@arbidocs/blocks 0.5.20 → 0.5.21

package/dist/agents/index.js

@@ -1,8 +1,8 @@
 "use client";
-export { AgentCard, AgentGallery, ConversationListView, ConversationTurnSpeaker, DEFAULT_AGENT_CARD_LABELS, DEFAULT_AGENT_GALLERY_LABELS, DEFAULT_SKILL_CARD_LABELS, DEFAULT_SKILL_ROW_LABELS, DEFAULT_TASKS_CHROME_LABELS, DEFAULT_TASK_LIST_LABELS, DEFAULT_TASK_OUTPUTS_CELL_LABELS, DEFAULT_TASK_STATUS_PILL_LABELS, DEFAULT_TASK_THREAD_CHIP_LABELS, DEFAULT_UPLOAD_TASK_ITEM_LABELS, DEFAULT_UPLOAD_TASK_LIST_LABELS, DEFAULT_WORKFLOWS_CHROME_LABELS, SkillCard, SkillRow, TASK_COLUMN_ORDER, TaskInbox, TaskMoveDialog, TaskOutputsCell, TaskStatusPill, TaskTable, TaskThreadChip, TasksToolbar, ThreadNotifyDialog, UploadTaskItem, UploadTaskList, WorkflowsToolbar, createTaskColumns, filterConversationRows, formatElapsed, useWorkflowPreview } from '../chunk-MBRUUST5.js';
-export { ANNOTATE, ANNOTATE_ID, AUTOMATION_EVENTS, ActionStepBody, AgentAvatarField, AgentBar, AgentBarIconButton, AgentBarMenu, AgentBarNotes, AgentBarProbeAnswer, AgentBarQueuedNote, AgentBarStatus, AgentConnectInstructions, AgentCreateView, AgentCreatedView, AgentCreator, AgentEditView, AgentMainView, AgentTypeSelector, ApprovalEvidence, AssigneeLine, AssistantEntity, BUILTIN_SKILLS, CHRONOLOGY, CHRONOLOGY_ID, CUSTOM_TASK, CUSTOM_TASK_ID, CapabilityGrid, CapabilityTile, ConfigField, ConfigForm, ConsentActions, ConsentBulletList, ConsentCard, ConsentFootnote, ConsentHeader, ConsentMessage, ConsentNotice, ConsentPage, ConsentPermissionList, ConsentSection, ConsentStrong, ConsentText, CopyableUrl, DASHBOARD_OPERATIONS, DASHBOARD_PINNED, DEEP_RESEARCH, DEEP_RESEARCH_ID, DEFAULT_AGENT_AVATAR_FIELD_LABELS, DEFAULT_AGENT_BAR_LABELS, DEFAULT_AGENT_CAPABILITIES, DEFAULT_AGENT_CREATOR_LABELS, DEFAULT_AGENT_STEPS_LABELS, DEFAULT_AGENT_TEMPLATES, DEFAULT_AGENT_TYPES, DEFAULT_AGENT_TYPE_SELECTOR_LABELS, DEFAULT_AUTHORIZE_AGENT_LABELS, DEFAULT_CONFIG_FIELD_LABELS, DEFAULT_CONFIG_FORM_LABELS, DEFAULT_CONSENT_ACTIONS_LABELS, DEFAULT_COPYABLE_URL_LABELS, DEFAULT_NEW_THREAD_DIALOG_LABELS, DEFAULT_PILL_SELECT_LABELS, DEFAULT_RECURRENCE, DEFAULT_RECURRENCE_BUILDER_LABELS, DEFAULT_SKILL_EDIT_FORM_LABELS, DEFAULT_SKILL_GENERATE_FORM_LABELS, DEFAULT_SKILL_GLOBAL_BADGE_LABELS, DEFAULT_SKILL_VIEW_TOGGLE_LABELS, DEFAULT_STEP_BAR_LABELS, DEFAULT_SUBAGENT_ROSTER_LABELS, DEFAULT_TASK_ACTIVITY_LABELS, DEFAULT_TASK_COMPOSER_LABELS, DEFAULT_TASK_PLAN_LABELS, DEFAULT_TASK_RUNS_DIALOG_LABELS, DEFAULT_THREAD_LAUNCHER_LABELS, DEFAULT_THREAD_STATE_LABELS, DEFAULT_TUPLE_ARRAY_FIELD_LABELS, DEFAULT_WORKFLOW_RUNNER_LABELS, DEFAULT_WORKFLOW_RUN_STATUS_LABELS, DEFAULT_WORKFLOW_STEP_PARTS_LABELS, DEFAULT_WORKFLOW_THREAD_STRIP_LABELS, DERIVED_NAME_WORDS, EMPTY_NEW_THREAD, GENERATE_IMAGE, GENERATE_IMAGE_ID, GoalCriteria, IMAGE_ASPECT_AUTO, IMAGE_ASPECT_RATIOS, MAX_TASK_DEPTH, MODEL_NAME_ICONS, MODEL_TIER_ICON_MAP, MODEL_TIER_LABELS, NewThreadDialog, PillSelect, REMIND_TASK, REMIND_TASK_ID, RecurrenceBuilder, SKILL_FIELD_TYPE_LABELS, SKILL_MAIN_FILENAME, SKILL_SOURCE_LABELS, SKILL_TYPES, SKILL_TYPE_LABELS, STATUS_LABELS, STATUS_ORDER, STATUS_TONE, STEP_ICON_MAP, SUMMARISE, SUMMARISE_ID, SendBackControl, SkillActionButton, SkillDetail, SkillDetailSection, SkillEditForm, SkillFilterChips, SkillGenerateForm, SkillGlobalBadge, SkillLibraryDetail, SkillTile, SkillTypeBadge, SkillViewToggle, StepDetail, StepNarration, StepOutcome, StepParams, StepRow, StepSummary, StepTrace, StepTraceSummary, SubAgentLane, SubStepGroup, SubagentRoster, TAG_ICONS, TIMELINE, TIMELINE_ID, TIMELINE_PROMPT, TOOL_ICON_MAP, TRANSLATE, TRANSLATE_ID, TRANSLATE_LANGUAGES, TRIGGER_LABELS, TaskActivityDialog, TaskActivityTimeline, TaskComposer, TaskEmptyState, TaskFlow, TaskPlan, TaskRunsDialog, TaskStartDialog, ThreadActivity, ThreadLauncher, ThreadStatusLine, TupleArrayField, WEB_WORKFLOWS, WEEKDAYS, WORD_ASK, WORD_ASK_ID, WORD_CONTINUE, WORD_CONTINUE_ID, WORD_SUMMARISE, WORD_SUMMARISE_ID, WORD_SUPPORT, WORD_SUPPORT_ID, WORD_WORKFLOWS, WORKFLOW_REGISTRY, WorkflowRunStatus, WorkflowRunner, WorkflowStepAction, WorkflowThreadStartedBy, WorkflowThreadStrip, activeStepId, agentConfigSectionToValues, agentCreatorToConfigSection, asTaskStatus, authModeFor, buildLibrarySkills, buildRRule, buildTaskRows, buildZipSkillImport, closeWorkflowLaunch, compactThreadActivity, composePersona, composerToTaskQuery, composerToWorkRequest, composerToWorkflowRequest, composerToWorkflowUpdate, createsWork, defaultScopeRenderer, defaultTaskComposerValues, deriveAgentName, deriveAnnotationName, deriveWorkflowName, descendantIds, describeRRule, describeTrigger, filterLibrarySkills, firstWords, fromPlanAssignee, fromPlanDocumentRef, fromPlanSteps, getAgentStepIcon, getAgentStepPresentation, getCurrentAgentStepPresentation, getModelIcon, goalProgress, groupThreadActivity, hasTaskFields, humanizeSection, importMarkdownSkill, importSkillFile, importSkillFromUrl, indexTasks, inferType, inputDocumentIds, isAgenticWorkflow, isIncompleteSignal, isMainSkillFile, isOutOfBounds, isPlainTodo, isSupersededStop, isValidAgentName, isoToLocalInput, latestMessageTime, layoutFromPlanSteps, linkedRunsFromActivity, localInputToIso, moveTargets, newThreadToRequest, nextCriterionId, notifiedLabel, openWorkflowLaunch, ownerExtId, parseRRule, parseSkillFrontmatter, prettifyKey, readSkillArchive, recordWorkflowUse, renderWorkflowIcon, resetWorkflowUsage, resolveScopeInputs, serializeSkill, skillSlug, sortByRecentUse, stepAccent, stepWindow, stripPersonaPreamble, summarizeAgent, summarizeCapabilities, taskActivityHeadline, taskComposerToCreateRequest, taskComposerToUpdateRequest, taskNeedsAccess, taskToComposerValues, toPlanAssignee, toPlanDocumentRef, toPlanSteps, unnotifiedMentions, useWorkflowLaunchRequest, useWorkflowUsage, useWorkflowView, workflowFromSkillMarkdown, workflowTaskFields, workflowToComposerValues, workflowToSkillMarkdown, workflowWhen } from '../chunk-WJZK5GAV.js';
+export { AgentCard, AgentGallery, ConversationListView, ConversationTurnSpeaker, DEFAULT_AGENT_CARD_LABELS, DEFAULT_AGENT_GALLERY_LABELS, DEFAULT_SKILL_CARD_LABELS, DEFAULT_SKILL_ROW_LABELS, DEFAULT_TASKS_CHROME_LABELS, DEFAULT_TASK_LIST_LABELS, DEFAULT_TASK_OUTPUTS_CELL_LABELS, DEFAULT_TASK_STATUS_PILL_LABELS, DEFAULT_TASK_THREAD_CHIP_LABELS, DEFAULT_UPLOAD_TASK_ITEM_LABELS, DEFAULT_UPLOAD_TASK_LIST_LABELS, DEFAULT_WORKFLOWS_CHROME_LABELS, SkillCard, SkillRow, TASK_COLUMN_ORDER, TaskInbox, TaskMoveDialog, TaskOutputsCell, TaskStatusPill, TaskTable, TaskThreadChip, TasksToolbar, ThreadNotifyDialog, UploadTaskItem, UploadTaskList, WorkflowsToolbar, createTaskColumns, filterConversationRows, formatElapsed, useWorkflowPreview } from '../chunk-F7IQGPZH.js';
