@securitydept/session-context-client 0.3.0-beta.3 → 0.3.0-beta.6

package/dist/index.mjs

@@ -1,98 +1,665 @@
-import { i as SessionUserInfoResponseSchema, n as SessionContextSource, r as SessionInfoSchema, t as SessionContextClient } from "./client-CTJyzp37.mjs";
-import { createSignal, readonlySignal } from "@securitydept/client";
-//#region src/controller.ts
-const SessionContextControllerStatus = {
-	Idle: "idle",
-	Loading: "loading",
-	Authenticated: "authenticated",
-	Unauthenticated: "unauthenticated",
-	Error: "error"
+import { ClientError, ClientErrorKind, ENVIRONMENT_TOKEN, INJECTOR_TOKEN, IdentityPrincipalSchema, IdentityPrincipalWireSchema, ResourceSnapshotUpdateKind, ResourceStatus, RouterNavigationIntent, RouterNavigationMode, SYMBOL_DISPOSE, SecuritydeptDestroyRef, SecuritydeptInjectionToken, UriReferenceString, createCancellationTokenSource, createLinkedCancellationToken, createOnceAsyncLockCallable, createSignal, defineInstrumentMethodDecorator, describeError, formatValidationFailure, injectDisposableStackFrom, mapResource, readonlySignal, reduceResourceSnapshot, resourceFromSnapshots, validateWithSchemaSync, withDisposableStack } from "@securitydept/client";
+import { RxEventReplaySubject, RxEventSubject, RxStateSignal, commandResponseData, concatCommand, dispatchCommandLocallyToStream } from "@securitydept/client/rx";
+import { filter, from, lastValueFrom, take, takeUntil } from "rxjs";
+import { v7 } from "uuid";
+import { type } from "arktype";
+//#region src/types.ts
+const SessionContextErrorCode = {
+	OperationFailed: "session.operation_failed",
+	ClientDisposed: "session.client_disposed",
+	RouterUnavailable: "session.router_unavailable",
+	InvalidSessionPayload: "session.invalid_user_info_payload"
 };
-var SessionContextController = class {
-	client;
-	state;
-	transport;
-	stateSignal = createSignal({
-		status: SessionContextControllerStatus.Idle,
-		session: null,
-		error: null
+const SessionContextSource = { SessionContext: "session-context" };
+const SessionContextEventType = {
+	SessionRefreshStarted: "session.refresh.started",
+	SessionRefreshSucceeded: "session.refresh.succeeded",
+	SessionRefreshFailed: "session.refresh.failed",
+	SessionLogoutStarted: "session.logout.started",
+	SessionLogoutSucceeded: "session.logout.succeeded",
+	SessionLogoutFailed: "session.logout.failed"
+};
+//#endregion
+//#region src/contracts/schemas.ts
+const SessionInfoSchema = type({
+	principal: IdentityPrincipalSchema,
+	"attributes?": "object",
+	"extra?": "object"
+}).pipe((input) => ({
+	principal: input.principal,
+	attributes: input.attributes,
+	extra: input.extra
+}));
+const SessionUserInfoResponseSchema = IdentityPrincipalWireSchema.pipe((principal) => ({ principal }));
+//#endregion
+//#region src/contracts/parsers.ts
+function parseSessionInfoPayload(body) {
+	const infoResult = validateWithSchemaSync(SessionInfoSchema, body);
+	if (infoResult.success) return infoResult.value;
+	const userInfoResult = validateWithSchemaSync(SessionUserInfoResponseSchema, body);
+	if (userInfoResult.success) return userInfoResult.value;
+	const failure = {
+		success: false,
+		issues: [...infoResult.issues, ...userInfoResult.issues]
+	};
+	const issueSummary = formatValidationFailure(failure);
+	throw new ClientError({
+		kind: ClientErrorKind.Protocol,
+		code: SessionContextErrorCode.InvalidSessionPayload,
+		message: issueSummary ? `Session /user-info payload is invalid: ${issueSummary}.` : "Session /user-info payload is invalid.",
+		source: SessionContextSource.SessionContext,
+		cause: failure.issues
 	});
