\n *\n * Intended for short-lived browser/session coordination state such as pending\n * redirects or callback fragments.\n */\nexport function createEphemeralFlowStore<T>(\n\toptions: CreateEphemeralFlowStoreOptions<T>,\n): EphemeralFlowStore<T> {\n\tconst codec = options.codec ?? createJsonCodec<T>();\n\tconst storeTake = requireRecordStoreTake(options.store);\n\n\tasync function load(): Promise<T | null> {\n\t\tconst raw = await executeStorageOperation(() =>\n\t\t\toptions.store.get(options.key),\n\t\t);\n\t\treturn raw === null ? null : decodeStoredValue(codec, raw);\n\t}\n\n\tasync function save(value: T): Promise<void> {\n\t\tawait executeStorageOperation(() =>\n\t\t\toptions.store.set(options.key, codec.encode(value)),\n\t\t);\n\t}\n\n\tasync function consume(): Promise<T | null> {\n\t\tconst raw = await executeStorageOperation(() => storeTake(options.key));\n\t\treturn raw === null ? null : decodeStoredValue(codec, raw);\n\t}\n\n\tasync function clear(): Promise<void> {\n\t\tawait executeStorageOperation(() => options.store.remove(options.key));\n\t}\n\n\treturn {\n\t\tload,\n\t\tsave,\n\t\tconsume,\n\t\tclear,\n\t};\n}\n\n/**\n * Create a typed keyed ephemeral flow-state store backed by a low-level\n * `StorageTrait`.\n *\n * Intended for short-lived browser/session coordination state where multiple\n * pending records must coexist and be consumed independently.\n */\nexport function createKeyedEphemeralFlowStore<T>(\n\toptions: CreateKeyedEphemeralFlowStoreOptions<T>,\n): KeyedEphemeralFlowStore<T> {\n\tconst codec = options.codec ?? createJsonCodec<T>();\n\tconst storeTake = requireRecordStoreTake(options.store);\n\n\tasync function load(key: string): Promise<T | null> {\n\t\tconst raw = await executeStorageOperation(() =>\n\t\t\toptions.store.get(resolveStorageKey(options.keyPrefix, key)),\n\t\t);\n\t\treturn raw === null ? null : decodeStoredValue(codec, raw);\n\t}\n\n\tasync function save(key: string, value: T): Promise<void> {\n\t\tawait executeStorageOperation(() =>\n\t\t\toptions.store.set(\n\t\t\t\tresolveStorageKey(options.keyPrefix, key),\n\t\t\t\tcodec.encode(value),\n\t\t\t),\n\t\t);\n\t}\n\n\tasync function take(key: string): Promise<T | null> {\n\t\tconst raw = await executeStorageOperation(() =>\n\t\t\tstoreTake(resolveStorageKey(options.keyPrefix, key)),\n\t\t);\n\t\treturn raw === null ? null : decodeStoredValue(codec, raw);\n\t}\n\n\tasync function clear(key: string): Promise<void> {\n\t\tawait executeStorageOperation(() =>\n\t\t\toptions.store.remove(resolveStorageKey(options.keyPrefix, key)),\n\t\t);\n\t}\n\n\treturn {\n\t\tload,\n\t\tsave,\n\t\ttake,\n\t\tclear,\n\t};\n}\n\nimport { ClientError, ClientErrorKind } from \"../errors\";\n","import { SYMBOL_OBSERVABLE } from \"../compat\";\nimport { createSignal, type ReadableSignalTrait } from \"../signals\";\n\nexport const OnceAsyncLockState = {\n\tInit: \"init\",\n\tRunning: \"running\",\n\tSuccess: \"success\",\n\tError: \"error\",\n} as const;\n\nexport type OnceAsyncLockState =\n\t(typeof OnceAsyncLockState)[keyof typeof OnceAsyncLockState];\n\nexport type OnceAsyncLockInit = {\n\treadonly state: typeof OnceAsyncLockState.Init;\n\treadonly promise?: never;\n};\n\nexport type OnceAsyncLockRunning = {\n\treadonly state: typeof OnceAsyncLockState.Running;\n\treadonly promise: Promise<unknown>;\n};\n\nexport type OnceAsyncLockSuccess<T> = {\n\treadonly state: typeof OnceAsyncLockState.Success;\n\treadonly data: T;\n};\n\nexport type OnceAsyncLockError<E> = {\n\treadonly state: typeof OnceAsyncLockState.Error;\n\treadonly error: E;\n};\n\nexport type OnceAsyncLock<T, E> =\n\t| OnceAsyncLockInit\n\t| OnceAsyncLockRunning\n\t| OnceAsyncLockSuccess<T>\n\t| OnceAsyncLockError<E>;\n\nexport type OnceAsyncLockCallable<\n\tF extends (...args: any[]) => PromiseLike<any>,\n\tE = unknown,\n> = F &\n\tOnceAsyncLock<Awaited<ReturnType<F>>, E> &\n\tReadableSignalTrait<OnceAsyncLock<Awaited<ReturnType<F>>, E>>;\n\nexport function createOnceAsyncLockCallable<\n\tF extends (...args: any[]) => PromiseLike<any>,\n\tE = unknown,\n>(fn: F): OnceAsyncLockCallable<F, E> {\n\tconst internalStateSignal = createSignal({\n\t\tstate: OnceAsyncLockState.Init,\n\t} as OnceAsyncLock<Awaited<ReturnType<F>>, E>);\n\n\tconst coreFn = async function (\n\t\tthis: any,\n\t\t...args: Parameters<F>\n\t): Promise<Awaited<ReturnType<F>>> {\n\t\tconst internalState = internalStateSignal.get();\n\t\tif (internalState.state === OnceAsyncLockState.Running) {\n\t\t\treturn internalState.promise as Promise<Awaited<ReturnType<F>>>;\n\t\t}\n\t\tif (internalState.state === OnceAsyncLockState.Success) {\n\t\t\treturn internalState.data;\n\t\t}\n\n\t\tlet resolvePromise!: (value: Awaited<ReturnType<F>>) => void;\n\t\tlet rejectPromise!: (reason: any) => void;\n\n\t\tconst promise = new Promise<Awaited<ReturnType<F>>>((res, rej) => {\n\t\t\tresolvePromise = res;\n\t\t\trejectPromise = rej;\n\t\t});\n\t\tpromise.catch(() => undefined);\n\n\t\tinternalStateSignal.set({ state: OnceAsyncLockState.Running, promise });\n\n\t\ttry {\n\t\t\tconst result = await fn.apply(this, args);\n\t\t\tinternalStateSignal.set({\n\t\t\t\tstate: OnceAsyncLockState.Success,\n\t\t\t\tdata: result,\n\t\t\t});\n\t\t\tresolvePromise(result);\n\t\t\treturn result;\n\t\t} catch (err) {\n\t\t\tinternalStateSignal.set({\n\t\t\t\tstate: OnceAsyncLockState.Error,\n\t\t\t\terror: err as E,\n\t\t\t});\n\t\t\trejectPromise(err);\n\t\t\tthrow err;\n\t\t}\n\t};\n\n\treturn new Proxy(coreFn, {\n\t\tget(target, prop, receiver) {\n\t\t\t// if accessing state, promise, data, error, map directly from internalState\n\t\t\tconst internalState = internalStateSignal.get();\n\t\t\tif (prop in internalState) {\n\t\t\t\treturn Reflect.get(internalState, prop);\n\t\t\t}\n\t\t\tif (\n\t\t\t\tprop === \"get\" ||\n\t\t\t\tprop === \"watchStream\" ||\n\t\t\t\tprop === SYMBOL_OBSERVABLE\n\t\t\t) {\n\t\t\t\tconst value = Reflect.get(\n\t\t\t\t\tinternalStateSignal,\n\t\t\t\t\tprop,\n\t\t\t\t\tinternalStateSignal,\n\t\t\t\t);\n\t\t\t\treturn typeof value === \"function\"\n\t\t\t\t\t? value.bind(internalStateSignal)\n\t\t\t\t\t: value;\n\t\t\t}\n\t\t\t// other properties (like function's name, length, toString, etc.) retain original function behavior\n\t\t\treturn Reflect.get(target, prop, receiver);\n\t\t},\n\t\t// intercept assignment operations to ensure state is read-only and prevent malicious or accidental modifications from outside\n\t\tset() {\n\t\t\treturn false; // in strict mode, this will throw a TypeError, preventing modification\n\t\t},\n\t}) as unknown as OnceAsyncLockCallable<F, E>;\n}\n","/**\n * Returns `true` for loopback HTTP URLs that browsers and local tooling often\n * permit during development flows.\n */\nexport function isLoopbackHttpUrl(url: URL): boolean {\n\treturn (\n\t\turl.protocol === \"http:\" &&\n\t\t(url.hostname === \"localhost\" ||\n\t\t\turl.hostname === \"127.0.0.1\" ||\n\t\t\turl.hostname === \"::1\" ||\n\t\t\turl.hostname === \"[::1]\")\n\t);\n}\n"],"mappings":";;;;;;;;;;AAoCA,IAAa,6BAAb,MAAa,2BAEb;CAEW;CACA;CACA;CAHV,YACC,IACA,OACA,YACC;EAHQ,KAAA,KAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;EAET,OAAO,OAAO,IAAI;CACnB;CAEA,OAAc,OACb,OAC0C;EAC1C,OAAO,IAAI,2BACV,OAAO,MAAMA,GAAO,GACpB,OAAO,OACP,OAAO,aAAa,OAAO,OAAO,MAAM,UAAU,IAAI,KAAA,CACvD;CACD;CAEA,OAAc,WACb,QACqD;EACrD,OAAO,OAAO,KAAK,UAAU,2BAA2B,OAAO,KAAK,CAAC;CACtE;AACD;;AAOA,MAAa,mBAAmB;CAC/B,WAAW;CACX,QAAQ;CACR,SAAS;AACV;;AAgBA,MAAa,aAAa;;CAEzB,SAAS;;CAET,SAAS;AACV;;AAKA,IAAa,0BAAb,cAA6C,MAAM;CAClD,YAAY,SAAiB;EAC5B,MAAM,OAAO;EACb,KAAK,OAAO;CACb;AACD;AAiHA,SAAgB,0BACf,OACmC;CACnC,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS;AAChE;AAEA,SAAgB,6BACf,OACsC;CACtC,OACC,OAAO,UAAU,YACjB,UAAU,QACV,gBAAgB,SAChB,0BAA0B,MAAM,UAAU;AAE5C;;AAWA,MAAa,kBAAkB;;CAE9B,SAAS;;CAET,UAAU;;CAEV,SAAS;;CAET,UAAU;AACX;;;;;;;;;AA6CA,MAAa,0BAA0B;CACtC,SAAS;CACT,OAAO;CACP,SAAS;AACV;;;;;;;;AAgCA,SAAgB,6BAGf,OACA,4BAA2C,IAAI,IAAI,GACnB;CAChC,QAAQ,MAAM,aAAd;EACC,KAAK,wBAAwB,SAC5B,OAAO;EAER,KAAK,wBAAwB;GAC5B,KAAK,MAAM,eAAe,MAAM,cAC/B,UAAU,IAAI,YAAY,IAAI,WAAW;GAE1C,OAAO;EAER,KAAK,wBAAwB;GAC5B,UAAU,MAAM;GAChB,KAAK,MAAM,eAAe,MAAM,cAC/B,UAAU,IAAI,YAAY,IAAI,WAAW;GAE1C,OAAO;EAER,SAAS;GACR,MAAM,cAAqB,MAAM;GACjC,MAAM,IAAI,wBACT,qCAAqC,OAAO,WAAW,GACxD;EACD;CACD;AACD;;;;AChWA,SAAgB,cAAc,OAA8B;CAC3D,IAAI,iBAAiB,aACpB,OAAO;EACN,WAAW,MAAM;EACjB,WAAW,MAAM;EACjB,WAAW,MAAM;EACjB,UAAU,MAAM;CACjB;CAGD,OAAO,EACN,WAAW,iBAAiB,QAAQ,MAAM,OAAO,OAAO,MACzD;AACD;;;ACtBA,MAAa,wBAAwB;CACpC,oBAAoB;CACpB,oBAAoB;AACrB;AAiBA,SAAgB,yBAAyB,OAA2B;CAGnE,MAAM,WADL,WAAW,WAC2B,UAAU;CACjD,IAAI,OAAO,aAAa,YACvB,OAAO