+export { ANNOTATE, ANNOTATE_ID, AUTOMATION_EVENTS, ActionStepBody, AgentAvatarField, AgentBar, AgentBarIconButton, AgentBarMenu, AgentBarNotes, AgentBarProbeAnswer, AgentBarQueuedNote, AgentBarStatus, AgentConnectInstructions, AgentCreateView, AgentCreatedView, AgentCreator, AgentEditView, AgentMainView, AgentTypeSelector, ApprovalEvidence, AssigneeLine, AssistantEntity, BUILTIN_SKILLS, CHRONOLOGY, CHRONOLOGY_ID, CUSTOM_TASK, CUSTOM_TASK_ID, CapabilityGrid, CapabilityTile, ConfigField, ConfigForm, ConsentActions, ConsentBulletList, ConsentCard, ConsentFootnote, ConsentHeader, ConsentMessage, ConsentNotice, ConsentPage, ConsentPermissionList, ConsentSection, ConsentStrong, ConsentText, CopyableUrl, DASHBOARD_OPERATIONS, DASHBOARD_PINNED, DEEP_RESEARCH, DEEP_RESEARCH_ID, DEFAULT_AGENT_AVATAR_FIELD_LABELS, DEFAULT_AGENT_BAR_LABELS, DEFAULT_AGENT_CAPABILITIES, DEFAULT_AGENT_CREATOR_LABELS, DEFAULT_AGENT_STEPS_LABELS, DEFAULT_AGENT_TEMPLATES, DEFAULT_AGENT_TYPES, DEFAULT_AGENT_TYPE_SELECTOR_LABELS, DEFAULT_AUTHORIZE_AGENT_LABELS, DEFAULT_CONFIG_FIELD_LABELS, DEFAULT_CONFIG_FORM_LABELS, DEFAULT_CONSENT_ACTIONS_LABELS, DEFAULT_COPYABLE_URL_LABELS, DEFAULT_NEW_THREAD_DIALOG_LABELS, DEFAULT_PILL_SELECT_LABELS, DEFAULT_RECURRENCE, DEFAULT_RECURRENCE_BUILDER_LABELS, DEFAULT_SKILL_EDIT_FORM_LABELS, DEFAULT_SKILL_GENERATE_FORM_LABELS, DEFAULT_SKILL_GLOBAL_BADGE_LABELS, DEFAULT_SKILL_VIEW_TOGGLE_LABELS, DEFAULT_STEP_BAR_LABELS, DEFAULT_SUBAGENT_ROSTER_LABELS, DEFAULT_TASK_ACTIVITY_LABELS, DEFAULT_TASK_COMPOSER_LABELS, DEFAULT_TASK_PLAN_LABELS, DEFAULT_TASK_RUNS_DIALOG_LABELS, DEFAULT_THREAD_LAUNCHER_LABELS, DEFAULT_THREAD_STATE_LABELS, DEFAULT_TUPLE_ARRAY_FIELD_LABELS, DEFAULT_WORKFLOW_RUNNER_LABELS, DEFAULT_WORKFLOW_RUN_STATUS_LABELS, DEFAULT_WORKFLOW_STEP_PARTS_LABELS, DEFAULT_WORKFLOW_THREAD_STRIP_LABELS, DERIVED_NAME_WORDS, EMPTY_NEW_THREAD, GENERATE_IMAGE, GENERATE_IMAGE_ID, GoalCriteria, IMAGE_ASPECT_AUTO, IMAGE_ASPECT_RATIOS, MAX_TASK_DEPTH, MODEL_NAME_ICONS, MODEL_TIER_ICON_MAP, MODEL_TIER_LABELS, NewThreadDialog, PillSelect, REMIND_TASK, REMIND_TASK_ID, RecurrenceBuilder, SKILL_FIELD_TYPE_LABELS, SKILL_MAIN_FILENAME, SKILL_SOURCE_LABELS, SKILL_TYPES, SKILL_TYPE_LABELS, STATUS_LABELS, STATUS_ORDER, STATUS_TONE, STEP_ICON_MAP, SUMMARISE, SUMMARISE_ID, SendBackControl, SkillActionButton, SkillDetail, SkillDetailSection, SkillEditForm, SkillFilterChips, SkillGenerateForm, SkillGlobalBadge, SkillLibraryDetail, SkillTile, SkillTypeBadge, SkillViewToggle, StepDetail, StepNarration, StepOutcome, StepParams, StepRow, StepSummary, StepTrace, StepTraceSummary, SubAgentLane, SubStepGroup, SubagentRoster, TAG_ICONS, TIMELINE, TIMELINE_ID, TIMELINE_PROMPT, TOOL_ICON_MAP, TRANSLATE, TRANSLATE_ID, TRANSLATE_LANGUAGES, TRIGGER_LABELS, TaskActivityDialog, TaskActivityTimeline, TaskComposer, TaskEmptyState, TaskFlow, TaskPlan, TaskRunsDialog, TaskStartDialog, ThreadActivity, ThreadLauncher, ThreadStatusLine, TupleArrayField, WEB_WORKFLOWS, WEEKDAYS, WORD_ASK, WORD_ASK_ID, WORD_CONTINUE, WORD_CONTINUE_ID, WORD_SUMMARISE, WORD_SUMMARISE_ID, WORD_SUPPORT, WORD_SUPPORT_ID, WORD_WORKFLOWS, WORKFLOW_REGISTRY, WorkflowRunStatus, WorkflowRunner, WorkflowStepAction, WorkflowThreadStartedBy, WorkflowThreadStrip, activeStepId, agentConfigSectionToValues, agentCreatorToConfigSection, asTaskStatus, authModeFor, buildLibrarySkills, buildRRule, buildTaskRows, buildZipSkillImport, closeWorkflowLaunch, compactThreadActivity, composePersona, composerToTaskQuery, composerToWorkRequest, composerToWorkflowRequest, composerToWorkflowUpdate, createsWork, defaultScopeRenderer, defaultTaskComposerValues, deriveAgentName, deriveAnnotationName, deriveWorkflowName, descendantIds, describeRRule, describeTrigger, filterLibrarySkills, firstWords, fromPlanAssignee, fromPlanDocumentRef, fromPlanSteps, getAgentStepIcon, getAgentStepPresentation, getCurrentAgentStepPresentation, getModelIcon, goalProgress, groupThreadActivity, hasTaskFields, humanizeSection, importMarkdownSkill, importSkillFile, importSkillFromUrl, indexTasks, inferType, inputDocumentIds, isAgenticWorkflow, isIncompleteSignal, isMainSkillFile, isOutOfBounds, isPlainTodo, isSupersededStop, isValidAgentName, isoToLocalInput, latestMessageTime, layoutFromPlanSteps, linkedRunsFromActivity, localInputToIso, moveTargets, newThreadToRequest, nextCriterionId, notifiedLabel, openWorkflowLaunch, ownerExtId, parseRRule, parseSkillFrontmatter, prettifyKey, readSkillArchive, recordWorkflowUse, renderWorkflowIcon, resetWorkflowUsage, resolveScopeInputs, serializeSkill, skillSlug, sortByRecentUse, stepAccent, stepWindow, stripPersonaPreamble, summarizeAgent, summarizeCapabilities, taskActivityHeadline, taskComposerToCreateRequest, taskComposerToUpdateRequest, taskNeedsAccess, taskToComposerValues, toPlanAssignee, toPlanDocumentRef, toPlanSteps, unnotifiedMentions, useWorkflowLaunchRequest, useWorkflowUsage, useWorkflowView, workflowFromSkillMarkdown, workflowTaskFields, workflowToComposerValues, workflowToSkillMarkdown, workflowWhen } from '../chunk-DTENNALR.js';
 import '../chunk-CQCC7LE7.js';
-export { AgentSelect, DEFAULT_AGENT_SELECT_LABELS, DEFAULT_SCHEMA_FORM_LABELS, DEFAULT_TASK_TRIGGER_CHIP_LABELS, DEFAULT_WORKFLOW_CONFIG_DIALOG_LABELS, DEFAULT_WORKFLOW_DOCUMENTS_FIELD_LABELS, DEFAULT_WORKFLOW_LIST_LABELS, PersonPill, SchemaForm, TaskTriggerChip, WORKFLOW_COLUMN_ORDER, WorkflowConfigDialog, WorkflowDocumentsField, WorkflowLauncher, WorkflowsTable, buildWorkflowScopeSource, createWorkflowColumns, documentScopeLabels, hasTrigger, isSkillRow, matchWorkflowScope, workflowStatus, workflowTriggerType } from '../chunk-PYJUIEYV.js';
+export { AgentSelect, DEFAULT_AGENT_SELECT_LABELS, DEFAULT_SCHEMA_FORM_LABELS, DEFAULT_TASK_TRIGGER_CHIP_LABELS, DEFAULT_WORKFLOW_CONFIG_DIALOG_LABELS, DEFAULT_WORKFLOW_DOCUMENTS_FIELD_LABELS, DEFAULT_WORKFLOW_LIST_LABELS, PersonPill, SchemaForm, TaskTriggerChip, WORKFLOW_COLUMN_ORDER, WorkflowConfigDialog, WorkflowDocumentsField, WorkflowLauncher, WorkflowsTable, buildWorkflowScopeSource, createWorkflowColumns, documentScopeLabels, hasTrigger, isSkillRow, matchWorkflowScope, workflowStatus, workflowTriggerType } from '../chunk-YT5OOFK3.js';
 import '../chunk-KMF3ORIV.js';
 import '../chunk-G4GLDQLY.js';
 import '../chunk-M4S75AEJ.js';
@@ -12,9 +12,9 @@ import '../chunk-RLWIUUQ5.js';
 import '../chunk-YU2KUMGE.js';
 import '../chunk-ML62FUHZ.js';
 import '../chunk-7F5Z4K5W.js';
+import '../chunk-WNDIVNPT.js';
 import '../chunk-ABEKUV6L.js';
 import '../chunk-P6GHJSLR.js';
-import '../chunk-WNDIVNPT.js';
 export { DEFAULT_ASSIGNEE_WORDING, DEFAULT_STEP_DOCUMENT_LABELS, DEFAULT_STEP_KIND_LABELS, DEFAULT_STEP_RECORD_LABELS, STEP_KIND_ICONS, StepDocumentButton, StepDocumentCards, StepRecord, WORKFLOW_STEP_KINDS, assigneeName, canAssign, composeStepPrompt, dependsOn, fillRunText, fillStepInputs, initialRunInputs, isPersonAction, isPersonStep, isRunFinished, isSteppedWorkflow, nextAction, orderSteps, reviewInstructions, runFields, runFieldsOf, runThreadTitle, sendBackTargets, splitDocRef, stepConfigProblems, stepDependencies, stepDocuments, stepFields, stepKindOf, stepLevels, stepPhase, stepStatesFromActivity, upstreamSteps, validateStep, validateWorkflowGraph, workflowSteps } from '../chunk-THNTNAYI.js';
 export { EMPTY_WORKFLOW_SCOPE, SKILL_PROMPT_FALLBACK_PLACEHOLDER, SKILL_PROMPT_LABEL, buildLaunch, composeWorkflowPrompt, defaultInputs, fieldToFrontmatter, inputsFromContext, isEmptyWorkflowScope, isWorkflowScope, mergeSkillWorkflows, promptFieldName, skillTitle, skillToWorkflow, validateInputs, workflowAccepts, workflowFromFrontmatter, workflowsAccepting, workflowsForHost } from '../chunk-TZGBRLPK.js';
 import '../chunk-AUS3KBHJ.js';