-	refreshPromise = null;
-	disposed = false;
-	constructor(options) {
-		this.client = options.client;
-		this.transport = options.transport;
-		this.state = readonlySignal(this.stateSignal);
-	}
-	getState() {
-		return this.stateSignal.get();
-	}
-	subscribe(listener) {
-		return this.stateSignal.subscribe(listener);
-	}
-	refresh() {
-		if (this.disposed) return Promise.resolve(this.stateSignal.get().session);
-		if (this.refreshPromise) return this.refreshPromise;
-		this.stateSignal.set({
-			status: SessionContextControllerStatus.Loading,
-			session: this.stateSignal.get().session,
-			error: null
+}
+//#endregion
+//#region src/tokens.ts
+const SESSION_CONTEXT_CLIENT = new SecuritydeptInjectionToken("SESSION_CONTEXT_CLIENT");
+const SESSION_CONTEXT_CLIENT_CONFIG = new SecuritydeptInjectionToken("SESSION_CONTEXT_CLIENT_CONFIG");
+//#endregion
+//#region src/client.ts
+function toPrimitive(input, hint) {
+	if (typeof input !== "object" || input === null) return input;
+	var prim = input[Symbol.toPrimitive];
+	if (prim !== void 0) {
+		var res = prim.call(input, hint || "default");
+		if (typeof res !== "object") return res;
+		throw new TypeError("@@toPrimitive must return a primitive value.");
+	}
+	return (hint === "string" ? String : Number)(input);
+}
+function toPropertyKey(arg) {
+	var key = toPrimitive(arg, "string");
+	return typeof key === "symbol" ? key : String(key);
+}
+function checkInRHS(value) {
+	if (Object(value) !== value) throw TypeError("right-hand side of 'in' should be an object, got " + (value !== null ? typeof value : "null"));
+	return value;
+}
+function setFunctionName(fn, name, prefix) {
+	if (typeof name === "symbol") {
+		name = name.description;
+		name = name ? "[" + name + "]" : "";
+	}
+	try {
+		Object.defineProperty(fn, "name", {
+			configurable: true,
+			value: prefix ? prefix + " " + name : name
 		});
-		this.refreshPromise = this.client.fetchUserInfo(this.transport).then((session) => {
-			if (!this.disposed) this.stateSignal.set({
-				status: session ? SessionContextControllerStatus.Authenticated : SessionContextControllerStatus.Unauthenticated,
-				session,
-				error: null
-			});
-			return session;
-		}).catch((error) => {
-			if (!this.disposed) this.stateSignal.set({
-				status: SessionContextControllerStatus.Error,
-				session: null,
-				error
-			});
-			throw error;
-		}).finally(() => {
-			this.refreshPromise = null;
+	} catch (_) {}
+	return fn;
+}
+function _apply_decs_2311(targetClass, classDecs, memberDecs, classDecsHaveThis, instanceBrand, parentClass) {
+	var symbolMetadata = Symbol.metadata || Symbol.for("Symbol.metadata");
+	var defineProperty = Object.defineProperty;
+	var create = Object.create;
+	var metadata;
+	var existingNonFields = [create(null), create(null)];
+	var hasClassDecs = classDecs.length;
+	var _;
+	function createRunInitializers(initializers, useStaticThis, hasValue) {
+		return function(thisArg, value) {
+			if (useStaticThis) {
+				value = thisArg;
+				thisArg = targetClass;
+			}
+			for (var i = 0; i < initializers.length; i++) value = initializers[i].apply(thisArg, hasValue ? [value] : []);
+			return hasValue ? value : thisArg;
+		};
+	}
+	function assertCallable(fn, hint1, hint2, throwUndefined) {
+		if (typeof fn !== "function") {
+			if (throwUndefined || fn !== void 0) throw new TypeError(hint1 + " must " + (hint2 || "be") + " a function" + (throwUndefined ? "" : " or undefined"));
+		}
+		return fn;
+	}
+	function applyDec(Class, decInfo, decoratorsHaveThis, name, kind, initializers, ret, isStatic, isPrivate, isField, hasPrivateBrand) {
