@atlasauth/embed 0.1.0

package/dist/widget/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/widget/constants.ts"],"names":[],"mappings":";;;AAAA;yDACyD;AAC5C,QAAA,gBAAgB,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAE7D,oEAAoE;AACvD,QAAA,YAAY,GACvB,mLAAmL,CAAC;AACzK,QAAA,aAAa,GACxB,iLAAiL,CAAC;AAEvK,QAAA,IAAI,GAAG;IAClB,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE;IACnD,SAAS,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,UAAU,EAAE;CACvD,CAAC"}

package/dist/widget/dom.d.ts

@@ -0,0 +1,18 @@
+import { classFor } from '../appearance';
+import type { AtlasWidget } from '../widget';
+export declare function doc(w: AtlasWidget): Document;
+export declare function el(w: AtlasWidget, tag: string, className?: string, text?: string): HTMLElement;
+export declare function cls(w: AtlasWidget, element: Parameters<typeof classFor>[0], base: string): string;
+/**
+ * A material tap ripple: spawn a scaled circle at the pointer, sized to cover
+ * the button, and remove it when its animation ends. No-op unless the ripple
+ * effect is active and motion is allowed — cheap enough to bind to every button.
+ */
+export declare function bindRipple(w: AtlasWidget, button: HTMLElement): void;
+/**
+ * The primary submit button, with a built-in busy state: while `busy` it shows
+ * a spinner in place of its label (and is disabled), so clicking "Continue"
+ * gives immediate progress feedback instead of a dead, unchanged button. Goes
+ * through `el()` so the ripple/interaction bindings still apply.
+ */
+export declare function submitButton(w: AtlasWidget, label: string): HTMLButtonElement;

package/dist/widget/dom.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.doc = doc;
+exports.el = el;
+exports.cls = cls;
+exports.bindRipple = bindRipple;
+exports.submitButton = submitButton;
+const appearance_1 = require("../appearance");
+function doc(w) {
+    return w.root.ownerDocument ?? document;
+}
+function el(w, tag, className, text) {
+    const node = doc(w).createElement(tag);
+    if (className)
+        node.className = className;
+    if (text != null)
+        node.textContent = text;
+    // The two button classes the ripple stylesheet clips — bind the tap ripple
+    // here so every submit/social button gets it without touching each call site.
+    if (node.classList.contains('atlas-embed-button') ||
+        node.classList.contains('atlas-embed-social-button')) {
+        bindRipple(w, node);
+    }
+    return node;
+}
+function cls(w, element, base) {
+    return (0, appearance_1.classFor)(element, base, w.options.appearance);
+}
+/**
+ * A material tap ripple: spawn a scaled circle at the pointer, sized to cover
+ * the button, and remove it when its animation ends. No-op unless the ripple
+ * effect is active and motion is allowed — cheap enough to bind to every button.
+ */
+function bindRipple(w, button) {
+    if (w.interaction.buttonEffect !== 'ripple' || !w.interaction.animations)
+        return;
+    button.addEventListener('pointerdown', (ev) => {
+        const rect = button.getBoundingClientRect();
+        const size = Math.max(rect.width, rect.height);
+        const span = doc(w).createElement('span');
+        span.className = 'atlas-embed-ripple';
+        span.style.width = span.style.height = `${size}px`;
+        span.style.left = `${ev.clientX - rect.left - size / 2}px`;
+        span.style.top = `${ev.clientY - rect.top - size / 2}px`;
+        span.addEventListener('animationend', () => span.remove());
+        button.appendChild(span);
+    });
+}
+/**
+ * The primary submit button, with a built-in busy state: while `busy` it shows
+ * a spinner in place of its label (and is disabled), so clicking "Continue"
+ * gives immediate progress feedback instead of a dead, unchanged button. Goes
+ * through `el()` so the ripple/interaction bindings still apply.
+ */
+function submitButton(w, label) {
+    const btn = el(w, 'button', cls(w, 'buttonPrimary', 'atlas-embed-button'));
+    btn.type = 'submit';
+    btn.disabled = w.busy;
+    if (w.busy) {
+        btn.setAttribute('data-busy', '');
+        btn.setAttribute('aria-label', label);
+        const sp = el(w, 'span', 'atlas-embed-btn-spinner');
+        sp.setAttribute('aria-hidden', 'true');
+        btn.appendChild(sp);
+    }
+    else {
+        btn.textContent = label;
+    }
+    return btn;
+}
+//# sourceMappingURL=dom.js.map