,SAAS,KAAK,KAAK;CAG3B,IAAI,OAAO,WAAW,SAAS,YAAY;EAC1C,IAAI,SAAS;EACb,KAAK,MAAM,QAAQ,OAClB,UAAU,OAAO,aAAa,IAAI;EAEnC,OAAO,WAAW,KAAK,MAAM;CAC9B;CAEA,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;CAG1D,IAAI,OAAO,mBAAmB,SAAS,YACtC,OAAO,kBAAkB,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;CAGvD,MAAM,IAAI,YAAY;EACrB,MAAM,gBAAgB;EACtB,MAAM,sBAAsB;EAC5B,SAAS;EACT,QAAQ;CACT,CAAC;AACF;AAEA,SAAgB,yBAAyB,OAA2B;CACnE,MAAM,wBACL,WAAW;CACZ,IAAI,OAAO,sBAAsB,eAAe,YAC/C,OAAO,sBAAsB,WAAW,KAAK;CAG9C,IAAI,OAAO,WAAW,SAAS,YAAY;EAC1C,MAAM,SAAS,WAAW,KAAK,KAAK;EACpC,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;EAC1C,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,GACnD,MAAM,SAAS,OAAO,WAAW,KAAK;EAEvC,OAAO;CACR;CAEA,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;CAG1D,IAAI,OAAO,mBAAmB,SAAS,YACtC,OAAO,sBAAsB,KAAK,kBAAkB,KAAK,OAAO,QAAQ,CAAC;CAG1E,MAAM,IAAI,YAAY;EACrB,MAAM,gBAAgB;EACtB,MAAM,sBAAsB;EAC5B,SAAS;EACT,QAAQ;CACT,CAAC;AACF;;;AClFA,gBAAuB,8BACtB,UACmC;CACnC,MAAM,UAAU,IAAI,IACnB,SAAS,KAAK,SAAS,UAAU,CAChC,OACA,QAAQ,MAAM,WAAW;EAAE;EAAO;CAAM,EAAW,CACpD,CAAC,CACF;CACA,OAAO,QAAQ,OAAO,GAAG;EACxB,MAAM,OAAO,MAAM,QAAQ,KAAK,QAAQ,OAAO,CAAC;EAChD,QAAQ,OAAO,KAAK,KAAK;EACzB,MAAM,KAAK;CACZ;AACD;;;ACQA,SAAgB,OACf,OACA,SACW;CACX,IAAI,SAAS,aAAa,MACzB,OAAOC,SAAc,OAAO,EAC3B,UAAU,KACX,CAAC;CAGF,OAAOA,SAAc,KAAK;AAC3B;AAEA,SAAgB,4BACf,OACA,SACW;CACX,IAAI;EACH,IAAI,SAAS,aAAa,MACzB,OAAO,OAAO,OAAO,EAAE,UAAU,KAAK,CAAC;EAGxC,OAAO,OAAO,KAAK;CACpB,SAAS,OAAO;EACf,IAAI,+BAA+B,KAAK,GACvC,OAAO;EAGR,MAAM;CACP;AACD;AAEA,SAAgB,sBACf,UACA,IACU;CACV,OAAOC,wBAA6B,kBAAkB,QAAQ,GAAG,EAAE;AACpE;AAEA,SAAS,+BAA+B,OAAyB;CAChE,OACC,iBAAiB,SACjB,MAAM,QAAQ,SAAS,8CAA8C;AAEvE;;;AC9DA,IAAsB,yBAAtB,MAAwE;CAKvE,CAAC,kBAAwB;EACxB,KAAK,QAAQ;CACd;AACD;AAEA,IAAM,gCAAN,cAA4C,uBAAuB;CAClE,kBAAmC,aAAa,KAAK;CAErD,IAAI,YAAqB;EACxB,OAAO,KAAK,gBAAgB,IAAI;CACjC;CAEA,UAAU,UAAkC;EAC3C,IAAI,KAAK,gBAAgB,IAAI,GAAG;GAC/B,SAAS;GACT,aAAa,KAAA;EACd;EAEA,MAAM,eAAe,KAAK,KAAK,eAAe,CAAC,CAC7C,KACA,QAAQ,cAAiC,SAAS,GAClD,KAAK,CAAC,CACP,CAAC,CACA,UAAU,EACV,MAAM,SACP,CAAC;EACF,aAAa;GACZ,aAAa,YAAY;EAC1B;CACD;CAEA,UAAgB;EACf,IAAI,KAAK,gBAAgB,IAAI,GAC5B;EAGD,KAAK,gBAAgB,IAAI,IAAI;CAC9B;CAEA,UAAgB;EACf,KAAK,QAAQ;CACd;AACD;AAEA,SAAgB,+BAAuD;CACtE,OAAO,IAAI,8BAA8B;AAC1C;;;AChDA,MAAa,kBAAkBC,KAAW,QAAQ,CAAC,CAAC,QAAQ,OAAO,YAClE,UAAU,SAAS,KAAK,KAAK,OAC1B,QAAQ,OAAO,wBAAwB,IACvC,IACJ;AAEA,MAAa,sBAAsB;AAEnC,MAAa,0BAA0BA,KAAW,QAAQ,CAAC,CAAC,QAC1D,OAAO,YACP,kBAAkB,SAAS,KAAK,KAAK,OAClC,QAAQ,OAAO,iCAAiC,IAChD,IACL;AAEA,MAAa,2BAA2BA,KAAW,QAAQ,CAAC,CAAC,QAC3D,OAAO,YACP,mBAAmB,SAAS,KAAK,KAAK,OACnC,QAAQ,OAAO,wBAAwB,IACvC,IACL;;;ACbA,IAAa,0BAAb,MAEA;CAIgC;CAH/B,aAAa,IAAI,cAAuB,CAAC;CACzC;CAEA,YAAY,SAAsD;EAAnC,KAAA,UAAA;EAC9B,IAAI,QAAQ,WAAW,GACtB,KAAK,QAAQ,IAAI,kBAAkB;EAIpC,IAAI,QAAQ,WAAW,GACtB,KAAK,QAAQ,QAAQ;EAItB,KAAK,MAAM,UAAU,SACpB,IAAI,OAAO,yBAAyB;GACnC,KAAK,QAAQ;GACb;EACD;EAGD,MAAM,WAAW,IAAI,kBAAkB;EAEvC,MAAM,GAAG,OAAO,CAAC,CACf,KAAK,KAAK,CAAC,GAAG,UAAU,KAAK,UAAU,CAAC,CAAC,CACzC,WAAW,EAAE,aAAa;GAC1B,SAAS,QAAQ,MAAM;EACxB,CAAC;EAEF,KAAK,QAAQ;CACd;CACA,IAAI,0BAAmC;EACtC,OAAO,KAAK,MAAM;CACnB;CACA,IAAI,oBAA6C;EAChD,OAAO,KAAK,MAAM;CACnB;CACA,IAAI,SAAkB;EACrB,OAAO,KAAK,MAAM;CACnB;CACA,wBACC,UACkB;EAClB,OAAO,KAAK,MAAM,wBAAwB,QAAQ;CACnD;CACA,+BAAqC;EACpC,KAAK,MAAM,6BAA6B;CACzC;CAEA,UAAU;EACT,KAAK,WAAW,KAAK,IAAI;CAC1B;CAEA,CAAC,kBAAkB;EAClB,KAAK,QAAQ;CACd;CAEA,CAAC,qBAAoE;EACpE,OAAO,KAAK,MAAM,kBAAkB,CAAC;CACtC;AACD;;;;;;;;;;;;;;;AAgBA,SAAgB,8BACf,GAAG,SACwC;CAC3C,OAAO,IAAI,wBACV,QAAQ,QAAQ,MAAmC,CAAC,CAAC,CAAC,CACvD;AACD;;;;;;;;AC3FA,SAAgB,eACf,SACA,SACyB;CACzB,OAAO,iBAAiB,SAAS,SAAS,OAAO;AAClD;;;ACQA,SAAgB,eACf,SACmB;CACnB,OAAO,WAAW;EACjB,GAAG;EACH,SAAS,YAAY,KAAK,QAAQ,OAAO,OAAO,CAAC;CAClD,CAAC;AACF;;;;ACZA,MAAa,kCAAkC;;AAW/C,SAAgB,8BAGf,MAC0D;CAC1D,MAAM,MAAO,OACZ;CAED,IAAI,QAAQ,KAAA,KAAa,QAAQ,MAChC;CAED,OAAO;AACR;;AAGA,SAAgB,+BAGf,MACA,OAC0B;CAC1B,MAAM,OAAgC,EAAE,GAAI,QAAQ,CAAC,EAAG;CACxD,MAAM,WACJ,KAAA,uBAEgB,CAAC;CACnB,KAAK,mCAAmC;EAAE,GAAG;EAAU,GAAG;CAAM;CAChE,OAAO;AACR;;;ACvCA,SAAgB,oCACf,WACA,SACe;CACf,OAAO,OAAO,OAAO,SAAS;EAC7B,IAAI,CAAE,MAAM,QAAQ,UAAU,OAAO,IAAI,GACxC,OAAO,UAAU,OAAO,IAAI;EAE7B,MAAM,gBACL,eAAe,QAAQ,gBACpB,MAAM,QAAQ,cAAc,UAAU,IACtC,QAAQ,cAAc,IAAI;EAC9B,IAAI,CAAC,eACJ,OAAO,UAAU,OAAO,IAAI;EAE7B,MAAM,UAAU,IAAI,QACnB,OAAO,YAAY,eAAe,iBAAiB,UAChD,MAAM,UACN,KAAA,CACJ;EACA,IAAI,MAAM,SACT,IAAI,QAAQ,KAAK,OAAO,CAAC,CAAC,SAAS,OAAO,QAAQ;GACjD,QAAQ,IAAI,KAAK,KAAK;EACvB,CAAC;EAEF,QAAQ,IAAI,iBAAiB,aAAa;EAC1C,OAAO,UAAU,OAAO;GACvB,GAAG;GACH;EACD,CAAC;CACF;AACD;;;ACPA,IAAa,gBAAb,MAAa,cAA4C;CAE9C;CACQ;CACA;CAHlB,YACC,MACA,cACA,SACC;EAHQ,KAAA,OAAA;EACQ,KAAA,eAAA;EACA,KAAA,UAAA;CACf;CAEH,OAAO,MAAM,SAAiD;EAC7D,MAAM,OAAO,QAAQ,KAAK,KAAK;GAC9B,SAAS;GACT,WAAW,QAAQ;GACnB,YAAY,GACV,wBAAwB,gBAAgB,QAAQ,KAClD;EACD,CAAC;EACD,IAAI,QAAQ,iBACX,KAAK,cAAc,QAAQ,iBAAiB,EAC3C,YAAY,mCACb,CAAC;EAEF,MAAM,gBAAgB,IAAI,cACzB,MACA,QAAQ,aACR,QAAQ,MACT;EACA,cAAc,cAAc;EAC5B,OAAO;CACR;CAEA,mBAAmB,YAAkC;EACpD,KAAK,KAAK,cAAc,YAAY,EACnC,YAAY,mCACb,CAAC;CACF;CAEA,SAAS,MAAc,QAA+B;EACrD,KAAK,QAAQ,wBAAwB,OAAO,aAAa,MAAM;GAC9D,WAAW;GACX,GAAI,UAAU,CAAC;EAChB,CAAC;CACF;CAEA,YAAY,OAAgB,QAA+B;EAC1D,KAAK,QAAQ,wBAAwB,OAAO,aAAa,OAAO;GAC/D,GAAG,cAAc,KAAK;GACtB,GAAI,UAAU,CAAC;EAChB,CAAC;CACF;CAEA,gBAAsB;EACrB,KAAK,QAAQ,wBAAwB,SAAS,aAAa,IAAI;CAChE;CAEA,YAAY,SAAuC;EAClD,KAAK,QACJ,wBAAwB,OACxB,YAAY,cAAc,aAAa,OAAO,aAAa,OAC3D,EAAE,QAAQ,CACX;CACD;CAEA,QACC,MACA,OACA,QACO;EACP,KAAK,aAAa,QAAQ,OAAO;GAChC;GACA,IAAI,KAAK,aAAa,KAAK,IAAI;GAC/B,MAAM,KAAK;GACX;GACA,QAAQ,KAAK;GACb;EACD,CAAC;CACF;AACD;AAMA,SAAgB,aACf,SACiB;CACjB,MAAM,gBAAgB,cAAc,MAAM,OAAO;CACjD,IAAI;EACH,MAAM,SAAS,QAAQ,QAAQ,aAAa;EAC5C,IAAI,UAAU,MAAM,GACnB,OAAO,OAAO,MACZ,UAAU,kBAAkB,eAAe,KAAK,IAChD,UACA,cAAc,eAAe,OAAO,QAAQ,sBAAsB,CACpE;EAED,OAAO,kBAAkB,eAAe,MAAM;CAC/C,SAAS,OAAO;EACf,OAAO,cAAc,eAAe,OAAO,QAAQ,sBAAsB;CAC1E;AACD;AAEA,SAAS,kBAAqB,eAA8B,QAAc;CACzE,cAAc,YAAY,WAAW;CACrC,OAAO;AACR;AAEA,SAAS,cACR,eACA,OACA,wBACQ;CACR,MAAM,cAAc,yBACjB,uBAAuB,OAAO,EAAE,MAAM,cAAc,KAAK,CAAC,IAC1D;CACH,IAAI,uBAAuB,aAC1B,YAAY,mBAAmB,cAAc,IAAI;CAElD,cAAc,YAAY,WAAW;CACrC,cAAc,YAAY,QAAQ;CAClC,MAAM;AACP;;;AC5HA,SAAgB,gCAGd,SAA0E;CAC3E,QAAQ,GAAG,iBAET,QACA,YAII;EACJ,MAAM,aAAa,OAAO,QAAQ,IAAI;EACtC,MAAM,UAAU,QAAsB;GACrC;GACA;EACD,CAAC;EACD,OAAO,SAAuB,GAAG,MAAsB;GACtD,MAAM,kBAAkB,QAAQ,KAAK,MAAM;IAC1C;IACA;GACD,CAAC;GACD,OAAO,aAAa;IACnB,aAAa,gBAAgB;IAC7B,MAAM,gBAAgB;IACtB,MAAM,gBAAgB,QAAQ;IAC9B,QAAQ,gBAAgB;IACxB,iBAAiB,gBAAgB;IACjC,WAAW,gBAAgB;IAC3B,wBAAwB,gBAAgB;IACxC,UAAU,SAER,OAIC,KAAK,MAAM,GAAG,MAAM,IAAI;GAC5B,CAAC;EACF;CACD;AACF;;;ACrEA,IAAa,2BAAb,MAAwE;CACvE,OAAO,OAA2B;EACjC,MAAM,QAAQ,IAAI,MAAM,OAAO,IAAI,MAAM;EACzC,MAAM,UAAU;GACf,GAAI,MAAM,UAAU,CAAC;GACrB,gBAAgB,MAAM,KAAK,wBAAwB,EAClD,YAAY,mCACb,CAAC;EACF;EACA,QAAQ,MAAM,OAAd;GACC,KAAK;IACJ,QAAQ,MAAM,OAAO,OAAO;IAC5B;GACD,KAAK;IACJ,QAAQ,KAAK,OAAO,OAAO;IAC3B;GACD,KAAK;IACJ,QAAQ,KAAK,OAAO,OAAO;IAC3B;GACD,KAAK,SACJ,QAAQ,MAAM,OAAO,OAAO;EAE9B;CACD;AACD;AAEA,SAAgB,iCAA2D;CAC1E,OAAO,IAAI,yBAAyB;AACrC;;;AClCA,IAAa,0BAAb,MAAwC;CAMlB;CALrB;CACA,OAAe;CACf,OAAe;CACf,QAAgB;CAEhB,YAAY,UAA2B;EAAlB,KAAA,WAAA;EACpB,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,YAAY,GAC9C,MAAM,IAAI,WAAW,kDAAkD;EAExE,KAAK,SAAS,IAAI,MAAqB,QAAQ;CAChD;CAEA,IAAI,OAAe;EAClB,OAAO,KAAK;CACb;CAEA,OAAO,OAAgB;EACtB,KAAK,OAAO,KAAK,QAAQ;EACzB,KAAK,QAAQ,KAAK,OAAO,KAAK,KAAK;EAEnC,IAAI,KAAK,UAAU,KAAK,UACvB,KAAK,OAAO,KAAK;OAEjB,KAAK,SAAS;CAEhB;CAEA,UAAe;EACd,MAAM,WAAW,IAAI,MAAS,KAAK,KAAK;EACxC,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,OAAO,SAAS,GAChD,SAAS,SAAS,KAAK,QAAQ,KAAK,OAAO,SAAS,KAAK;EAE1D,OAAO;CACR;CAEA,QAAc;EACb,KAAK,OAAO,KAAK,KAAA,CAAS;EAC1B,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,QAAQ;CACd;AACD;;;;;;;;;;ACfA,IAAa,qBAAb,MAAkE;CAMlC;CAL/B,SAAmB;CACnB;CACA,qBACC,IAAI,eAA0C;CAE/C,YAAY,QAA2B,KAAK;EAAb,KAAA,QAAA;EAC9B,KAAK,WAAW,IAAI,wBAAwB,KAAK;CAClD;CAEA,IAAI,cAA2D;EAC9D,OAAO,KAAK;CACb;CAEA,IAAI,UAAyC;EAC5C,OAAO,KAAK,SAAS,QAAQ;CAC9B;CAEA,OAAO,OAA2B;EACjC,MAAM,EAAE,MAAM,GAAG,qBAAqB;EACtC,MAAM,QAA4B;GACjC,GAAG;GACH,IAAI,KAAK;GACT,eAAe,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,YAAY;GAC9C,MAAM;IACL,IAAI,KAAK;IACT,GAAI,KAAK,SAAS,EAAE,UAAU,KAAK,OAAO,GAAG,IAAI,CAAC;GACnD;GACA,gBAAgB,KAAK,wBAAwB,EAC5C,YAAY,mCACb,CAAC;EACF;EACA,KAAK,SAAS,OAAO,KAAK;EAC1B,KAAK,mBAAmB,KAAK,KAAK;CACnC;CAEA,QAAc;EACb,IAAI,KAAK,SAAS,OAAO,GAAG;GAC3B,KAAK,SAAS,MAAM;GACpB,KAAK,mBAAmB,KAAK,IAAI;EAClC;CACD;AACD;AAEA,SAAgB,yBAAyB,QAAQ,KAAyB;CACzE,OAAO,IAAI,mBAAmB,KAAK;AACpC;;;ACxCA,MAAa,2BAA2B,IAAI,2BAE1C,0BAA0B;;;;;;;;AA4B5B,SAAgB,yBAGqC;CACpD,OAAO,eAAe,qBACrB,SAIwC;EACxC,MAAM,SAAS,MAAM,QAAQ,cAAc,KAAK;EAChD,OAAO,OAAO,OAAO,KAAA,IAAY,OAAO;CACzC;AACD;;;;;;;;;;;;;;;;;;;;;;;AAiCA,IAAa,yBAAb,MAAa,uBAEX;CAMS;CACA;;CALV;CAEA,YACC,WACA,aACA,QACC;EAFQ,KAAA,cAAA;EACA,KAAA,SAAA;EAET,KAAK,aAAa;CACnB;;CAGA,OAAO,cACN,WACA,UAAqD,CAAC,GACjB;EACrC,OAAO,IAAI,uBACV,WACA,QAAQ,aACR,QAAQ,MACT;CACD;CAEA,MAAM,0BACL,KACqC;EACrC,OACC,KAAK,WAAW,QACf,MAAM,KAAK,QAAQ,0BAA0B,GAAG;CAEnD;CACA,MAAM,oBACL,KACA,cAGsC;EACtC,OACE,MAAM,KAAK,0BAA0B,GAAG,KAAO,MAAM,aAAa;CAErE;CAEA,MAAM,2BAAuE;EAC5E,OAAO,KAAK,eAAgB,MAAM,KAAK,QAAQ,yBAAyB;CACzE;CAEA,MAAM,mBACL,cACiC;EACjC,OAAQ,MAAM,KAAK,yBAAyB,KAAO,MAAM,aAAa;CACvE;AACD;AAEA,SAAgB,8BAOf,WAKA,UAA4D,CAAC,GACF;CAC3D,OAAO;EACN,SAAS;EACT,aACC,gBACA,gBACI;GACJ,MAAM,SACL,QAAQ,UACP,gBAAgB,IAChB,0BACA,IACD,KACA,KAAA;GACD,MAAM,WACL,OAAO,cAAc,aAAa,UAAU,IAAI;GACjD,OAAO,uBAAuB,cAAc,UAAU;IACrD;IACA,aAAa,QAAQ,eAAe,eAAe,KAAA;GACpD,CAAC;EACF;EACA,MAAM,CACL,CAAC,IAAI,qBAAqB,GAAG,qBAAqB,GAClD,CAAC,IAAI,qBAAqB,GAAG,iBAAiB,CAC/C;CACD;AACD;AAEA,SAAgB,6BAOf,SAC4C;CAC5C,OAAO,QAAQ,SAAS,IACvB,0BACA,IACD;AACD;;;;;;;;;AChKA,IAAsB,yBAAtB,MAME;CACD;CACA;CAIA,YACC,MACA,qBAAuD,CAAC,GACvD;EACD,KAAK,OAAO;EACZ,KAAK,qBAAqB,mBAAmB,KAAK,eACjD,OAAO,OAAO,EAAE,GAAG,WAAW,CAAC,CAChC;CACD;;;;;;;;;CAYA,MAAa,YAEX;EACD,OAAO;GACN,aAAa,KAAK;GAClB,aAAa,MAAM,KAAK,KAAK,yBAAyB;IACrD,MAAM,IAAI,wBAAwB,yBAAyB;GAC5D,CAAC;GACD,oBAAoB,MAAM,KAAK,KAAK,oBACnC,4BACM;IACL,MAAM,IAAI,wBAAwB,gCAAgC;GACnE,CACD;GACA,mBAAmB,MAAM,KAAK,KAAK,oBAClC,2BACM;IACL,MAAM,IAAI,wBACT,yCACD;GACD,CACD;GACA,iBAAiB,MAAM,KAAK,KAAK,oBAChC,mBACA,sBACD;GACA,cAAc,MAAM,KAAK,uBAAuB;GAChD,gBAAgB,CAAC,GAAG,KAAK,kBAAkB;EAC5C;CACD;;;;CAiBA,MAAa,yBAA+D;EAE3E,OAAO,CAAC,IAAG,MADgB,KAAK,qBAAqB,EAAA,CAC7B,OAAO,CAAC;CACjC;;;;;CAKA,MAAM,QACL,MACgD;EAChD,MAAM,YAAY,MAAM,KAAK,gBAAgB;GAC5C,GAAG;GACH,eAAe,KAAK,sBAAsB,IAAI;EAC/C,CAAC;EACD,IAAI,CAAC,WACJ,OAAO,EAAE,SAAS,gBAAgB,QAAQ;EAE3C,MAAM,SAAS,MAAM,KAAK,kBAAkB,WAAW,IAAI;EAE3D,OAAO,KAAK,iBAAiB,MAAM,WAAW,MAAM;CACrD;CAEA,iBACC,MACA,WACA,QACuC;EACvC,IAAI,WAAW,MAAM;GACpB,KAAK,gBAAgB,MAAM,SAAS;GACpC,OAAO;IAAE,SAAS,gBAAgB;IAAU,aAAa;GAAU;EACpE;EACA,IAAI,WAAW,OACd,OAAO;GAAE,SAAS,gBAAgB;GAAS,aAAa;EAAU;EAEnE,OAAO;GACN,SAAS,gBAAgB;GACzB,aAAa;GACb,UAAU;EACX;CACD;;;;;;CASA,MAAM,kBAAgE;EACrE,MAAM,OAAO,MAAM,KAAK,UAAU;EAClC,OAAO,KAAK,wBAAwB,IAAI;CACzC;CAEA,MAAM,wBACL,MAC+C;EAC/C,OAAO,MAAM;GACZ,MAAM,OAAO,MAAM,KAAK,QAAQ,IAAI;GAEpC,IAAI,KAAK,YAAY,gBAAgB,SACpC,OAAO;IACN,SAAS,gBAAgB;IACzB,aAAa,KAAK;GACnB;GAED,IAAI,KAAK,YAAY,gBAAgB,UACpC;GAED,IAAI,KAAK,YAAY,gBAAgB,SACpC,OAAO;GAER,IAAI,KAAK,YAAY,gBAAgB,UACpC,OAAO;EAET;CACD;CAEA,OAAe,sBACd,MACkD;EAClD,MAAM,UAAU;GACf,aAAa,KAAK;GAClB,cAAc,KAAK;GACnB,gBAAgB,KAAK;GACrB,aAAa,KAAK;EACnB;EACA,MAAM,UAAU,KAAK,aACnB,QACC,gBACA,CAAC,KAAK,eAAe,MACnB,eAAe,WAAW,kBAAkB,YAAY,EAC1D,CACF,CAAC,CACA,IACA,OACC,gBACuD;GAEvD,OAAO;IAAE;IAAa,WAAA,MADE,KAAK,mBAAmB,aAAa,OAAO;GACpC;EACjC,CACD;EAED,WAAW,MAAM,EAChB,aACA,eACI,8BAA8B,OAAO,GAAG;GAC5C,IAAI,WAAW;IACd,KAAK,gBAAgB,MAAM,WAAW;IACtC;GACD;GACA,MAAM;EACP;CACD;CAEA,gBACC,MACA,aACO;EACP,IACC,KAAK,eAAe,MAClB,eAAe,WAAW,kBAAkB,YAAY,EAC1D,GAEA;EAED,KAAK,eAAe,KACnB,OAAO,OAAO;GACb,eAAe,YAAY;GAC3B,QAAQ,iBAAiB;EAC1B,CAAC,CACF;CACD;AACD;;;;;;;;;;;;;;;ACvPA,IAAa,0BAAb,MAAa,gCAMH,uBAAmE;CAC5E;CAMA,IAAI,cAA4B;EAC/B,OAAO,OAAO,OACb,CAAC,GACD,GAAG,KAAK,QAAQ,KAAK,WAAW,OAAO,WAAW,CACnD;CACD;CAEA,YACC,MACA,SAKC;EACD,MAAM,IAAI;EACV,KAAK,UAAU;CAChB;;CAGA,OAAO,aAON,MACA,UAKsE;EACtE,OAAO,IAAI,wBAAwB,MAAM,QAAQ;CAClD;CAEA,MAAgB,uBAEd;EACD,MAAM,sBAAM,IAAI,IAA8B;EAC9C,KAAK,MAAM,UAAU,KAAK,SACzB,KAAK,MAAM,eAAe,MAAM,OAAO,uBAAuB,GAC7D,IAAI,IAAI,YAAY,IAAI,WAAW;EAGrC,OAAO;CACR;AACD;;;;AC1DA,SAAS,aAGR,UAC8B;CAC9B,MAAM,4BAAY,IAAI,IAA8B;CACpD,KAAK,MAAM,WAAW,UACrB,6BACC;EACC,aAAa,QAAQ,eAAe,wBAAwB;EAC5D,cAAc,QAAQ;CACvB,GACA,SACD;CAED,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC;AAC9B;;AAGA,SAAS,mBACR,UACA,MACS;CACT,MAAM,QAAQ,KAAK,IAAI,SAAS,QAAQ,KAAK,MAAM;CACnD,IAAI,SAAS;CACb,OAAO,SAAS,SAAS,SAAS,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,IAC7D,UAAU;CAEX,OAAO;AACR;;;;;;;;AASA,IAAa,qCAAb,MAAa,2CAKH,uBAIR;CACD;CACA;CACA;CAEA,YACC,MACA,UACA,YACA,uBAAyD,CAAC,GACzD;EACD,MAAM,MAAM,oBAAoB;EAChC,KAAK,YAAY;EACjB,KAAK,aAAa,aAAa,QAAQ;EACvC,KAAK,eAAe,OAAO,OAAO,EACjC,YAAY,OAAO,OAAO,EAAE,GAAG,WAAW,CAAC,EAC5C,CAAC;CACF;;CAGA,OAAO,kBAMN,MACA,UACA,YACmE;EACnE,OAAO,IAAI,mCAAmC,MAAM,UAAU,UAAU;CACzE;;;;;CAMA,OAAO,oBAMN,MACA,iBACA,YACA,iBAIA,cACmE;EACnE,MAAM,gBAAgB,aAAa,eAAe;EAClD,MAAM,SAAS,mBACd,gBAAgB,uBAChB,aACD;EACA,MAAM,YAAY,IAAI,IACrB,cAAc,MAAM,GAAG,MAAM,CAAC,CAAC,KAAK,gBAAgB,YAAY,EAAE,CACnE;EACA,MAAM,YAAY,aAAa,eAAe,QAAQ,eACrD,UAAU,IAAI,WAAW,aAAa,CACvC;EACA,OAAO,IAAI,mCACV,MACA,iBACA,YACA,SACD;CACD;CAEA,IAAI,cAA0C;EAC7C,OAAO,KAAK;CACb;;CAGA,IAAI,WAA0D;EAC7D,OAAO,KAAK;CACb;;CAGA,IAAI,wBAAqD;EACxD,OAAO,KAAK;CACb;CAEA,uBAAgE;EAC/D,OAAO,IAAI,IACV,KAAK,WAAW,KAAK,gBAAgB,CAAC,YAAY,IAAI,WAAW,CAAC,CACnE;CACD;AACD;;;;;;;;;;;;;;;;;AC7IA,IAAa,2BAAb,MAAa,iCAKH,uBAAyD;CAClE;CAEA,IAAI,cAAkB;EACrB,OAAO,CAAC;CACT;CAEA,YACC,MACA,cACC;EACD,MAAM,IAAI;EACV,KAAK,qBAAqB;CAC3B;;CAGA,OAAO,iBAMN,MACA,cACyD;EACzD,OAAO,IAAI,yBAAyB,MAAM,YAAY;CACvD;CAEA,uBAAgE;EAC/D,MAAM,sBAAM,IAAI,IAA8B;EAC9C,KAAK,MAAM,eAAe,KAAK,oBAC9B,IAAI,IAAI,YAAY,IAAI,WAAW;EAEpC,OAAO;CACR;AACD;;;;;;;;;;AC3CA,SAAgB,kBACf,UACsB;CACtB,OAAO,IAAI,cAAc,QAAQ;AAClC;AAEA,SAAgB,qBAA8C;CAC7D,OAAO,IAAI,eAAkB;AAC9B;AAEA,SAAgB,yBACf,aAAa,UACU;CACvB,OAAO,IAAI,qBAAwB,UAAU;AAC9C;AAEA,SAAgB,yBAAiD;CAChE,OAAO,cAAc,oBAAoB,KAAK;AAC/C;AAEA,SAAgB,yBAAiD;CAChE,OAAO,cAAc,oBAAoB,KAAK;AAC/C;;;ACjCA,SAAgB,mBACf,OAC2C;CAC3C,IAAI,OAAO,UAAU,YAAY,UAAU,MAC1C,OAAO;CAER,IAAI,WAAW,SAAS,MAAM,iBAAiB,aAC9C,OAAO;CAER,OACC,aAAa,SACb,OAAO,MAAM,YAAY,YACzB,MAAM,YAAY,QAClB,WAAW,MAAM,WACjB,MAAM,QAAQ,iBAAiB;AAEjC;;;ACRA,SAAgB,cACf,OACsB;CACtB,IAAI,mBAAmB,KAAK,GAC3B,OAAO;CAER,OAAO,cAAc,oBAAoB,KAAK,KAAK,CAAC;AACrD;;;ACpBA,MAAa,0BAA0BC,KAAW;CACjD,SAAS;CACT,gBAAgB;CAChB,YAAY;CACZ,WAAW;CACX,WAAW;AACZ,CAAC,CAAC,CAAC,MACD,WAA8B;CAC9B,SAAS,MAAM;CACf,aACC,OAAO,MAAM,gBAAgB,YAC7B,MAAM,YAAY,KAAK,CAAC,CAAC,SAAS,IAC/B,MAAM,cACN,MAAM;CACV,SAAS,MAAM,WAAW,KAAA;CAC1B,QAAQ,MAAM,UAAU,KAAA;CACxB,QAAS,MAAM,UAAU,KAAA;AAC1B,EACD;AAEA,MAAa,8BAA8BA,KAAW;CACrD,SAAS;CACT,iBAAiB;CACjB,YAAY;CACZ,WAAW;CACX,WAAW;AACZ,CAAC,CAAC,CAAC,MACD,WAA8B;CAC9B,SAAS,MAAM;CACf,aACC,OAAO,MAAM,iBAAiB,YAC9B,MAAM,aAAa,KAAK,CAAC,CAAC,SAAS,IAChC,MAAM,eACN,MAAM;CACV,SAAS,MAAM,WAAW,KAAA;CAC1B,QAAQ,MAAM,UAAU,KAAA;CACxB,QAAS,MAAM,UAAU,KAAA;AAC1B,EACD;;;AC1BA,SAAS,iCAAiC,SAIhC;CACT,MAAM,IAAI,YAAY;EACrB,MAAM,gBAAgB;EACtB,MAAM,QAAQ;EACd,SAAS,GAAG,QAAQ,cAAc,IAAI,wBAAwB,QAAQ,OAAO,KAAK,2BAA2B;EAC7G,QAAQ;EACR,OAAO,QAAQ,QAAQ;CACxB,CAAC;AACF;AAEA,SAAgB,uBAAuB,OAAmC;CACzE,MAAM,SAAS,uBAAuB,yBAAyB,KAAK;CACpE,IAAI,OAAO,SACV,OAAO,OAAO;CAEf,iCAAiC;EAChC,MAAM;EACN,eAAe;EACf,SAAS;CACV,CAAC;AACF;AAEA,SAAgB,2BAA2B,OAAmC;CAC7E,MAAM,SAAS,uBAAuB,6BAA6B,KAAK;CACxE,IAAI,OAAO,SACV,OAAO,OAAO;CAEf,iCAAiC;EAChC,MAAM;EACN,eAAe;EACf,SAAS;CACV,CAAC;AACF;AAEA,SAAgB,yBACf,SACoB;CACpB,MAAM,YAAY,QAAQ;CAC1B,MAAM,UACL,WAAW,WAAW,QAAQ,mBAAmB;CAIlD,OAAO;EACN;EACA,aAJA,WAAW,aAAa,KAAK,KAAK,QAAQ,uBAAuB;EAKjE,SAAS,WAAW;EACpB,QAAQ,WAAW,UAAU,QAAQ;EACrC,QAAQ,WAAW,UAAU,QAAQ;CACtC;AACD;;;ACnEA,MAAa,qBAAqB;CACjC,eAAe;CACf,gBAAgB;CAChB,cAAc;AACf;AAKA,IAAa,iBAAb,cAAoC,YAAY;CAC/C;CAEA,YAAY,SAIT;EACF,MAAM;GACL,MAAM,gBAAgB;GACtB,MAAM,QAAQ;GACd,SAAS,QAAQ;GACjB,QAAQ;GACR,OAAO,QAAQ;EAChB,CAAC;EACD,KAAK,OAAO;EACZ,KAAK,OAAO,QAAQ;CACrB;AACD;;;AC1BA,SAAgB,iBACf,KACA,UAAmC,CAAC,GACrB;CACf,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAGF,MAAM,SAAS,yBAAyB,MAAM,IAAI,GAAG,MAAM,SAAS;CACpE,6BAA6B,QAAQ,KAAK;CAC1C,OAAO;AACR;AAEA,SAAS,yBAAyB,OAAe,OAA6B;CAC7E,IAAI;CACJ,IAAI;EACH,SAAS,KAAK,MAAM,oBAAoB,KAAK,CAAC;CAC/C,SAAS,OAAO;EACf,MAAM,IAAI,eAAe;GACxB,MAAM,mBAAmB;GACzB,SAAS,GAAG,MAAM;GAClB;EACD,CAAC;CACF;CAEA,IAAI,CAAC,aAAa,MAAM,GACvB,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,OAAO;AACR;AAEA,SAAS,oBAAoB,OAAuB;CACnD,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CACzD,MAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;CAChE,MAAM,SAAS,KAAK,MAAM;CAC1B,MAAM,QAAQ,WAAW,KAAK,SAAS,SAAS,KAAK,WAAW,CAAC,CAAC;CAClE,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK;AACtC;AAEA,SAAS,6BACR,QACA,OACO;CACP,IAAI,OAAO,QAAQ,KAAA,KAAa,OAAO,OAAO,QAAQ,UACrD,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,IAAI,OAAO,QAAQ,KAAA,KAAa,OAAO,OAAO,QAAQ,UACrD,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,IAAI,OAAO,QAAQ,KAAA,KAAa,OAAO,OAAO,QAAQ,UACrD,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,IAAI,OAAO,QAAQ,KAAA,KAAa,OAAO,OAAO,QAAQ,UACrD,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;CAEF,IACC,OAAO,QAAQ,KAAA,KACf,OAAO,OAAO,QAAQ,YACtB,CAAC,cAAc,OAAO,GAAG,GAEzB,MAAM,IAAI,eAAe;EACxB,MAAM,mBAAmB;EACzB,SAAS,GAAG,MAAM;CACnB,CAAC;AAEH;AAEA,SAAS,aAAa,OAAuC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC3E;AAEA,SAAS,cAAc,OAA4C;CAClE,OACC,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