@securitydept/token-set-context-client-angular 0.2.0 → 0.3.0-beta.10

package/fesm2022/securitydept-token-set-context-client-angular.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"securitydept-token-set-context-client-angular.mjs","sources":["../../src/lib/token-set-auth.service.ts","../../src/lib/token-set-auth-registry.ts","../../src/lib/bearer-interceptor.ts","../../src/lib/callback-resume.service.ts","../../src/lib/oidc-callback-url.ts","../../src/lib/tokens.ts","../../src/lib/provide-token-set-auth.ts","../../src/lib/route-aggregation-guard.ts","../../src/lib/secure-routes.ts","../../src/lib/token-set-callback.component.ts","../../src/lib/index.ts","../../src/public-api.ts","../../src/securitydept-token-set-context-client-angular.ts"],"sourcesContent":["import { signal, type WritableSignal } from \"@angular/core\";\nimport type { EventStreamTrait } from \"@securitydept/client\";\nimport {\n\tbridgeToAngularSignal,\n\tsignalToObservable,\n} from \"@securitydept/client-angular\";\nimport {\n\ttype AuthSnapshot,\n\ttype EnsureAuthForResourceOptions,\n\ttype EnsureAuthForResourceResult,\n\ttype EnsureAuthorizationHeaderOptions,\n\ttype EnsureFreshAuthStateOptions,\n\tgetTokenFreshness,\n\tTokenFreshnessState,\n\ttype TokenSetAuthEvent,\n} from \"@securitydept/token-set-context-client/orchestration\";\nimport type { Observable } from \"rxjs\";\nimport type { TokenSetAngularClient } from \"./contracts\";\n\n// ============================================================================\n// 5. TokenSetAuthService — per-client service wrapper\n// ============================================================================\n\n/**\n * Per-client Angular service that bridges a single OIDC mode client to\n * Angular signals + RxJS.\n *\n * Iteration 110 change: lifecycle teardown is now explicit. Construct with\n * `new TokenSetAuthService(client, autoRestore)` and call `.dispose()` when\n * the service owner tears down. The shared registry core handles this\n * automatically — adopters that wire the service directly (rare) must call\n * `dispose()` themselves, typically bound to a `DestroyRef.onDestroy`.\n */\nexport class TokenSetAuthService {\n\t/** Current auth snapshot as an Angular signal. */\n\treadonly authState: WritableSignal<AuthSnapshot | null>;\n\t/** Current auth snapshot as an RxJS Observable. */\n\treadonly authState$: Observable<AuthSnapshot | null>;\n\t/** Promise that resolves when initial state restore completes (or null if skipped). */\n\treadonly restorePromise: Promise<AuthSnapshot | null> | null;\n\treadonly authEvents: EventStreamTrait<TokenSetAuthEvent>;\n\n\tprivate readonly cleanup: () => void;\n\tprivate disposed = false;\n\n\tconstructor(\n\t\t/** The underlying SDK client instance. */\n\t\treadonly client: TokenSetAngularClient,\n\t\tautoRestore: boolean,\n\t) {\n\t\tthis.authState = signal<AuthSnapshot | null>(null);\n\t\tthis.cleanup = bridgeToAngularSignal(client.state, this.authState);\n\t\tthis.authState$ = signalToObservable(client.state);\n\t\tthis.authEvents = client.authEvents;\n\t\tthis.restorePromise = autoRestore ? client.restorePersistedState() : null;\n\t}\n\n\t/** Whether the user is currently authenticated. */\n\tisAuthenticated(): boolean {\n\t\treturn this.accessToken() !== null;\n\t}\n\n\t/** Current access token, or null. */\n\taccessToken(): string | null {\n\t\tconst snapshot = this.authState();\n\t\tif (!isFreshOrUsable(snapshot)) {\n\t\t\treturn null;\n\t\t}\n\t\treturn snapshot?.tokens.accessToken ?? null;\n\t}\n\n\tasync ensureFreshAuthState(\n\t\toptions?: EnsureFreshAuthStateOptions,\n\t): Promise<AuthSnapshot | null> {\n\t\treturn await this.client.ensureFreshAuthState(options);\n\t}\n\n\tasync ensureAuthForResource(\n\t\toptions?: EnsureAuthForResourceOptions,\n\t): Promise<EnsureAuthForResourceResult> {\n\t\treturn await this.client.ensureAuthForResource(options);\n\t}\n\n\tasync ensureAccessToken(\n\t\toptions?: EnsureFreshAuthStateOptions,\n\t): Promise<string | null> {\n\t\treturn (\n\t\t\t(await this.ensureFreshAuthState(options))?.tokens.accessToken ?? null\n\t\t);\n\t}\n\n\tasync ensureAuthorizationHeader(\n\t\toptions?: EnsureAuthorizationHeaderOptions,\n\t): Promise<string | null> {\n\t\treturn await this.client.ensureAuthorizationHeader(options);\n\t}\n\n\t/**\n\t * Release all resources owned by this service.\n\t *\n\t * - Unsubscribes the SDK state bridge\n\t * - Calls `client.dispose()`\n\t *\n\t * Idempotent: subsequent calls are no-ops. Called by the shared registry\n\t * at teardown; adopters invoking TokenSetAuthService directly must call\n\t * this themselves (typically bound to `DestroyRef.onDestroy`).\n\t */\n\tdispose(): void {\n\t\tif (this.disposed) return;\n\t\tthis.disposed = true;\n\t\ttry {\n\t\t\tthis.cleanup();\n\t\t} catch {\n\t\t\t// Swallow — best effort.\n\t\t}\n\t\ttry {\n\t\t\tthis.client.dispose();\n\t\t} catch {\n\t\t\t// Swallow — best effort.\n\t\t}\n\t}\n}\n\nfunction isFreshOrUsable(snapshot: AuthSnapshot | null): boolean {\n\tconst freshness = getTokenFreshness(snapshot, {\n\t\tnow: Date.now(),\n\t\tclockSkewMs: 30_000,\n\t\trefreshWindowMs: 0,\n\t});\n\treturn (\n\t\tfreshness === TokenFreshnessState.Fresh ||\n\t\tfreshness === TokenFreshnessState.RefreshDue ||\n\t\tfreshness === TokenFreshnessState.NoExpiry\n\t);\n}\n","import { DestroyRef, Injectable, inject } from \"@angular/core\";\nimport type { EventStreamTrait } from \"@securitydept/client\";\nimport type { ClientReadinessState } from \"@securitydept/token-set-context-client/frontend-oidc-mode\";\nimport type {\n\tEnsureAuthForResourceResult,\n\tTokenSetAuthEvent,\n} from \"@securitydept/token-set-context-client/orchestration\";\nimport { attachTokenSetResumeReconciliation } from \"@securitydept/token-set-context-client/orchestration\";\nimport {\n\ttype ClientFilter,\n\ttype ClientKeySelector,\n\ttype ClientMeta,\n\ttype ClientQueryOptions,\n\ttype TokenSetAuthRegistry as CoreTokenSetAuthRegistry,\n\ttype TokenSetClientEntry as CoreTokenSetClientEntry,\n\tcreateTokenSetAuthRegistry,\n\ttype EnsureRegistryAuthForResourceOptions,\n} from \"@securitydept/token-set-context-client/registry\";\nimport type { TokenSetAngularClient, TokenSetClientEntry } from \"./contracts\";\nimport { TokenSetAuthService } from \"./token-set-auth.service\";\n\n// Re-export core registry types so existing adopter imports from\n// @securitydept/token-set-context-client-angular keep working.\nexport type {\n\tClientFilter,\n\tClientKeySelector,\n\tClientMeta,\n\tClientQueryOptions,\n\tEnsureRegistryAuthForResourceOptions,\n} from \"@securitydept/token-set-context-client/registry\";\nexport { ClientInitializationPriority } from \"@securitydept/token-set-context-client/registry\";\n\n// ============================================================================\n// TokenSetAuthRegistry — thin Angular DI wrapper around the framework-neutral\n// core at @securitydept/token-set-context-client/registry\n//\n// Iteration 110: the Angular registry used to own all multi-client state\n// directly. It now delegates to a `createTokenSetAuthRegistry()` core and\n// supplies Angular-idiomatic glue:\n//   - Injectable scope (root or provider-level)\n//   - DestroyRef-bound dispose (envelopes `coreRegistry.dispose()`)\n//   - Materialize callback wraps raw clients in `TokenSetAuthService`\n//   - access-token sugar routed through the service's signal\n// ============================================================================\n\ntype AngularClient = TokenSetAngularClient;\n\n@Injectable()\nexport class TokenSetAuthRegistry {\n\t/**\n\t * Shared framework-neutral registry core. Angular consumers rarely need\n\t * direct access, but this is exposed so adapter-internal helpers\n\t * (`CallbackResumeService`, `bearer-interceptor`) can query the core\n\t * directly when they don't need Angular-specific behaviour.\n\t */\n\treadonly core: CoreTokenSetAuthRegistry<AngularClient, TokenSetAuthService>;\n\treadonly authEvents: EventStreamTrait<TokenSetAuthEvent>;\n\n\tconstructor() {\n\t\tthis.core = createTokenSetAuthRegistry<AngularClient, TokenSetAuthService>({\n\t\t\tmaterialize: (client, entry) => {\n\t\t\t\tconst angularEntry = entry as TokenSetClientEntry;\n\t\t\t\tconst managedClient = attachTokenSetResumeReconciliation(client, {\n\t\t\t\t\tresumeReconciliation: angularEntry.resumeReconciliation,\n\t\t\t\t\tresumeReconciliationOptions: angularEntry.resumeReconciliationOptions,\n\t\t\t\t});\n\t\t\t\treturn new TokenSetAuthService(\n\t\t\t\t\tmanagedClient,\n\t\t\t\t\tentry.autoRestore ?? true,\n\t\t\t\t);\n\t\t\t},\n\t\t\tdispose: (service) => service.dispose(),\n\t\t\taccessTokenOf: (service) => service.accessToken(),\n\t\t\tensureAccessTokenOf: (service) => service.ensureAccessToken(),\n\t\t\tensureAuthorizationHeaderOf: (service) =>\n\t\t\t\tservice.ensureAuthorizationHeader(),\n\t\t\tensureAuthForResourceOf: (service, options) =>\n\t\t\t\tservice.ensureAuthForResource(options),\n\t\t\tauthEventsOf: (service) => service.authEvents,\n\t\t});\n\t\tthis.authEvents = this.core.authEvents;\n\t\t// Try to bind core.dispose() to the current injection context's\n\t\t// DestroyRef. Registry is typically constructed via DI (where this\n\t\t// always succeeds); pure unit tests instantiate directly and must\n\t\t// call `.dispose()` manually.\n\t\ttry {\n\t\t\tconst destroyRef = inject(DestroyRef);\n\t\t\tdestroyRef.onDestroy(() => this.core.dispose());\n\t\t} catch {\n\t\t\t// Not in an injection context — adopter is expected to call\n\t\t\t// registry.dispose() manually (or never, for short-lived tests).\n\t\t}\n\t}\n\n\t/**\n\t * Register a client entry. Supports sync / async / lazy priority.\n\t *\n\t * Iteration 110 change: the second `destroyRef` argument is no longer\n\t * required — the registry pulls its own `DestroyRef` via injection and\n\t * binds teardown once per Angular scope.\n\t */\n\tregister(\n\t\tentry: TokenSetClientEntry & {\n\t\t\tpriority?: \"primary\" | \"lazy\";\n\t\t\tclientFactory: () => AngularClient;\n\t\t},\n\t): TokenSetAuthService;\n\tregister(\n\t\tentry: TokenSetClientEntry & {\n\t\t\tpriority?: \"primary\" | \"lazy\";\n\t\t\tclientFactory: () => Promise<AngularClient>;\n\t\t},\n\t): Promise<TokenSetAuthService>;\n\tregister(\n\t\tentry: TokenSetClientEntry,\n\t): TokenSetAuthService | Promise<TokenSetAuthService> | undefined;\n\tregister(\n\t\tentry: TokenSetClientEntry,\n\t): TokenSetAuthService | Promise<TokenSetAuthService> | undefined {\n\t\treturn this.core.register(entry as CoreTokenSetClientEntry<AngularClient>);\n\t}\n\n\t/**\n\t * Manually dispose the registry. Normally bound to the ambient\n\t * `DestroyRef` at construction; call this explicitly when instantiating\n\t * the registry outside of an Angular injection context (e.g. in unit\n\t * tests).\n\t */\n\tdispose(): void {\n\t\tthis.core.dispose();\n\t}\n\n\t// --------------------------------------------------------------------------\n\t// Pass-through API (backwards-compatible with iteration 109 surface)\n\t// --------------------------------------------------------------------------\n\n\tisReady(key: string): boolean {\n\t\treturn this.core.isReady(key);\n\t}\n\n\treadinessState(key: string): ClientReadinessState {\n\t\treturn this.core.readinessState(key);\n\t}\n\n\tasync whenReady(key: string): Promise<TokenSetAuthService> {\n\t\treturn this.core.whenReady(key);\n\t}\n\n\t/**\n\t * Preload a lazy client without throwing on rejection. Callers are\n\t * expected to attach `.catch` handlers for fire-and-forget usage.\n\t */\n\tpreload(key: string): Promise<TokenSetAuthService> {\n\t\treturn this.core.preload(key);\n\t}\n\n\t/**\n\t * Schedule preload for every lazy+not-initialized client using\n\t * `requestIdleCallback` / `setTimeout` fallback.\n\t */\n\tidleWarmup(): () => void {\n\t\treturn this.core.idleWarmup();\n\t}\n\n\treset(key: string): void {\n\t\tthis.core.reset(key);\n\t}\n\n\tmetaFor(clientKey: string): ClientMeta | undefined {\n\t\treturn this.core.metaFor(clientKey);\n\t}\n\n\tget(key: string): TokenSetAuthService | undefined {\n\t\treturn this.core.get(key);\n\t}\n\n\trequire(key: string): TokenSetAuthService {\n\t\treturn this.core.require(key);\n\t}\n\n\tkeys(): string[] {\n\t\treturn this.core.keys();\n\t}\n\n\tentries(): Array<[string, TokenSetAuthService]> {\n\t\treturn this.core.entriesSnapshot();\n\t}\n\n\t// ---- URL / callback / requirement / provider-family discrimination -----\n\n\t*clientKeyGenForUrl(url: string): Generator<string, void, unknown> {\n\t\tyield* this.core.clientKeyGenForUrl(url);\n\t}\n\n\t*clientKeyGenForCallback(url: string): Generator<string, void, unknown> {\n\t\tyield* this.core.clientKeyGenForCallback(url);\n\t}\n\n\t*clientKeyGenForRequirement(\n\t\trequirementKind: string,\n\t): Generator<string, void, unknown> {\n\t\tyield* this.core.clientKeyGenForRequirement(requirementKind);\n\t}\n\n\t*clientKeyGenForProviderFamily(\n\t\tproviderFamily: string,\n\t): Generator<string, void, unknown> {\n\t\tyield* this.core.clientKeyGenForProviderFamily(providerFamily);\n\t}\n\n\tclientKeyListForUrl(url: string): string[] {\n\t\treturn this.core.clientKeyListForUrl(url);\n\t}\n\n\tclientKeyListForCallback(url: string): string[] {\n\t\treturn this.core.clientKeyListForCallback(url);\n\t}\n\n\tclientKeyListForRequirement(requirementKind: string): string[] {\n\t\treturn this.core.clientKeyListForRequirement(requirementKind);\n\t}\n\n\tclientKeyListForProviderFamily(providerFamily: string): string[] {\n\t\treturn this.core.clientKeyListForProviderFamily(providerFamily);\n\t}\n\n\tclientKeyForUrl(\n\t\turl: string,\n\t\tselector?: ClientKeySelector,\n\t): string | undefined {\n\t\treturn this.core.clientKeyForUrl(url, selector);\n\t}\n\n\tclientKeyForCallback(\n\t\turl: string,\n\t\tselector?: ClientKeySelector,\n\t): string | undefined {\n\t\treturn this.core.clientKeyForCallback(url, selector);\n\t}\n\n\tclientKeyForRequirement(\n\t\trequirementKind: string,\n\t\tselector?: ClientKeySelector,\n\t): string | undefined {\n\t\treturn this.core.clientKeyForRequirement(requirementKind, selector);\n\t}\n\n\tclientKeyForProviderFamily(\n\t\tproviderFamily: string,\n\t\tselector?: ClientKeySelector,\n\t): string | undefined {\n\t\treturn this.core.clientKeyForProviderFamily(providerFamily, selector);\n\t}\n\n\trequireForRequirement(\n\t\trequirementKind: string,\n\t\tselector?: ClientKeySelector,\n\t): TokenSetAuthService {\n\t\treturn this.core.requireForRequirement(requirementKind, selector);\n\t}\n\n\trequireForProviderFamily(\n\t\tproviderFamily: string,\n\t\tselector?: ClientKeySelector,\n\t): TokenSetAuthService {\n\t\treturn this.core.requireForProviderFamily(providerFamily, selector);\n\t}\n\n\t*clientKeyGenForFilter(\n\t\tfilter: ClientFilter,\n\t): Generator<string, void, unknown> {\n\t\tyield* this.core.clientKeyGenForFilter(filter);\n\t}\n\n\t*clientKeyGenForOptions(\n\t\toptions: ClientQueryOptions,\n\t): Generator<string, void, unknown> {\n\t\tyield* this.core.clientKeyGenForOptions(options);\n\t}\n\n\tclientKeysForOptions(options: ClientQueryOptions): string[] {\n\t\treturn this.core.clientKeysForOptions(options);\n\t}\n\n\taccessToken(key?: string): string | null {\n\t\treturn this.core.accessToken(key);\n\t}\n\n\tasync ensureAccessToken(key?: string): Promise<string | null> {\n\t\treturn await this.core.ensureAccessToken(key);\n\t}\n\n\tasync ensureAuthorizationHeader(key?: string): Promise<string | null> {\n\t\treturn await this.core.ensureAuthorizationHeader(key);\n\t}\n\n\tasync ensureAuthForResource(\n\t\toptions: EnsureRegistryAuthForResourceOptions = {},\n\t): Promise<EnsureAuthForResourceResult | null> {\n\t\treturn await this.core.ensureAuthForResource(options);\n\t}\n}\n","import {\n\tHTTP_INTERCEPTORS,\n\ttype HttpEvent,\n\ttype HttpHandler,\n\ttype HttpInterceptor,\n\ttype HttpRequest,\n} from \"@angular/common/http\";\nimport {\n\tInjectable,\n\tInjectionToken,\n\tinject,\n\ttype Provider,\n} from \"@angular/core\";\nimport { TokenSetAuthFlowSource } from \"@securitydept/token-set-context-client/orchestration\";\nimport { from, type Observable, switchMap } from \"rxjs\";\nimport { TokenSetAuthRegistry } from \"./token-set-auth-registry\";\n\n// ============================================================================\n// 7. Class-based HTTP interceptor + provider factory\n// ============================================================================\n\n/**\n * Adopter-tunable behaviour for the token-set bearer interceptor.