package/dist/auth/index.cjs

@@ -1,157 +1,157 @@
 "use client";
 'use strict';
 
-var chunkMKNSIZWR_cjs = require('../chunk-MKNSIZWR.cjs');
-var chunkEWRRV37Z_cjs = require('../chunk-EWRRV37Z.cjs');
+var chunkMSPNYW6Z_cjs = require('../chunk-MSPNYW6Z.cjs');
+var chunkK237IYOD_cjs = require('../chunk-K237IYOD.cjs');
 var chunkCG757WKY_cjs = require('../chunk-CG757WKY.cjs');
 require('../chunk-MHVNT4J3.cjs');
 require('../chunk-DES3K4SD.cjs');
 
 
 
+Object.defineProperty(exports, "DEFAULT_SSO_LOGIN_BUTTON_LABELS", {
+  enumerable: true,
+  get: function () { return chunkMSPNYW6Z_cjs.DEFAULT_SSO_LOGIN_BUTTON_LABELS; }
+});
+Object.defineProperty(exports, "SsoLoginButton", {
+  enumerable: true,
+  get: function () { return chunkMSPNYW6Z_cjs.SsoLoginButton; }
+});
 Object.defineProperty(exports, "consumeFragmentCredentials", {
   enumerable: true,
-  get: function () { return chunkMKNSIZWR_cjs.consumeFragmentCredentials; }
+  get: function () { return chunkMSPNYW6Z_cjs.consumeFragmentCredentials; }
 });
 Object.defineProperty(exports, "isAuthRoutePath", {
   enumerable: true,
-  get: function () { return chunkMKNSIZWR_cjs.isAuthRoutePath; }
+  get: function () { return chunkMSPNYW6Z_cjs.isAuthRoutePath; }
 });
 Object.defineProperty(exports, "normalizeAuthPath", {
   enumerable: true,
-  get: function () { return chunkMKNSIZWR_cjs.normalizeAuthPath; }
+  get: function () { return chunkMSPNYW6Z_cjs.normalizeAuthPath; }
 });
 Object.defineProperty(exports, "parseFragmentCredentials", {
   enumerable: true,
-  get: function () { return chunkMKNSIZWR_cjs.parseFragmentCredentials; }
+  get: function () { return chunkMSPNYW6Z_cjs.parseFragmentCredentials; }
 });
 Object.defineProperty(exports, "preserveAuthReturnUrl", {
   enumerable: true,
-  get: function () { return chunkMKNSIZWR_cjs.preserveAuthReturnUrl; }
+  get: function () { return chunkMSPNYW6Z_cjs.preserveAuthReturnUrl; }
 });
 Object.defineProperty(exports, "useFragmentCredentials", {
   enumerable: true,
-  get: function () { return chunkMKNSIZWR_cjs.useFragmentCredentials; }
+  get: function () { return chunkMSPNYW6Z_cjs.useFragmentCredentials; }
 });
 Object.defineProperty(exports, "AccountRecoveryDialog", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AccountRecoveryDialog; }
+  get: function () { return chunkK237IYOD_cjs.AccountRecoveryDialog; }
 });
 Object.defineProperty(exports, "AuthAlert", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthAlert; }
+  get: function () { return chunkK237IYOD_cjs.AuthAlert; }
 });
 Object.defineProperty(exports, "AuthConsent", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthConsent; }
+  get: function () { return chunkK237IYOD_cjs.AuthConsent; }
 });
 Object.defineProperty(exports, "AuthDivider", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthDivider; }
+  get: function () { return chunkK237IYOD_cjs.AuthDivider; }
 });
 Object.defineProperty(exports, "AuthField", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthField; }
+  get: function () { return chunkK237IYOD_cjs.AuthField; }
 });
 Object.defineProperty(exports, "AuthFieldBadge", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthFieldBadge; }
+  get: function () { return chunkK237IYOD_cjs.AuthFieldBadge; }
 });
 Object.defineProperty(exports, "AuthFooterLinks", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthFooterLinks; }
+  get: function () { return chunkK237IYOD_cjs.AuthFooterLinks; }
 });
 Object.defineProperty(exports, "AuthHeading", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthHeading; }
+  get: function () { return chunkK237IYOD_cjs.AuthHeading; }
 });
 Object.defineProperty(exports, "AuthHero", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthHero; }
+  get: function () { return chunkK237IYOD_cjs.AuthHero; }
 });
 Object.defineProperty(exports, "AuthInput", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthInput; }
+  get: function () { return chunkK237IYOD_cjs.AuthInput; }
 });
 Object.defineProperty(exports, "AuthLayout", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthLayout; }
+  get: function () { return chunkK237IYOD_cjs.AuthLayout; }
 });
 Object.defineProperty(exports, "AuthLink", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthLink; }
+  get: function () { return chunkK237IYOD_cjs.AuthLink; }
 });
 Object.defineProperty(exports, "AuthNote", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthNote; }
+  get: function () { return chunkK237IYOD_cjs.AuthNote; }
 });
 Object.defineProperty(exports, "AuthOfflineBadge", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthOfflineBadge; }
+  get: function () { return chunkK237IYOD_cjs.AuthOfflineBadge; }
 });
 Object.defineProperty(exports, "AuthSubmitButton", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthSubmitButton; }
+  get: function () { return chunkK237IYOD_cjs.AuthSubmitButton; }
 });
 Object.defineProperty(exports, "AuthTabs", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.AuthTabs; }
+  get: function () { return chunkK237IYOD_cjs.AuthTabs; }
 });
 Object.defineProperty(exports, "DEFAULT_ACCOUNT_RECOVERY_DIALOG_LABELS", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.DEFAULT_ACCOUNT_RECOVERY_DIALOG_LABELS; }
+  get: function () { return chunkK237IYOD_cjs.DEFAULT_ACCOUNT_RECOVERY_DIALOG_LABELS; }
 });
 Object.defineProperty(exports, "DEFAULT_AUTH_CONSENT_LABELS", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.DEFAULT_AUTH_CONSENT_LABELS; }
+  get: function () { return chunkK237IYOD_cjs.DEFAULT_AUTH_CONSENT_LABELS; }
 });
 Object.defineProperty(exports, "DEFAULT_AUTH_FOOTER_LINKS_LABELS", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.DEFAULT_AUTH_FOOTER_LINKS_LABELS; }
+  get: function () { return chunkK237IYOD_cjs.DEFAULT_AUTH_FOOTER_LINKS_LABELS; }
 });
 Object.defineProperty(exports, "DEFAULT_AUTH_OFFLINE_BADGE_LABELS", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.DEFAULT_AUTH_OFFLINE_BADGE_LABELS; }
+  get: function () { return chunkK237IYOD_cjs.DEFAULT_AUTH_OFFLINE_BADGE_LABELS; }
 });
 Object.defineProperty(exports, "DEFAULT_PASSWORD_RULES", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.DEFAULT_PASSWORD_RULES; }
+  get: function () { return chunkK237IYOD_cjs.DEFAULT_PASSWORD_RULES; }
 });
 Object.defineProperty(exports, "DEFAULT_RECOVERY_KEY_DIALOG_LABELS", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.DEFAULT_RECOVERY_KEY_DIALOG_LABELS; }
+  get: function () { return chunkK237IYOD_cjs.DEFAULT_RECOVERY_KEY_DIALOG_LABELS; }
 });
 Object.defineProperty(exports, "DEFAULT_REVEALABLE_PASSWORD_INPUT_LABELS", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.DEFAULT_REVEALABLE_PASSWORD_INPUT_LABELS; }
-});
-Object.defineProperty(exports, "DEFAULT_SSO_LOGIN_BUTTON_LABELS", {
-  enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.DEFAULT_SSO_LOGIN_BUTTON_LABELS; }
+  get: function () { return chunkK237IYOD_cjs.DEFAULT_REVEALABLE_PASSWORD_INPUT_LABELS; }
 });
 Object.defineProperty(exports, "RecoveryKeyDialog", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.RecoveryKeyDialog; }
+  get: function () { return chunkK237IYOD_cjs.RecoveryKeyDialog; }
 });
 Object.defineProperty(exports, "RevealablePasswordInput", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.RevealablePasswordInput; }
-});
-Object.defineProperty(exports, "SsoLoginButton", {
-  enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.SsoLoginButton; }
+  get: function () { return chunkK237IYOD_cjs.RevealablePasswordInput; }
 });
 Object.defineProperty(exports, "createPasswordRules", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.createPasswordRules; }
+  get: function () { return chunkK237IYOD_cjs.createPasswordRules; }
 });
 Object.defineProperty(exports, "parseAuthError", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.parseAuthError; }
+  get: function () { return chunkK237IYOD_cjs.parseAuthError; }
 });
 Object.defineProperty(exports, "promptSaveCredential", {
   enumerable: true,
-  get: function () { return chunkEWRRV37Z_cjs.promptSaveCredential; }
+  get: function () { return chunkK237IYOD_cjs.promptSaveCredential; }
 });
 Object.defineProperty(exports, "DEFAULT_PASSWORD_STRENGTH_INPUT_LABELS", {
   enumerable: true,

package/dist/auth/index.js

@@ -1,6 +1,6 @@
 "use client";
-export { consumeFragmentCredentials, isAuthRoutePath, normalizeAuthPath, parseFragmentCredentials, preserveAuthReturnUrl, useFragmentCredentials } from '../chunk-6AXJBTHM.js';
-export { AccountRecoveryDialog, AuthAlert, AuthConsent, AuthDivider, AuthField, AuthFieldBadge, AuthFooterLinks, AuthHeading, AuthHero, AuthInput, AuthLayout, AuthLink, AuthNote, AuthOfflineBadge, AuthSubmitButton, AuthTabs, DEFAULT_ACCOUNT_RECOVERY_DIALOG_LABELS, DEFAULT_AUTH_CONSENT_LABELS, DEFAULT_AUTH_FOOTER_LINKS_LABELS, DEFAULT_AUTH_OFFLINE_BADGE_LABELS, DEFAULT_PASSWORD_RULES, DEFAULT_RECOVERY_KEY_DIALOG_LABELS, DEFAULT_REVEALABLE_PASSWORD_INPUT_LABELS, DEFAULT_SSO_LOGIN_BUTTON_LABELS, RecoveryKeyDialog, RevealablePasswordInput, SsoLoginButton, createPasswordRules, parseAuthError, promptSaveCredential } from '../chunk-MVP7METT.js';
+export { DEFAULT_SSO_LOGIN_BUTTON_LABELS, SsoLoginButton, consumeFragmentCredentials, isAuthRoutePath, normalizeAuthPath, parseFragmentCredentials, preserveAuthReturnUrl, useFragmentCredentials } from '../chunk-KL6XOSEN.js';
+export { AccountRecoveryDialog, AuthAlert, AuthConsent, AuthDivider, AuthField, AuthFieldBadge, AuthFooterLinks, AuthHeading, AuthHero, AuthInput, AuthLayout, AuthLink, AuthNote, AuthOfflineBadge, AuthSubmitButton, AuthTabs, DEFAULT_ACCOUNT_RECOVERY_DIALOG_LABELS, DEFAULT_AUTH_CONSENT_LABELS, DEFAULT_AUTH_FOOTER_LINKS_LABELS, DEFAULT_AUTH_OFFLINE_BADGE_LABELS, DEFAULT_PASSWORD_RULES, DEFAULT_RECOVERY_KEY_DIALOG_LABELS, DEFAULT_REVEALABLE_PASSWORD_INPUT_LABELS, RecoveryKeyDialog, RevealablePasswordInput, createPasswordRules, parseAuthError, promptSaveCredential } from '../chunk-IXBJEQH5.js';
 export { DEFAULT_PASSWORD_STRENGTH_INPUT_LABELS, PasswordStrengthInput } from '../chunk-P6OLZGQA.js';
 import '../chunk-7F6CBP3Z.js';
 import '../chunk-VUNV25KB.js';

package/dist/auth0/index.cjs

@@ -84,14 +84,15 @@ function auth0Sso({ domain, callbackPath = "/sso" }) {
           family_name: user.family_name,
           picture: user.picture
         } : null,
-        async signIn({ returnTo, redirectUri, consent } = {}) {
+        async signIn({ returnTo, redirectUri, consent, connection } = {}) {
           rememberAuth0Token(null);
           await loginWithRedirect({
             ...returnTo ? { appState: { returnTo } } : {},
-            ...redirectUri || consent ? {
+            ...redirectUri || consent || connection ? {
               authorizationParams: {
                 ...redirectUri ? { redirect_uri: redirectUri } : {},
-                ...consent ? { prompt: "consent" } : {}
+                ...consent ? { prompt: "consent" } : {},
+                ...connection ? { connection } : {}
               }
             } : {}
           });

