@securitydept/token-set-context-client-angular 0.3.0-beta.3 → 0.3.0-beta.6

package/fesm2022/securitydept-token-set-context-client-angular.mjs

@@ -1,469 +1,158 @@
-import { HTTP_INTERCEPTORS } from '@angular/common/http';
 import * as i0 from '@angular/core';
-import { signal, inject, DestroyRef, Injectable, InjectionToken, provideEnvironmentInitializer, EnvironmentInjector, runInInjectionContext, Component } from '@angular/core';
-import { getTokenFreshness, TokenFreshnessState, attachTokenSetResumeReconciliation, TokenSetAuthFlowSource } from '@securitydept/token-set-context-client/orchestration';
-import { from, switchMap, firstValueFrom, take } from 'rxjs';
-import { createTokenSetAuthRegistry, TokenSetCallbackResumeController } from '@securitydept/token-set-context-client/registry';
-export { ClientInitializationPriority } from '@securitydept/token-set-context-client/registry';
-import { bridgeToAngularSignal, signalToObservable, AUTH_PLANNER_HOST, extractFullRouteRequirements, resolvePageClientEnvironmentSource, PAGE_CLIENT_ENVIRONMENT, withRouteRequirements } from '@securitydept/client-angular';
-import { Router } from '@angular/router';
-import { assertResolveEnvironment } from '@securitydept/client/web';
+import { InjectionToken, makeEnvironmentProviders, inject, Injectable, input, DestroyRef, afterNextRender, Component } from '@angular/core';
+import { REQUIREMENT_PLANNER_HOST, SecuritydeptInjector, createSignal, createComputed, ResourceStatus, resourceFromSnapshots } from '@securitydept/client';
+import { ENVIRONMENT, provideEnvironmentProvider, SECURITYDEPT_INJECTOR, createAngularCanActivate, createAngularCanActivateChild, secureRoute, secureRouteRoot, toNgSignal } from '@securitydept/client-angular';
+import { provideTokenSetClientRegistry as provideTokenSetClientRegistry$1, TOKEN_SET_CLIENT_REGISTRY as TOKEN_SET_CLIENT_REGISTRY$1, TokenSetClientRegistryRequirementBehaviour, TokenSetClientRegistryPlannerHost, TokenSetCallbackClientSelectionKind, selectTokenSetBackendCallbackClientFromRegistry, selectTokenSetFrontendCallbackClientFromRegistry } from '@securitydept/token-set-context-client/registry';
+import { HTTP_INTERCEPTORS } from '@angular/common/http';
+import { from, switchMap } from 'rxjs';
+import { OidcModeCallbackHandlingKind } from '@securitydept/token-set-context-client/orchestration';
+
+const TOKEN_SET_CLIENT_REGISTRY = new InjectionToken("TOKEN_SET_CLIENT_REGISTRY");
+function provideTokenSetClientRegistry(options = {}) {
+    return [
+        ...provideTokenSetClientRegistry$1(options).map(provideEnvironmentProvider),
+        {
+            provide: TOKEN_SET_CLIENT_REGISTRY,
+            useFactory: (environment) => environment.injector.get(TOKEN_SET_CLIENT_REGISTRY$1),
+            deps: [ENVIRONMENT],
+        },
+    ];
+}
 
-// ============================================================================
-// 5. TokenSetAuthService — per-client service wrapper
-// ============================================================================
+// Token-set requirement planner host — Angular DI adapter over core registry auth coordination
 /**
- * Per-client Angular service that bridges a single OIDC mode client to
- * Angular signals + RxJS.
+ * Provide registry-backed requirement behaviour for Angular guards.
  *
- * Lifecycle teardown is explicit. Construct with
- * `new TokenSetAuthService(client, autoRestore)` and call `.dispose()` when
- * the service owner tears down. The shared registry core handles this
- * automatically — adopters that wire the service directly (rare) must call
- * `dispose()` themselves, typically bound to a `DestroyRef.onDestroy`.
+ * This is intentionally a thin adapter over the framework-neutral registry
+ * auth-coordination layer. Route requirements must carry
+ * `attributes.query: TokenSetClientQueryOptions`.
  */
-class TokenSetAuthService {
-    client;
-    /** Current auth snapshot as an Angular signal. */
-    authState;
-    /** Current auth snapshot as an RxJS Observable. */
-    authState$;
-    /** Promise that resolves when initial state restore completes (or null if skipped). */
-    restorePromise;
-    authEvents;
-    cleanup;
-    disposed = false;
-    constructor(
-    /** The underlying SDK client instance. */
-    client, autoRestore) {
-        this.client = client;
-        this.authState = signal(null, ...(ngDevMode ? [{ debugName: "authState" }] : /* istanbul ignore next */ []));
-        this.cleanup = bridgeToAngularSignal(client.state, this.authState);
-        this.authState$ = signalToObservable(client.state);
-        this.authEvents = client.authEvents;
-        this.restorePromise = autoRestore ? client.restorePersistedState() : null;
-    }
-    /** Whether the user is currently authenticated. */
-    isAuthenticated() {
-        return this.accessToken() !== null;
-    }
-    /** Current access token, or null. */
-    accessToken() {
-        const snapshot = this.authState();
-        if (!isFreshOrUsable(snapshot)) {
-            return null;
-        }
-        return snapshot?.tokens.accessToken ?? null;
-    }
-    async ensureFreshAuthState(options) {
-        return await this.client.ensureFreshAuthState(options);
-    }
-    async ensureAuthForResource(options) {
-        return await this.client.ensureAuthForResource(options);
-    }
-    async ensureAccessToken(options) {
-        return ((await this.ensureFreshAuthState(options))?.tokens.accessToken ?? null);
-    }
-    async ensureAuthorizationHeader(options) {
-        return await this.client.ensureAuthorizationHeader(options);
-    }
-    /**
-     * Release all resources owned by this service.
-     *
-     * - Unsubscribes the SDK state bridge
-     * - Calls `client.dispose()`
-     *
-     * Idempotent: subsequent calls are no-ops. Called by the shared registry
-     * at teardown; adopters invoking TokenSetAuthService directly must call
-     * this themselves (typically bound to `DestroyRef.onDestroy`).
-     */
-    dispose() {
-        if (this.disposed)
-            return;
-        this.disposed = true;
-        try {
-            this.cleanup();
-        }
-        catch {
-            // Swallow — best effort.
-        }
-        try {
-            this.client.dispose();
-        }
-        catch {
-            // Swallow — best effort.
-        }
-    }
-}
-function isFreshOrUsable(snapshot) {
-    const freshness = getTokenFreshness(snapshot, {
-        now: Date.now(),
-        clockSkewMs: 30_000,
-        refreshWindowMs: 0,
-    });
-    return (freshness === TokenFreshnessState.Fresh ||
-        freshness === TokenFreshnessState.RefreshDue ||
-        freshness === TokenFreshnessState.NoExpiry);
-}
-
-class TokenSetAuthRegistry {
-    /**
-     * Shared framework-neutral registry core. Angular consumers rarely need
-     * direct access, but this is exposed so adapter-internal helpers
-     * (`CallbackResumeService`, `bearer-interceptor`) can query the core
-     * directly when they don't need Angular-specific behaviour.
-     */
-    core;
-    authEvents;
-    constructor() {
-        this.core = createTokenSetAuthRegistry({
-            materialize: (client, entry) => {
-                const angularEntry = entry;
-                const managedClient = attachTokenSetResumeReconciliation(client, {
-                    resumeReconciliation: angularEntry.resumeReconciliation,
-                    resumeReconciliationOptions: angularEntry.resumeReconciliationOptions,
-                });
-                return new TokenSetAuthService(managedClient, entry.autoRestore ?? true);
+function provideTokenSetRequirementPlannerHost(options = {}) {
+    return makeEnvironmentProviders([
+        {
+            provide: SECURITYDEPT_INJECTOR,
+            useFactory: () => {
+                const registry = inject(TOKEN_SET_CLIENT_REGISTRY);
+                const environment = inject(ENVIRONMENT);
+                const parentInjector = inject(SECURITYDEPT_INJECTOR, {
+                    optional: true,
+                    skipSelf: true,
+                }) ?? undefined;
+                const parent = (parentInjector?.get(REQUIREMENT_PLANNER_HOST, null) ??