\n *\n * Iteration 150 (review 1) lifted `strictUrlMatch` out of the implicit\n * single-client convenience path into an explicit option, so multi-backend\n * adopters can guarantee that bearer tokens never leak outside the URL\n * patterns they registered with `provideTokenSetAuth({ clients: [...] })`.\n */\nexport interface BearerInterceptorOptions {\n\t/**\n\t * When `true`, the interceptor injects a bearer header ONLY for requests\n\t * whose URL matches a registered client's `urlPatterns`. Requests with no\n\t * matching client receive no `Authorization` header even when a token is\n\t * available elsewhere in the registry.\n\t *\n\t * When `false` (default, single-client convenience), the interceptor\n\t * falls back to `registry.accessToken()` for unmatched URLs — useful only\n\t * when the host issues all HTTP traffic to one already-known backend.\n\t *\n\t * Adopters with more than one backend, more than one OIDC audience, or\n\t * any third-party HTTP traffic from the same Angular host MUST set this\n\t * to `true` to prevent cross-origin token leakage.\n\t *\n\t * @default false\n\t */\n\tstrictUrlMatch?: boolean;\n}\n\n/**\n * DI token for {@link BearerInterceptorOptions}. Adopters normally configure\n * options via `provideTokenSetBearerInterceptor({ ... })`; the token is\n * exported for advanced cases where the options need to be supplied or\n * overridden separately (for example, in tests).\n */\nexport const TOKEN_SET_BEARER_INTERCEPTOR_OPTIONS =\n\tnew InjectionToken<BearerInterceptorOptions>(\n\t\t\"TOKEN_SET_BEARER_INTERCEPTOR_OPTIONS\",\n\t);\n\n/**\n * Angular class-based bearer-token interceptor (`HTTP_INTERCEPTORS` style).\n *\n * Selects the correct access token from the multi-client registry by URL\n * pattern. Behaviour for unmatched URLs is governed by\n * {@link BearerInterceptorOptions.strictUrlMatch}.\n *\n * Prefer the functional version via `createTokenSetBearerInterceptor()` +\n * `withInterceptors()` when using `provideHttpClient`. Use this class-based\n * version when you need classic `HTTP_INTERCEPTORS` multi-provider style\n * (e.g. NgModule apps).\n *\n * @example\n * ```ts\n * // NgModule providers:\n * provideTokenSetBearerInterceptor({ strictUrlMatch: true })\n * ```\n */\n@Injectable()\nexport class TokenSetBearerInterceptor implements HttpInterceptor {\n\tprivate readonly registry = inject(TokenSetAuthRegistry);\n\tprivate readonly options: BearerInterceptorOptions =\n\t\tinject(TOKEN_SET_BEARER_INTERCEPTOR_OPTIONS, { optional: true }) ?? {};\n\n\tintercept(\n\t\treq: HttpRequest<unknown>,\n\t\tnext: HttpHandler,\n\t): Observable<HttpEvent<unknown>> {\n\t\tconst key = this.registry.clientKeyForUrl(req.url);\n\t\t// When a client key matches but the client is still initializing\n\t\t// (async clientFactory not yet resolved), registry.get() returns\n\t\t// undefined. This is an explicit design decision: interceptors do NOT\n\t\t// block the HTTP request waiting for client initialization.\n\t\t// Responsibility for \"ensure client is ready before making requests\"\n\t\t// belongs to route guards (which use whenReady() to await readiness).\n\t\t// A not-yet-ready client correctly produces no token → request proceeds\n\t\t// without Authorization header.\n\t\treturn from(\n\t\t\tresolveAuthorizationForRequest(this.registry, req.url, key, {\n\t\t\t\tstrictUrlMatch: this.options.strictUrlMatch,\n\t\t\t}),\n\t\t).pipe(\n\t\t\tswitchMap((authorization) => {\n\t\t\t\tif (!authorization) {\n\t\t\t\t\treturn next.handle(req);\n\t\t\t\t}\n\t\t\t\treturn next.handle(\n\t\t\t\t\treq.clone({ setHeaders: { Authorization: authorization } }),\n\t\t\t\t);\n\t\t\t}),\n\t\t);\n\t}\n}\n\n/**\n * Create an `HTTP_INTERCEPTORS` multi-provider entry for bearer token injection.\n *\n * Returns a single `Provider` object that registers {@link TokenSetBearerInterceptor}\n * as a class-based HTTP interceptor. Suitable for NgModule `providers` arrays.\n *\n * For functional-interceptor style (standalone apps using `provideHttpClient`),\n * use `createTokenSetBearerInterceptor()` with `withInterceptors()` instead.\n *\n * @example\n * ```ts\n * @NgModule({\n *   providers: [\n *     provideTokenSetAuth({ clients: [...] }),\n *     provideTokenSetBearerInterceptor(),     // <— replaces hand-written AuthInterceptor\n *     provideHttpClient(withInterceptorsFromDi()),\n *   ],\n * })\n * export class AppModule {}\n * ```\n */\n/**\n * Create an `HTTP_INTERCEPTORS` multi-provider entry for bearer token injection.\n *\n * Returns Angular providers that register {@link TokenSetBearerInterceptor}\n * as a class-based HTTP interceptor and (optionally) the\n * {@link BearerInterceptorOptions} that govern its URL-match behaviour.\n * Suitable for NgModule `providers` arrays.\n *\n * For functional-interceptor style (standalone apps using `provideHttpClient`),\n * use `createTokenSetBearerInterceptor()` with `withInterceptors()` instead.\n *\n * @example\n * ```ts\n * @NgModule({\n *   providers: [\n *     provideTokenSetAuth({ clients: [...] }),\n *     // Adopters with multiple backends or any third-party HTTP traffic\n *     // MUST opt into strictUrlMatch to prevent token leakage.\n *     provideTokenSetBearerInterceptor({ strictUrlMatch: true }),\n *     provideHttpClient(withInterceptorsFromDi()),\n *   ],\n * })\n * export class AppModule {}\n * ```\n */\nexport function provideTokenSetBearerInterceptor(\n\toptions?: BearerInterceptorOptions,\n): Provider[] {\n\tconst providers: Provider[] = [\n\t\t{\n\t\t\tprovide: HTTP_INTERCEPTORS,\n\t\t\tuseClass: TokenSetBearerInterceptor,\n\t\t\tmulti: true,\n\t\t},\n\t];\n\tif (options) {\n\t\tproviders.push({\n\t\t\tprovide: TOKEN_SET_BEARER_INTERCEPTOR_OPTIONS,\n\t\t\tuseValue: options,\n\t\t});\n\t}\n\treturn providers;\n}\n\n/**\n * Create an Angular `HttpInterceptorFn` that injects bearer authorization\n * headers, selecting the correct token from the multi-client registry\n * based on URL pattern matching.\n *\n * If no URL pattern matches, falls back to the first available token\n * (single-client convenience).\n *\n * ## Async client readiness\n *\n * The interceptor does **not** block or delay the HTTP request waiting for\n * an async client to materialize. If a client is still initializing when the\n * request fires, the request proceeds without an Authorization header.\n *\n * This is intentional: blocking HTTP for client initialization would deadlock\n * apps that make HTTP requests during initialization itself. Route guards\n * (which use `registry.whenReady()`) are the correct place to enforce\n * \"client must be ready before user reaches this route\".\n *\n * For NgModule-style apps using `HTTP_INTERCEPTORS`, use\n * `provideTokenSetBearerInterceptor()` instead.\n *\n * @example\n * ```ts\n * import { provideHttpClient, withInterceptors } from \"@angular/common/http\";\n * import { createTokenSetBearerInterceptor } from \"@securitydept/token-set-context-client-angular\";\n *\n * provideHttpClient(withInterceptors([\n *   createTokenSetBearerInterceptor(registry),\n * ]));\n * ```\n */\n/**\n * Create an Angular `HttpInterceptorFn` that injects bearer authorization\n * headers, selecting the correct token from the multi-client registry\n * based on URL pattern matching.\n *\n * If no URL pattern matches, the unmatched-URL behaviour is governed by\n * {@link BearerInterceptorOptions.strictUrlMatch}: the default falls back\n * to `registry.accessToken()` (single-client convenience), while\n * `strictUrlMatch: true` returns no token, ensuring bearer headers are\n * never injected for URLs outside the registered patterns.\n *\n * ## Async client readiness\n *\n * The interceptor does **not** block or delay the HTTP request waiting for\n * an async client to materialize. If a client is still initializing when the\n * request fires, the request proceeds without an Authorization header.\n *\n * This is intentional: blocking HTTP for client initialization would deadlock\n * apps that make HTTP requests during initialization itself. Route guards\n * (which use `registry.whenReady()`) are the correct place to enforce\n * \"client must be ready before user reaches this route\".\n *\n * For NgModule-style apps using `HTTP_INTERCEPTORS`, use\n * `provideTokenSetBearerInterceptor()` instead.\n *\n * @example\n * ```ts\n * import { provideHttpClient, withInterceptors } from \"@angular/common/http\";\n * import { createTokenSetBearerInterceptor } from \"@securitydept/token-set-context-client-angular\";\n *\n * provideHttpClient(withInterceptors([\n *   createTokenSetBearerInterceptor(registry, { strictUrlMatch: true }),\n * ]));\n * ```\n */\nexport function createTokenSetBearerInterceptor(\n\tregistry: TokenSetAuthRegistry,\n\toptions: BearerInterceptorOptions = {},\n) {\n\treturn (\n\t\treq: {\n\t\t\turl: string;\n\t\t\tclone(update: { setHeaders?: Record<string, string> }): unknown;\n\t\t},\n\t\tnext: (req: unknown) => Observable<unknown>,\n\t): Observable<unknown> => {\n\t\t// Try URL-pattern-based client selection first.\n\t\tconst key = registry.clientKeyForUrl(req.url);\n\t\t// Explicit not-yet-ready semantics: if the client exists in metadata\n\t\t// (via clientKeyForUrl) but registry.get() returns undefined because the\n\t\t// async clientFactory has not resolved yet, the request proceeds without\n\t\t// a token. See class-based interceptor above for full rationale.\n\t\treturn from(\n\t\t\tresolveAuthorizationForRequest(registry, req.url, key, options),\n\t\t).pipe(\n\t\t\tswitchMap((authorization) => {\n\t\t\t\tif (!authorization) {\n\t\t\t\t\treturn next(req);\n\t\t\t\t}\n\t\t\t\treturn next(\n\t\t\t\t\treq.clone({ setHeaders: { Authorization: authorization } }),\n\t\t\t\t);\n\t\t\t}),\n\t\t);\n\t};\n}\n\nasync function resolveAuthorizationForRequest(\n\tregistry: TokenSetAuthRegistry,\n\turl: string,\n\tkey: string | undefined,\n\toptions: BearerInterceptorOptions,\n): Promise<string | null> {\n\tif (!key && options.strictUrlMatch) {\n\t\treturn null;\n\t}\n\n\tconst result = await registry.ensureAuthForResource({\n\t\tkey,\n\t\twaitForReady: false,\n\t\tsource: TokenSetAuthFlowSource.HttpInterceptor,\n\t\tneedsAuthorizationHeader: true,\n\t\tforceRefreshWhenDue: true,\n\t\turl,\n\t});\n\treturn result?.authorizationHeader ?? null;\n}\n","import { Injectable, inject } from \"@angular/core\";\nimport type { AuthSnapshot } from \"@securitydept/token-set-context-client/orchestration\";\nimport { TokenSetAuthRegistry } from \"./token-set-auth-registry\";\n\n/**\n * Angular-native service for handling OIDC redirect callbacks,\n * with multi-client discrimination support.\n *\n * The post-authentication redirect URI is propagated automatically through\n * the core client's pending state (set via `loginWithRedirect({ postAuthRedirectUri })`\n * and recovered in `handleCallback()`). No manual URL storage is required.\n *\n * @example\n * ```ts\n * @Component({ ... })\n * export class AuthCallbackComponent {\n *   private readonly callbackService = inject(CallbackResumeService);\n *   private readonly router = inject(Router);\n *\n *   async ngOnInit() {\n *     const result = await this.callbackService.handleCallback(\n *       window.location.href,\n *     );\n *     this.router.navigateByUrl(result.resumeUrl, { replaceUrl: true });\n *   }\n * }\n * ```\n */\n@Injectable()\nexport class CallbackResumeService {\n\tprivate readonly registry = inject(TokenSetAuthRegistry);\n\n\t/**\n\t * Check whether a URL is an OIDC authorization callback for any registered\n\t * client in this registry.\n\t *\n\t * This is a convenience wrapper over `clientKeyForCallback()`. Use it for\n\t * programmatic early-exit guards (e.g. in a service constructor) before\n\t * calling `handleCallback()`.\n\t *\n\t * @param url - The full URL to check (e.g. `window.location.href`).\n\t * @returns `true` when the URL matches a registered callback path and\n\t *   contains an `code` or `error` query parameter.\n\t */\n\tisCallback(url: string): boolean {\n\t\treturn this.registry.clientKeyForCallback(url) !== undefined;\n\t}\n\n\t/**\n\t * Handle the OIDC callback, auto-detecting which client the callback\n\t * belongs to via registered callback paths.\n\t *\n\t * The `resumeUrl` in the result is taken directly from the core client's\n\t * pending state (`postAuthRedirectUri` set at `loginWithRedirect()` time),\n\t * falling back to `\"/\"` when no redirect URI was recorded.\n\t *\n\t * @param callbackUrl - The full current URL (e.g. `window.location.href`).\n\t * @param explicitClientKey - Optional: force-select a client key instead of\n\t *   auto-detecting from registered callback paths.\n\t */\n\tasync handleCallback(\n\t\tcallbackUrl: string,\n\t\texplicitClientKey?: string,\n\t): Promise<{\n\t\tclientKey: string;\n\t\tsnapshot: AuthSnapshot;\n\t\t/** The URL to navigate to after a successful callback. */\n\t\tresumeUrl: string;\n\t}> {\n\t\t// Determine which client this callback is for.\n\t\tconst clientKey =\n\t\t\texplicitClientKey ?? this.registry.clientKeyForCallback(callbackUrl);\n\t\tif (!clientKey) {\n\t\t\tthrow new Error(\n\t\t\t\t`[CallbackResumeService] Cannot determine which client this callback belongs to. ` +\n\t\t\t\t\t`URL: ${callbackUrl}. Register callbackPath in the client entry.`,\n\t\t\t);\n\t\t}\n\n\t\t// Use whenReady() — not require() — so that if the client's async\n\t\t// clientFactory is still in-flight when the callback page first loads,\n\t\t// we wait for it to materialize rather than throwing.\n\t\tconst service = await this.registry.whenReady(clientKey);\n\t\tconst result = await service.client.handleCallback(callbackUrl);\n\n\t\t// postAuthRedirectUri is recovered from the core client's pending state,\n\t\t// which was stored by authorizeUrl() when loginWithRedirect() was called.