package/dist/auth0/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth0/availability.ts","../../src/auth0/token-source.ts","../../src/auth0/Auth0Gate.tsx","../../src/auth0/sso.ts"],"names":["initialContext","useAuth0","useEffect","Auth0Context","jsxs","Auth0Provider","jsx","useMemo"],"mappings":";;;;;;;;AAMO,IAAM,gBAAA,GACX,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,eAAA,IAAmB,CAAC,CAAC,MAAA,CAAO,MAAA,EAAQ;;;ACG9E,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,cAAA,GAAiB,GAAA;AAEvB,IAAI,WAAA,GAA8C,IAAA;AAClD,IAAI,SAAA,GAA2B,IAAA;AAGxB,SAAS,oBAAoB,MAAA,EAA8C;AAChF,EAAA,WAAA,GAAc,MAAA;AAChB;AAGO,SAAS,mBAAmB,KAAA,EAA4B;AAC7D,EAAA,SAAA,GAAY,KAAA;AACd;AAEO,IAAM,gBAAA,GAAmC;AAAA,EAC9C,MAAM,QAAA,GAAW;AAGf,IAAA,KAAA,IAAS,MAAA,GAAS,CAAA,IAAK,MAAA,IAAU,cAAA,EAAgB;AAC/C,MAAA,IAAI,WAAA,EAAa;AACf,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,GAAQ,MAAM,WAAA,EAAY;AAChC,UAAA,IAAI,OAAO,OAAO,KAAA;AAClB,UAAA;AAAA,QACF,SAAS,KAAA,EAAO;AAEd,UAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,KAAK,CAAA;AAAA,QAC7D;AAAA,MACF;AACA,MAAA,IAAI,UAAU,cAAA,EAAgB;AAC9B,MAAA,IAAI,MAAA,KAAW,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,qDAAqD,CAAA;AACpF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,cAAc,CAAC,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AACF;ACbA,SAAS,WAAA,GAAqB;AAC5B,EAAA,MAAM,IAAI,KAAA;AAAA,IACR;AAAA,GACF;AACF;AAQA,IAAM,gBAAgB,EAAE,GAAGA,2BAAgB,SAAA,EAAW,KAAA,EAAO,wBAAwB,WAAA,EAAY;AAMjG,SAAS,gBAAA,GAAmB;AAC1B,EAAA,MAAM,EAAE,eAAA,EAAiB,SAAA,EAAW,sBAAA,KAA2BC,mBAAA,EAAS;AACxE,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,mBAAmB,SAAA,EAAW;AACnC,IAAA,mBAAA,CAAoB,sBAAsB,CAAA;AAC1C,IAAA,sBAAA,EAAuB,CAAE,IAAA,CAAK,kBAAA,EAAoB,MAAM;AAAA,IAExD,CAAC,CAAA;AACD,IAAA,OAAO,MAAM,oBAAoB,IAAI,CAAA;AAAA,EACvC,CAAA,EAAG,CAAC,eAAA,EAAiB,SAAA,EAAW,sBAAsB,CAAC,CAAA;AACvD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,SAAA,CAAU;AAAA,EACxB,QAAA;AAAA,EACA,GAAG;AACL,CAAA,EAAmD;AACjD,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,sCAAQC,uBAAA,CAAa,QAAA,EAAb,EAAsB,KAAA,EAAO,eAAgB,QAAA,EAAS,CAAA;AAAA,EAChE;AACA,EAAA,uBACEC,eAAA,CAACC,wBAAA,EAAA,EAAe,GAAG,OAAA,EACjB,QAAA,EAAA;AAAA,oBAAAC,cAAA,CAAC,gBAAA,EAAA,EAAiB,CAAA;AAAA,IACjB;AAAA,GAAA,EACH,CAAA;AAEJ;ACxDO,SAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,YAAA,GAAe,QAAO,EAAgC;AACvF,EAAA,SAAS,SAAA,GAAuB;AAC9B,IAAA,MAAM,EAAE,WAAW,eAAA,EAAiB,IAAA,EAAM,mBAAmB,MAAA,EAAQ,sBAAA,KACnEL,mBAAAA,EAAS;AACX,IAAA,OAAOM,aAAA;AAAA,MACL,OAAO;AAAA,QACL,SAAA,EAAW,gBAAA;AAAA,QACX,SAAA;AAAA,QACA,eAAA;AAAA,QACA,IAAA,EAAM,MAAM,GAAA,GACR;AAAA,UACE,KAAK,IAAA,CAAK,GAAA;AAAA,UACV,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,aAAa,IAAA,CAAK,WAAA;AAAA,UAClB,SAAS,IAAA,CAAK;AAAA,SAChB,GACA,IAAA;AAAA,QACJ,MAAM,OAAO,EAAE,QAAA,EAAU,aAAa,OAAA,EAAQ,GAAI,EAAC,EAAG;AAEpD,UAAA,kBAAA,CAAmB,IAAI,CAAA;AACvB,UAAA,MAAM,iBAAA,CAAkB;AAAA,YACtB,GAAI,WAAW,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS,KAAM,EAAC;AAAA,YAC7C,GAAI,eAAe,OAAA,GACf;AAAA,cACE,mBAAA,EAAqB;AAAA,gBACnB,GAAI,WAAA,GAAc,EAAE,YAAA,EAAc,WAAA,KAAgB,EAAC;AAAA,gBACnD,GAAI,OAAA,GAAU,EAAE,MAAA,EAAQ,SAAA,KAAuB;AAAC;AAClD,gBAEF;AAAC,WACN,CAAA;AAAA,QACH,CAAA;AAAA,QACA,OAAA,CAAQ,EAAE,QAAA,EAAS,GAAI,EAAC,EAAG;AACzB,UAAA,KAAK,MAAA,CAAO,WAAW,EAAE,YAAA,EAAc,EAAE,QAAA,EAAS,KAAM,MAAS,CAAA;AAAA,QACnE,CAAA;AAAA,QACA,UAAU,MAAM,sBAAA,EAAuB,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,QACzD,aAAa,CAAC,MAAA,EAAQ,KAAA,KACpB,CAAA,QAAA,EAAW,MAAM,CAAA,uBAAA,EAA0B,kBAAA;AAAA,UACzC,MAAA,CAAO,SAAS,MAAA,GAAS;AAAA,SAC1B,CAAA,QAAA,EAAW,MAAM,CAAA,OAAA,EAAU,KAAK,CAAA;AAAA,OACrC,CAAA;AAAA,MACA,CAAC,SAAA,EAAW,eAAA,EAAiB,IAAA,EAAM,iBAAA,EAAmB,QAAQ,sBAAsB;AAAA,KACtF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB","file":"index.cjs","sourcesContent":["/**\n * Whether Auth0 can run in this browsing context. `auth0-spa-js` needs Web Crypto, which browsers\n * expose only on a SECURE ORIGIN (https, or `localhost`): a dev server reached over a LAN address\n * (`http://10.0.0.5:5173`) is not one. The site's own email + password sign-in does not need\n * Auth0, so the SSO affordances are hidden there rather than let them throw.\n */\nexport const isAuth0Available: boolean =\n  typeof window !== 'undefined' && window.isSecureContext && !!window.crypto?.subtle\n","/**\n * Auth0 as the SDK client's `SsoTokenSource` (`createArbiClient({ sso: auth0TokenSource })`): the\n * token for a silent re-login of an SSO account. `Auth0Gate` registers Auth0's token getter once\n * Auth0 is signed in; the client asks only in SSO mode, which is also the cross-deployment guard\n * (Auth0's cache is shared by every deployment on the tenant).\n */\n\nimport type { SsoTokenSource } from '@arbidocs/client'\n\n/** How long a re-login waits for Auth0 to expose its token getter after a page load. */\nconst GETTER_WAIT_MS = 1_000\nconst GETTER_POLL_MS = 250\n\nlet tokenGetter: (() => Promise<string>) | null = null\nlet lastToken: string | null = null\n\n/** Auth0's token getter, once signed in there (`Auth0Gate`); `null` to drop it. */\nexport function setAuth0TokenGetter(getter: (() => Promise<string>) | null): void {\n  tokenGetter = getter\n}\n\n/** The last token Auth0 gave (the re-login's fallback); `null` to forget it. */\nexport function rememberAuth0Token(token: string | null): void {\n  lastToken = token\n}\n\nexport const auth0TokenSource: SsoTokenSource = {\n  async getToken() {\n    // On a page load the getter may not exist yet: wait up to 1s for it, then fall back to the\n    // last token Auth0 gave.\n    for (let waited = 0; ; waited += GETTER_POLL_MS) {\n      if (tokenGetter) {\n        try {\n          const token = await tokenGetter()\n          if (token) return token\n          break\n        } catch (error) {\n          // Auth0 not settled yet: try again until the wait is over.\n          console.error('[SSO] Failed to get the Auth0 token:', error)\n        }\n      }\n      if (waited >= GETTER_WAIT_MS) break\n      if (waited === 0) console.info('[SSO] No Auth0 token getter yet - waiting for Auth0')\n      await new Promise((resolve) => setTimeout(resolve, GETTER_POLL_MS))\n    }\n    return lastToken\n  },\n}\n","/**\n * Auth0Gate — mount Auth0 only where it can actually run.\n *\n * `auth0-spa-js` requires Web Crypto, which the browser only exposes on a SECURE\n * ORIGIN (https, or `localhost`). Reached over a LAN address — `http://10.0.0.5:5173`,\n * the way a dev server started with `--host` is usually opened — it throws\n * \"auth0-spa-js must run on a secure origin\" while `Auth0Provider` initialises,\n * and the app never boots.\n *\n * That is a shame, because ARBI's own email + password login does not need Auth0\n * at all: Auth0 backs the SSO buttons and the hosted password-reset flow. So on an\n * insecure origin we render an INERT Auth0 context instead of the real provider.\n * The app boots, native sign-in works, and the SSO paths are hidden (see\n * `isAuth0Available`) rather than throwing when clicked.\n *\n * It is the site's `Auth0Gate`: mounted once around the app, it is also where the re-login gets\n * Auth0's token (`auth0TokenSource`).\n *\n * Note the context must be inert, not absent: `useAuth0()` outside a provider\n * returns `isLoading: true` forever, which would hang `App` on its loading screen.\n */\n\nimport { useEffect, type ReactNode } from 'react'\nimport {\n  Auth0Context,\n  Auth0Provider,\n  initialContext,\n  useAuth0,\n  type Auth0ProviderOptions,\n} from '@auth0/auth0-react'\nimport { isAuth0Available } from './availability'\nimport { rememberAuth0Token, setAuth0TokenGetter } from './token-source'\n\n/** Rejects rather than silently no-oping, so a stray SSO call is visible in dev. */\nfunction unavailable(): never {\n  throw new Error(\n    'Auth0 is unavailable on a non-secure origin. Open the app over https or on localhost.'\n  )\n}\n\n/**\n * A settled, signed-out Auth0 context, built from the library's own default so it\n * cannot drift as the interface grows. `isLoading: false` is the load-bearing\n * override — it lets `App` finish booting instead of waiting on a provider that\n * will never initialise. The auth methods keep the defaults' throwing stubs.\n */\nconst INERT_CONTEXT = { ...initialContext, isLoading: false, getAccessTokenSilently: unavailable }\n\n/**\n * Hands Auth0's token getter to the re-login (`auth0TokenSource`) once Auth0 is signed in, and\n * keeps its last token as the fallback. The client asks for it only in SSO mode.\n */\nfunction Auth0TokenBridge() {\n  const { isAuthenticated, isLoading, getAccessTokenSilently } = useAuth0()\n  useEffect(() => {\n    if (!isAuthenticated || isLoading) return\n    setAuth0TokenGetter(getAccessTokenSilently)\n    getAccessTokenSilently().then(rememberAuth0Token, () => {\n      // Expected during registration: no token yet.\n    })\n    return () => setAuth0TokenGetter(null)\n  }, [isAuthenticated, isLoading, getAccessTokenSilently])\n  return null\n}\n\n/** Auth0 for the site, where it can run (see above); its token is handed to the re-login. */\nexport function Auth0Gate({\n  children,\n  ...options\n}: Auth0ProviderOptions & { children: ReactNode }) {\n  if (!isAuth0Available) {\n    return <Auth0Context.Provider value={INERT_CONTEXT}>{children}</Auth0Context.Provider>\n  }\n  return (\n    <Auth0Provider {...options}>\n      <Auth0TokenBridge />\n      {children}\n    </Auth0Provider>\n  )\n}\n","/**\n * Auth0 as the site's single sign-on provider (the host configuration's `sso`): the sign-in kits\n * reach Auth0 through it, never through `@auth0/auth0-react` themselves.\n *\n *   <ArbiHost config={{ sso: auth0Sso({ domain: 'auth.example.com' }), … }}>\n *\n * Needs `Auth0Gate` around the site.\n */\n\nimport { useMemo } from 'react'\nimport { useAuth0 } from '@auth0/auth0-react'\nimport type { SsoSignIn, SsoSupport } from '../connection/auth/support'\nimport { isAuth0Available } from './availability'\nimport { rememberAuth0Token } from './token-source'\n\nexport interface Auth0SsoOptions {\n  /** The Auth0 tenant's domain: an account link continues there. */\n  domain: string\n  /** Where Auth0 comes back to after an account link (default: `<origin>/sso`). */\n  callbackPath?: string\n}\n\n/** The SSO provider backed by Auth0. */\nexport function auth0Sso({ domain, callbackPath = '/sso' }: Auth0SsoOptions): SsoSupport {\n  function useSignIn(): SsoSignIn {\n    const { isLoading, isAuthenticated, user, loginWithRedirect, logout, getAccessTokenSilently } =\n      useAuth0()\n    return useMemo(\n      () => ({\n        available: isAuth0Available,\n        isLoading,\n        isAuthenticated,\n        user: user?.sub\n          ? {\n              sub: user.sub,\n              email: user.email,\n              name: user.name,\n              given_name: user.given_name,\n              family_name: user.family_name,\n              picture: user.picture,\n            }\n          : null,\n        async signIn({ returnTo, redirectUri, consent } = {}) {\n          // A token from a previous Auth0 session must not stand in for the coming one.\n          rememberAuth0Token(null)\n          await loginWithRedirect({\n            ...(returnTo ? { appState: { returnTo } } : {}),\n            ...(redirectUri || consent\n              ? {\n                  authorizationParams: {\n                    ...(redirectUri ? { redirect_uri: redirectUri } : {}),\n                    ...(consent ? { prompt: 'consent' as const } : {}),\n                  },\n                }\n              : {}),\n          })\n        },\n        signOut({ returnTo } = {}) {\n          void logout(returnTo ? { logoutParams: { returnTo } } : undefined)\n        },\n        getToken: () => getAccessTokenSilently().catch(() => null),\n        continueUrl: (action, state) =>\n          `https://${domain}/continue?redirect_uri=${encodeURIComponent(\n            window.location.origin + callbackPath\n          )}&action=${action}&state=${state}`,\n      }),\n      [isLoading, isAuthenticated, user, loginWithRedirect, logout, getAccessTokenSilently]\n    )\n  }\n  return { useSignIn }\n}\n"]}