,SAAS,OAAO,SAAS,QAAQ;AAExE;;;;;;;AC9FA,SAAgB,kBAAkB,UAA0B;CAC3D,MAAM,QAAQ,SAAS,MAAM,gCAAgC;CAC7D,IAAI,CAAC,OACJ,OAAO;CAER,MAAM,QAAQ,OAAO,MAAM,EAAE;CAE7B,QAAQ,MAAM,IAAd;EACC,KAAK,MACJ,OAAO;EACR,KAAK,KACJ,OAAO,QAAQ;EAChB,KAAK,KACJ,OAAO,QAAQ,KAAK;EACrB,KAAK,KACJ,OAAO,QAAQ,KAAK,KAAK;EAC1B,SACC,OAAO;CACT;AACD;;;;ACpBA,SAAgB,kBAA+B;CAC9C,OAAO;EACN,OAAO,OAAkB;GACxB,OAAO,KAAK,UAAU,KAAK;EAC5B;EACA,OAAO,KAAgB;GACtB,OAAO,KAAK,MAAM,GAAG;EACtB;CACD;AACD;;;ACQA,SAAS,kBAAkB,WAAmB,KAAqB;CAClE,OAAO,UAAU,SAAS,IAAI,GAAG,UAAU,GAAG,QAAQ;AACvD;AAEA,SAAS,uBACR,OACoC;CACpC,IAAI,CAAC,MAAM,MACV,MAAM,IAAI,YAAY;EACrB,MAAM,gBAAgB;EACtB,MAAM;EACN,SACC;EACD,QAAQ;CACT,CAAC;CAGF,OAAO,MAAM,KAAK,KAAK,KAAK;AAC7B;AAEA,eAAe,wBACd,WACa;CACb,IAAI;EACH,OAAO,MAAM,UAAU;CACxB,SAAS,OAAO;EACf,IAAI,iBAAiB,aACpB,MAAM;EAEP,MAAM,IAAI,YAAY;GACrB,MAAM,gBAAgB;GACtB,MAAM;GACN,SAAS;GACT,QAAQ;GACR,OAAO;EACR,CAAC;CACF;AACD;AAEA,SAAS,kBAAqB,OAAiB,OAAkB;CAChE,IAAI;EACH,OAAO,MAAM,OAAO,KAAK;CAC1B,SAAS,OAAO;EACf,MAAM,IAAI,YAAY;GACrB,MAAM,gBAAgB;GACtB,MAAM;GACN,SAAS;GACT,QAAQ;GACR,OAAO;EACR,CAAC;CACF;AACD;;;;;;;AAQA,SAAgB,yBACf,SACwB;CACxB,MAAM,QAAQ,QAAQ,SAAS,gBAAmB;CAClD,MAAM,YAAY,uBAAuB,QAAQ,KAAK;CAEtD,eAAe,OAA0B;EACxC,MAAM,MAAM,MAAM,8BACjB,QAAQ,MAAM,IAAI,QAAQ,GAAG,CAC9B;EACA,OAAO,QAAQ,OAAO,OAAO,kBAAkB,OAAO,GAAG;CAC1D;CAEA,eAAe,KAAK,OAAyB;EAC5C,MAAM,8BACL,QAAQ,MAAM,IAAI,QAAQ,KAAK,MAAM,OAAO,KAAK,CAAC,CACnD;CACD;CAEA,eAAe,UAA6B;EAC3C,MAAM,MAAM,MAAM,8BAA8B,UAAU,QAAQ,GAAG,CAAC;EACtE,OAAO,QAAQ,OAAO,OAAO,kBAAkB,OAAO,GAAG;CAC1D;CAEA,eAAe,QAAuB;EACrC,MAAM,8BAA8B,QAAQ,MAAM,OAAO,QAAQ,GAAG,CAAC;CACtE;CAEA,OAAO;EACN;EACA;EACA;EACA;CACD;AACD;;;;;;;;AASA,SAAgB,8BACf,SAC6B;CAC7B,MAAM,QAAQ,QAAQ,SAAS,gBAAmB;CAClD,MAAM,YAAY,uBAAuB,QAAQ,KAAK;CAEtD,eAAe,KAAK,KAAgC;EACnD,MAAM,MAAM,MAAM,8BACjB,QAAQ,MAAM,IAAI,kBAAkB,QAAQ,WAAW,GAAG,CAAC,CAC5D;EACA,OAAO,QAAQ,OAAO,OAAO,kBAAkB,OAAO,GAAG;CAC1D;CAEA,eAAe,KAAK,KAAa,OAAyB;EACzD,MAAM,8BACL,QAAQ,MAAM,IACb,kBAAkB,QAAQ,WAAW,GAAG,GACxC,MAAM,OAAO,KAAK,CACnB,CACD;CACD;CAEA,eAAe,KAAK,KAAgC;EACnD,MAAM,MAAM,MAAM,8BACjB,UAAU,kBAAkB,QAAQ,WAAW,GAAG,CAAC,CACpD;EACA,OAAO,QAAQ,OAAO,OAAO,kBAAkB,OAAO,GAAG;CAC1D;CAEA,eAAe,MAAM,KAA4B;EAChD,MAAM,8BACL,QAAQ,MAAM,OAAO,kBAAkB,QAAQ,WAAW,GAAG,CAAC,CAC/D;CACD;CAEA,OAAO;EACN;EACA;EACA;EACA;CACD;AACD;;;AChKA,MAAa,qBAAqB;CACjC,MAAM;CACN,SAAS;CACT,SAAS;CACT,OAAO;AACR;AAsCA,SAAgB,4BAGd,IAAoC;CACrC,MAAM,sBAAsB,aAAa,EACxC,OAAO,mBAAmB,KAC3B,CAA6C;CAE7C,MAAM,SAAS,eAEd,GAAG,MAC+B;EAClC,MAAM,gBAAgB,oBAAoB,IAAI;EAC9C,IAAI,cAAc,UAAU,mBAAmB,SAC9C,OAAO,cAAc;EAEtB,IAAI,cAAc,UAAU,mBAAmB,SAC9C,OAAO,cAAc;EAGtB,IAAI;EACJ,IAAI;EAEJ,MAAM,UAAU,IAAI,SAAiC,KAAK,QAAQ;GACjE,iBAAiB;GACjB,gBAAgB;EACjB,CAAC;EACD,QAAQ,YAAY,KAAA,CAAS;EAE7B,oBAAoB,IAAI;GAAE,OAAO,mBAAmB;GAAS;EAAQ,CAAC;EAEtE,IAAI;GACH,MAAM,SAAS,MAAM,GAAG,MAAM,MAAM,IAAI;GACxC,oBAAoB,IAAI;IACvB,OAAO,mBAAmB;IAC1B,MAAM;GACP,CAAC;GACD,eAAe,MAAM;GACrB,OAAO;EACR,SAAS,KAAK;GACb,oBAAoB,IAAI;IACvB,OAAO,mBAAmB;IAC1B,OAAO;GACR,CAAC;GACD,cAAc,GAAG;GACjB,MAAM;EACP;CACD;CAEA,OAAO,IAAI,MAAM,QAAQ;EACxB,IAAI,QAAQ,MAAM,UAAU;GAE3B,MAAM,gBAAgB,oBAAoB,IAAI;GAC9C,IAAI,QAAQ,eACX,OAAO,QAAQ,IAAI,eAAe,IAAI;GAEvC,IACC,SAAS,SACT,SAAS,iBACT,SAAS,mBACR;IACD,MAAM,QAAQ,QAAQ,IACrB,qBACA,MACA,mBACD;IACA,OAAO,OAAO,UAAU,aACrB,MAAM,KAAK,mBAAmB,IAC9B;GACJ;GAEA,OAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;EAC1C;EAEA,MAAM;GACL,OAAO;EACR;CACD,CAAC;AACF;;;;;;;ACxHA,SAAgB,kBAAkB,KAAmB;CACpD,OACC,IAAI,aAAa,YAChB,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa,SACjB,IAAI,aAAa;AAEpB"}

package/dist/server/index.d.mts

@@ -1,4 +1,4 @@
-import { Lt as CreateFoundationEnvironmentOptions, Vt as FoundationEnvironment, hn as BaseTransportTrait } from "../index-B9SEJGU2.mjs";
+import { Lt as CreateFoundationEnvironmentOptions, Vt as FoundationEnvironment, hn as BaseTransportTrait } from "../index-CbeZ3AfB.mjs";
 //#region src/server/transport.d.ts
 interface ServerRequestContext {
   headers: Record<string, string>;

package/dist/test/index.d.mts

@@ -1,5 +1,5 @@
 import { C as IdleCallbackTrait, T as TimeTrait, on as SecuritydeptProvider, wt as EventSubjectTrait } from "../index-CFAJ969E.mjs";
-import { Bt as EnvironmentValidators, Cr as PopupAttachResult, Er as PopupTrait, Hn as RouterTrait, Lt as CreateFoundationEnvironmentOptions, Mn as WithTraitInputValidator, Oi as PageLifecycleTrait, Tr as PopupOpenOptions, Vn as RouterNavigationRequest, Vt as FoundationEnvironment, _n as HttpResponse, ar as UriReferenceString, dn as SyncStorageTrait, gn as HttpRequest, hn as BaseTransportTrait } from "../index-B9SEJGU2.mjs";