+                    undefined);
+                const behaviour = new TokenSetClientRegistryRequirementBehaviour(registry, options);
+                const host = new TokenSetClientRegistryPlannerHost(registry, behaviour, environment, parent);
+                const providers = [
+                    {
+                        provide: REQUIREMENT_PLANNER_HOST,
+                        useValue: host,
+                    },
+                ];
+                return parentInjector
+                    ? SecuritydeptInjector.fromParentInjector(parentInjector, providers)
+                    : SecuritydeptInjector.resolveAndCreate(providers);
             },
-            dispose: (service) => service.dispose(),
-            accessTokenOf: (service) => service.accessToken(),
-            ensureAccessTokenOf: (service) => service.ensureAccessToken(),
-            ensureAuthorizationHeaderOf: (service) => service.ensureAuthorizationHeader(),
-            ensureAuthForResourceOf: (service, options) => service.ensureAuthForResource(options),
-            authEventsOf: (service) => service.authEvents,
-        });
-        this.authEvents = this.core.authEvents;
-        // Try to bind core.dispose() to the current injection context's
-        // DestroyRef. Registry is typically constructed via DI (where this
-        // always succeeds); pure unit tests instantiate directly and must
-        // call `.dispose()` manually.
-        try {
-            const destroyRef = inject(DestroyRef);
-            destroyRef.onDestroy(() => this.core.dispose());
-        }
-        catch {
-            // Not in an injection context — adopter is expected to call
-            // registry.dispose() manually (or never, for short-lived tests).
-        }
-    }
-    register(entry) {
-        return this.core.register(entry);
-    }
-    /**
-     * Manually dispose the registry. Normally bound to the ambient
-     * `DestroyRef` at construction; call this explicitly when instantiating
-     * the registry outside of an Angular injection context (e.g. in unit
-     * tests).
-     */
-    dispose() {
-        this.core.dispose();
-    }
-    // --------------------------------------------------------------------------
-    // Pass-through API for the earlier wrapper surface
-    // --------------------------------------------------------------------------
-    isReady(key) {
-        return this.core.isReady(key);
-    }
-    readinessState(key) {
-        return this.core.readinessState(key);
-    }
-    async whenReady(key) {
-        return this.core.whenReady(key);
-    }
-    /**
-     * Preload a lazy client without throwing on rejection. Callers are
-     * expected to attach `.catch` handlers for fire-and-forget usage.
-     */
-    preload(key) {
-        return this.core.preload(key);
-    }
-    /**
-     * Schedule preload for every lazy+not-initialized client using
-     * `requestIdleCallback` / `setTimeout` fallback.
-     */
-    idleWarmup() {
-        return this.core.idleWarmup();
-    }
-    reset(key) {
-        this.core.reset(key);
-    }
-    metaFor(clientKey) {
-        return this.core.metaFor(clientKey);
-    }
-    get(key) {
-        return this.core.get(key);
-    }
-    require(key) {
-        return this.core.require(key);
-    }
-    keys() {
-        return this.core.keys();
-    }
-    entries() {
-        return this.core.entriesSnapshot();
-    }
-    // ---- URL / callback / requirement / provider-family discrimination -----
-    *clientKeyGenForUrl(url) {
-        yield* this.core.clientKeyGenForUrl(url);
-    }
-    *clientKeyGenForCallback(url) {
-        yield* this.core.clientKeyGenForCallback(url);
-    }
-    *clientKeyGenForRequirement(requirementKind) {
-        yield* this.core.clientKeyGenForRequirement(requirementKind);
-    }
-    *clientKeyGenForProviderFamily(providerFamily) {
-        yield* this.core.clientKeyGenForProviderFamily(providerFamily);
-    }
-    clientKeyListForUrl(url) {
-        return this.core.clientKeyListForUrl(url);
-    }
-    clientKeyListForCallback(url) {
-        return this.core.clientKeyListForCallback(url);
-    }
-    clientKeyListForRequirement(requirementKind) {
-        return this.core.clientKeyListForRequirement(requirementKind);
-    }
-    clientKeyListForProviderFamily(providerFamily) {
-        return this.core.clientKeyListForProviderFamily(providerFamily);
-    }
-    clientKeyForUrl(url, selector) {
-        return this.core.clientKeyForUrl(url, selector);
-    }
-    clientKeyForCallback(url, selector) {
-        return this.core.clientKeyForCallback(url, selector);
-    }
-    clientKeyForRequirement(requirementKind, selector) {
-        return this.core.clientKeyForRequirement(requirementKind, selector);
-    }
-    clientKeyForProviderFamily(providerFamily, selector) {
-        return this.core.clientKeyForProviderFamily(providerFamily, selector);
-    }
-    requireForRequirement(requirementKind, selector) {
-        return this.core.requireForRequirement(requirementKind, selector);
-    }
-    requireForProviderFamily(providerFamily, selector) {
-        return this.core.requireForProviderFamily(providerFamily, selector);
-    }
-    *clientKeyGenForFilter(filter) {
-        yield* this.core.clientKeyGenForFilter(filter);
-    }
-    *clientKeyGenForOptions(options) {
-        yield* this.core.clientKeyGenForOptions(options);
-    }
-    clientKeysForOptions(options) {
-        return this.core.clientKeysForOptions(options);
-    }
-    accessToken(key) {
-        return this.core.accessToken(key);
-    }
-    async ensureAccessToken(key) {
-        return await this.core.ensureAccessToken(key);
-    }
-    async ensureAuthorizationHeader(key) {
-        return await this.core.ensureAuthorizationHeader(key);
-    }
-    async ensureAuthForResource(options = {}) {
-        return await this.core.ensureAuthForResource(options);
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: TokenSetAuthRegistry, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: TokenSetAuthRegistry });
+        },
+    ]);
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: TokenSetAuthRegistry, decorators: [{
-            type: Injectable
-        }], ctorParameters: () => [] });
 
+// Token-set secure route helpers — query-first registry requirements
 /**
- * DI token for {@link BearerInterceptorOptions}. Adopters normally configure
- * options via `provideTokenSetBearerInterceptor({ ... })`; the token is
- * exported for advanced cases where the options need to be supplied or
- * overridden separately (for example, in tests).
+ * Create a token-set `CanActivateFn`. The behaviour host is resolved from DI
+ * (provided by {@link provideTokenSetRequirementPlannerHost}).
  */
-const TOKEN_SET_BEARER_INTERCEPTOR_OPTIONS = new InjectionToken("TOKEN_SET_BEARER_INTERCEPTOR_OPTIONS");
+function createTokenSetCanActivate(options) {
+    return createAngularCanActivate(options);
+}
 /**
- * Angular class-based bearer-token interceptor (`HTTP_INTERCEPTORS` style).
- *
- * Selects the correct access token from the multi-client registry by URL
- * pattern. Behaviour for unmatched URLs is governed by
- * {@link BearerInterceptorOptions.strictUrlMatch}.
- *
- * Prefer the functional version via `createTokenSetBearerInterceptor()` +
- * `withInterceptors()` when using `provideHttpClient`. Use this class-based
- * version when you need classic `HTTP_INTERCEPTORS` multi-provider style
- * (e.g. NgModule apps).
- *
- * @example
- * ```ts
- * // NgModule providers:
- * provideTokenSetBearerInterceptor({ strictUrlMatch: true })
- * ```
+ * Create a token-set `CanActivateChildFn`. The behaviour host is resolved from
+ * DI (provided by {@link provideTokenSetRequirementPlannerHost}).