+{"version":3,"sources":["../../src/auth0/availability.ts","../../src/auth0/token-source.ts","../../src/auth0/Auth0Gate.tsx","../../src/auth0/sso.ts"],"names":["initialContext","useAuth0","useEffect","Auth0Context","jsxs","Auth0Provider","jsx","useMemo"],"mappings":";;;;;;;;AAMO,IAAM,gBAAA,GACX,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,eAAA,IAAmB,CAAC,CAAC,MAAA,CAAO,MAAA,EAAQ;;;ACG9E,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,cAAA,GAAiB,GAAA;AAEvB,IAAI,WAAA,GAA8C,IAAA;AAClD,IAAI,SAAA,GAA2B,IAAA;AAGxB,SAAS,oBAAoB,MAAA,EAA8C;AAChF,EAAA,WAAA,GAAc,MAAA;AAChB;AAGO,SAAS,mBAAmB,KAAA,EAA4B;AAC7D,EAAA,SAAA,GAAY,KAAA;AACd;AAEO,IAAM,gBAAA,GAAmC;AAAA,EAC9C,MAAM,QAAA,GAAW;AAGf,IAAA,KAAA,IAAS,MAAA,GAAS,CAAA,IAAK,MAAA,IAAU,cAAA,EAAgB;AAC/C,MAAA,IAAI,WAAA,EAAa;AACf,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,GAAQ,MAAM,WAAA,EAAY;AAChC,UAAA,IAAI,OAAO,OAAO,KAAA;AAClB,UAAA;AAAA,QACF,SAAS,KAAA,EAAO;AAEd,UAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,KAAK,CAAA;AAAA,QAC7D;AAAA,MACF;AACA,MAAA,IAAI,UAAU,cAAA,EAAgB;AAC9B,MAAA,IAAI,MAAA,KAAW,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,qDAAqD,CAAA;AACpF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,cAAc,CAAC,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AACF;ACbA,SAAS,WAAA,GAAqB;AAC5B,EAAA,MAAM,IAAI,KAAA;AAAA,IACR;AAAA,GACF;AACF;AAQA,IAAM,gBAAgB,EAAE,GAAGA,2BAAgB,SAAA,EAAW,KAAA,EAAO,wBAAwB,WAAA,EAAY;AAMjG,SAAS,gBAAA,GAAmB;AAC1B,EAAA,MAAM,EAAE,eAAA,EAAiB,SAAA,EAAW,sBAAA,KAA2BC,mBAAA,EAAS;AACxE,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,mBAAmB,SAAA,EAAW;AACnC,IAAA,mBAAA,CAAoB,sBAAsB,CAAA;AAC1C,IAAA,sBAAA,EAAuB,CAAE,IAAA,CAAK,kBAAA,EAAoB,MAAM;AAAA,IAExD,CAAC,CAAA;AACD,IAAA,OAAO,MAAM,oBAAoB,IAAI,CAAA;AAAA,EACvC,CAAA,EAAG,CAAC,eAAA,EAAiB,SAAA,EAAW,sBAAsB,CAAC,CAAA;AACvD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,SAAA,CAAU;AAAA,EACxB,QAAA;AAAA,EACA,GAAG;AACL,CAAA,EAAmD;AACjD,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,sCAAQC,uBAAA,CAAa,QAAA,EAAb,EAAsB,KAAA,EAAO,eAAgB,QAAA,EAAS,CAAA;AAAA,EAChE;AACA,EAAA,uBACEC,eAAA,CAACC,wBAAA,EAAA,EAAe,GAAG,OAAA,EACjB,QAAA,EAAA;AAAA,oBAAAC,cAAA,CAAC,gBAAA,EAAA,EAAiB,CAAA;AAAA,IACjB;AAAA,GAAA,EACH,CAAA;AAEJ;ACxDO,SAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,YAAA,GAAe,QAAO,EAAgC;AACvF,EAAA,SAAS,SAAA,GAAuB;AAC9B,IAAA,MAAM,EAAE,WAAW,eAAA,EAAiB,IAAA,EAAM,mBAAmB,MAAA,EAAQ,sBAAA,KACnEL,mBAAAA,EAAS;AACX,IAAA,OAAOM,aAAA;AAAA,MACL,OAAO;AAAA,QACL,SAAA,EAAW,gBAAA;AAAA,QACX,SAAA;AAAA,QACA,eAAA;AAAA,QACA,IAAA,EAAM,MAAM,GAAA,GACR;AAAA,UACE,KAAK,IAAA,CAAK,GAAA;AAAA,UACV,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,aAAa,IAAA,CAAK,WAAA;AAAA,UAClB,SAAS,IAAA,CAAK;AAAA,SAChB,GACA,IAAA;AAAA,QACJ,MAAM,OAAO,EAAE,QAAA,EAAU,aAAa,OAAA,EAAS,UAAA,EAAW,GAAI,EAAC,EAAG;AAEhE,UAAA,kBAAA,CAAmB,IAAI,CAAA;AACvB,UAAA,MAAM,iBAAA,CAAkB;AAAA,YACtB,GAAI,WAAW,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS,KAAM,EAAC;AAAA,YAC7C,GAAI,WAAA,IAAe,OAAA,IAAW,UAAA,GAC1B;AAAA,cACE,mBAAA,EAAqB;AAAA,gBACnB,GAAI,WAAA,GAAc,EAAE,YAAA,EAAc,WAAA,KAAgB,EAAC;AAAA,gBACnD,GAAI,OAAA,GAAU,EAAE,MAAA,EAAQ,SAAA,KAAuB,EAAC;AAAA,gBAChD,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe;AAAC;AACrC,gBAEF;AAAC,WACN,CAAA;AAAA,QACH,CAAA;AAAA,QACA,OAAA,CAAQ,EAAE,QAAA,EAAS,GAAI,EAAC,EAAG;AACzB,UAAA,KAAK,MAAA,CAAO,WAAW,EAAE,YAAA,EAAc,EAAE,QAAA,EAAS,KAAM,MAAS,CAAA;AAAA,QACnE,CAAA;AAAA,QACA,UAAU,MAAM,sBAAA,EAAuB,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,QACzD,aAAa,CAAC,MAAA,EAAQ,KAAA,KACpB,CAAA,QAAA,EAAW,MAAM,CAAA,uBAAA,EAA0B,kBAAA;AAAA,UACzC,MAAA,CAAO,SAAS,MAAA,GAAS;AAAA,SAC1B,CAAA,QAAA,EAAW,MAAM,CAAA,OAAA,EAAU,KAAK,CAAA;AAAA,OACrC,CAAA;AAAA,MACA,CAAC,SAAA,EAAW,eAAA,EAAiB,IAAA,EAAM,iBAAA,EAAmB,QAAQ,sBAAsB;AAAA,KACtF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB","file":"index.cjs","sourcesContent":["/**\n * Whether Auth0 can run in this browsing context. `auth0-spa-js` needs Web Crypto, which browsers\n * expose only on a SECURE ORIGIN (https, or `localhost`): a dev server reached over a LAN address\n * (`http://10.0.0.5:5173`) is not one. The site's own email + password sign-in does not need\n * Auth0, so the SSO affordances are hidden there rather than let them throw.\n */\nexport const isAuth0Available: boolean =\n  typeof window !== 'undefined' && window.isSecureContext && !!window.crypto?.subtle\n","/**\n * Auth0 as the SDK client's `SsoTokenSource` (`createArbiClient({ sso: auth0TokenSource })`): the\n * token for a silent re-login of an SSO account. `Auth0Gate` registers Auth0's token getter once\n * Auth0 is signed in; the client asks only in SSO mode, which is also the cross-deployment guard\n * (Auth0's cache is shared by every deployment on the tenant).\n */\n\nimport type { SsoTokenSource } from '@arbidocs/client'\n\n/** How long a re-login waits for Auth0 to expose its token getter after a page load. */\nconst GETTER_WAIT_MS = 1_000\nconst GETTER_POLL_MS = 250\n\nlet tokenGetter: (() => Promise<string>) | null = null\nlet lastToken: string | null = null\n\n/** Auth0's token getter, once signed in there (`Auth0Gate`); `null` to drop it. */\nexport function setAuth0TokenGetter(getter: (() => Promise<string>) | null): void {\n  tokenGetter = getter\n}\n\n/** The last token Auth0 gave (the re-login's fallback); `null` to forget it. */\nexport function rememberAuth0Token(token: string | null): void {\n  lastToken = token\n}\n\nexport const auth0TokenSource: SsoTokenSource = {\n  async getToken() {\n    // On a page load the getter may not exist yet: wait up to 1s for it, then fall back to the\n    // last token Auth0 gave.\n    for (let waited = 0; ; waited += GETTER_POLL_MS) {\n      if (tokenGetter) {\n        try {\n          const token = await tokenGetter()\n          if (token) return token\n          break\n        } catch (error) {\n          // Auth0 not settled yet: try again until the wait is over.\n          console.error('[SSO] Failed to get the Auth0 token:', error)\n        }\n      }\n      if (waited >= GETTER_WAIT_MS) break\n      if (waited === 0) console.info('[SSO] No Auth0 token getter yet - waiting for Auth0')\n      await new Promise((resolve) => setTimeout(resolve, GETTER_POLL_MS))\n    }\n    return lastToken\n  },\n}\n","/**\n * Auth0Gate — mount Auth0 only where it can actually run.\n *\n * `auth0-spa-js` requires Web Crypto, which the browser only exposes on a SECURE\n * ORIGIN (https, or `localhost`). Reached over a LAN address — `http://10.0.0.5:5173`,\n * the way a dev server started with `--host` is usually opened — it throws\n * \"auth0-spa-js must run on a secure origin\" while `Auth0Provider` initialises,\n * and the app never boots.\n *\n * That is a shame, because ARBI's own email + password login does not need Auth0\n * at all: Auth0 backs the SSO buttons and the hosted password-reset flow. So on an\n * insecure origin we render an INERT Auth0 context instead of the real provider.\n * The app boots, native sign-in works, and the SSO paths are hidden (see\n * `isAuth0Available`) rather than throwing when clicked.\n *\n * It is the site's `Auth0Gate`: mounted once around the app, it is also where the re-login gets\n * Auth0's token (`auth0TokenSource`).\n *\n * Note the context must be inert, not absent: `useAuth0()` outside a provider\n * returns `isLoading: true` forever, which would hang `App` on its loading screen.\n */\n\nimport { useEffect, type ReactNode } from 'react'\nimport {\n  Auth0Context,\n  Auth0Provider,\n  initialContext,\n  useAuth0,\n  type Auth0ProviderOptions,\n} from '@auth0/auth0-react'\nimport { isAuth0Available } from './availability'\nimport { rememberAuth0Token, setAuth0TokenGetter } from './token-source'\n\n/** Rejects rather than silently no-oping, so a stray SSO call is visible in dev. */\nfunction unavailable(): never {\n  throw new Error(\n    'Auth0 is unavailable on a non-secure origin. Open the app over https or on localhost.'\n  )\n}\n\n/**\n * A settled, signed-out Auth0 context, built from the library's own default so it\n * cannot drift as the interface grows. `isLoading: false` is the load-bearing\n * override — it lets `App` finish booting instead of waiting on a provider that\n * will never initialise. The auth methods keep the defaults' throwing stubs.\n */\nconst INERT_CONTEXT = { ...initialContext, isLoading: false, getAccessTokenSilently: unavailable }\n\n/**\n * Hands Auth0's token getter to the re-login (`auth0TokenSource`) once Auth0 is signed in, and\n * keeps its last token as the fallback. The client asks for it only in SSO mode.\n */\nfunction Auth0TokenBridge() {\n  const { isAuthenticated, isLoading, getAccessTokenSilently } = useAuth0()\n  useEffect(() => {\n    if (!isAuthenticated || isLoading) return\n    setAuth0TokenGetter(getAccessTokenSilently)\n    getAccessTokenSilently().then(rememberAuth0Token, () => {\n      // Expected during registration: no token yet.\n    })\n    return () => setAuth0TokenGetter(null)\n  }, [isAuthenticated, isLoading, getAccessTokenSilently])\n  return null\n}\n\n/** Auth0 for the site, where it can run (see above); its token is handed to the re-login. */\nexport function Auth0Gate({\n  children,\n  ...options\n}: Auth0ProviderOptions & { children: ReactNode }) {\n  if (!isAuth0Available) {\n    return <Auth0Context.Provider value={INERT_CONTEXT}>{children}</Auth0Context.Provider>\n  }\n  return (\n    <Auth0Provider {...options}>\n      <Auth0TokenBridge />\n      {children}\n    </Auth0Provider>\n  )\n}\n","/**\n * Auth0 as the site's single sign-on provider (the host configuration's `sso`): the sign-in kits\n * reach Auth0 through it, never through `@auth0/auth0-react` themselves.\n *\n *   <ArbiHost config={{ sso: auth0Sso({ domain: 'auth.example.com' }), … }}>\n *\n * Needs `Auth0Gate` around the site.\n */\n\nimport { useMemo } from 'react'\nimport { useAuth0 } from '@auth0/auth0-react'\nimport type { SsoSignIn, SsoSupport } from '../connection/auth/support'\nimport { isAuth0Available } from './availability'\nimport { rememberAuth0Token } from './token-source'\n\nexport interface Auth0SsoOptions {\n  /** The Auth0 tenant's domain: an account link continues there. */\n  domain: string\n  /** Where Auth0 comes back to after an account link (default: `<origin>/sso`). */\n  callbackPath?: string\n}\n\n/** The SSO provider backed by Auth0. */\nexport function auth0Sso({ domain, callbackPath = '/sso' }: Auth0SsoOptions): SsoSupport {\n  function useSignIn(): SsoSignIn {\n    const { isLoading, isAuthenticated, user, loginWithRedirect, logout, getAccessTokenSilently } =\n      useAuth0()\n    return useMemo(\n      () => ({\n        available: isAuth0Available,\n        isLoading,\n        isAuthenticated,\n        user: user?.sub\n          ? {\n              sub: user.sub,\n              email: user.email,\n              name: user.name,\n              given_name: user.given_name,\n              family_name: user.family_name,\n              picture: user.picture,\n            }\n          : null,\n        async signIn({ returnTo, redirectUri, consent, connection } = {}) {\n          // A token from a previous Auth0 session must not stand in for the coming one.\n          rememberAuth0Token(null)\n          await loginWithRedirect({\n            ...(returnTo ? { appState: { returnTo } } : {}),\n            ...(redirectUri || consent || connection\n              ? {\n                  authorizationParams: {\n                    ...(redirectUri ? { redirect_uri: redirectUri } : {}),\n                    ...(consent ? { prompt: 'consent' as const } : {}),\n                    ...(connection ? { connection } : {}),\n                  },\n                }\n              : {}),\n          })\n        },\n        signOut({ returnTo } = {}) {\n          void logout(returnTo ? { logoutParams: { returnTo } } : undefined)\n        },\n        getToken: () => getAccessTokenSilently().catch(() => null),\n        continueUrl: (action, state) =>\n          `https://${domain}/continue?redirect_uri=${encodeURIComponent(\n            window.location.origin + callbackPath\n          )}&action=${action}&state=${state}`,\n      }),\n      [isLoading, isAuthenticated, user, loginWithRedirect, logout, getAccessTokenSilently]\n    )\n  }\n  return { useSignIn }\n}\n"]}