+		function assertInstanceIfPrivate(target) {
+			if (!hasPrivateBrand(target)) throw new TypeError("Attempted to access private element on non-instance");
+		}
+		var decs = [].concat(decInfo[0]);
+		var decVal = decInfo[3];
+		var isClass = !ret;
+		var isAccessor = kind === 1;
+		var isGetter = kind === 3;
+		var isSetter = kind === 4;
+		var isMethod = kind === 2;
+		function bindPropCall(name, useStaticThis, before) {
+			return function(_this, value) {
+				if (useStaticThis) {
+					value = _this;
+					_this = Class;
+				}
+				if (before) before(_this);
+				return desc[name].call(_this, value);
+			};
+		}
+		var desc1 = {};
+		var init = [];
+		var key = isGetter ? "get" : isSetter || isAccessor ? "set" : "value";
+		if (!isClass) {
+			if (isPrivate) {
+				if (isField || isAccessor) desc1 = {
+					get: setFunctionName(function() {
+						return decVal(this);
+					}, name, "get"),
+					set: function(value) {
+						decInfo[4](this, value);
+					}
+				};
+				else desc1[key] = decVal;
+				if (!isField) setFunctionName(desc1[key], name, isMethod ? "" : key);
+			} else if (!isField) desc1 = Object.getOwnPropertyDescriptor(Class, name);
+			if (!isField && !isPrivate) {
+				_ = existingNonFields[+isStatic][name];
+				if (_ && (_ ^ kind) !== 7) throw new Error("Decorating two elements with the same name (" + desc1[key].name + ") is not supported yet");
+				existingNonFields[+isStatic][name] = kind < 3 ? 1 : kind;
+			}
+		}
+		var newValue = Class;
+		for (var i = decs.length - 1; i >= 0; i -= decoratorsHaveThis ? 2 : 1) {
+			var dec = assertCallable(decs[i], "A decorator", "be", true);
+			var decThis = decoratorsHaveThis ? decs[i - 1] : void 0;
+			var decoratorFinishedRef = {};
+			var ctx = {
+				kind: [
+					"field",
+					"accessor",
+					"method",
+					"getter",
+					"setter",
+					"class"
+				][kind],
+				name,
+				metadata,
+				addInitializer: (function(decoratorFinishedRef, initializer) {
+					if (decoratorFinishedRef.v) throw new TypeError("attempted to call addInitializer after decoration was finished");
+					assertCallable(initializer, "An initializer", "be", true);
+					initializers.push(initializer);
+				}).bind(null, decoratorFinishedRef)
+			};
+			if (isClass) {
+				_ = dec.call(decThis, newValue, ctx);
+				decoratorFinishedRef.v = 1;
+				if (assertCallable(_, "class decorators", "return")) newValue = _;
+				continue;
+			}
+			ctx.static = isStatic;
+			ctx.private = isPrivate;
+			_ = ctx.access = { has: isPrivate ? hasPrivateBrand.bind() : function(target) {
+				return name in target;
+			} };
+			if (!isSetter) _.get = isPrivate ? isMethod ? function(_this) {
+				assertInstanceIfPrivate(_this);
+				return desc1.value;
+			} : bindPropCall("get", 0, assertInstanceIfPrivate) : function(target) {
+				return target[name];
+			};
+			if (!isMethod && !isGetter) _.set = isPrivate ? bindPropCall("set", 0, assertInstanceIfPrivate) : function(target, value) {
+				target[name] = value;
+			};
+			newValue = dec.call(decThis, isAccessor ? {
+				get: desc1.get,
+				set: desc1.set
+			} : desc1[key], ctx);
+			decoratorFinishedRef.v = 1;
+			if (isAccessor) {
+				if (typeof newValue === "object" && newValue) {
+					if (_ = assertCallable(newValue.get, "accessor.get")) desc1.get = _;
+					if (_ = assertCallable(newValue.set, "accessor.set")) desc1.set = _;
+					if (_ = assertCallable(newValue.init, "accessor.init")) init.unshift(_);
+				} else if (newValue !== void 0) throw new TypeError("accessor decorators must return an object with get, set, or init properties or undefined");