\n\t\treturn {\n\t\t\tclientKey,\n\t\t\tsnapshot: result.snapshot,\n\t\t\tresumeUrl: result.postAuthRedirectUri ?? \"/\",\n\t\t};\n\t}\n}\n","// ============================================================================\n// 8. Callback helper — OIDC redirect callback with multi-client discrimination\n// ============================================================================\n\n/**\n * Check whether the current URL is an OIDC authorization callback.\n */\nexport function isOidcCallback(options: {\n\tcurrentUrl: string;\n\tcallbackPath: string;\n}): boolean {\n\ttry {\n\t\tconst url = new URL(options.currentUrl);\n\t\tconst callbackUrl = new URL(options.callbackPath, url.origin);\n\t\treturn (\n\t\t\turl.pathname === callbackUrl.pathname &&\n\t\t\t(url.searchParams.has(\"code\") || url.searchParams.has(\"error\"))\n\t\t);\n\t} catch {\n\t\treturn false;\n\t}\n}\n","import { InjectionToken } from \"@angular/core\";\nimport type { TokenSetAuthRegistry } from \"./token-set-auth-registry\";\n\n/** InjectionToken for the multi-client auth registry. */\nexport const TOKEN_SET_AUTH_REGISTRY = new InjectionToken<TokenSetAuthRegistry>(\n\t\"TOKEN_SET_AUTH_REGISTRY\",\n);\n","import {\n\ttype EnvironmentProviders,\n\tinject,\n\ttype Provider,\n\tprovideEnvironmentInitializer,\n} from \"@angular/core\";\nimport { CallbackResumeService } from \"./callback-resume.service\";\nimport type { TokenSetClientEntry } from \"./contracts\";\nimport { TokenSetAuthRegistry } from \"./token-set-auth-registry\";\nimport { TOKEN_SET_AUTH_REGISTRY } from \"./tokens\";\n\n/**\n * Options for {@link provideTokenSetAuth}.\n */\nexport interface ProvideTokenSetAuthOptions {\n\t/**\n\t * Adapter/host registration entries.\n\t *\n\t * Each entry must have a unique `key`. The entry itself owns how one client\n\t * composes auth-context config and runtime capabilities; Angular DI here only\n\t * owns host registration, readiness wiring, and lifecycle.\n\t */\n\tclients: TokenSetClientEntry[];\n\t/**\n\t * When true (default), schedule `registry.idleWarmup()` during Angular\n\t * environment initialization so `priority: \"lazy\"` clients get\n\t * preloaded in the browser's idle callback.\n\t *\n\t * Disable for tests that want deterministic, manual materialization\n\t * control.\n\t *\n\t * @default true\n\t */\n\tidleWarmup?: boolean;\n}\n\n/**\n * Create Angular providers for the multi-client token-set auth integration.\n *\n * Registers all services into Angular DI so adopters can directly inject\n * `TokenSetAuthRegistry`, `CallbackResumeService`, and look up individual\n * `TokenSetAuthService` instances by key.\n *\n * ## Async client initialization\n *\n * When a client's `clientFactory` returns a `Promise` (e.g. because it\n * needs to fetch a config projection from a backend endpoint), the\n * registry tracks its initialization state automatically. Guards and\n * interceptors should use `registry.whenReady(key)` to await\n * materialization before accessing the service.\n *\n * Adapter-managed browser clients also install token-set page-resume\n * reconciliation by default during materialization. Set\n * `resumeReconciliation: false` on an individual client entry only when the\n * host intentionally owns equivalent browser lifecycle wiring.\n *\n * @example\n * ```ts\n * import { provideTokenSetAuth } from \"@securitydept/token-set-context-client-angular\";\n * import { resolveConfigProjection, networkConfigSource, createFrontendOidcModeClient }\n *   from \"@securitydept/token-set-context-client/frontend-oidc-mode\";\n *\n * export const appConfig = {\n *   providers: [\n *     provideTokenSetAuth({\n *       clients: [\n *         {\n *           key: \"main\",\n *           // Async clientFactory: fetches config projection from backend\n *           clientFactory: async () => {\n *             const resolved = await resolveConfigProjection([\n *               networkConfigSource({\n *                 apiEndpoint: \"https://api.example.com/api\",\n *                 redirectUri: `${location.origin}/auth/callback`,\n *               }),\n *             ]);\n *             return createFrontendOidcModeClient(resolved.config, runtime);\n *           },\n *           urlPatterns: [\"/api/\"],\n *           callbackPath: \"/auth/callback\",\n *           // Optional: opt out only if the host already wires equivalent\n *           // resume reconciliation for this browser client.\n *           // resumeReconciliation: false,\n *         },\n *       ],\n *     }),\n *   ],\n * };\n * ```\n */\nexport function provideTokenSetAuth(\n\toptions: ProvideTokenSetAuthOptions,\n): (Provider | EnvironmentProviders)[] {\n\treturn [\n\t\t// Registry is a singleton — all clients share one registry.\n\t\t{\n\t\t\tprovide: TokenSetAuthRegistry,\n\t\t\tuseFactory: () => new TokenSetAuthRegistry(),\n\t\t},\n\t\t// Eagerly register all client entries during environment initialization.\n\t\t// provideEnvironmentInitializer runs in injection context, so inject() works.\n\t\t// Note: async clientFactories create promises that the registry tracks;\n\t\t// the initializer does not block Angular bootstrap on them (guards/interceptors\n\t\t// use registry.whenReady() instead).\n\t\tprovideEnvironmentInitializer(() => {\n\t\t\tconst registry = inject(TokenSetAuthRegistry);\n\t\t\tfor (const entry of options.clients) {\n\t\t\t\tregistry.register(entry);\n\t\t\t}\n\t\t\tif (options.idleWarmup !== false) {\n\t\t\t\t// Kick off idle-time preload for any lazy clients. The cancel\n\t\t\t\t// handle is intentionally discarded — teardown happens through\n\t\t\t\t// the registry's own DestroyRef binding at dispose time.\n\t\t\t\tregistry.idleWarmup();\n\t\t\t}\n\t\t}),\n\t\t// Token for direct registry access.\n\t\t{\n\t\t\tprovide: TOKEN_SET_AUTH_REGISTRY,\n\t\t\tuseExisting: TokenSetAuthRegistry,\n\t\t},\n\t\t// Callback resume service.\n\t\tCallbackResumeService,\n\t];\n}\n","import {\n\tEnvironmentInjector,\n\tinject,\n\trunInInjectionContext,\n} from \"@angular/core\";\nimport type {\n\tActivatedRouteSnapshot,\n\tCanActivateFn,\n\tRouterStateSnapshot,\n\tUrlTree,\n} from \"@angular/router\";\nimport { Router } from \"@angular/router\";\nimport type {\n\tAuthGuardClientOption,\n\tAuthRequirement,\n\tPlannerHost,\n} from \"@securitydept/client/auth-coordination\";\nimport {\n\tAUTH_PLANNER_HOST,\n\textractFullRouteRequirements,\n} from \"@securitydept/client-angular\";\nimport {\n\ttype AuthSnapshot,\n\tTokenSetAuthFlowSource,\n} from \"@securitydept/token-set-context-client/orchestration\";\nimport { firstValueFrom, from, switchMap, take } from \"rxjs\";\nimport type { UnauthenticatedEntry } from \"./guard-types\";\nimport type { ClientMeta, ClientQueryOptions } from \"./token-set-auth-registry\";\nimport { TokenSetAuthRegistry } from \"./token-set-auth-registry\";\n\n// ============================================================================\n// Guard factory — createTokenSetRouteAggregationGuard() [LOWER-LEVEL ADVANCED]\n//\n// Canonical Angular Router auth pattern for multi-requirement coordination:\n//\n//   1. Declaration layer  — withRouteRequirements([...]) in route data\n//   2. Aggregation layer  — this guard walks pathFromRoot once and collects\n//                           the full requirement chain\n//   3. Decision layer     — planner host evaluates all candidates in one call\n//   4. Enforcement layer  — registry maps requirement.kind → client → action\n//\n// Fine-grained control is available via requirementPolicies[requirementId]:\n//   - selector.clientKey / selector.query override the default kind→client mapping\n//   - per-requirement onUnauthenticated takes precedence over kind handlers\n//\n// secureRouteRoot() / secureRoute() are the canonical adopter-facing path.\n// This guard remains available as the lower-level route-tree primitive.\n// ============================================================================\n\n// ---------------------------------------------------------------------------\n// Selector type — used in requirementPolicies to override client resolution\n// ---------------------------------------------------------------------------\n\n/**\n * How to select a token-set client from the registry for a specific requirement.\n *\n * Choose exactly one:\n * - `clientKey` — direct key lookup (explicit, single client)\n * - `query` — composite filter query ({@link ClientQueryOptions})\n */\nexport type TokenSetClientSelector =\n\t| { clientKey: string; query?: never }\n\t| { clientKey?: never; query: ClientQueryOptions };\n\n/**\n * Runtime context passed to unauthenticated route handlers.\n *\n * `attemptedUrl` is the Angular Router target URL for the navigation being\n * guarded. Use it as `postAuthRedirectUri`; do not read `Router.url` for this,\n * because Angular still exposes the currently active URL while a guard is\n * deciding whether the attempted navigation may proceed.\n */\nexport interface TokenSetRouteUnauthenticatedContext {\n\treadonly route: ActivatedRouteSnapshot;\n\treadonly state: RouterStateSnapshot;\n\treadonly attemptedUrl: string;\n}\n\nexport type TokenSetRouteUnauthenticatedHandler = (\n\tunauthenticated: ReadonlyArray<UnauthenticatedEntry>,\n\trequirement: AuthRequirement,\n\tcontext: TokenSetRouteUnauthenticatedContext,\n) => boolean | string | UrlTree | Promise<boolean | string | UrlTree>;\n\n// ---------------------------------------------------------------------------\n// Per-requirement policy\n// ---------------------------------------------------------------------------\n\n/**\n * Policy override for a specific requirement ID in\n * {@link CreateTokenSetRouteAggregationGuardOptions.requirementPolicies}.\n *\n * Allows fine-grained control per declared requirement:\n * - `selector` overrides the default kind→client registry lookup (use when\n *   you need a specific client key or a query instead of all clients of that kind).\n * - `onUnauthenticated` overrides both `requirementHandlers[kind]` and\n *   `defaultOnUnauthenticated` for this exact requirement.\n *\n * @example\n * ```ts\n * createTokenSetRouteAggregationGuard({\n *   requirementPolicies: {\n *     \"confluence-oidc\": {\n *       selector: { clientKey: \"confluence\" },\n *       onUnauthenticated: (_failing, _req, context) => {\n *         inject(AuthService)\n *           .redirectToLogin(\"confluence\", context.attemptedUrl)\n *           .subscribe();\n *         return false;\n *       },\n *     },\n *     \"admin-oidc\": {\n *       selector: { query: { providerFamily: \"internal-sso\" } },\n *       onUnauthenticated: () => \"/admin/login\",\n *     },\n *   },\n * })\n * ```\n */\nexport interface TokenSetRequirementPolicy {\n\t/**\n\t * Override the default kind→client registry lookup for this requirement.\n\t *\n\t * When omitted, the guard resolves clients via\n\t * `registry.clientKeyListForRequirement(requirement.kind)`.\n\t */\n\tselector?: TokenSetClientSelector;\n\n\t/**\n\t * Handler called when this requirement is selected as pending by the planner.\n\t *\n\t * Takes precedence over `requirementHandlers[kind]` and\n\t * `defaultOnUnauthenticated`.\n\t *\n\t * Return:\n\t *   - `true`  — allow navigation\n\t *   - `false` — block navigation\n\t *   - `string` — redirect URL path\n\t *   - `UrlTree` — Angular router tree\n\t */\n\tonUnauthenticated: TokenSetRouteUnauthenticatedHandler;\n}\n\n// ---------------------------------------------------------------------------\n// Guard options\n// ---------------------------------------------------------------------------\n\n/**\n * Options for {@link createTokenSetRouteAggregationGuard}.\n */\nexport interface CreateTokenSetRouteAggregationGuardOptions {\n\t/**\n\t * Per-requirement-id policies.\n\t *\n\t * Keys are `AuthRequirement.id` strings (not kind). Policies declared here\n\t * take precedence over {@link requirementHandlers} and\n\t * {@link defaultOnUnauthenticated}.\n\t *\n\t * Use this for fine-grained control:\n\t * - override client selection (specific key or composite query)\n\t * - per-requirement redirect behaviour\n\t * - multi-client / providerFamily selection per requirement\n\t *\n\t * @example\n\t * ```ts\n\t * createTokenSetRouteAggregationGuard({\n\t *   requirementPolicies: {\n\t *     \"confluence-oidc\": {\n\t *       selector: { clientKey: \"confluence\" },\n\t *       onUnauthenticated: () => \"/auth/confluence\",\n\t *     },\n\t *     \"admin-oidc\": {\n\t *       selector: { query: { providerFamily: \"internal-sso\" } },\n\t *       onUnauthenticated: () => \"/auth/admin\",\n\t *     },\n\t *   },\n\t * })\n\t * ```\n\t */\n\trequirementPolicies?: Record<string, TokenSetRequirementPolicy>;\n\n\t/**\n\t * Per-requirement-kind handlers.\n\t *\n\t * When the planner selects a pending requirement whose `kind` maps to an\n\t * entry here (and no `requirementPolicies[id]` is set), that handler is\n\t * called instead of `defaultOnUnauthenticated`.\n\t *\n\t * Keys are `AuthRequirement.kind` strings.\n\t *\n\t * @example\n\t * ```ts\n\t * createTokenSetRouteAggregationGuard({\n\t *   requirementHandlers: {\n\t *     frontend_oidc: (failing, _req, context) => {\n\t *       inject(AuthService)\n\t *         .redirectToLogin(failing[0].clientKey, context.attemptedUrl)\n\t *         .subscribe();\n\t *       return false;\n\t *     },\n\t *   },\n\t * })\n\t * ```\n\t */\n\trequirementHandlers?: Record<string, TokenSetRouteUnauthenticatedHandler>;\n\n\t/**\n\t * Fallback handler used when no `requirementPolicies[id]` or\n\t * `requirementHandlers[kind]` is found for the pending requirement.\n\t */\n\tdefaultOnUnauthenticated?: TokenSetRouteUnauthenticatedHandler;\n\n\t/**\n\t * Custom route data key for reading requirements from route segments.\n\t * @default \"authRequirements\"\n\t */\n\trequirementsKey?: string;\n\n\t/**\n\t * Inline planner-host instance. If provided, used instead of injecting\n\t * `AUTH_PLANNER_HOST` from Angular DI.\n\t */\n\tplannerHost?: PlannerHost;\n\n\t/**\n\t * Resolve the planner-host for the current target route chain.\n\t *\n\t * Use this when planner-host selection depends on route metadata or other\n\t * route-tree state. Takes precedence over `plannerHost` and DI lookup.\n\t */\n\tplannerHostResolver?: (\n\t\troute: ActivatedRouteSnapshot,\n\t\tstate: RouterStateSnapshot,\n\t) => PlannerHost | undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Guard factory\n// ---------------------------------------------------------------------------\n\n/**\n * Create an Angular `CanActivateFn` that performs full-route requirement\n * aggregation and single-pass planner evaluation.\n *\n * **Canonical Angular Router auth pattern** (route-metadata driven):\n * 1. Requirements are declared in route `data` using `withRouteRequirements()`.\n * 2. When the guard runs, it walks `route.pathFromRoot` to collect ALL\n *    requirements from every ancestor segment in a single pass.\n * 3. Each requirement's `kind` is mapped to one or more registry clients,\n *    unless overridden by a `requirementPolicies[id].selector`.\n * 4. The complete candidate set is handed to the `PlannerHost` for a\n *    single `evaluate()` call — the planner selects the first unresolved\n *    requirement and calls the matching handler.\n *\n * **Handler resolution order** (most specific wins):\n * 1. `requirementPolicies[requirement.id].onUnauthenticated`\n * 2. `requirementHandlers[requirement.kind]`\n * 3. `defaultOnUnauthenticated`\n * 4. Block navigation (`false`) if none of the above is provided.