package/dist/auth0/index.js

@@ -82,14 +82,15 @@ function auth0Sso({ domain, callbackPath = "/sso" }) {
           family_name: user.family_name,
           picture: user.picture
         } : null,
-        async signIn({ returnTo, redirectUri, consent } = {}) {
+        async signIn({ returnTo, redirectUri, consent, connection } = {}) {
           rememberAuth0Token(null);
           await loginWithRedirect({
             ...returnTo ? { appState: { returnTo } } : {},
-            ...redirectUri || consent ? {
+            ...redirectUri || consent || connection ? {
               authorizationParams: {
                 ...redirectUri ? { redirect_uri: redirectUri } : {},
-                ...consent ? { prompt: "consent" } : {}
+                ...consent ? { prompt: "consent" } : {},
+                ...connection ? { connection } : {}
               }
             } : {}
           });

package/dist/auth0/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth0/availability.ts","../../src/auth0/token-source.ts","../../src/auth0/Auth0Gate.tsx","../../src/auth0/sso.ts"],"names":["useAuth0"],"mappings":";;;;;;AAMO,IAAM,gBAAA,GACX,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,eAAA,IAAmB,CAAC,CAAC,MAAA,CAAO,MAAA,EAAQ;;;ACG9E,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,cAAA,GAAiB,GAAA;AAEvB,IAAI,WAAA,GAA8C,IAAA;AAClD,IAAI,SAAA,GAA2B,IAAA;AAGxB,SAAS,oBAAoB,MAAA,EAA8C;AAChF,EAAA,WAAA,GAAc,MAAA;AAChB;AAGO,SAAS,mBAAmB,KAAA,EAA4B;AAC7D,EAAA,SAAA,GAAY,KAAA;AACd;AAEO,IAAM,gBAAA,GAAmC;AAAA,EAC9C,MAAM,QAAA,GAAW;AAGf,IAAA,KAAA,IAAS,MAAA,GAAS,CAAA,IAAK,MAAA,IAAU,cAAA,EAAgB;AAC/C,MAAA,IAAI,WAAA,EAAa;AACf,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,GAAQ,MAAM,WAAA,EAAY;AAChC,UAAA,IAAI,OAAO,OAAO,KAAA;AAClB,UAAA;AAAA,QACF,SAAS,KAAA,EAAO;AAEd,UAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,KAAK,CAAA;AAAA,QAC7D;AAAA,MACF;AACA,MAAA,IAAI,UAAU,cAAA,EAAgB;AAC9B,MAAA,IAAI,MAAA,KAAW,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,qDAAqD,CAAA;AACpF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,cAAc,CAAC,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AACF;ACbA,SAAS,WAAA,GAAqB;AAC5B,EAAA,MAAM,IAAI,KAAA;AAAA,IACR;AAAA,GACF;AACF;AAQA,IAAM,gBAAgB,EAAE,GAAG,gBAAgB,SAAA,EAAW,KAAA,EAAO,wBAAwB,WAAA,EAAY;AAMjG,SAAS,gBAAA,GAAmB;AAC1B,EAAA,MAAM,EAAE,eAAA,EAAiB,SAAA,EAAW,sBAAA,KAA2B,QAAA,EAAS;AACxE,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,mBAAmB,SAAA,EAAW;AACnC,IAAA,mBAAA,CAAoB,sBAAsB,CAAA;AAC1C,IAAA,sBAAA,EAAuB,CAAE,IAAA,CAAK,kBAAA,EAAoB,MAAM;AAAA,IAExD,CAAC,CAAA;AACD,IAAA,OAAO,MAAM,oBAAoB,IAAI,CAAA;AAAA,EACvC,CAAA,EAAG,CAAC,eAAA,EAAiB,SAAA,EAAW,sBAAsB,CAAC,CAAA;AACvD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,SAAA,CAAU;AAAA,EACxB,QAAA;AAAA,EACA,GAAG;AACL,CAAA,EAAmD;AACjD,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,2BAAQ,YAAA,CAAa,QAAA,EAAb,EAAsB,KAAA,EAAO,eAAgB,QAAA,EAAS,CAAA;AAAA,EAChE;AACA,EAAA,uBACE,IAAA,CAAC,aAAA,EAAA,EAAe,GAAG,OAAA,EACjB,QAAA,EAAA;AAAA,oBAAA,GAAA,CAAC,gBAAA,EAAA,EAAiB,CAAA;AAAA,IACjB;AAAA,GAAA,EACH,CAAA;AAEJ;ACxDO,SAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,YAAA,GAAe,QAAO,EAAgC;AACvF,EAAA,SAAS,SAAA,GAAuB;AAC9B,IAAA,MAAM,EAAE,WAAW,eAAA,EAAiB,IAAA,EAAM,mBAAmB,MAAA,EAAQ,sBAAA,KACnEA,QAAAA,EAAS;AACX,IAAA,OAAO,OAAA;AAAA,MACL,OAAO;AAAA,QACL,SAAA,EAAW,gBAAA;AAAA,QACX,SAAA;AAAA,QACA,eAAA;AAAA,QACA,IAAA,EAAM,MAAM,GAAA,GACR;AAAA,UACE,KAAK,IAAA,CAAK,GAAA;AAAA,UACV,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,aAAa,IAAA,CAAK,WAAA;AAAA,UAClB,SAAS,IAAA,CAAK;AAAA,SAChB,GACA,IAAA;AAAA,QACJ,MAAM,OAAO,EAAE,QAAA,EAAU,aAAa,OAAA,EAAQ,GAAI,EAAC,EAAG;AAEpD,UAAA,kBAAA,CAAmB,IAAI,CAAA;AACvB,UAAA,MAAM,iBAAA,CAAkB;AAAA,YACtB,GAAI,WAAW,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS,KAAM,EAAC;AAAA,YAC7C,GAAI,eAAe,OAAA,GACf;AAAA,cACE,mBAAA,EAAqB;AAAA,gBACnB,GAAI,WAAA,GAAc,EAAE,YAAA,EAAc,WAAA,KAAgB,EAAC;AAAA,gBACnD,GAAI,OAAA,GAAU,EAAE,MAAA,EAAQ,SAAA,KAAuB;AAAC;AAClD,gBAEF;AAAC,WACN,CAAA;AAAA,QACH,CAAA;AAAA,QACA,OAAA,CAAQ,EAAE,QAAA,EAAS,GAAI,EAAC,EAAG;AACzB,UAAA,KAAK,MAAA,CAAO,WAAW,EAAE,YAAA,EAAc,EAAE,QAAA,EAAS,KAAM,MAAS,CAAA;AAAA,QACnE,CAAA;AAAA,QACA,UAAU,MAAM,sBAAA,EAAuB,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,QACzD,aAAa,CAAC,MAAA,EAAQ,KAAA,KACpB,CAAA,QAAA,EAAW,MAAM,CAAA,uBAAA,EAA0B,kBAAA;AAAA,UACzC,MAAA,CAAO,SAAS,MAAA,GAAS;AAAA,SAC1B,CAAA,QAAA,EAAW,MAAM,CAAA,OAAA,EAAU,KAAK,CAAA;AAAA,OACrC,CAAA;AAAA,MACA,CAAC,SAAA,EAAW,eAAA,EAAiB,IAAA,EAAM,iBAAA,EAAmB,QAAQ,sBAAsB;AAAA,KACtF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB","file":"index.js","sourcesContent":["/**\n * Whether Auth0 can run in this browsing context. `auth0-spa-js` needs Web Crypto, which browsers\n * expose only on a SECURE ORIGIN (https, or `localhost`): a dev server reached over a LAN address\n * (`http://10.0.0.5:5173`) is not one. The site's own email + password sign-in does not need\n * Auth0, so the SSO affordances are hidden there rather than let them throw.\n */\nexport const isAuth0Available: boolean =\n  typeof window !== 'undefined' && window.isSecureContext && !!window.crypto?.subtle\n","/**\n * Auth0 as the SDK client's `SsoTokenSource` (`createArbiClient({ sso: auth0TokenSource })`): the\n * token for a silent re-login of an SSO account. `Auth0Gate` registers Auth0's token getter once\n * Auth0 is signed in; the client asks only in SSO mode, which is also the cross-deployment guard\n * (Auth0's cache is shared by every deployment on the tenant).\n */\n\nimport type { SsoTokenSource } from '@arbidocs/client'\n\n/** How long a re-login waits for Auth0 to expose its token getter after a page load. */\nconst GETTER_WAIT_MS = 1_000\nconst GETTER_POLL_MS = 250\n\nlet tokenGetter: (() => Promise<string>) | null = null\nlet lastToken: string | null = null\n\n/** Auth0's token getter, once signed in there (`Auth0Gate`); `null` to drop it. */\nexport function setAuth0TokenGetter(getter: (() => Promise<string>) | null): void {\n  tokenGetter = getter\n}\n\n/** The last token Auth0 gave (the re-login's fallback); `null` to forget it. */\nexport function rememberAuth0Token(token: string | null): void {\n  lastToken = token\n}\n\nexport const auth0TokenSource: SsoTokenSource = {\n  async getToken() {\n    // On a page load the getter may not exist yet: wait up to 1s for it, then fall back to the\n    // last token Auth0 gave.\n    for (let waited = 0; ; waited += GETTER_POLL_MS) {\n      if (tokenGetter) {\n        try {\n          const token = await tokenGetter()\n          if (token) return token\n          break\n        } catch (error) {\n          // Auth0 not settled yet: try again until the wait is over.\n          console.error('[SSO] Failed to get the Auth0 token:', error)\n        }\n      }\n      if (waited >= GETTER_WAIT_MS) break\n      if (waited === 0) console.info('[SSO] No Auth0 token getter yet - waiting for Auth0')\n      await new Promise((resolve) => setTimeout(resolve, GETTER_POLL_MS))\n    }\n    return lastToken\n  },\n}\n","/**\n * Auth0Gate — mount Auth0 only where it can actually run.\n *\n * `auth0-spa-js` requires Web Crypto, which the browser only exposes on a SECURE\n * ORIGIN (https, or `localhost`). Reached over a LAN address — `http://10.0.0.5:5173`,\n * the way a dev server started with `--host` is usually opened — it throws\n * \"auth0-spa-js must run on a secure origin\" while `Auth0Provider` initialises,\n * and the app never boots.\n *\n * That is a shame, because ARBI's own email + password login does not need Auth0\n * at all: Auth0 backs the SSO buttons and the hosted password-reset flow. So on an\n * insecure origin we render an INERT Auth0 context instead of the real provider.\n * The app boots, native sign-in works, and the SSO paths are hidden (see\n * `isAuth0Available`) rather than throwing when clicked.\n *\n * It is the site's `Auth0Gate`: mounted once around the app, it is also where the re-login gets\n * Auth0's token (`auth0TokenSource`).\n *\n * Note the context must be inert, not absent: `useAuth0()` outside a provider\n * returns `isLoading: true` forever, which would hang `App` on its loading screen.\n */\n\nimport { useEffect, type ReactNode } from 'react'\nimport {\n  Auth0Context,\n  Auth0Provider,\n  initialContext,\n  useAuth0,\n  type Auth0ProviderOptions,\n} from '@auth0/auth0-react'\nimport { isAuth0Available } from './availability'\nimport { rememberAuth0Token, setAuth0TokenGetter } from './token-source'\n\n/** Rejects rather than silently no-oping, so a stray SSO call is visible in dev. */\nfunction unavailable(): never {\n  throw new Error(\n    'Auth0 is unavailable on a non-secure origin. Open the app over https or on localhost.'