+			} else if (assertCallable(newValue, (isField ? "field" : "method") + " decorators", "return")) if (isField) init.unshift(newValue);
+			else desc1[key] = newValue;
+		}
+		if (kind < 2) ret.push(createRunInitializers(init, isStatic, 1), createRunInitializers(initializers, isStatic, 0));
+		if (!isField && !isClass) if (isPrivate) if (isAccessor) ret.splice(-1, 0, bindPropCall("get", isStatic), bindPropCall("set", isStatic));
+		else ret.push(isMethod ? desc1[key] : assertCallable.call.bind(desc1[key]));
+		else defineProperty(Class, name, desc1);
+		return newValue;
+	}
+	function applyMemberDecs() {
+		var ret = [];
+		var protoInitializers;
+		var staticInitializers;
+		var pushInitializers = function(initializers) {
+			if (initializers) ret.push(createRunInitializers(initializers));
+		};
+		var applyMemberDecsOfKind = function(isStatic, isField) {
+			for (var i = 0; i < memberDecs.length; i++) {
+				var decInfo = memberDecs[i];
+				var kind = decInfo[1];
+				var kindOnly = kind & 7;
+				if ((kind & 8) == isStatic && !kindOnly == isField) {
+					var name = decInfo[2];
+					var isPrivate = !!decInfo[3];
+					var decoratorsHaveThis = kind & 16;
+					applyDec(isStatic ? targetClass : targetClass.prototype, decInfo, decoratorsHaveThis, isPrivate ? "#" + name : toPropertyKey(name), kindOnly, kindOnly < 2 ? [] : isStatic ? staticInitializers = staticInitializers || [] : protoInitializers = protoInitializers || [], ret, !!isStatic, isPrivate, isField, isStatic && isPrivate ? function(_) {
+						return checkInRHS(_) === targetClass;
+					} : instanceBrand);
+				}
+			}
+		};
+		applyMemberDecsOfKind(8, 0);
+		applyMemberDecsOfKind(0, 0);
+		applyMemberDecsOfKind(8, 1);
+		applyMemberDecsOfKind(0, 1);
+		pushInitializers(protoInitializers);
+		pushInitializers(staticInitializers);
+		return ret;
+	}
+	function defineMetadata(Class) {
+		return defineProperty(Class, symbolMetadata, {
+			configurable: true,
+			enumerable: true,
+			value: metadata
 		});
-		return this.refreshPromise;
 	}
-	async rememberPostAuthRedirect(uri) {
-		await this.client.rememberPostAuthRedirect(uri);
+	if (parentClass !== void 0) metadata = parentClass[symbolMetadata];
+	metadata = create(metadata == null ? null : metadata);
+	_ = applyMemberDecs();
+	if (!hasClassDecs) defineMetadata(targetClass);
+	return {
+		e: _,
+		get c() {
+			var initializers = [];
+			return hasClassDecs && [defineMetadata(targetClass = applyDec(targetClass, [classDecs], classDecsHaveThis, targetClass.name, 5, initializers)), createRunInitializers(initializers, 1)];
+		}
+	};
+}
+let _dec;
+let _dec1;
+let _dec2;
+let _dec3;
+let _dec4;
+let _dec5;
+let _dec6;
+let _initProto;
+const POST_AUTH_REDIRECT_PARAM = "post_auth_redirect_uri";
+const instrumentSessionMethod = defineInstrumentMethodDecorator(({ factoryArgs: [operation] }) => function() {
+	return {
+		environment: this.environment,
+		span: this.span,
+		name: `${this.config.tracing.prefix}.${operation}`,
+		target: this.config.tracing.target,
+		fields: { operation },
+		normalizeError: (error) => ClientError.fromUnknown(error, {
+			code: SessionContextErrorCode.OperationFailed,
+			message: "The session operation failed unexpectedly",
+			source: SessionContextSource.SessionContext
+		})
+	};
+});
+_dec = instrumentSessionMethod("start"), _dec1 = withDisposableStack(0, true), _dec2 = instrumentSessionMethod("refresh"), _dec3 = withDisposableStack(0, true), _dec4 = instrumentSessionMethod("logout"), _dec5 = withDisposableStack(0, true), _dec6 = instrumentSessionMethod("login.redirect");
+/**
+* Session Context Client.