+ */
+function createTokenSetCanActivateChild(options) {
+    return createAngularCanActivateChild(options);
+}
+/**
+ * Declare a secured child route. Writes token-set registry requirement
+ * metadata only; enforcement is owned by a guarded
+ * {@link secureTokenSetRouteRoot} ancestor.
+ */
+function secureTokenSetRoute(path, security = {}, routeOptions) {
+    return secureRoute(path, {
+        requirements: security.requirements,
+        composition: security.composition,
+    }, routeOptions);
+}
+/**
+ * Declare a guarded token-set route root. Delegates guard assembly to the
+ * client-angular base helper and mounts registry-backed behaviour hooks.
  */
-class TokenSetBearerInterceptor {
-    registry = inject(TokenSetAuthRegistry);
-    options = inject(TOKEN_SET_BEARER_INTERCEPTOR_OPTIONS, { optional: true }) ?? {};
+function secureTokenSetRouteRoot(path, security = {}, routeOptions) {
+    const providers = [
+        ...(routeOptions?.providers ?? []),
+        provideTokenSetRequirementPlannerHost({
+            checkClientAuthenticated: security.checkClientAuthenticated,
+            onClientUnauthenticated: security.onClientUnauthenticated,
+            selectClientCandidate: security.selectClientCandidate,
+        }),
+    ];
+    return secureRouteRoot(path, {
+        requirements: security.requirements,
+        composition: security.composition,
+    }, {
+        ...routeOptions,
+        providers,
+    });
+}
+
+const TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST = new InjectionToken("TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST");
+class TokenSetClientRegistryAuthorizationInterceptor {
+    registry = inject(TOKEN_SET_CLIENT_REGISTRY);
+    authorizationForRequest = inject(TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST, {
+        optional: true,
+    }) ?? defaultTokenSetClientRegistryAuthorizationForRequest;
     intercept(req, next) {
-        const key = this.registry.clientKeyForUrl(req.url);
-        // When a client key matches but the client is still initializing
-        // (async clientFactory not yet resolved), registry.get() returns
-        // undefined. This is an explicit design decision: interceptors do NOT
-        // block the HTTP request waiting for client initialization.
-        // Responsibility for "ensure client is ready before making requests"
-        // belongs to route guards (which use whenReady() to await readiness).
-        // A not-yet-ready client correctly produces no token → request proceeds
-        // without Authorization header.
-        return from(resolveAuthorizationForRequest(this.registry, req.url, key, {
-            strictUrlMatch: this.options.strictUrlMatch,
-        })).pipe(switchMap((authorization) => {
+        return from(Promise.resolve(this.authorizationForRequest(this.registry, req))).pipe(switchMap((authorization) => {
             if (!authorization) {
                 return next.handle(req);
             }
             return next.handle(req.clone({ setHeaders: { Authorization: authorization } }));
         }));
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: TokenSetBearerInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: TokenSetBearerInterceptor });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.0", ngImport: i0, type: TokenSetClientRegistryAuthorizationInterceptor, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.0", ngImport: i0, type: TokenSetClientRegistryAuthorizationInterceptor });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: TokenSetBearerInterceptor, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.0", ngImport: i0, type: TokenSetClientRegistryAuthorizationInterceptor, decorators: [{
             type: Injectable
         }] });
-/**
- * Create an `HTTP_INTERCEPTORS` multi-provider entry for bearer token injection.
- *
- * Returns a single `Provider` object that registers {@link TokenSetBearerInterceptor}
- * as a class-based HTTP interceptor. Suitable for NgModule `providers` arrays.
- *
- * For functional-interceptor style (standalone apps using `provideHttpClient`),
- * use `createTokenSetBearerInterceptor()` with `withInterceptors()` instead.
- *
- * @example
- * ```ts
- * @NgModule({
- *   providers: [
- *     provideTokenSetAuth({ clients: [...] }),
- *     provideTokenSetBearerInterceptor(),     // <— replaces hand-written AuthInterceptor
- *     provideHttpClient(withInterceptorsFromDi()),
- *   ],
- * })
- * export class AppModule {}
- * ```
- */
-/**
- * Create an `HTTP_INTERCEPTORS` multi-provider entry for bearer token injection.
- *
- * Returns Angular providers that register {@link TokenSetBearerInterceptor}
- * as a class-based HTTP interceptor and (optionally) the
- * {@link BearerInterceptorOptions} that govern its URL-match behaviour.
- * Suitable for NgModule `providers` arrays.
- *
- * For functional-interceptor style (standalone apps using `provideHttpClient`),
- * use `createTokenSetBearerInterceptor()` with `withInterceptors()` instead.
- *
- * @example
- * ```ts
- * @NgModule({
- *   providers: [
- *     provideTokenSetAuth({ clients: [...] }),
- *     // Adopters with multiple backends or any third-party HTTP traffic
- *     // MUST opt into strictUrlMatch to prevent token leakage.
- *     provideTokenSetBearerInterceptor({ strictUrlMatch: true }),
- *     provideHttpClient(withInterceptorsFromDi()),
- *   ],
- * })
- * export class AppModule {}
- * ```
- */
-function provideTokenSetBearerInterceptor(options) {
+function provideTokenSetClientRegistryAuthorizationInterceptor(options) {
     const providers = [
         {
             provide: HTTP_INTERCEPTORS,
-            useClass: TokenSetBearerInterceptor,
+            useClass: TokenSetClientRegistryAuthorizationInterceptor,
             multi: true,
         },
     ];
     if (options) {
-        providers.push({
-            provide: TOKEN_SET_BEARER_INTERCEPTOR_OPTIONS,
-            useValue: options,
-        });
+        if (options.authorizationForRequest) {
+            providers.push({
+                provide: TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST,
+                useValue: options.authorizationForRequest,
+            });
+        }
     }
     return providers;
 }
-/**
- * Create an Angular `HttpInterceptorFn` that injects bearer authorization
- * headers, selecting the correct token from the multi-client registry
- * based on URL pattern matching.
- *
- * If no URL pattern matches, falls back to the first available token
- * (single-client convenience).
- *
- * ## Async client readiness
- *
- * The interceptor does **not** block or delay the HTTP request waiting for
- * an async client to materialize. If a client is still initializing when the
- * request fires, the request proceeds without an Authorization header.
- *
- * This is intentional: blocking HTTP for client initialization would deadlock
- * apps that make HTTP requests during initialization itself. Route guards
- * (which use `registry.whenReady()`) are the correct place to enforce
- * "client must be ready before user reaches this route".
- *
- * For NgModule-style apps using `HTTP_INTERCEPTORS`, use
- * `provideTokenSetBearerInterceptor()` instead.
- *
- * @example
- * ```ts
- * import { provideHttpClient, withInterceptors } from "@angular/common/http";
- * import { createTokenSetBearerInterceptor } from "@securitydept/token-set-context-client-angular";
- *
- * provideHttpClient(withInterceptors([
- *   createTokenSetBearerInterceptor(registry),
- * ]));
- * ```
- */
-/**
- * Create an Angular `HttpInterceptorFn` that injects bearer authorization
- * headers, selecting the correct token from the multi-client registry
- * based on URL pattern matching.
- *
- * If no URL pattern matches, the unmatched-URL behaviour is governed by
- * {@link BearerInterceptorOptions.strictUrlMatch}: the default falls back
- * to `registry.accessToken()` (single-client convenience), while
- * `strictUrlMatch: true` returns no token, ensuring bearer headers are
- * never injected for URLs outside the registered patterns.
- *
- * ## Async client readiness
- *
- * The interceptor does **not** block or delay the HTTP request waiting for
- * an async client to materialize. If a client is still initializing when the
- * request fires, the request proceeds without an Authorization header.
- *
- * This is intentional: blocking HTTP for client initialization would deadlock
- * apps that make HTTP requests during initialization itself. Route guards
- * (which use `registry.whenReady()`) are the correct place to enforce
- * "client must be ready before user reaches this route".