\n  )\n}\n\n/**\n * A settled, signed-out Auth0 context, built from the library's own default so it\n * cannot drift as the interface grows. `isLoading: false` is the load-bearing\n * override — it lets `App` finish booting instead of waiting on a provider that\n * will never initialise. The auth methods keep the defaults' throwing stubs.\n */\nconst INERT_CONTEXT = { ...initialContext, isLoading: false, getAccessTokenSilently: unavailable }\n\n/**\n * Hands Auth0's token getter to the re-login (`auth0TokenSource`) once Auth0 is signed in, and\n * keeps its last token as the fallback. The client asks for it only in SSO mode.\n */\nfunction Auth0TokenBridge() {\n  const { isAuthenticated, isLoading, getAccessTokenSilently } = useAuth0()\n  useEffect(() => {\n    if (!isAuthenticated || isLoading) return\n    setAuth0TokenGetter(getAccessTokenSilently)\n    getAccessTokenSilently().then(rememberAuth0Token, () => {\n      // Expected during registration: no token yet.\n    })\n    return () => setAuth0TokenGetter(null)\n  }, [isAuthenticated, isLoading, getAccessTokenSilently])\n  return null\n}\n\n/** Auth0 for the site, where it can run (see above); its token is handed to the re-login. */\nexport function Auth0Gate({\n  children,\n  ...options\n}: Auth0ProviderOptions & { children: ReactNode }) {\n  if (!isAuth0Available) {\n    return <Auth0Context.Provider value={INERT_CONTEXT}>{children}</Auth0Context.Provider>\n  }\n  return (\n    <Auth0Provider {...options}>\n      <Auth0TokenBridge />\n      {children}\n    </Auth0Provider>\n  )\n}\n","/**\n * Auth0 as the site's single sign-on provider (the host configuration's `sso`): the sign-in kits\n * reach Auth0 through it, never through `@auth0/auth0-react` themselves.\n *\n *   <ArbiHost config={{ sso: auth0Sso({ domain: 'auth.example.com' }), … }}>\n *\n * Needs `Auth0Gate` around the site.\n */\n\nimport { useMemo } from 'react'\nimport { useAuth0 } from '@auth0/auth0-react'\nimport type { SsoSignIn, SsoSupport } from '../connection/auth/support'\nimport { isAuth0Available } from './availability'\nimport { rememberAuth0Token } from './token-source'\n\nexport interface Auth0SsoOptions {\n  /** The Auth0 tenant's domain: an account link continues there. */\n  domain: string\n  /** Where Auth0 comes back to after an account link (default: `<origin>/sso`). */\n  callbackPath?: string\n}\n\n/** The SSO provider backed by Auth0. */\nexport function auth0Sso({ domain, callbackPath = '/sso' }: Auth0SsoOptions): SsoSupport {\n  function useSignIn(): SsoSignIn {\n    const { isLoading, isAuthenticated, user, loginWithRedirect, logout, getAccessTokenSilently } =\n      useAuth0()\n    return useMemo(\n      () => ({\n        available: isAuth0Available,\n        isLoading,\n        isAuthenticated,\n        user: user?.sub\n          ? {\n              sub: user.sub,\n              email: user.email,\n              name: user.name,\n              given_name: user.given_name,\n              family_name: user.family_name,\n              picture: user.picture,\n            }\n          : null,\n        async signIn({ returnTo, redirectUri, consent } = {}) {\n          // A token from a previous Auth0 session must not stand in for the coming one.\n          rememberAuth0Token(null)\n          await loginWithRedirect({\n            ...(returnTo ? { appState: { returnTo } } : {}),\n            ...(redirectUri || consent\n              ? {\n                  authorizationParams: {\n                    ...(redirectUri ? { redirect_uri: redirectUri } : {}),\n                    ...(consent ? { prompt: 'consent' as const } : {}),\n                  },\n                }\n              : {}),\n          })\n        },\n        signOut({ returnTo } = {}) {\n          void logout(returnTo ? { logoutParams: { returnTo } } : undefined)\n        },\n        getToken: () => getAccessTokenSilently().catch(() => null),\n        continueUrl: (action, state) =>\n          `https://${domain}/continue?redirect_uri=${encodeURIComponent(\n            window.location.origin + callbackPath\n          )}&action=${action}&state=${state}`,\n      }),\n      [isLoading, isAuthenticated, user, loginWithRedirect, logout, getAccessTokenSilently]\n    )\n  }\n  return { useSignIn }\n}\n"]}
+{"version":3,"sources":["../../src/auth0/availability.ts","../../src/auth0/token-source.ts","../../src/auth0/Auth0Gate.tsx","../../src/auth0/sso.ts"],"names":["useAuth0"],"mappings":";;;;;;AAMO,IAAM,gBAAA,GACX,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,eAAA,IAAmB,CAAC,CAAC,MAAA,CAAO,MAAA,EAAQ;;;ACG9E,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,cAAA,GAAiB,GAAA;AAEvB,IAAI,WAAA,GAA8C,IAAA;AAClD,IAAI,SAAA,GAA2B,IAAA;AAGxB,SAAS,oBAAoB,MAAA,EAA8C;AAChF,EAAA,WAAA,GAAc,MAAA;AAChB;AAGO,SAAS,mBAAmB,KAAA,EAA4B;AAC7D,EAAA,SAAA,GAAY,KAAA;AACd;AAEO,IAAM,gBAAA,GAAmC;AAAA,EAC9C,MAAM,QAAA,GAAW;AAGf,IAAA,KAAA,IAAS,MAAA,GAAS,CAAA,IAAK,MAAA,IAAU,cAAA,EAAgB;AAC/C,MAAA,IAAI,WAAA,EAAa;AACf,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,GAAQ,MAAM,WAAA,EAAY;AAChC,UAAA,IAAI,OAAO,OAAO,KAAA;AAClB,UAAA;AAAA,QACF,SAAS,KAAA,EAAO;AAEd,UAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,KAAK,CAAA;AAAA,QAC7D;AAAA,MACF;AACA,MAAA,IAAI,UAAU,cAAA,EAAgB;AAC9B,MAAA,IAAI,MAAA,KAAW,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,qDAAqD,CAAA;AACpF,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,cAAc,CAAC,CAAA;AAAA,IACpE;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AACF;ACbA,SAAS,WAAA,GAAqB;AAC5B,EAAA,MAAM,IAAI,KAAA;AAAA,IACR;AAAA,GACF;AACF;AAQA,IAAM,gBAAgB,EAAE,GAAG,gBAAgB,SAAA,EAAW,KAAA,EAAO,wBAAwB,WAAA,EAAY;AAMjG,SAAS,gBAAA,GAAmB;AAC1B,EAAA,MAAM,EAAE,eAAA,EAAiB,SAAA,EAAW,sBAAA,KAA2B,QAAA,EAAS;AACxE,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,mBAAmB,SAAA,EAAW;AACnC,IAAA,mBAAA,CAAoB,sBAAsB,CAAA;AAC1C,IAAA,sBAAA,EAAuB,CAAE,IAAA,CAAK,kBAAA,EAAoB,MAAM;AAAA,IAExD,CAAC,CAAA;AACD,IAAA,OAAO,MAAM,oBAAoB,IAAI,CAAA;AAAA,EACvC,CAAA,EAAG,CAAC,eAAA,EAAiB,SAAA,EAAW,sBAAsB,CAAC,CAAA;AACvD,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,SAAA,CAAU;AAAA,EACxB,QAAA;AAAA,EACA,GAAG;AACL,CAAA,EAAmD;AACjD,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,2BAAQ,YAAA,CAAa,QAAA,EAAb,EAAsB,KAAA,EAAO,eAAgB,QAAA,EAAS,CAAA;AAAA,EAChE;AACA,EAAA,uBACE,IAAA,CAAC,aAAA,EAAA,EAAe,GAAG,OAAA,EACjB,QAAA,EAAA;AAAA,oBAAA,GAAA,CAAC,gBAAA,EAAA,EAAiB,CAAA;AAAA,IACjB;AAAA,GAAA,EACH,CAAA;AAEJ;ACxDO,SAAS,QAAA,CAAS,EAAE,MAAA,EAAQ,YAAA,GAAe,QAAO,EAAgC;AACvF,EAAA,SAAS,SAAA,GAAuB;AAC9B,IAAA,MAAM,EAAE,WAAW,eAAA,EAAiB,IAAA,EAAM,mBAAmB,MAAA,EAAQ,sBAAA,KACnEA,QAAAA,EAAS;AACX,IAAA,OAAO,OAAA;AAAA,MACL,OAAO;AAAA,QACL,SAAA,EAAW,gBAAA;AAAA,QACX,SAAA;AAAA,QACA,eAAA;AAAA,QACA,IAAA,EAAM,MAAM,GAAA,GACR;AAAA,UACE,KAAK,IAAA,CAAK,GAAA;AAAA,UACV,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,aAAa,IAAA,CAAK,WAAA;AAAA,UAClB,SAAS,IAAA,CAAK;AAAA,SAChB,GACA,IAAA;AAAA,QACJ,MAAM,OAAO,EAAE,QAAA,EAAU,aAAa,OAAA,EAAS,UAAA,EAAW,GAAI,EAAC,EAAG;AAEhE,UAAA,kBAAA,CAAmB,IAAI,CAAA;AACvB,UAAA,MAAM,iBAAA,CAAkB;AAAA,YACtB,GAAI,WAAW,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS,KAAM,EAAC;AAAA,YAC7C,GAAI,WAAA,IAAe,OAAA,IAAW,UAAA,GAC1B;AAAA,cACE,mBAAA,EAAqB;AAAA,gBACnB,GAAI,WAAA,GAAc,EAAE,YAAA,EAAc,WAAA,KAAgB,EAAC;AAAA,gBACnD,GAAI,OAAA,GAAU,EAAE,MAAA,EAAQ,SAAA,KAAuB,EAAC;AAAA,gBAChD,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe;AAAC;AACrC,gBAEF;AAAC,WACN,CAAA;AAAA,QACH,CAAA;AAAA,QACA,OAAA,CAAQ,EAAE,QAAA,EAAS,GAAI,EAAC,EAAG;AACzB,UAAA,KAAK,MAAA,CAAO,WAAW,EAAE,YAAA,EAAc,EAAE,QAAA,EAAS,KAAM,MAAS,CAAA;AAAA,QACnE,CAAA;AAAA,QACA,UAAU,MAAM,sBAAA,EAAuB,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,QACzD,aAAa,CAAC,MAAA,EAAQ,KAAA,KACpB,CAAA,QAAA,EAAW,MAAM,CAAA,uBAAA,EAA0B,kBAAA;AAAA,UACzC,MAAA,CAAO,SAAS,MAAA,GAAS;AAAA,SAC1B,CAAA,QAAA,EAAW,MAAM,CAAA,OAAA,EAAU,KAAK,CAAA;AAAA,OACrC,CAAA;AAAA,MACA,CAAC,SAAA,EAAW,eAAA,EAAiB,IAAA,EAAM,iBAAA,EAAmB,QAAQ,sBAAsB;AAAA,KACtF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAA,EAAU;AACrB","file":"index.js","sourcesContent":["/**\n * Whether Auth0 can run in this browsing context. `auth0-spa-js` needs Web Crypto, which browsers\n * expose only on a SECURE ORIGIN (https, or `localhost`): a dev server reached over a LAN address\n * (`http://10.0.0.5:5173`) is not one. The site's own email + password sign-in does not need\n * Auth0, so the SSO affordances are hidden there rather than let them throw.\n */\nexport const isAuth0Available: boolean =\n  typeof window !