\n *\n * **Client resolution order** for a requirement:\n * 1. `requirementPolicies[requirement.id].selector.clientKey` — single explicit key\n * 2. `requirementPolicies[requirement.id].selector.query` — composite query\n * 3. `registry.clientKeyListForRequirement(requirement.kind)` — default mapping\n *\n * This model enables:\n *   - One-pass requirement collection (no per-segment DI scope accumulation)\n *   - One-call planner evaluation (chooser sees the full set at once)\n *   - One redirect decision (no per-segment guard coordination needed)\n *   - Fine-grained per-requirement policy via `requirementPolicies`\n *\n * @example\n * ```ts\n * // routes.ts — declare requirements in route data\n * import { withRouteRequirements } from \"@securitydept/client-angular\";\n * import {\n *   createFrontendOidcLoginRedirectHandler,\n *   createTokenSetRouteAggregationGuard,\n * } from \"@securitydept/token-set-context-client-angular\";\n *\n * // Simple — kind-level handler\n * const guard = createTokenSetRouteAggregationGuard({\n *   requirementHandlers: {\n *     frontend_oidc: createFrontendOidcLoginRedirectHandler({ clientKey: \"confluence\" }),\n *   },\n * });\n *\n * // Fine-grained — per-requirement policy\n * const guard = createTokenSetRouteAggregationGuard({\n *   requirementPolicies: {\n *     \"confluence-oidc\": {\n *       selector: { clientKey: \"confluence\" },\n *       onUnauthenticated: () => \"/auth/confluence\",\n *     },\n *     \"admin-oidc\": {\n *       selector: { query: { providerFamily: \"internal-sso\" } },\n *       onUnauthenticated: (failing) => \"/auth/admin\",\n *     },\n *   },\n * });\n *\n * export const routes: Routes = [\n *   {\n *     path: \"\",\n *     data: withRouteRequirements([{ id: \"session\", kind: \"session\" }]),\n *     children: [\n *       {\n *         path: \"confluence\",\n *         data: withRouteRequirements([{ id: \"confluence-oidc\", kind: \"frontend_oidc\" }]),\n *         canActivate: [guard],\n *       },\n *     ],\n *   },\n * ];\n * ```\n */\nexport function createTokenSetRouteAggregationGuard(\n\toptions: CreateTokenSetRouteAggregationGuardOptions = {},\n): CanActivateFn {\n\treturn async (route: ActivatedRouteSnapshot, state: RouterStateSnapshot) => {\n\t\tconst injector = inject(EnvironmentInjector);\n\t\tconst registry = inject(TokenSetAuthRegistry);\n\t\tconst router = inject(Router);\n\t\tconst handlerContext: TokenSetRouteUnauthenticatedContext = {\n\t\t\troute,\n\t\t\tstate,\n\t\t\tattemptedUrl: state.url,\n\t\t};\n\n\t\t// ── Resolve planner-host ────────────────────────────────────────────\n\t\tconst plannerHost =\n\t\t\toptions.plannerHostResolver?.(route, state) ??\n\t\t\toptions.plannerHost ??\n\t\t\tinject(AUTH_PLANNER_HOST, { optional: true });\n\n\t\tif (!plannerHost) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[createTokenSetRouteAggregationGuard] No PlannerHost found. \" +\n\t\t\t\t\t\"Provide AUTH_PLANNER_HOST via provideAuthPlannerHost() \" +\n\t\t\t\t\t\"in your app/route providers, or pass plannerHost inline.\",\n\t\t\t);\n\t\t}\n\n\t\t// ── Step 1: Full-route requirement aggregation ───────────────────────\n\t\tconst allRequirements = extractFullRouteRequirements(\n\t\t\troute,\n\t\t\toptions.requirementsKey,\n\t\t);\n\n\t\tif (allRequirements.length === 0) {\n\t\t\treturn true;\n\t\t}\n\n\t\t// ── Step 2: Map requirements → registry clients ──────────────────────\n\t\t// Per-requirement policy may override the default kind→client mapping.\n\t\tinterface ResolvedRequirementEntry {\n\t\t\trequirement: AuthRequirement;\n\t\t\tentries: UnauthenticatedEntry[];\n\t\t}\n\n\t\tconst resolvedRequirements: ResolvedRequirementEntry[] = [];\n\n\t\tfor (const req of allRequirements) {\n\t\t\tconst policy = options.requirementPolicies?.[req.id];\n\t\t\tlet clientKeys: string[];\n\n\t\t\tif (policy?.selector) {\n\t\t\t\t// Policy provides an explicit selector — use it instead of kind mapping.\n\t\t\t\tif (policy.selector.clientKey !== undefined) {\n\t\t\t\t\tclientKeys = [policy.selector.clientKey];\n\t\t\t\t} else {\n\t\t\t\t\tclientKeys = registry.clientKeysForOptions(policy.selector.query);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Default: resolve by requirement kind.\n\t\t\t\tclientKeys = registry.clientKeyListForRequirement(req.kind);\n\t\t\t}\n\n\t\t\tif (clientKeys.length === 0) {\n\t\t\t\t// No client for this requirement — skip (lets non-token-set requirements\n\t\t\t\t// coexist in the same route chain without breaking the guard).\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst entries: UnauthenticatedEntry[] = await Promise.all(\n\t\t\t\tclientKeys.map(async (key) => ({\n\t\t\t\t\t// Use whenReady() — not require() — so that if the client's\n\t\t\t\t\t// async clientFactory is still in-flight when the guard first\n\t\t\t\t\t// fires, we block here until it materializes rather than\n\t\t\t\t\t// crashing or silently bypassing auth.\n\t\t\t\t\tservice: await registry.whenReady(key),\n\t\t\t\t\tclientKey: key,\n\t\t\t\t\tmeta: registry.metaFor(key) as ClientMeta,\n\t\t\t\t})),\n\t\t\t);\n\n\t\t\tresolvedRequirements.push({ requirement: req, entries });\n\t\t}\n\n\t\tif (resolvedRequirements.length === 0) {\n\t\t\treturn true;\n\t\t}\n\n\t\t// ── Step 3: Build planner candidates ────────────────────────────────\n\t\t// De-duplicate by requirementId (last declaration for the same id wins).\n\t\tconst seenIds = new Map<string, ResolvedRequirementEntry>();\n\t\tfor (const r of resolvedRequirements) {\n\t\t\tseenIds.set(r.requirement.id, r);\n\t\t}\n\t\tconst deduped = [...seenIds.values()];\n\n\t\tconst candidates: Array<\n\t\t\tAuthGuardClientOption & { _resolved: ResolvedRequirementEntry }\n\t\t> = deduped.map((r) => ({\n\t\t\trequirementId: r.requirement.id,\n\t\t\trequirementKind: r.requirement.kind,\n\t\t\tlabel: r.requirement.label,\n\t\t\tattributes: r.requirement.attributes,\n\t\t\tcheckAuthenticated: () =>\n\t\t\t\tr.entries.every(({ service }) => service.isAuthenticated()),\n\t\t\tonUnauthenticated: async (): Promise<boolean | string> => {\n\t\t\t\tconst failing = r.entries.filter(\n\t\t\t\t\t({ service }) => !service.isAuthenticated(),\n\t\t\t\t);\n\t\t\t\t// Handler resolution: policy > kind handler > default\n\t\t\t\tconst handler =\n\t\t\t\t\toptions.requirementPolicies?.[r.requirement.id]?.onUnauthenticated ??\n\t\t\t\t\toptions.requirementHandlers?.[r.requirement.kind] ??\n\t\t\t\t\toptions.defaultOnUnauthenticated;\n\n\t\t\t\tif (!handler) return false;\n\n\t\t\t\tconst result = runUnauthenticatedHandlerInContext(\n\t\t\t\t\tinjector,\n\t\t\t\t\thandler,\n\t\t\t\t\tfailing,\n\t\t\t\t\tr.requirement,\n\t\t\t\t\thandlerContext,\n\t\t\t\t);\n\t\t\t\tconst resolved = await result;\n\t\t\t\tif (typeof resolved === \"string\") return resolved;\n\t\t\t\tif (typeof resolved === \"boolean\") return resolved;\n\t\t\t\treturn resolved.toString();\n\t\t\t},\n\t\t\t_resolved: r,\n\t\t}));\n\n\t\t// ── Step 4: Single planner evaluation ───────────────────────────────\n\t\tconst decide = async (): Promise<boolean | UrlTree> => {\n\t\t\tconst result = await plannerHost.evaluate(candidates);\n\n\t\t\tif (result.allAuthenticated) return true;\n\n\t\t\tif (result.pendingCandidate) {\n\t\t\t\tconst candidate = result.pendingCandidate as AuthGuardClientOption & {\n\t\t\t\t\t_resolved: ResolvedRequirementEntry;\n\t\t\t\t};\n\t\t\t\tconst failing = candidate._resolved.entries.filter(\n\t\t\t\t\t({ service }) => !service.isAuthenticated(),\n\t\t\t\t);\n\t\t\t\t// Handler resolution: policy > kind handler > default\n\t\t\t\tconst handler =\n\t\t\t\t\toptions.requirementPolicies?.[candidate._resolved.requirement.id]\n\t\t\t\t\t\t?.onUnauthenticated ??\n\t\t\t\t\toptions.requirementHandlers?.[candidate._resolved.requirement.kind] ??\n\t\t\t\t\toptions.defaultOnUnauthenticated;\n\n\t\t\t\tif (!handler) return false;\n\n\t\t\t\tconst action = await runUnauthenticatedHandlerInContext(\n\t\t\t\t\tinjector,\n\t\t\t\t\thandler,\n\t\t\t\t\tfailing,\n\t\t\t\t\tcandidate._resolved.requirement,\n\t\t\t\t\thandlerContext,\n\t\t\t\t);\n\t\t\t\tif (typeof action === \"string\") return router.parseUrl(action);\n\t\t\t\tif (typeof action === \"boolean\") return action;\n\t\t\t\treturn action;\n\t\t\t}\n\n\t\t\treturn false;\n\t\t};\n\n\t\t// ── Restore-aware: wait for all pending restores ─────────────────────\n\t\tconst pendingRestores = deduped\n\t\t\t.flatMap((r) => r.entries)\n\t\t\t.map(({ service }) => service.restorePromise)\n\t\t\t.filter((p): p is Promise<AuthSnapshot | null> => p !== null);\n\t\tasync function awaitAuthMaterial(): Promise<void> {\n\t\t\tawait Promise.all(pendingRestores);\n\t\t\tconst freshnessBarriers = deduped\n\t\t\t\t.flatMap((r) =>\n\t\t\t\t\tr.entries.map((entry) => ({\n\t\t\t\t\t\t...entry,\n\t\t\t\t\t\trequirement: r.requirement,\n\t\t\t\t\t})),\n\t\t\t\t)\n\t\t\t\t.map(({ service, clientKey, meta, requirement }) =>\n\t\t\t\t\tservice.ensureAuthForResource({\n\t\t\t\t\t\tsource: TokenSetAuthFlowSource.RouteGuard,\n\t\t\t\t\t\tclientKey,\n\t\t\t\t\t\trequirement: { id: requirement.id, kind: requirement.kind },\n\t\t\t\t\t\tproviderFamily: meta.providerFamily,\n\t\t\t\t\t\turl: state.url,\n\t\t\t\t\t\tforceRefreshWhenDue: true,\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\tawait Promise.all(freshnessBarriers);\n\t\t}\n\n\t\tif (deduped.every((r) => r.entries.length === 0)) {\n\t\t\treturn decide();\n\t\t}\n\n\t\t// await the restore-phase Observable before running planner evaluation\n\t\t// so the async guard always returns a Promise, not an Observable.\n\t\treturn firstValueFrom(\n\t\t\tfrom(awaitAuthMaterial()).pipe(\n\t\t\t\tswitchMap(() => from(decide())),\n\t\t\t\ttake(1),\n\t\t\t),\n\t\t);\n\t};\n}\n\nfunction runUnauthenticatedHandlerInContext(\n\tinjector: EnvironmentInjector,\n\thandler: TokenSetRouteUnauthenticatedHandler,\n\tunauthenticated: ReadonlyArray<UnauthenticatedEntry>,\n\trequirement: AuthRequirement,\n\tcontext: TokenSetRouteUnauthenticatedContext,\n): boolean | string | UrlTree | Promise<boolean | string | UrlTree> {\n\treturn runInInjectionContext(injector, () =>\n\t\thandler(unauthenticated, requirement, context),\n\t);\n}\n\n/**\n * Build an Angular route-security handler that starts frontend-oidc login and\n * records the attempted navigation URL as `postAuthRedirectUri`.\n *\n * Use this instead of reading `Router.url` inside a guard handler. During guard\n * execution Angular has not committed the attempted navigation yet, so\n * `Router.url` still points at the previously active page.\n *\n * After the browser redirect is started, the returned guard result intentionally\n * never settles. That keeps Angular from finalizing the rejected in-app\n * navigation while the page is already leaving for an external IdP.\n */\nexport function createFrontendOidcLoginRedirectHandler(options?: {\n\t/**\n\t * Explicit client key. When omitted, the first failing registry entry is\n\t * used, which is the common one-client-per-requirement case.\n\t */\n\tclientKey?: string;\n\t/**\n\t * Fallback used only when Angular does not provide a target URL.\n\t * @default \"/\"\n\t */\n\tfallbackPostAuthRedirectUri?: string;\n}): TokenSetRouteUnauthenticatedHandler {\n\treturn async (unauthenticated, _requirement, context) => {\n\t\tconst clientKey = options?.clientKey ?? unauthenticated[0]?.clientKey;\n\t\tif (!clientKey) return false;\n\n\t\tconst registry = inject(TokenSetAuthRegistry);\n\t\tconst service = await registry.whenReady(clientKey);\n\t\tif (!isLoginWithRedirectClient(service.client)) return false;\n\n\t\tawait service.client.loginWithRedirect({\n\t\t\tpostAuthRedirectUri:\n\t\t\t\tcontext.attemptedUrl || options?.fallbackPostAuthRedirectUri || \"/\",\n\t\t});\n\t\treturn await neverSettlingRedirectGuardResult();\n\t};\n}\n\nfunction neverSettlingRedirectGuardResult(): Promise<never> {\n\treturn new Promise<never>(() => {\n\t\t// Intentionally never resolves: a full-page browser redirect is in progress.\n\t});\n}\n\ninterface LoginWithRedirectClient {\n\tloginWithRedirect(options?: { postAuthRedirectUri?: string }): Promise<void>;\n}\n\nfunction isLoginWithRedirectClient(\n\tclient: unknown,\n): client is LoginWithRedirectClient {\n\treturn (\n\t\ttypeof client === \"object\" &&\n\t\tclient !== null &&\n\t\t\"loginWithRedirect\" in client &&\n\t\ttypeof client.loginWithRedirect === \"function\"\n\t);\n}\n","import type {\n\tActivatedRouteSnapshot,\n\tCanActivateChildFn,\n\tRoute,\n\tRouterStateSnapshot,\n} from \"@angular/router\";\nimport type {\n\tAuthRequirement,\n\tPlannerHost,\n\tRequirementsClientSetComposition,\n} from \"@securitydept/client/auth-coordination\";\nimport { withRouteRequirements } from \"@securitydept/client-angular\";\nimport type {\n\tCreateTokenSetRouteAggregationGuardOptions,\n\tTokenSetRequirementPolicy,\n} from \"./route-aggregation-guard\";\nimport { createTokenSetRouteAggregationGuard } from \"./route-aggregation-guard\";\n\n/**\n * Route data key for choosing a planner-host registered at the route root.\n */\nexport const TOKEN_SET_ROUTE_PLANNER_HOST_KEY_DATA_KEY =\n\t\"tokenSetPlannerHostKey\";\n\n/**\n * Serializable route-level security declaration.\n *\n * This object is safe to embed in Angular route metadata. Non-serializable\n * runtime policy (planner host instances, callbacks, chooser implementations)\n * belongs in {@link SecureRouteRootSecurityOptions}.\n */\nexport interface SecureRouteSecurityOptions {\n\t/**\n\t * Requirements declared at this route segment.\n\t * @default []\n\t */\n\trequirements?: AuthRequirement[];\n\n\t/**\n\t * How this segment composes with ancestor route requirements.\n\t * @default merge\n\t */\n\tcomposition?: RequirementsClientSetComposition;\n\n\t/**\n\t * Serializable lookup key for a planner-host provided by the root route.\n\t *\n\t * The nearest declared key on the active route chain wins.\n\t */\n\tplannerHostKey?: string;\n}\n\n/**\n * Root-level runtime policy for a secured route tree.\n *\n * Everything here is intentionally non-serializable and lives outside route\n * metadata. Child `secureRoute()` calls only reference these policies by\n * serializable keys / requirement ids.\n */\nexport interface SecureRouteRootSecurityOptions\n\textends SecureRouteSecurityOptions,\n\t\tOmit<\n\t\t\tCreateTokenSetRouteAggregationGuardOptions,\n\t\t\t\"plannerHost\" | \"plannerHostResolver\"\n\t\t> {\n\t/**\n\t * Named planner-host instances available to the secured route tree.\n\t */\n\tplannerHosts?: Record<string, PlannerHost>;\n\n\t/**\n\t * Fallback planner-host key when no route segment declares one.\n\t */\n\tdefaultPlannerHostKey?: string;\n}\n\ntype SecureRouteOptions = Omit<Route, \"path\" | \"data\"> & {\n\tdata?: Record<string, unknown>;\n};\n\n/**\n * Build a secured child route declaration.\n *\n * The returned route contains only serializable metadata:\n * requirements, composition strategy, planner-host lookup key, and any extra\n * route data the caller provides.\n */\nexport function secureRoute(\n\tpath: string,\n\tsecurityOptions: SecureRouteSecurityOptions = {},\n\trouteOptions: SecureRouteOptions = {},\n): Route {\n\tconst data = withRouteRequirements(securityOptions.requirements ?? [], {\n\t\tcomposition: securityOptions.composition,\n\t\textra: {\n\t\t\t...