- *
- * For NgModule-style apps using `HTTP_INTERCEPTORS`, use
- * `provideTokenSetBearerInterceptor()` instead.
- *
- * @example
- * ```ts
- * import { provideHttpClient, withInterceptors } from "@angular/common/http";
- * import { createTokenSetBearerInterceptor } from "@securitydept/token-set-context-client-angular";
- *
- * provideHttpClient(withInterceptors([
- *   createTokenSetBearerInterceptor(registry, { strictUrlMatch: true }),
- * ]));
- * ```
- */
-function createTokenSetBearerInterceptor(registry, options = {}) {
-    return (req, next) => {
-        // Try URL-pattern-based client selection first.
-        const key = registry.clientKeyForUrl(req.url);
-        // Explicit not-yet-ready semantics: if the client exists in metadata
-        // (via clientKeyForUrl) but registry.get() returns undefined because the
-        // async clientFactory has not resolved yet, the request proceeds without
-        // a token. See class-based interceptor above for full rationale.
-        return from(resolveAuthorizationForRequest(registry, req.url, key, options)).pipe(switchMap((authorization) => {
+function createTokenSetClientRegistryAuthorizationInterceptor(options) {
+    return function tokenSetClientRegistryAuthorizationInterceptorFn(req, next) {
+        const registry = options?.registry ?? inject(TOKEN_SET_CLIENT_REGISTRY);
+        const authorizationForRequest = options?.authorizationForRequest ??
+            (options
+                ? null
+                : inject(TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST, {
+                    optional: true,
+                })) ??
+            defaultTokenSetClientRegistryAuthorizationForRequest;
+        return from(Promise.resolve(authorizationForRequest(registry, req))).pipe(switchMap((authorization) => {
             if (!authorization) {
                 return next(req);
             }
@@ -471,684 +160,130 @@ function createTokenSetBearerInterceptor(registry, options = {}) {
         }));
     };
 }
-async function resolveAuthorizationForRequest(registry, url, key, options) {
-    if (!key && options.strictUrlMatch) {
+async function defaultTokenSetClientRegistryAuthorizationForRequest(registry, request) {
+    const record = await registry.clientRecordForQuery({
+        url: request.url,
+    }, { initialize: true });
+    if (!record) {
         return null;
     }
-    const result = await registry.ensureAuthForResource({
-        key,
-        waitForReady: false,
-        source: TokenSetAuthFlowSource.HttpInterceptor,
-        needsAuthorizationHeader: true,
-        forceRefreshWhenDue: true,
-        url,
-    });
-    return result?.authorizationHeader ?? null;
+    const header = await record.client.authorizationHeaderValue.whenValue();
+    return header ?? null;
 }
 
-/**
- * Angular-native service for handling OIDC redirect callbacks,
- * with multi-client discrimination support.
- *
- * The post-authentication redirect URI is propagated automatically through
- * the core client's pending state (set via `loginWithRedirect({ postAuthRedirectUri })`
- * and recovered in `handleCallback()`). No manual URL storage is required.
- *
- * @example
- * ```ts
- * @Component({ ... })
- * export class AuthCallbackComponent {
- *   private readonly callbackService = inject(CallbackResumeService);
- *   private readonly router = inject(Router);
- *
- *   async ngOnInit() {
- *     const result = await this.callbackService.handleCallback(
- *       window.location.href,
- *     );
- *     this.router.navigateByUrl(result.resumeUrl, { replaceUrl: true });
- *   }
- * }
- * ```
- */
-class CallbackResumeService {
-    registry = inject(TokenSetAuthRegistry);
-    destroyRef = inject(DestroyRef, { optional: true });
-    controller = new TokenSetCallbackResumeController({
-        registry: this.registry.core,
-        getCallbackClient: (service) => service.client,
+class TokenSetBackendCallbackComponent {
+    clientQuery = input(/* @ts-ignore */
+    ...(ngDevMode ? [undefined, { debugName: "clientQuery" }] : /* istanbul ignore next */ []));
+    autoInitialize = input(true, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "autoInitialize" }] : /* istanbul ignore next */ []));
+    environment = inject(ENVIRONMENT);
+    registry = inject(TOKEN_SET_CLIENT_REGISTRY);
+    destroyRef = inject(DestroyRef);
+    selectionSource = createSignal(null);
+    selectionSignal = createComputed(() => this.selectionSource.get()?.get() ?? {
+        status: ResourceStatus.Idle,
     });
-    state = signal(this.controller.getState(), ...(ngDevMode ? [{ debugName: "state" }] : /* istanbul ignore next */ []));
-    state$ = signalToObservable(this.controller.state);
-    constructor() {
-        const cleanup = bridgeToAngularSignal(this.controller.state, this.state);
-        this.destroyRef?.onDestroy(() => {
-            cleanup();
-            this.controller.dispose();
-        });
-    }
-    /**
-     * Check whether a URL is an OIDC authorization callback for any registered
-     * client in this registry.
-     *
-     * This is a convenience wrapper over `clientKeyForCallback()`. Use it for
-     * programmatic early-exit guards (e.g. in a service constructor) before
-     * calling `handleCallback()`.
-     *
-     * @param url - The full URL to check (e.g. `window.location.href`).
-     * @returns `true` when the URL matches a registered callback path and
-     *   contains an `code` or `error` query parameter.
-     */
-    isCallback(url) {
-        return this.controller.isCallback(url);
-    }
-    getState() {
-        return this.controller.getState();
-    }
-    resume(optionsOrCallbackUrl, explicitClientKey) {
-        return this.controller.resume(typeof optionsOrCallbackUrl === "string"
-            ? { currentUrl: optionsOrCallbackUrl, clientKey: explicitClientKey }
-            : optionsOrCallbackUrl);
-    }
-    /**
-     * Handle the OIDC callback, auto-detecting which client the callback
-     * belongs to via registered callback paths.
-     *
-     * The `resumeUrl` in the result is taken directly from the core client's
-     * pending state (`postAuthRedirectUri` set at `loginWithRedirect()` time),
-     * falling back to `"/"` when no redirect URI was recorded.
-     *
-     * @param callbackUrl - The full current URL (e.g. `window.location.href`).
-     * @param explicitClientKey - Optional: force-select a client key instead of
-     *   auto-detecting from registered callback paths.
-     */
-    async handleCallback(callbackUrl, explicitClientKey) {
-        const result = await this.resume(callbackUrl, explicitClientKey);
-        return {
-            clientKey: result.clientKey,
-            snapshot: result.snapshot,
-            resumeUrl: result.postAuthRedirectUri ?? "/",
-        };
-    }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: CallbackResumeService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: CallbackResumeService });
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: CallbackResumeService, decorators: [{
-            type: Injectable
-        }], ctorParameters: () => [] });
-
-// ============================================================================
-// 8. Callback helper — OIDC redirect callback with multi-client discrimination
-// ============================================================================
-/**
- * Check whether the current URL is an OIDC authorization callback.
- */
-function isOidcCallback(options) {
-    try {
-        const url = new URL(options.currentUrl);
-        const callbackUrl = new URL(options.callbackPath, url.origin);
-        return (url.pathname === callbackUrl.pathname &&
-            (url.searchParams.has("code") || url.searchParams.has("error")));
-    }
-    catch {
-        return false;
-    }
-}
-
-/** InjectionToken for the multi-client auth registry. */
-const TOKEN_SET_AUTH_REGISTRY = new InjectionToken("TOKEN_SET_AUTH_REGISTRY");
-/**
- * InjectionToken for the current callback URL used by the drop-in callback component.
- *
- * Defaults to `window.location.href` in real page hosts and `undefined` in
- * non-page or test hosts unless explicitly overridden.