== 'undefined' && window.isSecureContext && !!window.crypto?.subtle\n","/**\n * Auth0 as the SDK client's `SsoTokenSource` (`createArbiClient({ sso: auth0TokenSource })`): the\n * token for a silent re-login of an SSO account. `Auth0Gate` registers Auth0's token getter once\n * Auth0 is signed in; the client asks only in SSO mode, which is also the cross-deployment guard\n * (Auth0's cache is shared by every deployment on the tenant).\n */\n\nimport type { SsoTokenSource } from '@arbidocs/client'\n\n/** How long a re-login waits for Auth0 to expose its token getter after a page load. */\nconst GETTER_WAIT_MS = 1_000\nconst GETTER_POLL_MS = 250\n\nlet tokenGetter: (() => Promise<string>) | null = null\nlet lastToken: string | null = null\n\n/** Auth0's token getter, once signed in there (`Auth0Gate`); `null` to drop it. */\nexport function setAuth0TokenGetter(getter: (() => Promise<string>) | null): void {\n  tokenGetter = getter\n}\n\n/** The last token Auth0 gave (the re-login's fallback); `null` to forget it. */\nexport function rememberAuth0Token(token: string | null): void {\n  lastToken = token\n}\n\nexport const auth0TokenSource: SsoTokenSource = {\n  async getToken() {\n    // On a page load the getter may not exist yet: wait up to 1s for it, then fall back to the\n    // last token Auth0 gave.\n    for (let waited = 0; ; waited += GETTER_POLL_MS) {\n      if (tokenGetter) {\n        try {\n          const token = await tokenGetter()\n          if (token) return token\n          break\n        } catch (error) {\n          // Auth0 not settled yet: try again until the wait is over.\n          console.error('[SSO] Failed to get the Auth0 token:', error)\n        }\n      }\n      if (waited >= GETTER_WAIT_MS) break\n      if (waited === 0) console.info('[SSO] No Auth0 token getter yet - waiting for Auth0')\n      await new Promise((resolve) => setTimeout(resolve, GETTER_POLL_MS))\n    }\n    return lastToken\n  },\n}\n","/**\n * Auth0Gate — mount Auth0 only where it can actually run.\n *\n * `auth0-spa-js` requires Web Crypto, which the browser only exposes on a SECURE\n * ORIGIN (https, or `localhost`). Reached over a LAN address — `http://10.0.0.5:5173`,\n * the way a dev server started with `--host` is usually opened — it throws\n * \"auth0-spa-js must run on a secure origin\" while `Auth0Provider` initialises,\n * and the app never boots.\n *\n * That is a shame, because ARBI's own email + password login does not need Auth0\n * at all: Auth0 backs the SSO buttons and the hosted password-reset flow. So on an\n * insecure origin we render an INERT Auth0 context instead of the real provider.\n * The app boots, native sign-in works, and the SSO paths are hidden (see\n * `isAuth0Available`) rather than throwing when clicked.\n *\n * It is the site's `Auth0Gate`: mounted once around the app, it is also where the re-login gets\n * Auth0's token (`auth0TokenSource`).\n *\n * Note the context must be inert, not absent: `useAuth0()` outside a provider\n * returns `isLoading: true` forever, which would hang `App` on its loading screen.\n */\n\nimport { useEffect, type ReactNode } from 'react'\nimport {\n  Auth0Context,\n  Auth0Provider,\n  initialContext,\n  useAuth0,\n  type Auth0ProviderOptions,\n} from '@auth0/auth0-react'\nimport { isAuth0Available } from './availability'\nimport { rememberAuth0Token, setAuth0TokenGetter } from './token-source'\n\n/** Rejects rather than silently no-oping, so a stray SSO call is visible in dev. */\nfunction unavailable(): never {\n  throw new Error(\n    'Auth0 is unavailable on a non-secure origin. Open the app over https or on localhost.'\n  )\n}\n\n/**\n * A settled, signed-out Auth0 context, built from the library's own default so it\n * cannot drift as the interface grows. `isLoading: false` is the load-bearing\n * override — it lets `App` finish booting instead of waiting on a provider that\n * will never initialise. The auth methods keep the defaults' throwing stubs.\n */\nconst INERT_CONTEXT = { ...initialContext, isLoading: false, getAccessTokenSilently: unavailable }\n\n/**\n * Hands Auth0's token getter to the re-login (`auth0TokenSource`) once Auth0 is signed in, and\n * keeps its last token as the fallback. The client asks for it only in SSO mode.\n */\nfunction Auth0TokenBridge() {\n  const { isAuthenticated, isLoading, getAccessTokenSilently } = useAuth0()\n  useEffect(() => {\n    if (!isAuthenticated || isLoading) return\n    setAuth0TokenGetter(getAccessTokenSilently)\n    getAccessTokenSilently().then(rememberAuth0Token, () => {\n      // Expected during registration: no token yet.\n    })\n    return () => setAuth0TokenGetter(null)\n  }, [isAuthenticated, isLoading, getAccessTokenSilently])\n  return null\n}\n\n/** Auth0 for the site, where it can run (see above); its token is handed to the re-login. */\nexport function Auth0Gate({\n  children,\n  ...options\n}: Auth0ProviderOptions & { children: ReactNode }) {\n  if (!isAuth0Available) {\n    return <Auth0Context.Provider value={INERT_CONTEXT}>{children}</Auth0Context.Provider>\n  }\n  return (\n    <Auth0Provider {...options}>\n      <Auth0TokenBridge />\n      {children}\n    </Auth0Provider>\n  )\n}\n","/**\n * Auth0 as the site's single sign-on provider (the host configuration's `sso`): the sign-in kits\n * reach Auth0 through it, never through `@auth0/auth0-react` themselves.\n *\n *   <ArbiHost config={{ sso: auth0Sso({ domain: 'auth.example.com' }), … }}>\n *\n * Needs `Auth0Gate` around the site.\n */\n\nimport { useMemo } from 'react'\nimport { useAuth0 } from '@auth0/auth0-react'\nimport type { SsoSignIn, SsoSupport } from '../connection/auth/support'\nimport { isAuth0Available } from './availability'\nimport { rememberAuth0Token } from './token-source'\n\nexport interface Auth0SsoOptions {\n  /** The Auth0 tenant's domain: an account link continues there. */\n  domain: string\n  /** Where Auth0 comes back to after an account link (default: `<origin>/sso`). */\n  callbackPath?: string\n}\n\n/** The SSO provider backed by Auth0. */\nexport function auth0Sso({ domain, callbackPath = '/sso' }: Auth0SsoOptions): SsoSupport {\n  function useSignIn(): SsoSignIn {\n    const { isLoading, isAuthenticated, user, loginWithRedirect, logout, getAccessTokenSilently } =\n      useAuth0()\n    return useMemo(\n      () => ({\n        available: isAuth0Available,\n        isLoading,\n        isAuthenticated,\n        user: user?.sub\n          ? {\n              sub: user.sub,\n              email: user.email,\n              name: user.name,\n              given_name: user.given_name,\n              family_name: user.family_name,\n              picture: user.picture,\n            }\n          : null,\n        async signIn({ returnTo, redirectUri, consent, connection } = {}) {\n          // A token from a previous Auth0 session must not stand in for the coming one.\n          rememberAuth0Token(null)\n          await loginWithRedirect({\n            ...(returnTo ? { appState: { returnTo } } : {}),\n            ...(redirectUri || consent || connection\n              ? {\n                  authorizationParams: {\n                    ...(redirectUri ? { redirect_uri: redirectUri } : {}),\n                    ...(consent ? { prompt: 'consent' as const } : {}),\n                    ...(connection ? { connection } : {}),\n                  },\n                }\n              : {}),\n          })\n        },\n        signOut({ returnTo } = {}) {\n          void logout(returnTo ? { logoutParams: { returnTo } } : undefined)\n        },\n        getToken: () => getAccessTokenSilently().catch(() => null),\n        continueUrl: (action, state) =>\n          `https://${domain}/continue?redirect_uri=${encodeURIComponent(\n            window.location.origin + callbackPath\n          )}&action=${action}&state=${state}`,\n      }),\n      [isLoading, isAuthenticated, user, loginWithRedirect, logout, getAccessTokenSilently]\n    )\n  }\n  return { useSignIn }\n}\n"]}

package/dist/{chunk-BQNDBWLB.js → chunk-4ML5AMMO.js}

@@ -1,5 +1,5 @@
 "use client";
-import { TYPED_SIGNATURE_STYLE, AdoptSignatureDialog } from './chunk-TBNXJHTP.js';
+import { TYPED_SIGNATURE_STYLE, AdoptSignatureDialog } from './chunk-IA5BYEO7.js';
 import { ModalScaffold } from './chunk-TX2ZICS7.js';
 import { useRef, useState, useMemo, useEffect, useCallback } from 'react';
 import { X, ArrowRight, ArrowLeft, Check } from 'lucide-react';
@@ -805,5 +805,5 @@ function SharedFilesInbox() {
 }
 
 export { GuidedSigningViewer, SIGNER_COLORS, SharedFileView, SharedFilesInbox, SignatureFieldsOverlay, signingDate };
-//# sourceMappingURL=chunk-BQNDBWLB.js.map
-//# sourceMappingURL=chunk-BQNDBWLB.js.map
+//# sourceMappingURL=chunk-4ML5AMMO.js.map
+//# sourceMappingURL=chunk-4ML5AMMO.js.map