(routeOptions.data ?? {}),\n\t\t\t...(securityOptions.plannerHostKey\n\t\t\t\t? {\n\t\t\t\t\t\t[TOKEN_SET_ROUTE_PLANNER_HOST_KEY_DATA_KEY]:\n\t\t\t\t\t\t\tsecurityOptions.plannerHostKey,\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t},\n\t});\n\n\treturn {\n\t\t...routeOptions,\n\t\tpath,\n\t\tdata,\n\t};\n}\n\n/**\n * Build a secured route-tree root.\n *\n * This is the canonical Angular adopter entry for token-set route security:\n * root-level runtime policy stays here, child routes use {@link secureRoute}\n * for serializable declarations only.\n */\nexport function secureRouteRoot(\n\tpath: string,\n\tsecurityOptions: SecureRouteRootSecurityOptions = {},\n\trouteOptions: SecureRouteOptions = {},\n): Route {\n\tconst canActivate = createTokenSetRouteAggregationGuard({\n\t\trequirementPolicies: securityOptions.requirementPolicies,\n\t\trequirementHandlers: securityOptions.requirementHandlers,\n\t\tdefaultOnUnauthenticated: securityOptions.defaultOnUnauthenticated,\n\t\trequirementsKey: securityOptions.requirementsKey,\n\t\tplannerHostResolver: (route, state) =>\n\t\t\tresolvePlannerHostForRoute(route, state, securityOptions),\n\t});\n\tconst canActivateChild = createCanActivateChildAdapter(canActivate);\n\tconst baseRoute = secureRoute(path, securityOptions, routeOptions);\n\n\treturn {\n\t\t...baseRoute,\n\t\tcanActivate: [canActivate, ...(routeOptions.canActivate ?? [])],\n\t\tcanActivateChild: [\n\t\t\tcanActivateChild,\n\t\t\t...(routeOptions.canActivateChild ?? []),\n\t\t],\n\t};\n}\n\n/**\n * Alias with a token-set-specific name for callers who prefer explicit imports.\n */\nexport const secureTokenSetRoute = secureRoute;\n\n/**\n * Alias with a token-set-specific name for callers who prefer explicit imports.\n */\nexport const secureTokenSetRouteRoot = secureRouteRoot;\n\nfunction createCanActivateChildAdapter(\n\tcanActivate: ReturnType<typeof createTokenSetRouteAggregationGuard>,\n): CanActivateChildFn {\n\treturn (childRoute, state) => canActivate(childRoute, state);\n}\n\nfunction resolvePlannerHostForRoute(\n\troute: ActivatedRouteSnapshot,\n\t_state: RouterStateSnapshot,\n\tsecurityOptions: SecureRouteRootSecurityOptions,\n): PlannerHost | undefined {\n\tconst plannerHostKey =\n\t\tfindNearestPlannerHostKey(route) ?? securityOptions.defaultPlannerHostKey;\n\n\tif (plannerHostKey) {\n\t\tconst resolved = securityOptions.plannerHosts?.[plannerHostKey];\n\t\tif (!resolved) {\n\t\t\tthrow new Error(\n\t\t\t\t`[secureRouteRoot] No planner host registered for key \"${plannerHostKey}\"`,\n\t\t\t);\n\t\t}\n\t\treturn resolved;\n\t}\n\n\treturn undefined;\n}\n\nfunction findNearestPlannerHostKey(\n\troute: ActivatedRouteSnapshot,\n): string | undefined {\n\tconst chain = route.pathFromRoot ?? [route];\n\tfor (let index = chain.length - 1; index >= 0; index -= 1) {\n\t\tconst segment = chain[index];\n\t\tif (!segment) continue;\n\t\tconst raw =\n\t\t\tsegment.data[TOKEN_SET_ROUTE_PLANNER_HOST_KEY_DATA_KEY] ??\n\t\t\tsegment.routeConfig?.data?.[TOKEN_SET_ROUTE_PLANNER_HOST_KEY_DATA_KEY];\n\t\tif (typeof raw === \"string\" && raw.length > 0) {\n\t\t\treturn raw;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nexport type { TokenSetRequirementPolicy };\n","import { Component, inject, type OnInit } from \"@angular/core\";\nimport { Router } from \"@angular/router\";\nimport { CallbackResumeService } from \"./callback-resume.service\";\n\n// ============================================================================\n// 9. TokenSetCallbackComponent — drop-in standalone callback route component\n// ============================================================================\n\n/**\n * Drop-in standalone Angular component for OIDC redirect callback routes.\n *\n * Handles the full callback lifecycle on initialization:\n *   1. Calls `CallbackResumeService.handleCallback()` with the current URL.\n *   2. Navigates to `result.resumeUrl` (the post-auth redirect set at login time).\n *   3. On error: logs and falls back to navigating to `\"/\"`.\n *\n * Register as a route component — no additional glue needed:\n * ```ts\n * import { TokenSetCallbackComponent } from \"@securitydept/token-set-context-client-angular\";\n *\n * export const routes: Routes = [\n *   { path: \"auth/callback\", component: TokenSetCallbackComponent },\n * ];\n * ```\n *\n * For custom error handling or UI, subclass this component or build your own\n * using `CallbackResumeService` directly.\n */\n@Component({\n\tselector: \"token-set-callback\",\n\tstandalone: true,\n\ttemplate: \"\",\n})\nexport class TokenSetCallbackComponent implements OnInit {\n\tprivate readonly callbackService = inject(CallbackResumeService);\n\tprivate readonly router = inject(Router);\n\n\tngOnInit(): void {\n\t\tconst currentUrl = window.location.href;\n\t\tif (!this.callbackService.isCallback(currentUrl)) {\n\t\t\t// Not a callback URL — navigate home to avoid processing errors.\n\t\t\tthis.router.navigateByUrl(\"/\", { replaceUrl: true });\n\t\t\treturn;\n\t\t}\n\n\t\tthis.callbackService\n\t\t\t.handleCallback(currentUrl)\n\t\t\t.then((result) => {\n\t\t\t\tthis.router.navigateByUrl(result.resumeUrl, { replaceUrl: true });\n\t\t\t})\n\t\t\t.catch((error: unknown) => {\n\t\t\t\tconsole.error(\n\t\t\t\t\t\"[TokenSetCallbackComponent] Callback handling failed:\",\n\t\t\t\t\terror,\n\t\t\t\t);\n\t\t\t\tthis.router.navigateByUrl(\"/\", { replaceUrl: true });\n\t\t\t});\n\t}\n}\n","// Angular integration family for @securitydept/token-set-context-client\n//\n// Canonical import path:\n//   import { ... } from \"@securitydept/token-set-context-client-angular\"\n//\n// Multi-client-first Angular-native adapter surface:\n//   - Keyed client registration via provideTokenSetAuth()\n//   - Multi-client lookup via TokenSetAuthRegistry\n//   - Per-client TokenSetAuthService with signal + RxJS bridge\n//   - Multi-client bearer interceptor (functional + class-based)\n//   - provideTokenSetBearerInterceptor() for NgModule HTTP_INTERCEPTORS setup\n//   - OIDC callback resume with client key discrimination\n//   - CallbackResumeService.isCallback() for programmatic callback detection\n//   - TokenSetCallbackComponent standalone component (drop-in callback route)\n//   - Requirement/provider-family → client key mapping\n//   - secureRouteRoot() / secureRoute() — canonical Angular Router route-security\n//     builders: keep non-serializable runtime policy at the root, let child\n//     routes declare serializable requirement metadata only, and wire both\n//     canActivate + canActivateChild to the full-route aggregation guard.\n//   - createTokenSetRouteAggregationGuard() — lower-level advanced guard for\n//     direct route-tree evaluation when adopters intentionally bypass the route\n//     builder helpers.\n//   - Signal/Observable bridge utilities live in @securitydept/client-angular\n//\n// Built by ng-packagr (APF / FESM2022). Decorators are fully supported.\n//\n// Stability: provisional (framework adapter)\n\nexport * from \"./bearer-interceptor\";\nexport * from \"./callback-resume.service\";\nexport * from \"./contracts\";\nexport * from \"./guard-types\";\nexport * from \"./oidc-callback-url\";\nexport * from \"./provide-token-set-auth\";\nexport * from \"./route-aggregation-guard\";\nexport * from \"./secure-routes\";\nexport * from \"./token-set-auth.service\";\nexport * from \"./token-set-auth-registry\";\nexport * from \"./token-set-callback.component\";\nexport * from \"./tokens\";\n","/*\n * Public API Surface of @securitydept/token-set-context-client-angular\n */\n\nexport * from \"./lib\";\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":[],"mappings":";;;;;;;;;;AAmBA;AACA;AACA;AAEA;;;;;;;;;AASG;MACU,mBAAmB,CAAA;AAcrB,IAAA,MAAA;;AAZD,IAAA,SAAS;;AAET,IAAA,UAAU;;AAEV,IAAA,cAAc;AACd,IAAA,UAAU;AAEF,IAAA,OAAO;IAChB,QAAQ,GAAG,KAAK;AAExB,IAAA,WAAA;;AAEU,IAAA,MAA6B,EACtC,WAAoB,EAAA;QADX,IAAA,CAAA,MAAM,GAAN,MAAM;AAGf,QAAA,IAAI,CAAC,SAAS,GAAG,MAAM,CAAsB,IAAI,gFAAC;AAClD,QAAA,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;QAClE,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,QAAA,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU;AACnC,QAAA,IAAI,CAAC,cAAc,GAAG,WAAW,GAAG,MAAM,CAAC,qBAAqB,EAAE,GAAG,IAAI;IAC1E;;IAGA,eAAe,GAAA;AACd,QAAA,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI;IACnC;;IAGA,WAAW,GAAA;AACV,QAAA,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE;AACjC,QAAA,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE;AAC/B,YAAA,OAAO,IAAI;QACZ;AACA,QAAA,OAAO,QAAQ,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;IAC5C;IAEA,MAAM,oBAAoB,CACzB,OAAqC,EAAA;QAErC,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC;IACvD;IAEA,MAAM,qBAAqB,CAC1B,OAAsC,EAAA;QAEtC,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC;IACxD;IAEA,MAAM,iBAAiB,CACtB,OAAqC,EAAA;AAErC,QAAA,QACC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI;IAExE;IAEA,MAAM,yBAAyB,CAC9B,OAA0C,EAAA;QAE1C,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC;IAC5D;AAEA;;;;;;;;;AASG;IACH,OAAO,GAAA;QACN,IAAI,IAAI,CAAC,QAAQ;YAAE;AACnB,QAAA,IAAI,CAAC,QAAQ,GAAG,IAAI;AACpB,QAAA,IAAI;YACH,IAAI,CAAC,OAAO,EAAE;QACf;AAAE,QAAA,MAAM;;QAER;AACA,QAAA,IAAI;AACH,YAAA,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;QACtB;AAAE,QAAA,MAAM;;QAER;IACD;AACA;AAED,SAAS,eAAe,CAAC,QAA6B,EAAA;AACrD,IAAA,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE;AAC7C,QAAA,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;AACf,QAAA,WAAW,EAAE,MAAM;AACnB,QAAA,eAAe,EAAE,CAAC;AAClB,KAAA,CAAC;AACF,IAAA,QACC,SAAS,KAAK,mBAAmB,CAAC,KAAK;QACvC,SAAS,KAAK,mBAAmB,CAAC,UAAU;AAC5C,QAAA,SAAS,KAAK,mBAAmB,CAAC,QAAQ;AAE5C;;MCtFa,oBAAoB,CAAA;AAChC;;;;;AAKG;AACM,IAAA,IAAI;AACJ,IAAA,UAAU;AAEnB,IAAA,WAAA,GAAA;AACC,QAAA,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAqC;AAC1E,YAAA,WAAW,EAAE,CAAC,MAAM,EAAE,KAAK,KAAI;gBAC9B,MAAM,YAAY,GAAG,KAA4B;AACjD,gBAAA,MAAM,aAAa,GAAG,kCAAkC,CAAC,MAAM,EAAE;oBAChE,oBAAoB,EAAE,YAAY,CAAC,oBAAoB;oBACvD,2BAA2B,EAAE,YAAY,CAAC,2BAA2B;AACrE,iBAAA,CAAC;gBACF,OAAO,IAAI,mBAAmB,CAC7B,aAAa,EACb,KAAK,CAAC,WAAW,IAAI,IAAI,CACzB;YACF,CAAC;YACD,OAAO,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE;YACvC,aAAa,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE;YACjD,mBAAmB,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,iBAAiB,EAAE;YAC7D,2BAA2B,EAAE,CAAC,OAAO,KACpC,OAAO,CAAC,yBAAyB,EAAE;AACpC,YAAA,uBAAuB,EAAE,CAAC,OAAO,EAAE,OAAO,KACzC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC;YACvC,YAAY,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,UAAU;AAC7C,SAAA,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU;;;;;AAKtC,QAAA,IAAI;AACH,YAAA,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;AACrC,YAAA,UAAU,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD;AAAE,QAAA,MAAM;;;QAGR;IACD;AAwBA,IAAA,QAAQ,CACP,KAA0B,EAAA;QAE1B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAA+C,CAAC;IAC3E;AAEA;;;;;AAKG;IACH,OAAO,GAAA;AACN,QAAA,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;IACpB;;;;AAMA,IAAA,OAAO,CAAC,GAAW,EAAA;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC9B;AAEA,IAAA,cAAc,CAAC,GAAW,EAAA;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;IACrC;IAEA,MAAM,SAAS,CAAC,GAAW,EAAA;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAChC;AAEA;;;AAGG;AACH,IAAA,OAAO,CAAC,GAAW,EAAA;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC9B;AAEA;;;AAGG;IACH,UAAU,GAAA;AACT,QAAA,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;IAC9B;AAEA,IAAA,KAAK,CAAC,GAAW,EAAA;AAChB,QAAA,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;IACrB;AAEA,IAAA,OAAO,CAAC,SAAiB,EAAA;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;IACpC;AAEA,IAAA,GAAG,CAAC,GAAW,EAAA;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1B;AAEA,IAAA,OAAO,CAAC,GAAW,EAAA;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC9B;IAEA,IAAI,GAAA;AACH,QAAA,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;IACxB;IAEA,OAAO,GAAA;AACN,QAAA,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;IACnC;;IAIA,CAAC,kBAAkB,CAAC,GAAW,EAAA;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACzC;IAEA,CAAC,uBAAuB,CAAC,GAAW,EAAA;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;IAC9C;IAEA,CAAC,0BAA0B,CAC1B,eAAuB,EAAA;QAEvB,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC;IAC7D;IAEA,CAAC,6BAA6B,CAC7B,cAAsB,EAAA;QAEtB,OAAO,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC;IAC/D;AAEA,IAAA,mBAAmB,CAAC,GAAW,EAAA;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;IAC1C;AAEA,IAAA,wBAAwB,CAAC,GAAW,EAAA;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;IAC/C;AAEA,IAAA,2BAA2B,CAAC,eAAuB,EAAA;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,eAAe,CAAC;IAC9D;AAEA,IAAA,8BAA8B,CAAC,cAAsB,EAAA;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC;IAChE;IAEA,eAAe,CACd,GAAW,EACX,QAA4B,EAAA;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;IAChD;IAEA,oBAAoB,CACnB,GAAW,EACX,QAA4B,EAAA;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC;IACrD;IAEA,uBAAuB,CACtB,eAAuB,EACvB,QAA4B,EAAA;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,eAAe,EAAE,QAAQ,CAAC;IACpE;IAEA,0BAA0B,CACzB,cAAsB,EACtB,QAA4B,EAAA;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,cAAc,EAAE,QAAQ,CAAC;IACtE;IAEA,qBAAqB,CACpB,eAAuB,EACvB,QAA4B,EAAA;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,EAAE,QAAQ,CAAC;IAClE;IAEA,wBAAwB,CACvB,cAAsB,EACtB,QAA4B,EAAA;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,cAAc,EAAE,QAAQ,CAAC;IACpE;IAEA,CAAC,qBAAqB,CACrB,MAAoB,EAAA;QAEpB,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;IAC/C;IAEA,CAAC,sBAAsB,CACtB,OAA2B,EAAA;QAE3B,OAAO,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;IACjD;AAEA,IAAA,oBAAoB,CAAC,OAA2B,EAAA;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;IAC/C;AAEA,IAAA,WAAW,CAAC,GAAY,EAAA;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAClC;IAEA,MAAM,iBAAiB,CAAC,GAAY,EAAA;QACnC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;IAC9C;IAEA,MAAM,yBAAyB,CAAC,GAAY,EAAA;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;IACtD;AAEA,IAAA,MAAM,qBAAqB,CAC1B,OAAA,GAAgD,EAAE,EAAA;QAElD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;IACtD;uGA5PY,oBAAoB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;2GAApB,oBAAoB,EAAA,CAAA;;2FAApB,oBAAoB,EAAA,UAAA,EAAA,CAAA;kBADhC;;;ACED;;;;;AAKG;MACU,oCAAoC,GAChD,IAAI,cAAc,CACjB,sCAAsC;AAGxC;;;;;;;;;;;;;;;;;AAiBG;MAEU,yBAAyB,CAAA;AACpB,IAAA,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC;AACvC,IAAA,OAAO,GACvB,MAAM,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE;IAEvE,SAAS,CACR,GAAyB,EACzB,IAAiB,EAAA;AAEjB,QAAA,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;;;;;;;;;AASlD,QAAA,OAAO,IAAI,CACV,8BAA8B,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;AAC3D,YAAA,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;SAC3C,CAAC,CACF,CAAC,IAAI,CACL,SAAS,CAAC,CAAC,aAAa,KAAI;YAC3B,IAAI,CAAC,aAAa,EAAE;AACnB,gBAAA,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB;AACA,YAAA,OAAO,IAAI,CAAC,MAAM,CACjB,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAC3D;QACF,CAAC,CAAC,CACF;IACF;uGAhCY,yBAAyB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;2GAAzB,yBAAyB,EAAA,CAAA;;2FAAzB,yBAAyB,EAAA,UAAA,EAAA,CAAA;kBADrC;;AAoCD;;;;;;;;;;;;;;;;;;;;AAoBG;AACH