- */
-const TOKEN_SET_CALLBACK_CURRENT_URL = new InjectionToken("TOKEN_SET_CALLBACK_CURRENT_URL", {
-    providedIn: "root",
-    factory: () => () => {
-        const windowLike = globalThis.window;
-        return windowLike?.location?.href;
-    },
-});
-const TOKEN_SET_CALLBACK_COMPONENT_OPTIONS = new InjectionToken("TOKEN_SET_CALLBACK_COMPONENT_OPTIONS", {
-    providedIn: "root",
-    factory: () => ({
-        fallbackUrl: "/",
-        errorRedirectUrl: "/",
-    }),
-});
-
-/**
- * Create Angular providers for the multi-client token-set auth integration.
- *
- * Registers all services into Angular DI so adopters can directly inject
- * `TokenSetAuthRegistry`, `CallbackResumeService`, and look up individual
- * `TokenSetAuthService` instances by key.
- *
- * ## Async client initialization
- *
- * When a client's `clientFactory` returns a `Promise` (e.g. because it
- * needs to fetch a config projection from a backend endpoint), the
- * registry tracks its initialization state automatically. Guards and
- * interceptors should use `registry.whenReady(key)` to await
- * materialization before accessing the service.
- *
- * Adapter-managed browser clients also install token-set page-resume
- * reconciliation by default during materialization. Set
- * `resumeReconciliation: false` on an individual client entry only when the
- * host intentionally owns equivalent browser lifecycle wiring.
- *
- * @example
- * ```ts
- * import { provideTokenSetAuth } from "@securitydept/token-set-context-client-angular";
- * import { resolveConfigProjection, networkConfigSource, createFrontendOidcModeClient }
- *   from "@securitydept/token-set-context-client/frontend-oidc-mode";
- *
- * export const appConfig = {
- *   providers: [
- *     provideTokenSetAuth({
- *       clients: [
- *         {
- *           key: "main",
- *           // Async clientFactory: fetches config projection from backend
- *           clientFactory: async () => {
- *             const resolved = await resolveConfigProjection([
- *               networkConfigSource({
- *                 apiEndpoint: "https://api.example.com/api",
- *                 redirectUri: `${location.origin}/auth/callback`,
- *               }),
- *             ]);
- *             return createFrontendOidcModeClient(resolved.config, runtime);
- *           },
- *           urlPatterns: ["/api/"],
- *           callbackPath: "/auth/callback",
- *           // Optional: opt out only if the host already wires equivalent
- *           // resume reconciliation for this browser client.
- *           // resumeReconciliation: false,
- *         },
- *       ],
- *     }),
- *   ],
- * };
- * ```
- */
-function provideTokenSetAuth(options) {
-    return [
-        // Registry is a singleton — all clients share one registry.
-        {
-            provide: TokenSetAuthRegistry,
-            useFactory: () => new TokenSetAuthRegistry(),
-        },
-        // Eagerly register all client entries during environment initialization.
-        // provideEnvironmentInitializer runs in injection context, so inject() works.
-        // Note: async clientFactories create promises that the registry tracks;
-        // the initializer does not block Angular bootstrap on them (guards/interceptors
-        // use registry.whenReady() instead).
-        provideEnvironmentInitializer(() => {
-            const registry = inject(TokenSetAuthRegistry);
-            for (const entry of options.clients) {
-                registry.register(entry);
-            }
-            if (options.idleWarmup !== false) {
-                // Kick off idle-time preload for any lazy clients. The cancel
-                // handle is intentionally discarded — teardown happens through
-                // the registry's own DestroyRef binding at dispose time.
-                registry.idleWarmup();
-            }
-        }),
-        // Token for direct registry access.
-        {
-            provide: TOKEN_SET_AUTH_REGISTRY,
-            useExisting: TokenSetAuthRegistry,
-        },
-        // Callback resume service.
-        CallbackResumeService,
-    ];
-}
-
-// ---------------------------------------------------------------------------
-// Guard factory
-// ---------------------------------------------------------------------------
-/**
- * Create an Angular `CanActivateFn` that performs full-route requirement
- * aggregation and single-pass planner evaluation.
- *
- * **Canonical Angular Router auth pattern** (route-metadata driven):
- * 1. Requirements are declared in route `data` using `withRouteRequirements()`.
- * 2. When the guard runs, it walks `route.pathFromRoot` to collect ALL
- *    requirements from every ancestor segment in a single pass.
- * 3. Each requirement's `kind` is mapped to one or more registry clients,
- *    unless overridden by a `requirementPolicies[id].selector`.
- * 4. The complete candidate set is handed to the `PlannerHost` for a
- *    single `evaluate()` call — the planner selects the first unresolved
- *    requirement and calls the matching handler.
- *
- * **Handler resolution order** (most specific wins):
- * 1. `requirementPolicies[requirement.id].onUnauthenticated`
- * 2. `requirementHandlers[requirement.kind]`
- * 3. `defaultOnUnauthenticated`
- * 4. Block navigation (`false`) if none of the above is provided.
- *
- * **Client resolution order** for a requirement:
- * 1. `requirementPolicies[requirement.id].selector.clientKey` — single explicit key
- * 2. `requirementPolicies[requirement.id].selector.query` — composite query
- * 3. `registry.clientKeyListForRequirement(requirement.kind)` — default mapping
- *
- * This model enables:
- *   - One-pass requirement collection (no per-segment DI scope accumulation)
- *   - One-call planner evaluation (chooser sees the full set at once)
- *   - One redirect decision (no per-segment guard coordination needed)
- *   - Fine-grained per-requirement policy via `requirementPolicies`
- *
- * @example
- * ```ts
- * // routes.ts — declare requirements in route data
- * import { createBrowserPageClientEnvironment } from "@securitydept/client/web";
- * import {
- *   providePageClientEnvironment,
- *   withRouteRequirements,
- * } from "@securitydept/client-angular";
- * import {
- *   createTokenSetOidcLoginRedirectHandler,
- *   createTokenSetRouteAggregationGuard,
- * } from "@securitydept/token-set-context-client-angular";
- *
- * export const appConfig = {
- *   providers: [
- *     providePageClientEnvironment({
- *       environment: createBrowserPageClientEnvironment(),
- *     }),
- *   ],
- * };
- *
- * // Simple — kind-level handler
- * const guard = createTokenSetRouteAggregationGuard({
- *   requirementHandlers: {
- *     frontend_oidc: createTokenSetOidcLoginRedirectHandler({
- *       clientKey: "confluence",
- *     }),
- *   },
- * });
- *
- * // Fine-grained — per-requirement policy
- * const guard = createTokenSetRouteAggregationGuard({
- *   requirementPolicies: {
- *     "confluence-oidc": {
- *       selector: { clientKey: "confluence" },
- *       onUnauthenticated: () => "/auth/confluence",
- *     },
- *     "admin-oidc": {
- *       selector: { query: { providerFamily: "internal-sso" } },
- *       onUnauthenticated: (failing) => "/auth/admin",
- *     },
- *   },
- * });
- *
- * export const routes: Routes = [
- *   {
- *     path: "",
- *     data: withRouteRequirements([{ id: "session", kind: "session" }]),
- *     children: [
- *       {
- *         path: "confluence",
- *         data: withRouteRequirements([{ id: "confluence-oidc", kind: "frontend_oidc" }]),
- *         canActivate: [guard],
- *       },
- *     ],
- *   },
- * ];
- * ```
- */
-function createTokenSetRouteAggregationGuard(options = {}) {
-    return async (route, state) => {
-        const injector = inject(EnvironmentInjector);
-        const registry = inject(TokenSetAuthRegistry);
-        const router = inject(Router);
-        const handlerContext = {
-            route,
-            state,
-            attemptedUrl: state.url,
-        };
-        // ── Resolve planner-host ────────────────────────────────────────────
-        const plannerHost = options.plannerHostResolver?.(route, state) ??
-            options.plannerHost ??