+import { Bt as EnvironmentValidators, Cr as PopupAttachResult, Er as PopupTrait, Hn as RouterTrait, Lt as CreateFoundationEnvironmentOptions, Mn as WithTraitInputValidator, Oi as PageLifecycleTrait, Tr as PopupOpenOptions, Vn as RouterNavigationRequest, Vt as FoundationEnvironment, _n as HttpResponse, ar as UriReferenceString, dn as SyncStorageTrait, gn as HttpRequest, hn as BaseTransportTrait } from "../index-CbeZ3AfB.mjs";
 //#region src/test/environment.d.ts
 type EnvironmentCreatorOptions = {
   providers?: readonly SecuritydeptProvider[];

package/dist/web/index.d.mts

@@ -1,6 +1,6 @@
 import { Ct as EventStreamTrait, T as TimeTrait, ln as WithTraitDeps } from "../index-CFAJ969E.mjs";
-import { Bt as EnvironmentValidators, Er as PopupTrait, Hn as RouterTrait, Lt as CreateFoundationEnvironmentOptions, Mn as WithTraitInputValidator, Vt as FoundationEnvironment, dn as SyncStorageTrait } from "../index-B9SEJGU2.mjs";
-import { _ as createPageResumeSource, a as NativeWebWindowLike, b as fromStorageEvent, c as WebNavigationRouter, d as createPageLifecycleForNativeWeb, f as CreatePageResumeSourceOptions, g as PageResumeWindowTarget, h as PageResumeTriggerKind, i as NativeWebRouter, l as createRouterForNativeWeb, m as PageResumeEvent, n as NativeWebLocationLike, o as RouterForNativeWebCreateOptions, p as PageResumeDocumentTarget, r as NativeWebNavigationLike, s as WebLegacyRouter, t as NativeWebHistoryLike, u as PageLifecycleForNativeWebCreateOptions, v as FromStorageEventOptions, y as StorageEventTarget } from "../index-BjCFWcmV.mjs";
+import { Bt as EnvironmentValidators, Er as PopupTrait, Hn as RouterTrait, Lt as CreateFoundationEnvironmentOptions, Mn as WithTraitInputValidator, Vt as FoundationEnvironment, dn as SyncStorageTrait } from "../index-CbeZ3AfB.mjs";
+import { _ as createPageResumeSource, a as NativeWebWindowLike, b as fromStorageEvent, c as WebNavigationRouter, d as createPageLifecycleForNativeWeb, f as CreatePageResumeSourceOptions, g as PageResumeWindowTarget, h as PageResumeTriggerKind, i as NativeWebRouter, l as createRouterForNativeWeb, m as PageResumeEvent, n as NativeWebLocationLike, o as RouterForNativeWebCreateOptions, p as PageResumeDocumentTarget, r as NativeWebNavigationLike, s as WebLegacyRouter, t as NativeWebHistoryLike, u as PageLifecycleForNativeWebCreateOptions, v as FromStorageEventOptions, y as StorageEventTarget } from "../index-Bo1BtjZH.mjs";
 //#region src/web/popup.d.ts
 interface PopupForNativeWebCreateOptions {
   window?: unknown;

package/dist/webext/index.d.mts

@@ -1,5 +1,5 @@
-import { Bt as EnvironmentValidators, Hn as RouterTrait, Lt as CreateFoundationEnvironmentOptions, Mn as WithTraitInputValidator, Vt as FoundationEnvironment, ln as StorageTrait } from "../index-B9SEJGU2.mjs";
-import { o as RouterForNativeWebCreateOptions, u as PageLifecycleForNativeWebCreateOptions } from "../index-BjCFWcmV.mjs";
+import { Bt as EnvironmentValidators, Hn as RouterTrait, Lt as CreateFoundationEnvironmentOptions, Mn as WithTraitInputValidator, Vt as FoundationEnvironment, ln as StorageTrait } from "../index-CbeZ3AfB.mjs";
+import { o as RouterForNativeWebCreateOptions, u as PageLifecycleForNativeWebCreateOptions } from "../index-Bo1BtjZH.mjs";
 //#region src/webext/router.d.ts
 interface WebExtRouterBrowserLike {
   runtime?: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securitydept/client",
-  "version": "0.3.0-beta.7",
+  "version": "0.3.0-beta.8",
   "description": "Client of the SecurityDept TypeScript SDK, a layered authentication and authorization toolkit built as reusable Rust crates, a TypeScript client SDK workspace, and reference server/web apps.",
   "author": "Zhou Yeheng <root@aitiotekt.com>",
   "license": "MIT",
@@ -64,17 +64,8 @@
     "rxjs": "^7.8.2",
     "uuid": "^14.0.1"
   },
-  "peerDependencies": {
-    "mnemonist": "^0.40.4"
-  },
-  "peerDependenciesMeta": {
-    "mnemonist": {
-      "optional": true
-    }
-  },
   "devDependencies": {
     "@types/node": "^26.1.2",
-    "mnemonist": "^0.40.4",
     "vitest": "^4.1.10"
   },
   "scripts": {