+*
+* Owns session state, lifecycle, login/logout navigation, and tracing.
+* Host capabilities are resolved once through FoundationEnvironment at
+* construction time.
+*/ var SessionContextClient = class SessionContextClient {
+	static {
+		({e: [_initProto]} = _apply_decs_2311(this, [], [
+			[
+				_dec,
+				2,
+				"start"
+			],
+			[
+				_dec1,
+				2,
+				"refresh"
+			],
+			[
+				_dec2,
+				2,
+				"_refresh"
+			],
+			[
+				_dec3,
+				2,
+				"logout"
+			],
+			[
+				_dec4,
+				2,
+				"_logout"
+			],
+			[
+				_dec5,
+				2,
+				"loginWithRedirect"
+			],
+			[
+				_dec6,
+				2,
+				"_loginWithRedirect"
+			]
+		]));
+	}
+	static defaultOptions = {
+		loginPath: "/auth/session/login",
+		logoutPath: "/auth/session/logout",
+		userInfoPath: "/auth/session/user-info",
+		tracing: {
+			target: "session-context-client",
+			prefix: "session_context"
+		}
+	};
+	_environment;
+	_config;
+	_span;
+	_rootCancellation = (_initProto(this), createCancellationTokenSource());
+	_destroyed = RxStateSignal.fromInitialValue(false);
+	destroyed$ = from(this._destroyed).pipe(filter((value) => value), take(1));
+	_sessionSnapshotSignal = RxStateSignal.fromInitialValue({ status: ResourceStatus.Idle });
+	_operationSignals = {
+		startPending: createSignal(false),
+		refreshPending: createSignal(false),
+		logoutPending: createSignal(false),
+		loginRedirectPending: createSignal(false)
+	};
+	_eventSubject = new RxEventReplaySubject(100);
+	_refreshCommandSubject = new RxEventSubject();
+	_refreshResponseSubject = new RxEventSubject();
+	_logoutCommandSubject = new RxEventSubject();
+	_logoutResponseSubject = new RxEventSubject();
+	_startOnce = createOnceAsyncLockCallable(async (cancellationToken, operationSpan) => {
+		cancellationToken.throwIfCancellationRequested();
+		this._operationSignals.startPending.set(true);
+		try {
+			return await this._dispatchRefresh(cancellationToken, operationSpan);
+		} finally {
+			this._operationSignals.startPending.set(false);
+		}
+	});
+	id;
+	sessionSnapshot;
+	sessionResource;
+	isAuthenticated;
+	sessionOperations;
+	events;
+	get environment() {
+		return this._environment;
 	}
-	async clearPostAuthRedirect() {
-		await this.client.clearPostAuthRedirect();
+	get span() {
+		return this._span;
 	}
-	async resolveLoginUrl() {
-		return await this.client.resolveLoginUrl();
+	get config() {
+		return this._config;
 	}
-	async logout() {
-		this.stateSignal.set({
-			status: SessionContextControllerStatus.Loading,
-			session: this.stateSignal.get().session,
-			error: null
+	static fromEnvironmentConfig(options) {
+		return new SessionContextClient(options.config, options.environment);
+	}
+	static fromInjector(injector) {
+		const client = SessionContextClient.fromEnvironmentConfig({
+			config: injector.get(SESSION_CONTEXT_CLIENT_CONFIG),
+			environment: injector.get(ENVIRONMENT_TOKEN)
+		});
+		injector.get(SecuritydeptDestroyRef, null)?.onDestroy(() => client.dispose());
+		return client;
+	}
+	constructor(config, environment) {
+		this._environment = environment;
+		const baseUrl = config.baseUrl.replace(/\/+$/, "");
+		this._config = {
+			id: config.id ?? v7(),
+			baseUrl,
+			loginPath: config.loginPath ?? SessionContextClient.defaultOptions.loginPath,
+			logoutPath: config.logoutPath ?? SessionContextClient.defaultOptions.logoutPath,
+			userInfoPath: config.userInfoPath ?? SessionContextClient.defaultOptions.userInfoPath,
+			tracing: {
+				target: config.tracing?.target ?? SessionContextClient.defaultOptions.tracing.target,