-            inject(AUTH_PLANNER_HOST, { optional: true });
-        if (!plannerHost) {
-            throw new Error("[createTokenSetRouteAggregationGuard] No PlannerHost found. " +
-                "Provide AUTH_PLANNER_HOST via provideAuthPlannerHost() " +
-                "in your app/route providers, or pass plannerHost inline.");
+    selection = toNgSignal(this.selectionSignal, { requireSync: true });
+    resource = resourceFromSnapshots(() => {
+        const selection = this.selectionSignal.get();
+        switch (selection.status) {
+            case ResourceStatus.Idle:
+                return { status: ResourceStatus.Idle };
+            case ResourceStatus.Loading:
+                return { status: ResourceStatus.Loading };
+            case ResourceStatus.LoadingError:
+                return selection;
+            case ResourceStatus.Resolved:
+                return selection.value.kind ===
+                    TokenSetCallbackClientSelectionKind.NotApplicable
+                    ? {
+                        status: ResourceStatus.Resolved,
+                        value: { kind: OidcModeCallbackHandlingKind.NotApplicable },
+                    }
+                    : selection.value.client.callback.state.get();
         }
-        // ── Step 1: Full-route requirement aggregation ───────────────────────
-        const allRequirements = extractFullRouteRequirements(route, options.requirementsKey);
-        if (allRequirements.length === 0) {
-            return true;
-        }
-        const resolvedRequirements = [];
-        for (const req of allRequirements) {
-            const policy = options.requirementPolicies?.[req.id];
-            let clientKeys;
-            if (policy?.selector) {
-                if (policy.selector.clientKey) {
-                    clientKeys = [policy.selector.clientKey];
-                }
-                else if (policy.selector.query) {
-                    clientKeys = registry.clientKeysForOptions(policy.selector.query);
-                }
-                else {
-                    clientKeys = [];
-                }
-            }
-            else {
-                // Default: resolve by requirement kind.
-                clientKeys = registry.clientKeyListForRequirement(req.kind);
-            }
-            if (clientKeys.length === 0) {
-                // Unmapped requirement: leave it unresolved so other requirements can
-                // coexist in the same route chain without breaking the guard.
-                continue;
-            }
-            const entries = await Promise.all(clientKeys.map(async (key) => ({
-                // Use whenReady() — not require() — so that if the client's
-                // async clientFactory is still in-flight when the guard first
-                // fires, we block here until it materializes rather than
-                // crashing or silently bypassing auth.
-                service: await registry.whenReady(key),
-                clientKey: key,
-                meta: registry.metaFor(key),
-            })));
-            resolvedRequirements.push({ requirement: req, entries });
-        }
-        if (resolvedRequirements.length === 0) {
-            return true;
-        }
-        // ── Step 3: Build planner candidates ────────────────────────────────
-        // De-duplicate by requirementId (last declaration for the same id wins).
-        const seenIds = new Map();
-        for (const resolvedRequirement of resolvedRequirements) {
-            seenIds.set(resolvedRequirement.requirement.id, resolvedRequirement);
-        }
-        const deduped = [...seenIds.values()];
-        const candidates = deduped.map((resolvedRequirement) => ({
-            requirementId: resolvedRequirement.requirement.id,
-            requirementKind: resolvedRequirement.requirement.kind,
-            label: resolvedRequirement.requirement.label,
-            attributes: resolvedRequirement.requirement.attributes,
-            checkAuthenticated: () => resolvedRequirement.entries.every(({ service }) => service.isAuthenticated()),
-            onUnauthenticated: async () => {
-                const failing = resolvedRequirement.entries.filter(({ service }) => !service.isAuthenticated());
-                const handler = options.requirementPolicies?.[resolvedRequirement.requirement.id]
-                    ?.onUnauthenticated ??
-                    options.requirementHandlers?.[resolvedRequirement.requirement.kind] ??
-                    options.defaultOnUnauthenticated;
-                if (!handler)
-                    return false;
-                const result = runUnauthenticatedHandlerInContext(injector, handler, failing, resolvedRequirement.requirement, handlerContext);
-                const resolved = await result;
-                if (typeof resolved === "string")
-                    return resolved;
-                if (typeof resolved === "boolean")
-                    return resolved;
-                return resolved.toString();
-            },
-            _resolved: resolvedRequirement,
-        }));
-        // ── Step 4: Single planner evaluation ───────────────────────────────
-        const decide = async () => {
-            const result = await plannerHost.evaluate(candidates);
-            if (result.allAuthenticated)
-                return true;
-            if (result.pendingCandidate) {
-                const candidate = result.pendingCandidate;
-                const failing = candidate._resolved.entries.filter(({ service }) => !service.isAuthenticated());
-                // Handler resolution: policy > kind handler > default
-                const handler = options.requirementPolicies?.[candidate._resolved.requirement.id]
-                    ?.onUnauthenticated ??
-                    options.requirementHandlers?.[candidate._resolved.requirement.kind] ??
-                    options.defaultOnUnauthenticated;
-                if (!handler)
-                    return false;
-                const action = await runUnauthenticatedHandlerInContext(injector, handler, failing, candidate._resolved.requirement, handlerContext);
-                if (typeof action === "string")
-                    return router.parseUrl(action);
-                if (typeof action === "boolean")
-                    return action;
-                return action;
-            }
-            return false;
-        };
-        // ── Restore-aware: wait for all pending restores ─────────────────────
-        const pendingRestores = deduped
-            .flatMap((r) => r.entries)
-            .map(({ service }) => service.restorePromise)
-            .filter((p) => p !== null);
-        async function awaitAuthMaterial() {
-            await Promise.all(pendingRestores);
-            const freshnessBarriers = deduped
-                .flatMap((r) => r.entries.map((entry) => ({
-                ...entry,
-                requirement: r.requirement,
-            })))
-                .map(({ service, clientKey, meta, requirement }) => service.ensureAuthForResource({
-                source: TokenSetAuthFlowSource.RouteGuard,
-                clientKey,
-                requirement: { id: requirement.id, kind: requirement.kind },
-                providerFamily: meta.providerFamily,
-                url: state.url,
-                forceRefreshWhenDue: true,
+    });
+    state = toNgSignal(this.resource, { requireSync: true });
+    constructor() {
+        this.destroyRef.onDestroy(() => this.resource.dispose());
+        afterNextRender(() => {
+            this.selectionSource.set(selectTokenSetBackendCallbackClientFromRegistry({
+                registry: this.registry,
+                callbackUrl: this.environment.router?.currentUrl()?.toString() ?? "",
+                clientQuery: this.clientQuery(),
+                initialize: this.autoInitialize(),
             }));
-            await Promise.all(freshnessBarriers);
-        }
-        if (deduped.every((r) => r.entries.length === 0)) {
-            return decide();
-        }
-        // await the restore-phase Observable before running planner evaluation
-        // so the async guard always returns a Promise, not an Observable.
-        return firstValueFrom(from(awaitAuthMaterial()).pipe(switchMap(() => from(decide())), take(1)));
-    };
-}
-function runUnauthenticatedHandlerInContext(injector, handler, unauthenticated, requirement, context) {
-    return runInInjectionContext(injector, () => handler(unauthenticated, requirement, context));
-}
-function createTokenSetOidcLoginRedirectHandler(options = {}) {
-    return async (unauthenticated, _requirement, context) => {
-        const clientKey = options?.clientKey ?? unauthenticated[0]?.clientKey;
-        if (!clientKey)
-            return false;
-        const environmentPromise = resolveOidcRouteEnvironment(options?.environment);
-        const registry = inject(TokenSetAuthRegistry);
-        const service = await registry.whenReady(clientKey);
-        if (!isLoginWithRedirectClient(service.client)) {
-            failMissingOidcRedirectLoginCapability(clientKey);
-        }
-        const environment = await environmentPromise;
-        await service.client.loginWithRedirect({
-            environment,
-            postAuthRedirectUri: context.attemptedUrl || options?.fallbackPostAuthRedirectUri || "/",
         });
-        return await neverSettlingRedirectGuardResult();
-    };
-}
-function neverSettlingRedirectGuardResult() {
-    return new Promise(() => {
-        // Intentionally never resolves: a full-page browser redirect is in progress.