;;;;;;;;;;;;;;;;;;;;;;;;AAwBG;AACG,SAAU,gCAAgC,CAC/C,OAAkC,EAAA;AAElC,IAAA,MAAM,SAAS,GAAe;AAC7B,QAAA;AACC,YAAA,OAAO,EAAE,iBAAiB;AAC1B,YAAA,QAAQ,EAAE,yBAAyB;AACnC,YAAA,KAAK,EAAE,IAAI;AACX,SAAA;KACD;IACD,IAAI,OAAO,EAAE;QACZ,SAAS,CAAC,IAAI,CAAC;AACd,YAAA,OAAO,EAAE,oCAAoC;AAC7C,YAAA,QAAQ,EAAE,OAAO;AACjB,SAAA,CAAC;IACH;AACA,IAAA,OAAO,SAAS;AACjB;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCG;SACa,+BAA+B,CAC9C,QAA8B,EAC9B,UAAoC,EAAE,EAAA;AAEtC,IAAA,OAAO,CACN,GAGC,EACD,IAA2C,KACnB;;QAExB,MAAM,GAAG,GAAG,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;;;;;QAK7C,OAAO,IAAI,CACV,8BAA8B,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAC/D,CAAC,IAAI,CACL,SAAS,CAAC,CAAC,aAAa,KAAI;YAC3B,IAAI,CAAC,aAAa,EAAE;AACnB,gBAAA,OAAO,IAAI,CAAC,GAAG,CAAC;YACjB;AACA,YAAA,OAAO,IAAI,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAC3D;QACF,CAAC,CAAC,CACF;AACF,IAAA,CAAC;AACF;AAEA,eAAe,8BAA8B,CAC5C,QAA8B,EAC9B,GAAW,EACX,GAAuB,EACvB,OAAiC,EAAA;AAEjC,IAAA,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE;AACnC,QAAA,OAAO,IAAI;IACZ;AAEA,IAAA,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC;QACnD,GAAG;AACH,QAAA,YAAY,EAAE,KAAK;QACnB,MAAM,EAAE,sBAAsB,CAAC,eAAe;AAC9C,QAAA,wBAAwB,EAAE,IAAI;AAC9B,QAAA,mBAAmB,EAAE,IAAI;QACzB,GAAG;AACH,KAAA,CAAC;AACF,IAAA,OAAO,MAAM,EAAE,mBAAmB,IAAI,IAAI;AAC3C;;ACrSA;;;;;;;;;;;;;;;;;;;;;;;AAuBG;MAEU,qBAAqB,CAAA;AAChB,IAAA,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC;AAExD;;;;;;;;;;;AAWG;AACH,IAAA,UAAU,CAAC,GAAW,EAAA;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS;IAC7D;AAEA;;;;;;;;;;;AAWG;AACH,IAAA,MAAM,cAAc,CACnB,WAAmB,EACnB,iBAA0B,EAAA;;AAQ1B,QAAA,MAAM,SAAS,GACd,iBAAiB,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,WAAW,CAAC;QACrE,IAAI,CAAC,SAAS,EAAE;YACf,MAAM,IAAI,KAAK,CACd,CAAA,gFAAA,CAAkF;gBACjF,CAAA,KAAA,EAAQ,WAAW,CAAA,4CAAA,CAA8C,CAClE;QACF;;;;QAKA,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC;;;QAI/D,OAAO;YACN,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;AACzB,YAAA,SAAS,EAAE,MAAM,CAAC,mBAAmB,IAAI,GAAG;SAC5C;IACF;uGA/DY,qBAAqB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;2GAArB,qBAAqB,EAAA,CAAA;;2FAArB,qBAAqB,EAAA,UAAA,EAAA,CAAA;kBADjC;;;AC5BD;AACA;AACA;AAEA;;AAEG;AACG,SAAU,cAAc,CAAC,OAG9B,EAAA;AACA,IAAA,IAAI;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;AACvC,QAAA,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC;AAC7D,QAAA,QACC,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;AACrC,aAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEjE;AAAE,IAAA,MAAM;AACP,QAAA,OAAO,KAAK;IACb;AACD;;AClBA;MACa,uBAAuB,GAAG,IAAI,cAAc,CACxD,yBAAyB;;AC+B1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDG;AACG,SAAU,mBAAmB,CAClC,OAAmC,EAAA;IAEnC,OAAO;;AAEN,QAAA;AACC,YAAA,OAAO,EAAE,oBAAoB;AAC7B,YAAA,UAAU,EAAE,MAAM,IAAI,oBAAoB,EAAE;AAC5C,SAAA;;;;;;QAMD,6BAA6B,CAAC,MAAK;AAClC,YAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC;AAC7C,YAAA,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE;AACpC,gBAAA,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzB;AACA,YAAA,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE;;;;gBAIjC,QAAQ,CAAC,UAAU,EAAE;YACtB;AACD,QAAA,CAAC,CAAC;;AAEF,QAAA;AACC,YAAA,OAAO,EAAE,uBAAuB;AAChC,YAAA,WAAW,EAAE,oBAAoB;AACjC,SAAA;;QAED,qBAAqB;KACrB;AACF;;ACgHA;AACA;AACA;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2EG;AACG,SAAU,mCAAmC,CAClD,OAAA,GAAsD,EAAE,EAAA;AAExD,IAAA,OAAO,OAAO,KAA6B,EAAE,KAA0B,KAAI;AAC1E,QAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC;AAC5C,QAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC;AAC7C,QAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAC7B,QAAA,MAAM,cAAc,GAAwC;YAC3D,KAAK;YACL,KAAK;YACL,YAAY,EAAE,KAAK,CAAC,GAAG;SACvB;;QAGD,MAAM,WAAW,GAChB,OAAO,CAAC,mBAAmB,GAAG,KAAK,EAAE,KAAK,CAAC;AAC3C,YAAA,OAAO,CAAC,WAAW;YACnB,MAAM,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAE9C,IAAI,CAAC,WAAW,EAAE;YACjB,MAAM,IAAI,KAAK,CACd,8DAA8D;gBAC7D,yDAAyD;AACzD,gBAAA,0DAA0D,CAC3D;QACF;;QAGA,MAAM,eAAe,GAAG,4BAA4B,CACnD,KAAK,EACL,OAAO,CAAC,eAAe,CACvB;AAED,QAAA,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE;AACjC,YAAA,OAAO,IAAI;QACZ;QASA,MAAM,oBAAoB,GAA+B,EAAE;AAE3D,QAAA,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE;YAClC,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,GAAG,CAAC,EAAE,CAAC;AACpD,YAAA,IAAI,UAAoB;AAExB,YAAA,IAAI,MAAM,EAAE,QAAQ,EAAE;;gBAErB,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE;oBAC5C,UAAU,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACzC;qBAAO;oBACN,UAAU,GAAG,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAClE;YACD;iBAAO;;gBAEN,UAAU,GAAG,QAAQ,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC;YAC5D;AAEA,YAAA,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE;;;gBAG5B;YACD;AAEA,YAAA,MAAM,OAAO,GAA2B,MAAM,OAAO,CAAC,GAAG,CACxD,UAAU,CAAC,GAAG,CAAC,OAAO,GAAG,MAAM;;;;;AAK9B,gBAAA,OAAO,EAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;AACtC,gBAAA,SAAS,EAAE,GAAG;AACd,gBAAA,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAe;aACzC,CAAC,CAAC,CACH;YAED,oBAAoB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACzD;AAEA,QAAA,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE;AACtC,YAAA,OAAO,IAAI;QACZ;;;AAIA,QAAA,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC;AAC3D,QAAA,KAAK,MAAM,CAAC,IAAI,oBAAoB,EAAE;YACrC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC;QACA,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAErC,MAAM,UAAU,GAEZ,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AACvB,YAAA,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE;AAC/B,YAAA,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI;AACnC,YAAA,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK;AAC1B,YAAA,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU;YACpC,kBAAkB,EAAE,MACnB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5D,iBAAiB,EAAE,YAAsC;gBACxD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAC/B,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAC3C;;AAED,gBAAA,MAAM,OAAO,GACZ,OAAO,CAAC,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,iBAAiB;oBAClE,OAAO,CAAC,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;oBACjD,OAAO,CAAC,wBAAwB;AAEjC,gBAAA,IAAI,CAAC,OAAO;AAAE,oBAAA,OAAO,KAAK;AAE1B,gBAAA,MAAM,MAAM,GAAG,kCAAkC,CAChD,QAAQ,EACR,OAAO,EACP,OAAO,EACP,CAAC,CAAC,WAAW,EACb,cAAc,CACd;AACD,gBAAA,MAAM,QAAQ,GAAG,MAAM,MAAM;gBAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ;AAAE,oBAAA,OAAO,QAAQ;gBACjD,IAAI,OAAO,QAAQ,KAAK,SAAS;AAAE,oBAAA,OAAO,QAAQ;AAClD,gBAAA,OAAO,QAAQ,CAAC,QAAQ,EAAE;YAC3B,CAAC;AACD,YAAA,SAAS,EAAE,CAAC;AACZ,SAAA,CAAC,CAAC;;AAGH,QAAA,MAAM,MAAM,GAAG,YAAuC;YACrD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAErD,IAAI,MAAM,CAAC,gBAAgB;AAAE,gBAAA,OAAO,IAAI;AAExC,YAAA,IAAI,MAAM,CAAC,gBAAgB,EAAE;AAC5B,gBAAA,MAAM,SAAS,GAAG,MAAM,CAAC,gBAExB;gBACD,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CACjD,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAC3C;;AAED,gBAAA,MAAM,OAAO,GACZ,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;AAC/D,sBAAE,iBAAiB;oBACpB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC;oBACnE,OAAO,CAAC,wBAAwB;AAEjC,gBAAA,IAAI,CAAC,OAAO;AAAE,oBAAA,OAAO,KAAK;AAE1B,gBAAA,MAAM,MAAM,GAAG,MAAM,kCAAkC,CACtD,QAAQ,EACR,OAAO,EACP,OAAO,EACP,SAAS,CAAC,SAAS,CAAC,WAAW,EAC/B,cAAc,CACd;gBACD,IAAI,OAAO,MAAM,KAAK,QAAQ;AAAE,oBAAA,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC9D,IAAI,OAAO,MAAM,KAAK,SAAS;AAAE,oBAAA,OAAO,MAAM;AAC9C,gBAAA,OAAO,MAAM;YACd;AAEA,YAAA,OAAO,KAAK;AACb,QAAA,CAAC;;QAGD,MAAM,eAAe,GAAG;aACtB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO;aACxB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc;aAC3C,MAAM,CAAC,CAAC,CAAC,KAAwC,CAAC,KAAK,IAAI,CAAC;AAC9D,QAAA,eAAe,iBAAiB,GAAA;AAC/B,YAAA,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAClC,MAAM,iBAAiB,GAAG;AACxB,iBAAA,OAAO,CAAC,CAAC,CAAC,KACV,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM;AACzB,gBAAA,GAAG,KAAK;gBACR,WAAW,EAAE,CAAC,CAAC,WAAW;AAC1B,aAAA,CAAC,CAAC;AAEH,iBAAA,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAC9C,OAAO,CAAC,qBAAqB,CAAC;gBAC7B,MAAM,EAAE,sBAAsB,CAAC,UAAU;gBACzC,SAAS;AACT,gBAAA,WAAW,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE;gBAC3D,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,GAAG,EAAE,KAAK,CAAC,GAAG;AACd,gBAAA,mBAAmB,EAAE,IAAI;AACzB,aAAA,CAAC,CACF;AACF,YAAA,MAAM,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACrC;AAEA,QAAA,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE;YACjD,OAAO,MAAM,EAAE;QAChB;;;AAIA,QAAA,OAAO,cAAc,CACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAC7B,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAC/B,IAAI,CAAC,CAAC,CAAC,CACP,CACD;AACF,IAAA,CAAC;AACF;AAEA,SAAS,kCAAkC,CAC1C,QAA6B,EAC7B,OAA4C,EAC5C,eAAoD,EACpD,WAA4B,EAC5B,OAA4C,EAAA;AAE5C,IAAA,OAAO,qBAAqB,CAAC,QAAQ,EAAE,MACtC,OAAO,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,CAAC,CAC9C;AACF;AAEA;;;;;;;;;;;AAWG;AACG,SAAU,sCAAsC,CAAC,OAWtD,EAAA;IACA,OAAO,OAAO,eAAe,EAAE,YAAY,EAAE,OAAO,KAAI;AACvD,QAAA,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,SAAS;AACrE,QAAA,IAAI,CAAC,SAAS;AAAE,YAAA,OAAO,KAAK;AAE5B,QAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;AACnD,QAAA,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC;AAAE,YAAA,OAAO,KAAK;AAE5D,QAAA,MAAM,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACtC,mBAAmB,EAClB,OAAO,CAAC,YAAY,IAAI,OAAO,EAAE,2BAA2B,IAAI,GAAG;AACpE,SAAA,CAAC;QACF,OAAO,MAAM,gCAAgC,EAAE;AAChD,IAAA,CAAC;AACF;AAEA,SAAS,gCAAgC,GAAA;AACxC,IAAA,OAAO,IAAI,OAAO,CAAQ,MAAK;;AAE/B,IAAA,CAAC,CAAC;AACH;AAMA,SAAS,yBAAyB,CACjC,MAAe,EAAA;AAEf,IAAA,QACC,OAAO,MAAM,KAAK,QAAQ;AAC1B,QAAA,MAAM,KAAK,IAAI;AACf,QAAA,mBAAmB,IAAI,MAAM;AAC7B,QAAA,OAAO,MAAM,CAAC,iBAAiB,KAAK,UAAU;AAEhD;;ACnkBA;;AAEG;AACI,MAAM,yCAAyC,GACrD;AA0DD;;;;;;AAMG;AACG,SAAU,WAAW,CAC1B,IAAY,EACZ,eAAA,GAA8C,EAAE,EAChD,YAAA,GAAmC,EAAE,EAAA;IAErC,MAAM,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,YAAY,IAAI,EAAE,EAAE;QACtE,WAAW,EAAE,eAAe,CAAC,WAAW;AACxC,QAAA,KAAK,EAAE;AACN,YAAA,IAAI,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,IAAI,eAAe,CAAC;AACnB,kBAAE;AACA,oBAAA,CAAC,yCAAyC,GACzC,eAAe,CAAC,cAAc;AAC/B;kBACA,EAAE,CAAC;AACN,SAAA;AACD,KAAA,CAAC;IAEF,OAAO;AACN,QAAA,GAAG,YAAY;QACf,IAAI;QACJ,IAAI;KACJ;AACF;AAEA;;;;;;AAMG;AACG,SAAU,eAAe,CAC9B,IAAY,EACZ,eAAA,GAAkD,EAAE,EACpD,YAAA,GAAmC,EAAE,EAAA;IAErC,MAAM,WAAW,GAAG,mCAAmC,CAAC;QACvD,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;QACxD,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;QACxD,wBAAwB,EAAE,eAAe,CAAC,wBAAwB;QAClE,eAAe,EAAE,eAAe,CAAC,eAAe;AAChD,QAAA,mBAAmB,EAAE,CAAC,KAAK,EAAE,KAAK,KACjC,0BAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC;AAC1D,KAAA,CAAC;AACF,IAAA,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,WAAW,CAAC;IACnE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,YAAY,CAAC;IAElE,OAAO;AACN,QAAA,GAAG,SAAS;AACZ,QAAA,WAAW,EAAE,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;AAC/D,QAAA,gBAAgB,EAAE;YACjB,gBAAgB;AAChB,YAAA,IAAI,YAAY,CAAC,gBAAgB,IAAI,EAAE,CAAC;AACxC,SAAA;KACD;AACF;AAEA;;AAEG;AACI,MAAM,mBAAmB,GAAG;AAEnC;;AAEG;AACI,MAAM,uBAAuB,GAAG;AAEvC,SAAS,6BAA6B,CACrC,WAAmE,EAAA;AAEnE,IAAA,OAAO,CAAC,UAAU,EAAE,KAAK,KAAK,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC;AAC7D;AAEA,SAAS,0BAA0B,CAClC,KAA6B,EAC7B,MAA2B,EAC3B,eAA+C,EAAA;IAE/C,MAAM,cAAc,GACnB,yBAAyB,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,qBAAqB;IAE1E,IAAI,cAAc,EAAE;QACnB,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,GAAG,cAAc,CAAC;QAC/D,IAAI,CAAC,QAAQ,EAAE;AACd,YAAA,MAAM,IAAI,KAAK,CACd,yDAAyD,cAAc,CAAA,CAAA,CAAG,CAC1E;QACF;AACA,QAAA,OAAO,QAAQ;IAChB;AAEA,IAAA,OAAO,SAAS;AACjB;AAEA,SAAS,yBAAyB,CACjC,KAA6B,EAAA;IAE7B,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC;AAC3C,IAAA,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;AAC1D,QAAA,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;AAC5B,QAAA,IAAI,CAAC,OAAO;YAAE;AACd,QAAA,MAAM,GAAG,GACR,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC;YACvD,OAAO,CAAC,WAAW,EAAE,IAAI,GAAG,yCAAyC,CAAC;QACvE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;AAC9C,YAAA,OAAO,GAAG;QACX;IACD;AACA,IAAA,OAAO,SAAS;AACjB;;ACjMA;AACA;AACA;AAEA;;;;;;;;;;;;;;;;;;;AAmBG;MAMU,yBAAyB,CAAA;AACpB,IAAA,eAAe,GAAG,MAAM,CAAC,qBAAqB,CAAC;AAC/C,IAAA,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAExC,QAAQ,GAAA;AACP,QAAA,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI;QACvC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;;AAEjD,YAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YACpD;QACD;AAEA,QAAA,IAAI,CAAC;aACH,cAAc,CAAC,UAAU;AACzB,aAAA,IAAI,CAAC,CAAC,MAAM,KAAI;AAChB,YAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAClE,QAAA,CAAC;AACA,aAAA,KAAK,CAAC,CAAC,KAAc,KAAI;AACzB,YAAA,OAAO,CAAC,KAAK,CACZ,uDAAuD,EACvD,KAAK,CACL;AACD,YAAA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACrD,QAAA,CAAC,CAAC;IACJ;uGAxBY,yBAAyB,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA;AAAzB,IAAA,OAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,yBAAyB,8EAF3B,EAAE,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA;;2FAEA,yBAAyB,EAAA,UAAA,EAAA,CAAA;kBALrC,SAAS;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,QAAQ,EAAE,oBAAoB;AAC9B,oBAAA,UAAU,EAAE,IAAI;AAChB,oBAAA,QAAQ,EAAE,EAAE;AACZ,iBAAA;;;AChCD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AC1BA;;AAEG;;ACFH;;AAEG;;;;"}