+				prefix: config.tracing?.prefix ?? SessionContextClient.defaultOptions.tracing.prefix
+			}
+		};
+		this.id = this._config.id;
+		this._span = environment.span.fork({ attributes: {
+			clientName: this.constructor.name,
+			id: this.id
+		} });
+		this.sessionSnapshot = readonlySignal(this._sessionSnapshotSignal);
+		this.sessionResource = resourceFromSnapshots(() => this._sessionSnapshotSignal.get());
+		this.isAuthenticated = mapResource(this.sessionResource, (sessionInfo) => sessionInfo !== null);
+		this.sessionOperations = {
+			startPending: readonlySignal(this._operationSignals.startPending),
+			refreshPending: readonlySignal(this._operationSignals.refreshPending),
+			logoutPending: readonlySignal(this._operationSignals.logoutPending),
+			loginRedirectPending: readonlySignal(this._operationSignals.loginRedirectPending)
+		};
+		this.events = this._eventSubject;
+		this.destroyed$.subscribe(() => {
+			this._rootCancellation.cancel(new ClientError({
+				kind: ClientErrorKind.Cancelled,
+				code: SessionContextErrorCode.ClientDisposed,
+				message: "SessionContextClient has been disposed.",
+				source: SessionContextSource.SessionContext
+			}));
+			this.isAuthenticated.dispose();
+			this.sessionResource.dispose();
 		});
+		from(this._refreshCommandSubject).pipe(takeUntil(this.destroyed$), concatCommand((command) => this._executeRefresh(command.cancellationToken, command.operationSpan))).subscribe(this._refreshResponseSubject);
+		from(this._logoutCommandSubject).pipe(takeUntil(this.destroyed$), concatCommand((command) => this._executeLogout(command.cancellationToken, command.operationSpan))).subscribe(this._logoutResponseSubject);
+		if (config.autoStart === true) this.start().catch(() => {});
+	}
+	async start(operationSpan) {
+		const cancellationToken = this._rootCancellation.token;
+		return await this._startOnce(cancellationToken, operationSpan);
+	}
+	async refresh(options = {}) {
+		const disposableStack = injectDisposableStackFrom(options, true);
+		const cancellationToken = createLinkedCancellationToken(this._rootCancellation.token, options.cancellationToken);
+		disposableStack?.use(cancellationToken);
+		return await this._refresh(cancellationToken);
+	}
+	async _refresh(cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		return await this._dispatchRefresh(cancellationToken, operationSpan);
+	}
+	async logout(options = {}) {
+		const disposableStack = injectDisposableStackFrom(options, true);
+		const cancellationToken = createLinkedCancellationToken(this._rootCancellation.token, options.cancellationToken);
+		disposableStack?.use(cancellationToken);
+		await this._logout(cancellationToken);
+	}
+	async _logout(cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		await this._dispatchLogout(cancellationToken, operationSpan);
+	}
+	async loginWithRedirect(options = {}) {
+		const disposableStack = injectDisposableStackFrom(options, true);
+		const cancellationToken = createLinkedCancellationToken(this._rootCancellation.token, options.cancellationToken);
+		disposableStack?.use(cancellationToken);
+		await this._loginWithRedirect(options, cancellationToken);
+	}
+	async _loginWithRedirect(options, cancellationToken, _operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		const router = this._environment.router;
+		if (!router) throw new ClientError({
+			kind: ClientErrorKind.Configuration,
+			code: SessionContextErrorCode.RouterUnavailable,
+			message: "loginWithRedirect() requires environment.router.",
+			source: SessionContextSource.SessionContext
+		});
+		this._operationSignals.loginRedirectPending.set(true);