-    });
-}
-function resolveOidcRouteEnvironment(environmentOverride) {
-    return resolvePageClientEnvironmentSource(assertResolveEnvironment(environmentOverride ??
-        inject(PAGE_CLIENT_ENVIRONMENT, { optional: true }), failMissingOidcRouteEnvironment), failMissingOidcRouteEnvironment);
-}
-function failMissingOidcRouteEnvironment() {
-    throw new Error("createTokenSetOidcLoginRedirectHandler requires an explicit environment.\n" +
-        "Provide it once from the Angular composition root with providePageClientEnvironment({ environment }), where environment is a provider-scoped ClientEnvironmentService or another stable resolver.\n" +
-        "or pass a stable environment override with createTokenSetOidcLoginRedirectHandler({ environment: ... }).");
-}
-function failMissingOidcRedirectLoginCapability(clientKey) {
-    throw new Error(`createTokenSetOidcLoginRedirectHandler requires client key "${clientKey}" to implement OidcRedirectLoginClient.loginWithRedirect(options).`);
-}
-function isLoginWithRedirectClient(client) {
-    return (typeof client === "object" &&
-        client !== null &&
-        "loginWithRedirect" in client &&
-        typeof client.loginWithRedirect === "function");
-}
-
-/**
- * Route data key for choosing a planner-host registered at the route root.
- */
-const TOKEN_SET_ROUTE_PLANNER_HOST_KEY_DATA_KEY = "tokenSetPlannerHostKey";
-/**
- * Build a secured child route declaration.
- *
- * The returned route contains only serializable metadata:
- * requirements, composition strategy, planner-host lookup key, and any extra
- * route data the caller provides.
- */
-function secureRoute(path, securityOptions = {}, routeOptions = {}) {
-    const data = withRouteRequirements(securityOptions.requirements ?? [], {
-        composition: securityOptions.composition,
-        extra: {
-            ...(routeOptions.data ?? {}),
-            ...(securityOptions.plannerHostKey
-                ? {
-                    [TOKEN_SET_ROUTE_PLANNER_HOST_KEY_DATA_KEY]: securityOptions.plannerHostKey,
-                }
-                : {}),
-        },
-    });
-    return {
-        ...routeOptions,
-        path,
-        data,
-    };
-}
-/**
- * Build a secured route-tree root.
- *
- * This is the canonical Angular adopter entry for token-set route security:
- * root-level runtime policy stays here, child routes use {@link secureRoute}
- * for serializable declarations only.
- */
-function secureRouteRoot(path, securityOptions = {}, routeOptions = {}) {
-    const canActivate = createTokenSetRouteAggregationGuard({
-        requirementPolicies: securityOptions.requirementPolicies,
-        requirementHandlers: securityOptions.requirementHandlers,
-        defaultOnUnauthenticated: securityOptions.defaultOnUnauthenticated,
-        requirementsKey: securityOptions.requirementsKey,
-        plannerHostResolver: (route, state) => resolvePlannerHostForRoute(route, state, securityOptions),
-    });
-    const canActivateChild = createCanActivateChildAdapter(canActivate);
-    const baseRoute = secureRoute(path, securityOptions, routeOptions);
-    return {
-        ...baseRoute,
-        canActivate: [canActivate, ...(routeOptions.canActivate ?? [])],
-        canActivateChild: [
-            canActivateChild,
-            ...(routeOptions.canActivateChild ?? []),
-        ],
-    };
-}
-/**
- * Alias with a token-set-specific name for callers who prefer explicit imports.
- */
-const secureTokenSetRoute = secureRoute;
-/**
- * Alias with a token-set-specific name for callers who prefer explicit imports.
- */
-const secureTokenSetRouteRoot = secureRouteRoot;
-function createCanActivateChildAdapter(canActivate) {
-    return (childRoute, state) => canActivate(childRoute, state);
-}
-function resolvePlannerHostForRoute(route, _state, securityOptions) {
-    const plannerHostKey = findNearestPlannerHostKey(route) ?? securityOptions.defaultPlannerHostKey;
-    if (plannerHostKey) {
-        const resolved = securityOptions.plannerHosts?.[plannerHostKey];
-        if (!resolved) {
-            throw new Error(`[secureRouteRoot] No planner host registered for key "${plannerHostKey}"`);
-        }
-        return resolved;
     }
-    return undefined;
-}
-function findNearestPlannerHostKey(route) {
-    const chain = route.pathFromRoot ?? [route];
-    for (let index = chain.length - 1; index >= 0; index -= 1) {
-        const segment = chain[index];
-        if (!segment)
-            continue;
-        const raw = segment.data[TOKEN_SET_ROUTE_PLANNER_HOST_KEY_DATA_KEY] ??
-            segment.routeConfig?.data?.[TOKEN_SET_ROUTE_PLANNER_HOST_KEY_DATA_KEY];
-        if (typeof raw === "string" && raw.length > 0) {
-            return raw;
-        }
-    }
-    return undefined;
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.0", ngImport: i0, type: TokenSetBackendCallbackComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.1.0", version: "22.1.0", type: TokenSetBackendCallbackComponent, isStandalone: true, selector: "sd-token-set-backend-callback", inputs: { clientQuery: { classPropertyName: "clientQuery", publicName: "clientQuery", isSignal: true, isRequired: false, transformFunction: null }, autoInitialize: { classPropertyName: "autoInitialize", publicName: "autoInitialize", isSignal: true, isRequired: false, transformFunction: null } }, exportAs: ["sdTokenSetBackendCallback"], ngImport: i0, template: "", isInline: true });
 }
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.0", ngImport: i0, type: TokenSetBackendCallbackComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: "sd-token-set-backend-callback",
+                    standalone: true,
+                    template: "",
+                    exportAs: "sdTokenSetBackendCallback",
+                }]
+        }], ctorParameters: () => [], propDecorators: { clientQuery: [{ type: i0.Input, args: [{ isSignal: true, alias: "clientQuery", required: false }] }], autoInitialize: [{ type: i0.Input, args: [{ isSignal: true, alias: "autoInitialize", required: false }] }] } });
 
-// ============================================================================
-// 9. TokenSetCallbackComponent — drop-in standalone callback route component
-// ============================================================================
-/**
- * Drop-in standalone Angular component for OIDC redirect callback routes.
- *
- * Handles the full callback lifecycle on initialization:
- *   1. Calls `CallbackResumeService.resume()` with the current URL.
- *   2. Navigates to the post-auth redirect set at login time.
- *   3. On error: calls the optional `onError` hook and navigates to the
- *      configured error target (default `"/"`).
- *
- * Register as a route component — no additional glue needed:
- * ```ts
- * import { TokenSetCallbackComponent } from "@securitydept/token-set-context-client-angular";
- *
- * export const routes: Routes = [
- *   { path: "auth/callback", component: TokenSetCallbackComponent },
- * ];
- * ```
- *
- * Host policy can override `fallbackUrl`, `errorRedirectUrl`, and `onError`
- * through `TOKEN_SET_CALLBACK_COMPONENT_OPTIONS`. For fully custom UI or
- * orchestration, build your own component around `CallbackResumeService`.