package/dist/widget/dom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dom.js","sourceRoot":"","sources":["../../src/widget/dom.ts"],"names":[],"mappings":";;AAGA,kBAEC;AAED,gBAaC;AAED,kBAEC;AAOD,gCAaC;AAQD,oCAcC;AAlED,8CAAyC;AAGzC,SAAgB,GAAG,CAAC,CAAc;IAChC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAgB,EAAE,CAAC,CAAc,EAAE,GAAW,EAAE,SAAkB,EAAE,IAAa;IAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC1C,IAAI,IAAI,IAAI,IAAI;QAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1C,2EAA2E;IAC3E,8EAA8E;IAC9E,IACE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EACpD,CAAC;QACD,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,GAAG,CAAC,CAAc,EAAE,OAAuC,EAAE,IAAY;IACvF,OAAO,IAAA,qBAAQ,EAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,CAAc,EAAE,MAAmB;IAC5D,IAAI,CAAC,CAAC,WAAW,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU;QAAE,OAAO;IACjF,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,oBAAoB,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAI,EAAmB,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAI,EAAmB,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;QAC3E,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,CAAc,EAAE,KAAa;IACxD,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAsB,CAAC;IAChG,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;IACpB,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClC,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACpD,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/widget/flow.d.ts

@@ -0,0 +1,41 @@
+import type { AtlasWidget } from '../widget';
+export declare function handleRedirectLanding(w: AtlasWidget): Promise<boolean>;
+export declare function exchange(w: AtlasWidget, attemptId: string, ticket: string): Promise<void>;
+/**
+ * Finish: navigate to a VALIDATED redirect, or — when none is supplied or it
+ * is rejected — emit `atlas:complete` so the embedding page decides. The event
+ * bubbles and is cancelable-free; its detail carries the attempt id.
+ */
+export declare function complete(w: AtlasWidget, attemptId: string | null): Promise<void>;
+/**
+ * §bot — fire the anti-bot signal beacon for this interaction. Fully
+ * best-effort and fire-and-forget: it never blocks or fails a sign-in.
+ */
+export declare function beacon(w: AtlasWidget, attemptId?: string | null): void;
+export declare function submit(w: AtlasWidget, values: Record<string, string>): Promise<void>;
+export declare function startOAuth(w: AtlasWidget, provider: string, identifier?: string): Promise<void>;
+/**
+ * Start a "Sign in with Atlas" (or any SSO connection) sign-in: POST the
+ * connection id, then navigate to the authorize URL the server returns. The OIDC
+ * callback returns to this page (an allowed origin) to exchange the ticket — the
+ * same completion path startOAuth uses.
+ *
+ * `opts.popup` runs the flow in a GSI-style popup window instead of a full-page
+ * redirect; the callback hands the ticket back via postMessage and this page
+ * exchanges it in place. A blocked popup falls back to the redirect flow.
+ */
+export declare function startSso(w: AtlasWidget, connectionId: string, opts?: {
+    popup?: boolean;
+}): Promise<void>;
+/**
+ * Complete a native / One-Tap sign-in: POST the provider id_token, then either
+ * exchange the returned ticket for cookies (complete) or resume at the second
+ * factor the attempt still owes — the SAME completion paths the redirect flow
+ * uses, so GSI and the redirect flow finish identically.
+ */
+export declare function completeIdToken(w: AtlasWidget, provider: string, idToken: string): Promise<void>;
+/** §5.4 enter the "forgot password" sub-flow. */
+export declare function startReset(w: AtlasWidget): void;
+/** Drive the reset one step: start it, or advance it, then complete on success. */
+export declare function submitReset(w: AtlasWidget, values: Record<string, string>): Promise<void>;
+export declare function submitSignUp(w: AtlasWidget, values: Record<string, string>, consent?: boolean): Promise<void>;