 		try {
-			await this.client.logoutAndClearPendingLoginRedirect(this.transport);
-			if (!this.disposed) this.stateSignal.set({
-				status: SessionContextControllerStatus.Unauthenticated,
-				session: null,
-				error: null
+			await router.navigate({
+				url: UriReferenceString.parse(this._createLoginRedirectUrl(options.postAuthRedirectUri)),
+				intent: RouterNavigationIntent.AuthRedirect,
+				mode: RouterNavigationMode.External
 			});
+			cancellationToken.throwIfCancellationRequested();
+		} finally {
+			this._operationSignals.loginRedirectPending.set(false);
+		}
+	}
+	dispose() {
+		this._destroyed.set(true);
+	}
+	[SYMBOL_DISPOSE]() {
+		this.dispose();
+	}
+	async _dispatchRefresh(cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		const sessionInfo = await lastValueFrom(dispatchCommandLocallyToStream({
+			payload: void 0,
+			requestStream: this._refreshCommandSubject,
+			responseStream: this._refreshResponseSubject,
+			createCommandExtra: () => ({
+				cancellationToken,
+				operationSpan
+			})
+		}).pipe(commandResponseData()));
+		cancellationToken.throwIfCancellationRequested();
+		return sessionInfo;
+	}
+	async _dispatchLogout(cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		await lastValueFrom(dispatchCommandLocallyToStream({
+			payload: void 0,
+			requestStream: this._logoutCommandSubject,
+			responseStream: this._logoutResponseSubject,
+			createCommandExtra: () => ({
+				cancellationToken,
+				operationSpan
+			})
+		}).pipe(commandResponseData()));
+		cancellationToken.throwIfCancellationRequested();
+	}
+	async _executeRefresh(cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		this._operationSignals.refreshPending.set(true);
+		const previous = this._sessionSnapshotSignal.get();
+		const previousValue = previous.status === ResourceStatus.Reloading || previous.status === ResourceStatus.Resolved || previous.status === ResourceStatus.Error ? previous.value : null;
+		const loadingSnapshot = reduceResourceSnapshot(previous, { kind: ResourceSnapshotUpdateKind.Load });
+		this._sessionSnapshotSignal.set(loadingSnapshot);
+		this._emitSessionEvent({
+			type: SessionContextEventType.SessionRefreshStarted,
+			session: previousValue
+		});
+		try {
+			const sessionInfo = await this._fetchSessionInfo(cancellationToken);
+			cancellationToken.throwIfCancellationRequested();
+			this._sessionSnapshotSignal.set(reduceResourceSnapshot(loadingSnapshot, {
+				kind: ResourceSnapshotUpdateKind.Resolve,
+				value: sessionInfo
+			}));
+			operationSpan?.setAttributes({ authenticated: sessionInfo !== null });
+			this._emitSessionEvent({
+				type: SessionContextEventType.SessionRefreshSucceeded,
+				session: sessionInfo
+			});
+			return sessionInfo;
 		} catch (error) {
-			if (!this.disposed) this.stateSignal.set({
-				status: SessionContextControllerStatus.Error,
-				session: null,
+			this._sessionSnapshotSignal.set(reduceResourceSnapshot(loadingSnapshot, {
+				kind: ResourceSnapshotUpdateKind.Fail,
 				error
+			}));
+			this._emitSessionEvent({
+				type: SessionContextEventType.SessionRefreshFailed,
+				session: previousValue,
+				errorSummary: describeError(error)
 			});
 			throw error;
+		} finally {
+			this._operationSignals.refreshPending.set(false);
 		}
 	}
-	dispose() {
-		this.disposed = true;
+	async _executeLogout(cancellationToken, operationSpan) {
+		cancellationToken.throwIfCancellationRequested();
+		this._operationSignals.logoutPending.set(true);
+		const previous = this._sessionSnapshotSignal.get();