- */
-class TokenSetCallbackComponent {
-    callbackService = inject(CallbackResumeService);
-    router = inject(Router);
-    getCurrentUrl = inject(TOKEN_SET_CALLBACK_CURRENT_URL);
-    options = inject(TOKEN_SET_CALLBACK_COMPONENT_OPTIONS, {
-        optional: true,
-    }) ?? {
-        fallbackUrl: "/",
-        errorRedirectUrl: "/",
-    };
-    ngOnInit() {
-        const fallbackUrl = this.options.fallbackUrl ?? "/";
-        const errorRedirectUrl = this.options.errorRedirectUrl ?? fallbackUrl;
-        const currentUrl = this.getCurrentUrl();
-        if (!currentUrl || !this.callbackService.isCallback(currentUrl)) {
-            this.router.navigateByUrl(fallbackUrl, { replaceUrl: true });
-            return;
+class TokenSetFrontendCallbackComponent {
+    clientQuery = input(/* @ts-ignore */
+    ...(ngDevMode ? [undefined, { debugName: "clientQuery" }] : /* istanbul ignore next */ []));
+    autoInitialize = input(true, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "autoInitialize" }] : /* istanbul ignore next */ []));
+    environment = inject(ENVIRONMENT);
+    registry = inject(TOKEN_SET_CLIENT_REGISTRY);
+    destroyRef = inject(DestroyRef);
+    selectionSource = createSignal(null);
+    selectionSignal = createComputed(() => this.selectionSource.get()?.get() ?? {
+        status: ResourceStatus.Idle,
+    });
+    selection = toNgSignal(this.selectionSignal, { requireSync: true });
+    resource = resourceFromSnapshots(() => {
+        const selection = this.selectionSignal.get();
+        switch (selection.status) {
+            case ResourceStatus.Idle:
+                return { status: ResourceStatus.Idle };
+            case ResourceStatus.Loading:
+                return { status: ResourceStatus.Loading };
+            case ResourceStatus.LoadingError:
+                return selection;
+            case ResourceStatus.Resolved:
+                return selection.value.kind ===
+                    TokenSetCallbackClientSelectionKind.NotApplicable
+                    ? {
+                        status: ResourceStatus.Resolved,
+                        value: { kind: OidcModeCallbackHandlingKind.NotApplicable },
+                    }
+                    : selection.value.client.callback.state.get();
         }
-        this.callbackService
-            .resume(currentUrl)
-            .then((result) => {
-            this.router.navigateByUrl(result.postAuthRedirectUri ?? "/", {
-                replaceUrl: true,
-            });
-        })
-            .catch((error) => {
-            this.options.onError?.(error);
-            this.router.navigateByUrl(errorRedirectUrl, { replaceUrl: true });
+    });
+    state = toNgSignal(this.resource, { requireSync: true });
+    constructor() {
+        this.destroyRef.onDestroy(() => this.resource.dispose());
+        afterNextRender(() => {
+            this.selectionSource.set(selectTokenSetFrontendCallbackClientFromRegistry({
+                registry: this.registry,
+                callbackUrl: this.environment.router?.currentUrl()?.toString() ?? "",
+                clientQuery: this.clientQuery(),
+                initialize: this.autoInitialize(),
+            }));
         });
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: TokenSetCallbackComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "21.2.12", type: TokenSetCallbackComponent, isStandalone: true, selector: "token-set-callback", ngImport: i0, template: "", isInline: true });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.0", ngImport: i0, type: TokenSetFrontendCallbackComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.1.0", version: "22.1.0", type: TokenSetFrontendCallbackComponent, isStandalone: true, selector: "sd-token-set-frontend-callback", inputs: { clientQuery: { classPropertyName: "clientQuery", publicName: "clientQuery", isSignal: true, isRequired: false, transformFunction: null }, autoInitialize: { classPropertyName: "autoInitialize", publicName: "autoInitialize", isSignal: true, isRequired: false, transformFunction: null } }, exportAs: ["sdTokenSetFrontendCallback"], ngImport: i0, template: "", isInline: true });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: TokenSetCallbackComponent, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.0", ngImport: i0, type: TokenSetFrontendCallbackComponent, decorators: [{
             type: Component,
             args: [{
-                    selector: "token-set-callback",
+                    selector: "sd-token-set-frontend-callback",
                     standalone: true,
                     template: "",
+                    exportAs: "sdTokenSetFrontendCallback",
                 }]
-        }] });
+        }], ctorParameters: () => [], propDecorators: { clientQuery: [{ type: i0.Input, args: [{ isSignal: true, alias: "clientQuery", required: false }] }], autoInitialize: [{ type: i0.Input, args: [{ isSignal: true, alias: "autoInitialize", required: false }] }] } });
 
 // Angular integration family for @securitydept/token-set-context-client
 //
@@ -1156,22 +291,19 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
 //   import { ... } from "@securitydept/token-set-context-client-angular"
 //
 // Multi-client-first Angular-native adapter surface:
-//   - Keyed client registration via provideTokenSetAuth()
-//   - Multi-client lookup via TokenSetAuthRegistry
-//   - Per-client TokenSetAuthService with signal + RxJS bridge
-//   - Multi-client bearer interceptor (functional + class-based)
-//   - provideTokenSetBearerInterceptor() for NgModule HTTP_INTERCEPTORS setup
-//   - OIDC callback resume with client key discrimination
-//   - CallbackResumeService.isCallback() for programmatic callback detection
-//   - TokenSetCallbackComponent standalone component (drop-in callback route)
+//   - Keyed client registration via provideTokenSetClientRegistry()
+//   - Multi-client lookup via the core TokenSetClientRegistry
+//   - Per-client mode client replay signals with RxJS bridge support
+//   - Client-registry authorization interceptor (functional + class-based)
+//   - provideTokenSetClientRegistryAuthorizationInterceptor() for NgModule HTTP_INTERCEPTORS setup
 //   - Requirement/provider-family → client key mapping
-//   - secureRouteRoot() / secureRoute() — canonical Angular Router route-security
-//     builders: keep non-serializable runtime policy at the root, let child
-//     routes declare serializable requirement metadata only, and wire both
-//     canActivate + canActivateChild to the full-route aggregation guard.
-//   - createTokenSetRouteAggregationGuard() — lower-level advanced guard for
-//     direct route-tree evaluation when adopters intentionally bypass the route
-//     builder helpers.
+//   - secureTokenSetRouteRoot() / secureTokenSetRoute() — token-set Angular
+//     Router route-security builders that delegate to the client-angular base
+//     helpers and mount the token-set behaviour host.
+//   - provideTokenSetRequirementPlannerHost() — provides the token-set
+//     RequirementPlannerHost behaviour to the client-angular guard pipeline.
+//   - createTokenSetCanActivate() / createTokenSetCanActivateChild() — token-set
+//     named guard factories over the client-angular base guards.
 //   - Signal/Observable bridge utilities live in @securitydept/client-angular
 //
 // Built by ng-packagr (APF / FESM2022). Decorators are fully supported.
@@ -1186,5 +318,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
  * Generated bundle index. Do not edit.
  */
 
-export { CallbackResumeService, TOKEN_SET_AUTH_REGISTRY, TOKEN_SET_BEARER_INTERCEPTOR_OPTIONS, TOKEN_SET_CALLBACK_COMPONENT_OPTIONS, TOKEN_SET_CALLBACK_CURRENT_URL, TOKEN_SET_ROUTE_PLANNER_HOST_KEY_DATA_KEY, TokenSetAuthRegistry, TokenSetAuthService, TokenSetBearerInterceptor, TokenSetCallbackComponent, createTokenSetBearerInterceptor, createTokenSetOidcLoginRedirectHandler, createTokenSetRouteAggregationGuard, isOidcCallback, provideTokenSetAuth, provideTokenSetBearerInterceptor, secureRoute, secureRouteRoot, secureTokenSetRoute, secureTokenSetRouteRoot };
+export { TOKEN_SET_CLIENT_REGISTRY, TOKEN_SET_CLIENT_REGISTRY_AUTHORIZATION_FOR_REQUEST, TokenSetBackendCallbackComponent, TokenSetClientRegistryAuthorizationInterceptor, TokenSetFrontendCallbackComponent, createTokenSetCanActivate, createTokenSetCanActivateChild, createTokenSetClientRegistryAuthorizationInterceptor, defaultTokenSetClientRegistryAuthorizationForRequest, provideTokenSetClientRegistry, provideTokenSetClientRegistryAuthorizationInterceptor, provideTokenSetRequirementPlannerHost, secureTokenSetRoute, secureTokenSetRouteRoot };
 //# sourceMappingURL=securitydept-token-set-context-client-angular.mjs.map