+{"version":3,"file":"securitydept-token-set-context-client-angular.mjs","sources":["../../src/lib/client-registry.ts","../../src/lib/auth-coordination/planner-host.ts","../../src/lib/auth-coordination/secure-routes.ts","../../src/lib/client-registry-authorization.interceptor.ts","../../src/lib/components/backend-callback.component.ts","../../src/lib/components/frontend-callback.component.ts","../../src/lib/index.ts","../../src/public-api.ts","../../src/securitydept-token-set-context-client-angular.ts"],"sourcesContent":["import { InjectionToken, type Provider } from \"@angular/core\";\nimport { type FoundationEnvironment } from \"@securitydept/client\";\nimport {\n\tENVIRONMENT,\n\tprovideEnvironmentProvider,\n} from \"@securitydept/client-angular\";\nimport { type BaseOidcModeClient } from \"@securitydept/token-set-context-client/orchestration\";\nimport {\n\tTOKEN_SET_CLIENT_REGISTRY as CORE_TOKEN_SET_CLIENT_REGISTRY,\n\ttype ProvideTokenSetClientRegistryOptions,\n\tprovideTokenSetClientRegistry as provideCoreTokenSetClientRegistry,\n\ttype TokenSetClientRegistry,\n} from \"@securitydept/token-set-context-client/registry\";\n\nexport const TOKEN_SET_CLIENT_REGISTRY = new InjectionToken<\n\tTokenSetClientRegistry<BaseOidcModeClient>\n>(\"TOKEN_SET_CLIENT_REGISTRY\");\n\nexport { type ProvideTokenSetClientRegistryOptions };\n\nexport function provideTokenSetClientRegistry(\n\toptions: ProvideTokenSetClientRegistryOptions = {},\n): Provider[] {\n\treturn [\n\t\t...provideCoreTokenSetClientRegistry(options).map(\n\t\t\tprovideEnvironmentProvider,\n\t\t),\n\t\t{\n\t\t\tprovide: TOKEN_SET_CLIENT_REGISTRY,\n\t\t\tuseFactory: (environment: FoundationEnvironment) =>\n\t\t\t\tenvironment.injector.get(CORE_TOKEN_SET_CLIENT_REGISTRY),\n\t\t\tdeps: [ENVIRONMENT],\n\t\t},\n\t];\n}\n","// Token-set requirement planner host — Angular DI adapter over core registry auth coordination\n\nimport {\n\ttype EnvironmentProviders,\n\tinject,\n\tmakeEnvironmentProviders,\n} from \"@angular/core\";\nimport {\n\tREQUIREMENT_PLANNER_HOST,\n\ttype RequirementPlannerHost,\n\ttype RouteBehaviourContextExtra,\n\tSecuritydeptInjector,\n} from \"@securitydept/client\";\nimport {\n\tENVIRONMENT,\n\tSECURITYDEPT_INJECTOR,\n} from \"@securitydept/client-angular\";\nimport { type BaseOidcModeClient } from \"@securitydept/token-set-context-client/orchestration\";\nimport {\n\tTokenSetClientRegistryPlannerHost,\n\tTokenSetClientRegistryRequirementBehaviour,\n\ttype TokenSetClientRegistryRequirementBehaviourOptions,\n\ttype TokenSetClientRegistryRouteRequirementBehaviourShape,\n} from \"@securitydept/token-set-context-client/registry\";\nimport { TOKEN_SET_CLIENT_REGISTRY } from \"../client-registry\";\n\n/** Options for {@link provideTokenSetRequirementPlannerHost}. */\nexport type ProvideTokenSetRequirementPlannerHostOptions =\n\tTokenSetClientRegistryRequirementBehaviourOptions<\n\t\tBaseOidcModeClient,\n\t\tRouteBehaviourContextExtra\n\t>;\n\n/**\n * Provide registry-backed requirement behaviour for Angular guards.\n *\n * This is intentionally a thin adapter over the framework-neutral registry\n * auth-coordination layer. Route requirements must carry\n * `attributes.query: TokenSetClientQueryOptions`.\n */\nexport function provideTokenSetRequirementPlannerHost(\n\toptions: ProvideTokenSetRequirementPlannerHostOptions = {},\n): EnvironmentProviders {\n\treturn makeEnvironmentProviders([\n\t\t{\n\t\t\tprovide: SECURITYDEPT_INJECTOR,\n\t\t\tuseFactory: (): SecuritydeptInjector => {\n\t\t\t\tconst registry = inject(TOKEN_SET_CLIENT_REGISTRY);\n\t\t\t\tconst environment = inject(ENVIRONMENT);\n\t\t\t\tconst parentInjector =\n\t\t\t\t\tinject(SECURITYDEPT_INJECTOR, {\n\t\t\t\t\t\toptional: true,\n\t\t\t\t\t\tskipSelf: true,\n\t\t\t\t\t}) ?? undefined;\n\t\t\t\tconst parent = (parentInjector?.get(REQUIREMENT_PLANNER_HOST, null) ??\n\t\t\t\t\tundefined) as\n\t\t\t\t\t| RequirementPlannerHost<TokenSetClientRegistryRouteRequirementBehaviourShape>\n\t\t\t\t\t| undefined;\n\t\t\t\tconst behaviour = new TokenSetClientRegistryRequirementBehaviour<\n\t\t\t\t\tBaseOidcModeClient,\n\t\t\t\t\tRouteBehaviourContextExtra\n\t\t\t\t>(registry, options);\n\t\t\t\tconst host = new TokenSetClientRegistryPlannerHost<\n\t\t\t\t\tBaseOidcModeClient,\n\t\t\t\t\tRouteBehaviourContextExtra,\n\t\t\t\t\tTokenSetClientRegistryRouteRequirementBehaviourShape\n\t\t\t\t>(registry, behaviour, environment, parent);\n\t\t\t\tconst providers = [\n\t\t\t\t\t{\n\t\t\t\t\t\tprovide: REQUIREMENT_PLANNER_HOST,\n\t\t\t\t\t\tuseValue: host as RequirementPlannerHost<unknown>,\n\t\t\t\t\t},\n\t\t\t\t];\n\t\t\t\treturn parentInjector\n\t\t\t\t\t? SecuritydeptInjector.fromParentInjector(parentInjector, providers)\n\t\t\t\t\t: SecuritydeptInjector.resolveAndCreate(providers);\n\t\t\t},\n\t\t},\n\t]);\n}\n","// Token-set secure route helpers — query-first registry requirements\n\nimport {\n\ttype CanActivateChildFn,\n\ttype CanActivateFn,\n\ttype Route,\n} from \"@angular/router\";\nimport { type RequirementsComposition } from \"@securitydept/client\";\nimport {\n\tsecureRoute as baseSecureRoute,\n\tsecureRouteRoot as baseSecureRouteRoot,\n\ttype CreateAngularGuardOptions,\n\tcreateAngularCanActivate,\n\tcreateAngularCanActivateChild,\n\ttype SecureRouteConfig,\n} from \"@securitydept/client-angular\";\nimport { type TokenSetClientRegistryAuthRequirement } from \"@securitydept/token-set-context-client/registry\";\nimport {\n\ttype ProvideTokenSetRequirementPlannerHostOptions,\n\tprovideTokenSetRequirementPlannerHost,\n} from \"./planner-host\";\n\n/** Serializable token-set security declaration for a child route. */\nexport interface TokenSetSecureRouteSecurityOptions {\n\t/** Requirements declared at this route segment. */\n\trequirements?: readonly TokenSetClientRegistryAuthRequirement[];\n\t/** Composition strategy against ancestor requirements (default `merge`). */\n\tcomposition?: RequirementsComposition;\n}\n\n/** Root-level token-set security: metadata plus registry behaviour hooks. */\nexport interface TokenSetSecureRouteRootSecurityOptions\n\textends TokenSetSecureRouteSecurityOptions,\n\t\tProvideTokenSetRequirementPlannerHostOptions {}\n\n/** Guard factory options specialized to token-set registry requirements. */\nexport type TokenSetAngularGuardOptions =\n\tCreateAngularGuardOptions<TokenSetClientRegistryAuthRequirement>;\n\n/**\n * Create a token-set `CanActivateFn`. The behaviour host is resolved from DI\n * (provided by {@link provideTokenSetRequirementPlannerHost}).\n */\nexport function createTokenSetCanActivate(\n\toptions?: TokenSetAngularGuardOptions,\n): CanActivateFn {\n\treturn createAngularCanActivate<TokenSetClientRegistryAuthRequirement>(\n\t\toptions,\n\t);\n}\n\n/**\n * Create a token-set `CanActivateChildFn`. The behaviour host is resolved from\n * DI (provided by {@link provideTokenSetRequirementPlannerHost}).\n */\nexport function createTokenSetCanActivateChild(\n\toptions?: TokenSetAngularGuardOptions,\n): CanActivateChildFn {\n\treturn createAngularCanActivateChild<TokenSetClientRegistryAuthRequirement>(\n\t\toptions,\n\t);\n}\n\n/**\n * Declare a secured child route. Writes token-set registry requirement\n * metadata only; enforcement is owned by a guarded\n * {@link secureTokenSetRouteRoot} ancestor.\n */\nexport function secureTokenSetRoute(\n\tpath: string,\n\tsecurity: TokenSetSecureRouteSecurityOptions = {},\n\trouteOptions?: SecureRouteConfig,\n): Route {\n\treturn baseSecureRoute<TokenSetClientRegistryAuthRequirement>(\n\t\tpath,\n\t\t{\n\t\t\trequirements: security.requirements,\n\t\t\tcomposition: security.composition,\n\t\t},\n\t\trouteOptions,\n\t);\n}\n\n/**\n * Declare a guarded token-set route root. Delegates guard assembly to the\n * client-angular base helper and mounts registry-backed behaviour hooks.\n */\nexport function secureTokenSetRouteRoot(\n\tpath: string,\n\tsecurity: TokenSetSecureRouteRootSecurityOptions = {},\n\trouteOptions?: SecureRouteConfig,\n): Route {\n\tconst providers = [\n\t\t...(routeOptions?.providers ?? []),\n\t\tprovideTokenSetRequirementPlannerHost({\n\t\t\tcheckClientAuthenticated: security.checkClientAuthenticated,\n\t\t\tonClientUnauthenticated: security.onClientUnauthenticated,\n\t\t\tselectClientCandidate: security.selectClientCandidate,\n\t\t}),\n\t];\n\treturn baseSecureRouteRoot<TokenSetClientRegistryAuthRequirement>(\n\t\tpath,\n\t\t{\n\t\t\trequirements: security.requirements,\n\t\t\tcomposition: security.composition,\n\t\t},\n\t\t{\n\t\t\t...routeOptions,\n\t\t\tproviders,\n\t\t},\n\t);\n}\n","import {\n\tHTTP_INTERCEPTORS,\n\ttype HttpEvent,\n\ttype HttpHandler,\n\ttype HttpHandlerFn,\n\ttype HttpInterceptor,\n\ttype HttpInterceptorFn,\n\ttype HttpRequest,\n} from \"@angular/common/http\";\nimport {\n\tInjectable,\n\tInjectionToken,\n\tinject,\n\ttype Provider,\n} from \"@angular/core\";\nimport { type BaseOidcModeClient } from \"@securitydept/token-set-context-client/orchestration\";\nimport { type TokenSetClientRegistry } from \"@securitydept/token-set-context-client/registry\";\nimport { from, type Observable, switchMap } from \"rxjs\";\nimport { TOKEN_SET_CLIENT_REGISTRY } from \"./client-registry\";\n\nexport interface TokenSetClientRegistryAuthorizationRequest {\n\turl: string;\n\tclone(update: { setHeaders?: Record<string, string> }): unknown;\n}\n\nexport type TokenSetClientRegistryAuthorizationForRequest = (\n\tregistry: TokenSetClientRegistry<BaseOidcModeClient>,\n\trequest: TokenSetClientRegistryAuthorizationRequest,\n) => Promise<string | null | undefined> | string | null | undefined;\n\nexport interface TokenSetClientRegistryAuthorizationInterceptorProviderOptions {\n\t/**\n\t * Resolves the Authorization header value for a request.\n\t *\n\t * The default implementation selects a registered client by request URL,\n\t * initializes that client, and reads its replayed authorization header.\n\t */\n\tauthorizationForRequest?: TokenSetClientRegistryAuthorizationForRequest;\n}\n\nexport interface TokenSetClientRegistryAuthorizationInterceptorOptions\n\textends TokenSetClientRegistryAuthorizationInterceptorProviderOptions {\n\tregistry?: TokenSetClientRegistry<BaseOidcModeClient>;\n}\n\nexport const TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST =\n\tnew InjectionToken<TokenSetClientRegistryAuthorizationForRequest>(\n\t\t\"TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST\",\n\t);\n\n@Injectable()\nexport class TokenSetClientRegistryAuthorizationInterceptor\n\timplements HttpInterceptor\n{\n\tprivate readonly registry = inject(TOKEN_SET_CLIENT_REGISTRY);\n\tprivate readonly authorizationForRequest =\n\t\tinject(TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST, {\n\t\t\toptional: true,\n\t\t}) ?? defaultTokenSetClientRegistryAuthorizationForRequest;\n\n\tintercept(\n\t\treq: HttpRequest<unknown>,\n\t\tnext: HttpHandler,\n\t): Observable<HttpEvent<unknown>> {\n\t\treturn from(\n\t\t\tPromise.resolve(this.authorizationForRequest(this.registry, req)),\n\t\t).pipe(\n\t\t\tswitchMap((authorization) => {\n\t\t\t\tif (!authorization) {\n\t\t\t\t\treturn next.handle(req);\n\t\t\t\t}\n\t\t\t\treturn next.handle(\n\t\t\t\t\treq.clone({ setHeaders: { Authorization: authorization } }),\n\t\t\t\t);\n\t\t\t}),\n\t\t);\n\t}\n}\n\nexport function provideTokenSetClientRegistryAuthorizationInterceptor(\n\toptions?: TokenSetClientRegistryAuthorizationInterceptorProviderOptions,\n): Provider[] {\n\tconst providers: Provider[] = [\n\t\t{\n\t\t\tprovide: HTTP_INTERCEPTORS,\n\t\t\tuseClass: TokenSetClientRegistryAuthorizationInterceptor,\n\t\t\tmulti: true,\n\t\t},\n\t];\n\tif (options) {\n\t\tif (options.authorizationForRequest) {\n\t\t\tproviders.push({\n\t\t\t\tprovide: TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST,\n\t\t\t\tuseValue: options.authorizationForRequest,\n\t\t\t});\n\t\t}\n\t}\n\treturn providers;\n}\n\nexport function createTokenSetClientRegistryAuthorizationInterceptor(\n\toptions?: TokenSetClientRegistryAuthorizationInterceptorOptions,\n): HttpInterceptorFn {\n\treturn function tokenSetClientRegistryAuthorizationInterceptorFn(\n\t\treq: HttpRequest<unknown>,\n\t\tnext: HttpHandlerFn,\n\t): Observable<HttpEvent<unknown>> {\n\t\tconst registry = options?.registry ?? inject(TOKEN_SET_CLIENT_REGISTRY);\n\t\tconst authorizationForRequest =\n\t\t\toptions?.authorizationForRequest ??\n\t\t\t(options\n\t\t\t\t? null\n\t\t\t\t: inject(TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST, {\n\t\t\t\t\t\toptional: true,\n\t\t\t\t\t})) ??\n\t\t\tdefaultTokenSetClientRegistryAuthorizationForRequest;\n\t\treturn from(Promise.resolve(authorizationForRequest(registry, req))).pipe(\n\t\t\tswitchMap((authorization) => {\n\t\t\t\tif (!authorization) {\n\t\t\t\t\treturn next(req);\n\t\t\t\t}\n\t\t\t\treturn next(\n\t\t\t\t\treq.clone({ setHeaders: { Authorization: authorization } }),\n\t\t\t\t);\n\t\t\t}),\n\t\t);\n\t};\n}\n\nexport async function defaultTokenSetClientRegistryAuthorizationForRequest(\n\tregistry: TokenSetClientRegistry<BaseOidcModeClient>,\n\trequest: TokenSetClientRegistryAuthorizationRequest,\n): Promise<string | null> {\n\tconst record = await registry.clientRecordForQuery(\n\t\t{\n\t\t\turl: request.url,\n\t\t},\n\t\t{ initialize: true },\n\t);\n\tif (!record) {\n\t\treturn null;\n\t}\n\n\tconst header = await record.client.authorizationHeaderValue.whenValue();\n\treturn header ?? null;\n}\n","import {\n\tafterNextRender,\n\tComponent,\n\tDestroyRef,\n\tinject,\n\tinput,\n\ttype Signal,\n} from \"@angular/core\";\nimport {\n\tcreateComputed,\n\tcreateSignal,\n\ttype ResourceSnapshot,\n\tResourceStatus,\n\tresourceFromSnapshots,\n} from \"@securitydept/client\";\nimport { ENVIRONMENT, toNgSignal } from \"@securitydept/client-angular\";\nimport {\n\tOidcModeCallbackHandlingKind,\n\ttype OidcModeCallbackHandlingResult,\n\ttype TokenSetAuthSnapshot,\n} from \"@securitydept/token-set-context-client/orchestration\";\nimport {\n\tselectTokenSetBackendCallbackClientFromRegistry,\n\ttype TokenSetBackendCallbackClient,\n\ttype TokenSetBackendCallbackClientFromRegistrySelectionSignal,\n\ttype TokenSetCallbackClientGuard,\n\ttype TokenSetCallbackClientQuery,\n\tTokenSetCallbackClientSelectionKind,\n\ttype TokenSetCallbackClientSelectionSnapshot,\n} from \"@securitydept/token-set-context-client/registry\";\nimport { TOKEN_SET_CLIENT_REGISTRY } from \"../client-registry\";\n\ntype BackendCallbackResult =\n\tOidcModeCallbackHandlingResult<TokenSetAuthSnapshot>;\n\n@Component({\n\tselector: \"sd-token-set-backend-callback\",\n\tstandalone: true,\n\ttemplate: \"\",\n\texportAs: \"sdTokenSetBackendCallback\",\n})\nexport class TokenSetBackendCallbackComponent {\n\treadonly clientQuery = input<TokenSetCallbackClientQuery | undefined>();\n\treadonly clientGuard =\n\t\tinput<TokenSetCallbackClientGuard<TokenSetBackendCallbackClient>>();\n\treadonly autoInitialize = input(true);\n\n\tprivate readonly environment = inject(ENVIRONMENT);\n\tprivate readonly registry = inject(TOKEN_SET_CLIENT_REGISTRY);\n\tprivate readonly destroyRef = inject(DestroyRef);\n\tprivate readonly selectionSource =\n\t\tcreateSignal<TokenSetBackendCallbackClientFromRegistrySelectionSignal | null>(\n\t\t\tnull,\n\t\t);\n\tprivate readonly selectionSignal = createComputed<\n\t\tTokenSetCallbackClientSelectionSnapshot<TokenSetBackendCallbackClient>\n\t>(\n\t\t() =>\n\t\t\tthis.selectionSource.get()?.get() ?? {\n\t\t\t\tstatus: ResourceStatus.Idle,\n\t\t\t},\n\t);\n\n\treadonly selection: Signal<\n\t\tTokenSetCallbackClientSelectionSnapshot<TokenSetBackendCallbackClient>\n\t> = toNgSignal(this.selectionSignal, { requireSync: true });\n\treadonly resource = resourceFromSnapshots<BackendCallbackResult>(() => {\n\t\tconst selection = this.selectionSignal.get();\n\t\tswitch (selection.status) {\n\t\t\tcase ResourceStatus.Idle:\n\t\t\t\treturn { status: ResourceStatus.Idle };\n\t\t\tcase ResourceStatus.Loading:\n\t\t\t\treturn { status: ResourceStatus.Loading };\n\t\t\tcase ResourceStatus.LoadingError:\n\t\t\t\treturn selection;\n\t\t\tcase ResourceStatus.Resolved:\n\t\t\t\treturn selection.value.kind ===\n\t\t\t\t\tTokenSetCallbackClientSelectionKind.NotApplicable\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tstatus: ResourceStatus.Resolved,\n\t\t\t\t\t\t\tvalue: { kind: OidcModeCallbackHandlingKind.NotApplicable },\n\t\t\t\t\t\t}\n\t\t\t\t\t: selection.value.client.callback.state.get();\n\t\t}\n\t});\n\treadonly state: Signal<ResourceSnapshot<BackendCallbackResult>> = toNgSignal(\n\t\tthis.resource,\n\t\t{ requireSync: true },\n\t);\n\n\tconstructor() {\n\t\tthis.destroyRef.onDestroy(() => this.resource.dispose());\n\t\tafterNextRender(() => {\n\t\t\tthis.selectionSource.set(\n\t\t\t\tselectTokenSetBackendCallbackClientFromRegistry({\n\t\t\t\t\tregistry: this.registry,\n\t\t\t\t\tcallbackUrl: this.environment.router?.currentUrl()?.toString() ?? \"\",\n\t\t\t\t\tclientQuery: this.clientQuery(),\n\t\t\t\t\tclientGuard: this.clientGuard(),\n\t\t\t\t\tinitialize: this.autoInitialize(),\n\t\t\t\t}),\n\t\t\t);\n\t\t});\n\t}\n}\n","import {\n\tafterNextRender,\n\tComponent,\n\tDestroyRef,\n\tinject,\n\tinput,\n\ttype Signal,\n} from \"@angular/core\";\nimport {\n\tcreateComputed,\n\tcreateSignal,\n\ttype ResourceSnapshot,\n\tResourceStatus,\n\tresourceFromSnapshots,\n} from \"@securitydept/client\";\nimport { ENVIRONMENT, toNgSignal } from \"@securitydept/client-angular\";\nimport { type FrontendOidcModeCallbackResult } from \"@securitydept/token-set-context-client/frontend-oidc-mode\";\nimport {\n\tOidcModeCallbackHandlingKind,\n\ttype OidcModeCallbackHandlingResult,\n} from \"@securitydept/token-set-context-client/orchestration\";\nimport {\n\tselectTokenSetFrontendCallbackClientFromRegistry,\n\ttype TokenSetCallbackClientGuard,\n\ttype TokenSetCallbackClientQuery,\n\tTokenSetCallbackClientSelectionKind,\n\ttype TokenSetCallbackClientSelectionSnapshot,\n\ttype TokenSetFrontendCallbackClient,\n\ttype TokenSetFrontendCallbackClientFromRegistrySelectionSignal,\n} from \"@securitydept/token-set-context-client/registry\";\nimport { TOKEN_SET_CLIENT_REGISTRY } from \"../client-registry\";\n\ntype FrontendCallbackResult =\n\tOidcModeCallbackHandlingResult<FrontendOidcModeCallbackResult>;\n\n@Component({\n\tselector: \"sd-token-set-frontend-callback\",\n\tstandalone: true,\n\ttemplate: \"\",\n\texportAs: \"sdTokenSetFrontendCallback\",\n})\nexport class TokenSetFrontendCallbackComponent {\n\treadonly clientQuery = input<TokenSetCallbackClientQuery | undefined>();\n\treadonly clientGuard =\n\t\tinput<TokenSetCallbackClientGuard<TokenSetFrontendCallbackClient>>();\n\treadonly autoInitialize = input(true);\n\n\tprivate readonly environment = inject(ENVIRONMENT);\n\tprivate readonly registry = inject(TOKEN_SET_CLIENT_REGISTRY);\n\tprivate readonly destroyRef = inject(DestroyRef);\n\tprivate readonly selectionSource =\n\t\tcreateSignal<TokenSetFrontendCallbackClientFromRegistrySelectionSignal | null>(\n\t\t\tnull,\n\t\t);\n\tprivate readonly selectionSignal = createComputed<\n\t\tTokenSetCallbackClientSelectionSnapshot<TokenSetFrontendCallbackClient>\n\t>(\n\t\t() =>\n\t\t\tthis.selectionSource.get()?.get() ?? {\n\t\t\t\tstatus: ResourceStatus.Idle,\n\t\t\t},\n\t);\n\n\treadonly selection: Signal<\n\t\tTokenSetCallbackClientSelectionSnapshot<TokenSetFrontendCallbackClient>\n\t> = toNgSignal(this.selectionSignal, { requireSync: true });\n\treadonly resource = resourceFromSnapshots<FrontendCallbackResult>(() => {\n\t\tconst selection = this.selectionSignal.get();\n\t\tswitch (selection.status) {\n\t\t\tcase ResourceStatus.Idle:\n\t\t\t\treturn { status: ResourceStatus.Idle };\n\t\t\tcase ResourceStatus.Loading:\n\t\t\t\treturn { status: ResourceStatus.Loading };\n\t\t\tcase ResourceStatus.LoadingError:\n\t\t\t\treturn selection;\n\t\t\tcase ResourceStatus.Resolved:\n\t\t\t\treturn selection.value.kind ===\n\t\t\t\t\tTokenSetCallbackClientSelectionKind.NotApplicable\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tstatus: ResourceStatus.Resolved,\n\t\t\t\t\t\t\tvalue: { kind: OidcModeCallbackHandlingKind.NotApplicable },\n\t\t\t\t\t\t}\n\t\t\t\t\t: selection.value.client.callback.state.get();\n\t\t}\n\t});\n\treadonly state: Signal<ResourceSnapshot<FrontendCallbackResult>> = toNgSignal(\n\t\tthis.resource,\n\t\t{ requireSync: true },\n\t);\n\n\tconstructor() {\n\t\tthis.destroyRef.onDestroy(() => this.resource.dispose());\n\t\tafterNextRender(() => {\n\t\t\tthis.selectionSource.set(\n\t\t\t\tselectTokenSetFrontendCallbackClientFromRegistry({\n\t\t\t\t\tregistry: this.registry,\n\t\t\t\t\tcallbackUrl: this.environment.router?.currentUrl()?.toString() ?? \"\",\n\t\t\t\t\tclientQuery: this.clientQuery(),\n\t\t\t\t\tclientGuard: this.clientGuard(),\n\t\t\t\t\tinitialize: this.autoInitialize(),\n\t\t\t\t}),\n\t\t\t);\n\t\t});\n\t}\n}\n","// Angular integration family for @securitydept/token-set-context-client\n//\n// Canonical import path:\n//   import { ... } from \"@securitydept/token-set-context-client-angular\"\n//\n// Multi-client-first Angular-native adapter surface:\n//   - Keyed client registration via provideTokenSetClientRegistry()\n//   - Multi-client lookup via the core TokenSetClientRegistry\n//   - Per-client mode client replay signals with RxJS bridge support\n//   - Client-registry authorization interceptor (functional + class-based)\n//   - provideTokenSetClientRegistryAuthorizationInterceptor() for NgModule HTTP_INTERCEPTORS setup\n//   - Requirement/provider-family → client key mapping\n//   - secureTokenSetRouteRoot() / secureTokenSetRoute() — token-set Angular\n//     Router route-security builders that delegate to the client-angular base\n//     helpers and mount the token-set behaviour host.\n//   - provideTokenSetRequirementPlannerHost() — provides the token-set\n//     RequirementPlannerHost behaviour to the client-angular guard pipeline.\n//   - createTokenSetCanActivate() / createTokenSetCanActivateChild() — token-set\n//     named guard factories over the client-angular base guards.\n//   - Signal/Observable bridge utilities live in @securitydept/client-angular\n//\n// Built by ng-packagr (APF / FESM2022). Decorators are fully supported.\n//\n// Stability: provisional (framework adapter)\n\nexport * from \"./auth-coordination\";\nexport * from \"./client-registry\";\nexport * from \"./client-registry-authorization.interceptor\";\nexport * from \"./components\";\n","/*\n * Public API Surface of @securitydept/token-set-context-client-angular\n */\n\nexport * from \"./lib\";\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":["provideCoreTokenSetClientRegistry","CORE_TOKEN_SET_CLIENT_REGISTRY","baseSecureRoute","baseSecureRouteRoot"],"mappings":";;;;;;;;;MAca,yBAAyB,GAAG,IAAI,cAAc,CAEzD,2BAA2B;AAIvB,SAAU,6BAA6B,CAC5C,OAAA,GAAgD,EAAE,EAAA;IAElD,OAAO;QACN,GAAGA,+BAAiC,CAAC,OAAO,CAAC,CAAC,GAAG,CAChD,0BAA0B,CAC1B;AACD,QAAA;AACC,YAAA,OAAO,EAAE,yBAAyB;AAClC,YAAA,UAAU,EAAE,CAAC,WAAkC,KAC9C,WAAW,CAAC,QAAQ,CAAC,GAAG,CAACC,2BAA8B,CAAC;YACzD,IAAI,EAAE,CAAC,WAAW,CAAC;AACnB,SAAA;KACD;AACF;;AClCA;AAiCA;;;;;;AAMG;AACG,SAAU,qCAAqC,CACpD,OAAA,GAAwD,EAAE,EAAA;AAE1D,IAAA,OAAO,wBAAwB,CAAC;AAC/B,QAAA;AACC,YAAA,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,MAA2B;AACtC,gBAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAClD,gBAAA,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;AACvC,gBAAA,MAAM,cAAc,GACnB,MAAM,CAAC,qBAAqB,EAAE;AAC7B,oBAAA,QAAQ,EAAE,IAAI;AACd,oBAAA,QAAQ,EAAE,IAAI;iBACd,CAAC,IAAI,SAAS;gBAChB,MAAM,MAAM,IAAI,cAAc,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC;AAClE,oBAAA,SAAS,CAEE;gBACZ,MAAM,SAAS,GAAG,IAAI,0CAA0C,CAG9D,QAAQ,EAAE,OAAO,CAAC;AACpB,gBAAA,MAAM,IAAI,GAAG,IAAI,iCAAiC,CAIhD,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;AAC3C,gBAAA,MAAM,SAAS,GAAG;AACjB,oBAAA;AACC,wBAAA,OAAO,EAAE,wBAAwB;AACjC,wBAAA,QAAQ,EAAE,IAAuC;AACjD,qBAAA;iBACD;AACD,gBAAA,OAAO;sBACJ,oBAAoB,CAAC,kBAAkB,CAAC,cAAc,EAAE,SAAS;AACnE,sBAAE,oBAAoB,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACpD,CAAC;AACD,SAAA;AACD,KAAA,CAAC;AACH;;AC/EA;AAuCA;;;AAGG;AACG,SAAU,yBAAyB,CACxC,OAAqC,EAAA;AAErC,IAAA,OAAO,wBAAwB,CAC9B,OAAO,CACP;AACF;AAEA;;;AAGG;AACG,SAAU,8BAA8B,CAC7C,OAAqC,EAAA;AAErC,IAAA,OAAO,6BAA6B,CACnC,OAAO,CACP;AACF;AAEA;;;;AAIG;AACG,SAAU,mBAAmB,CAClC,IAAY,EACZ,QAAA,GAA+C,EAAE,EACjD,YAAgC,EAAA;IAEhC,OAAOC,WAAe,CACrB,IAAI,EACJ;QACC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;KACjC,EACD,YAAY,CACZ;AACF;AAEA;;;AAGG;AACG,SAAU,uBAAuB,CACtC,IAAY,EACZ,QAAA,GAAmD,EAAE,EACrD,YAAgC,EAAA;AAEhC,IAAA,MAAM,SAAS,GAAG;AACjB,QAAA,IAAI,YAAY,EAAE,SAAS,IAAI,EAAE,CAAC;AAClC,QAAA,qCAAqC,CAAC;YACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;YAC3D,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;SACrD,CAAC;KACF;IACD,OAAOC,eAAmB,CACzB,IAAI,EACJ;QACC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;KACjC,EACD;AACC,QAAA,GAAG,YAAY;QACf,SAAS;AACT,KAAA,CACD;AACF;;MClEa,mDAAmD,GAC/D,IAAI,cAAc,CACjB,qDAAqD;MAI1C,8CAA8C,CAAA;AAGzC,IAAA,QAAQ,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAC5C,IAAA,uBAAuB,GACvC,MAAM,CAAC,mDAAmD,EAAE;AAC3D,QAAA,QAAQ,EAAE,IAAI;KACd,CAAC,IAAI,oDAAoD;IAE3D,SAAS,CACR,GAAyB,EACzB,IAAiB,EAAA;QAEjB,OAAO,IAAI,CACV,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CACjE,CAAC,IAAI,CACL,SAAS,CAAC,CAAC,aAAa,KAAI;YAC3B,IAAI,CAAC,aAAa,EAAE;AACnB,gBAAA,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB;AACA,YAAA,OAAO,IAAI,CAAC,MAAM,CACjB,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAC3D;QACF,CAAC,CAAC,CACF;IACF;uGAzBY,8CAA8C,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;2GAA9C,8CAA8C,EAAA,CAAA;;2FAA9C,8CAA8C,EAAA,UAAA,EAAA,CAAA;kBAD1D;;AA6BK,SAAU,qDAAqD,CACpE,OAAuE,EAAA;AAEvE,IAAA,MAAM,SAAS,GAAe;AAC7B,QAAA;AACC,YAAA,OAAO,EAAE,iBAAiB;AAC1B,YAAA,QAAQ,EAAE,8CAA8C;AACxD,YAAA,KAAK,EAAE,IAAI;AACX,SAAA;KACD;IACD,IAAI,OAAO,EAAE;AACZ,QAAA,IAAI,OAAO,CAAC,uBAAuB,EAAE;YACpC,SAAS,CAAC,IAAI,CAAC;AACd,gBAAA,OAAO,EAAE,mDAAmD;gBAC5D,QAAQ,EAAE,OAAO,CAAC,uBAAuB;AACzC,aAAA,CAAC;QACH;IACD;AACA,IAAA,OAAO,SAAS;AACjB;AAEM,SAAU,oDAAoD,CACnE,OAA+D,EAAA;AAE/D,IAAA,OAAO,SAAS,gDAAgD,CAC/D,GAAyB,EACzB,IAAmB,EAAA;QAEnB,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,yBAAyB,CAAC;AACvE,QAAA,MAAM,uBAAuB,GAC5B,OAAO,EAAE,uBAAuB;AAChC,aAAC;AACA,kBAAE;AACF,kBAAE,MAAM,CAAC,mDAAmD,EAAE;AAC5D,oBAAA,QAAQ,EAAE,IAAI;AACd,iBAAA,CAAC,CAAC;AACL,YAAA,oDAAoD;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACxE,SAAS,CAAC,CAAC,aAAa,KAAI;YAC3B,IAAI,CAAC,aAAa,EAAE;AACnB,gBAAA,OAAO,IAAI,CAAC,GAAG,CAAC;YACjB;AACA,YAAA,OAAO,IAAI,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAC3D;QACF,CAAC,CAAC,CACF;AACF,IAAA,CAAC;AACF;AAEO,eAAe,oDAAoD,CACzE,QAAoD,EACpD,OAAmD,EAAA;AAEnD,IAAA,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CACjD;QACC,GAAG,EAAE,OAAO,CAAC,GAAG;AAChB,KAAA,EACD,EAAE,UAAU,EAAE,IAAI,EAAE,CACpB;IACD,IAAI,CAAC,MAAM,EAAE;AACZ,QAAA,OAAO,IAAI;IACZ;IAEA,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE;IACvE,OAAO,MAAM,IAAI,IAAI;AACtB;;MCxGa,gCAAgC,CAAA;AACnC,IAAA,WAAW,GAAG,KAAK;+FAA2C;AAC9D,IAAA,WAAW,GACnB,KAAK;+FAA8D;IAC3D,cAAc,GAAG,KAAK,CAAC,IAAI;uFAAC;AAEpB,IAAA,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;AACjC,IAAA,QAAQ,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAC5C,IAAA,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;AAC/B,IAAA,eAAe,GAC/B,YAAY,CACX,IAAI,CACJ;AACe,IAAA,eAAe,GAAG,cAAc,CAGhD,MACC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI;QACpC,MAAM,EAAE,cAAc,CAAC,IAAI;AAC3B,KAAA,CACF;AAEQ,IAAA,SAAS,GAEd,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAClD,IAAA,QAAQ,GAAG,qBAAqB,CAAwB,MAAK;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;AAC5C,QAAA,QAAQ,SAAS,CAAC,MAAM;YACvB,KAAK,cAAc,CAAC,IAAI;AACvB,gBAAA,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,IAAI,EAAE;YACvC,KAAK,cAAc,CAAC,OAAO;AAC1B,gBAAA,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE;YAC1C,KAAK,cAAc,CAAC,YAAY;AAC/B,gBAAA,OAAO,SAAS;YACjB,KAAK,cAAc,CAAC,QAAQ;AAC3B,gBAAA,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI;AAC1B,oBAAA,mCAAmC,CAAC;AACpC,sBAAE;wBACA,MAAM,EAAE,cAAc,CAAC,QAAQ;AAC/B,wBAAA,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,aAAa,EAAE;AAC3D;AACF,sBAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE;;AAEjD,IAAA,CAAC,CAAC;AACO,IAAA,KAAK,GAAoD,UAAU,CAC3E,IAAI,CAAC,QAAQ,EACb,EAAE,WAAW,EAAE,IAAI,EAAE,CACrB;AAED,IAAA,WAAA,GAAA;AACC,QAAA,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,eAAe,CAAC,MAAK;AACpB,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CACvB,+CAA+C,CAAC;gBAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;AACvB,gBAAA,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpE,gBAAA,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;AAC/B,gBAAA,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;AAC/B,gBAAA,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE;AACjC,aAAA,CAAC,CACF;AACF,QAAA,CAAC,CAAC;IACH;uGA9DY,gCAAgC,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA;AAAhC,IAAA,OAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,gCAAgC,qjBAHlC,EAAE,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA;;2FAGA,gCAAgC,EAAA,UAAA,EAAA,CAAA;kBAN5C,SAAS;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,QAAQ,EAAE,+BAA+B;AACzC,oBAAA,UAAU,EAAE,IAAI;AAChB,oBAAA,QAAQ,EAAE,EAAE;AACZ,oBAAA,QAAQ,EAAE,2BAA2B;AACrC,iBAAA;;;MCCY,iCAAiC,CAAA;AACpC,IAAA,WAAW,GAAG,KAAK;+FAA2C;AAC9D,IAAA,WAAW,GACnB,KAAK;+FAA+D;IAC5D,cAAc,GAAG,KAAK,CAAC,IAAI;uFAAC;AAEpB,IAAA,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;AACjC,IAAA,QAAQ,GAAG,MAAM,CAAC,yBAAyB,CAAC;AAC5C,IAAA,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;AAC/B,IAAA,eAAe,GAC/B,YAAY,CACX,IAAI,CACJ;AACe,IAAA,eAAe,GAAG,cAAc,CAGhD,MACC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI;QACpC,MAAM,EAAE,cAAc,CAAC,IAAI;AAC3B,KAAA,CACF;AAEQ,IAAA,SAAS,GAEd,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAClD,IAAA,QAAQ,GAAG,qBAAqB,CAAyB,MAAK;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;AAC5C,QAAA,QAAQ,SAAS,CAAC,MAAM;YACvB,KAAK,cAAc,CAAC,IAAI;AACvB,gBAAA,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,IAAI,EAAE;YACvC,KAAK,cAAc,CAAC,OAAO;AAC1B,gBAAA,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE;YAC1C,KAAK,cAAc,CAAC,YAAY;AAC/B,gBAAA,OAAO,SAAS;YACjB,KAAK,cAAc,CAAC,QAAQ;AAC3B,gBAAA,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI;AAC1B,oBAAA,mCAAmC,CAAC;AACpC,sBAAE;wBACA,MAAM,EAAE,cAAc,CAAC,QAAQ;AAC/B,wBAAA,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,CAAC,aAAa,EAAE;AAC3D;AACF,sBAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE;;AAEjD,IAAA,CAAC,CAAC;AACO,IAAA,KAAK,GAAqD,UAAU,CAC5E,IAAI,CAAC,QAAQ,EACb,EAAE,WAAW,EAAE,IAAI,EAAE,CACrB;AAED,IAAA,WAAA,GAAA;AACC,QAAA,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,eAAe,CAAC,MAAK;AACpB,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CACvB,gDAAgD,CAAC;gBAChD,QAAQ,EAAE,IAAI,CAAC,QAAQ;AACvB,gBAAA,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpE,gBAAA,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;AAC/B,gBAAA,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;AAC/B,gBAAA,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE;AACjC,aAAA,CAAC,CACF;AACF,QAAA,CAAC,CAAC;IACH;uGA9DY,iCAAiC,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,SAAA,EAAA,CAAA;AAAjC,IAAA,OAAA,IAAA,GAAA,EAAA,CAAA,oBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,QAAA,EAAA,IAAA,EAAA,iCAAiC,ujBAHnC,EAAE,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA;;2FAGA,iCAAiC,EAAA,UAAA,EAAA,CAAA;kBAN7C,SAAS;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,QAAQ,EAAE,gCAAgC;AAC1C,oBAAA,UAAU,EAAE,IAAI;AAChB,oBAAA,QAAQ,EAAE,EAAE;AACZ,oBAAA,QAAQ,EAAE,4BAA4B;AACtC,iBAAA;;;ACxCD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;ACvBA;;AAEG;;ACFH;;AAEG;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securitydept/token-set-context-client-angular",
-  "version": "0.2.0",
+  "version": "0.3.0-beta.10",
   "description": "Token Set Context Client Angular of the SecurityDept TypeScript SDK, a layered authentication and authorization toolkit built as reusable Rust crates, a TypeScript client SDK workspace, and reference server/web apps.",
   "author": "Zhou Yeheng <root@aitiotekt.com>",
   "license": "MIT",
@@ -45,9 +45,9 @@
     "@angular/common": ">=19.0.0",
     "@angular/router": ">=19.0.0",
     "rxjs": ">=7.0.0",
-    "@securitydept/client": "0.2.0",
-    "@securitydept/client-angular": "0.2.0",
-    "@securitydept/token-set-context-client": "0.2.0"
+    "@securitydept/client-angular": "0.3.0-beta.10",
+    "@securitydept/client": "0.3.0-beta.10",
+    "@securitydept/token-set-context-client": "0.3.0-beta.10"
   },
   "module": "fesm2022/securitydept-token-set-context-client-angular.mjs",
   "typings": "types/securitydept-token-set-context-client-angular.d.ts",