+		const loadingSnapshot = reduceResourceSnapshot(previous, { kind: ResourceSnapshotUpdateKind.Load });
+		this._sessionSnapshotSignal.set(loadingSnapshot);
+		this._emitSessionEvent({
+			type: SessionContextEventType.SessionLogoutStarted,
+			session: this._readCurrentSession()
+		});
+		try {
+			const response = await this._environment.transport.execute({
+				url: this._createLogoutUrl(),
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({}),
+				cancellationToken
+			});
+			if (response.status < 200 || response.status >= 300) throw ClientError.fromHttpResponse({
+				status: response.status,
+				body: response.body
+			});
+			cancellationToken.throwIfCancellationRequested();
+			this._sessionSnapshotSignal.set(reduceResourceSnapshot(loadingSnapshot, {
+				kind: ResourceSnapshotUpdateKind.Resolve,
+				value: null
+			}));
+			operationSpan?.setAttributes({ authenticated: false });
+			this._emitSessionEvent({
+				type: SessionContextEventType.SessionLogoutSucceeded,
+				session: null
+			});
+		} catch (error) {
+			this._sessionSnapshotSignal.set(reduceResourceSnapshot(loadingSnapshot, {
+				kind: ResourceSnapshotUpdateKind.Fail,
+				error
+			}));
+			this._emitSessionEvent({
+				type: SessionContextEventType.SessionLogoutFailed,
+				session: this._readCurrentSession(),
+				errorSummary: describeError(error)
+			});
+			throw error;
+		} finally {
+			this._operationSignals.logoutPending.set(false);
+		}
+	}
+	async _fetchSessionInfo(cancellationToken) {
+		cancellationToken.throwIfCancellationRequested();
+		const response = await this._environment.transport.execute({
+			url: this._config.baseUrl + this._config.userInfoPath,
+			method: "GET",
+			headers: {},
+			cancellationToken
+		});
+		cancellationToken.throwIfCancellationRequested();
+		if (response.status === 401 || response.status === 403) return null;
+		if (response.status >= 200 && response.status < 300) return parseSessionInfoPayload(response.body);
+		throw ClientError.fromHttpResponse({
+			status: response.status,
+			body: response.body
+		});
+	}
+	_createLoginRedirectUrl(postAuthRedirectUri) {
+		const base = this._config.baseUrl + this._config.loginPath;
+		if (postAuthRedirectUri) return `${base}?${new URLSearchParams({ [POST_AUTH_REDIRECT_PARAM]: postAuthRedirectUri }).toString()}`;
+		return base;
+	}
+	_createLogoutUrl() {
+		return this._config.baseUrl + this._config.logoutPath;
+	}
+	_readCurrentSession() {
+		const snapshot = this._sessionSnapshotSignal.get();
+		return snapshot.status === ResourceStatus.Reloading || snapshot.status === ResourceStatus.Resolved || snapshot.status === ResourceStatus.Error ? snapshot.value : null;
+	}
+	_emitSessionEvent(input) {
+		this._eventSubject.next({
+			...input,
+			at: this._environment.time.now(),
+			client: { id: this.id }
+		});
 	}
 };
 //#endregion
-export { SessionContextClient, SessionContextController, SessionContextControllerStatus, SessionContextSource, SessionInfoSchema, SessionUserInfoResponseSchema };
+//#region src/providers.ts
+function provideSessionContext(options) {
+	return [{
+		provide: SESSION_CONTEXT_CLIENT_CONFIG,
+		useValue: options.config
+	}, {
+		provide: SESSION_CONTEXT_CLIENT,
+		useFactory: (injector) => SessionContextClient.fromInjector(injector),
+		deps: [INJECTOR_TOKEN]
+	}];
+}
+//#endregion
+export { SESSION_CONTEXT_CLIENT, SESSION_CONTEXT_CLIENT_CONFIG, SessionContextClient, SessionContextErrorCode, SessionContextEventType, SessionContextSource, SessionInfoSchema, SessionUserInfoResponseSchema, parseSessionInfoPayload, provideSessionContext };
 
 //# sourceMappingURL=index.mjs.map