package/dist/widget/flow.js

@@ -0,0 +1,424 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleRedirectLanding = handleRedirectLanding;
+exports.exchange = exchange;
+exports.complete = complete;
+exports.beacon = beacon;
+exports.submit = submit;
+exports.startOAuth = startOAuth;
+exports.startSso = startSso;
+exports.completeIdToken = completeIdToken;
+exports.startReset = startReset;
+exports.submitReset = submitReset;
+exports.submitSignUp = submitSignUp;
+const js_1 = require("@atlasauth/js");
+const redirect_1 = require("../redirect");
+const captcha_1 = require("./captcha");
+const render_1 = require("./render");
+/**
+ * §5 obtain a captcha token for a flow, mounting the challenge OUTSIDE `w.root`
+ * (render() wipes root on every paint, so a host inside it would vanish). The
+ * host is removed as soon as the token resolves. Returns null when no token is
+ * needed or the provider isn't one the widget renders — the server still fails
+ * closed if it required one, surfacing the normal CAPTCHA_REQUIRED error.
+ *
+ * `always` renders even when the flow's always-on flag is off — used for a
+ * risk-triggered sign-in challenge, where the server demands a token mid-flow
+ * regardless of the per-flow toggle.
+ */
+async function captchaToken(w, key, always = false) {
+    const flow = w.captchaFlows[key];
+    const wanted = always ? !!flow && (0, captcha_1.isRenderable)(flow.provider) : (0, captcha_1.flowNeedsCaptcha)(flow);
+    if (!wanted || !flow)
+        return null;
+    const doc = w.root.ownerDocument ?? document;
+    const host = doc.createElement('div');
+    host.className = 'atlas-embed-captcha';
+    (w.root.parentElement ?? doc.body ?? doc.documentElement).appendChild(host);
+    try {
+        return await (0, captcha_1.getCaptchaToken)(flow, host);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        host.remove();
+    }
+}
+// ---- redirect landing (OAuth / hosted completion) ------------------------
+async function handleRedirectLanding(w) {
+    const win = w.root.ownerDocument?.defaultView ?? (typeof window !== 'undefined' ? window : null);
+    if (!win)
+        return false;
+    const result = (0, js_1.readRedirectResult)(win.location.search);
+    if (!result)
+        return false;
+    if (result.ticket) {
+        await exchange(w, result.attemptId, result.ticket);
+        scrubUrl(w, win);
+        await complete(w, result.attemptId);
+        return true;
+    }
+    // A redirect that carries a status but no ticket owes a second factor:
+    // resume the flow AT that step, bound to the same attempt.
+    if (result.status) {
+        w.state = (0, js_1.flowFromPending)({ id: result.attemptId, status: result.status });
+        scrubUrl(w, win);
+    }
+    return false;
+}
+function scrubUrl(w, win) {
+    try {
+        win.history.replaceState({}, win.document.title, (0, js_1.stripRedirectParams)(win.location.href));
+    }
+    catch {
+        // A sandboxed history is not fatal — the flow still works.
+    }
+}
+// ---- completion ----------------------------------------------------------
+async function exchange(w, attemptId, ticket) {
+    // Preview: the flow ran end-to-end, but we deliberately do NOT redeem the
+    // ticket — no session cookie is set, so the host page's session is untouched.
+    if (w.options.preview)
+        return;
+    // §7.5 carry the Remember-me choice so the server can make the refresh cookie
+    // persistent (default) or a session cookie (unticked).
+    await w.client.post('/v1/client/tickets/exchange', {
+        attempt_id: attemptId,
+        ticket,
+        remember: w.remember,
+    });
+}
+/**
+ * Finish: navigate to a VALIDATED redirect, or — when none is supplied or it
+ * is rejected — emit `atlas:complete` so the embedding page decides. The event
+ * bubbles and is cancelable-free; its detail carries the attempt id.
+ */
+async function complete(w, attemptId) {
+    const win = w.root.ownerDocument?.defaultView ?? (typeof window !== 'undefined' ? window : null);
+    const target = (0, redirect_1.validateRedirect)(w.options.redirect, win ? win.location.origin : undefined);
+    w.root.dispatchEvent(new CustomEvent('atlas:complete', {
+        bubbles: true,
+        detail: { attemptId, redirected: Boolean(target) },
+    }));
+    // Preview never navigates and never claims a session — it confirms the flow.
+    if (w.options.preview) {
+        (0, render_1.renderNote)(w, 'Sign-in works — this is a preview, so no session was created.');
+        return;
+    }
+    if (target && win) {
+        win.location.assign(target);
+        return;
+    }
+    (0, render_1.renderNote)(w, 'You are signed in.');
+}
+// ---- flow submit ---------------------------------------------------------
+/**
+ * §bot — fire the anti-bot signal beacon for this interaction. Fully
+ * best-effort and fire-and-forget: it never blocks or fails a sign-in.
+ */
+function beacon(w, attemptId) {
+    void (0, js_1.sendTelemetry)({
+        api: w.options.frontendApi,
+        publishableKey: w.options.publishableKey,
+        attemptId: attemptId ?? undefined,
+        kind: w.mode === 'sign-up' ? 'sign_up' : 'sign_in',
+        recorder: w.recorder,
+        fetchImpl: w.options.fetchImpl,
+    });
+}
+async function submit(w, values) {
+    if (w.busy)
+        return;
+    // The user is signing in by other means — stand down the background passkey
+    // autofill ceremony so it cannot resolve underneath them.
+    w.conditionalAbort?.abort();
+    w.flash = null; // the confirmation banner clears once the user acts
+    // Remember the identifier so the code/password steps can show it as context.
+    if (typeof values.identifier === 'string' && values.identifier.trim()) {
+        w.enteredIdentifier = values.identifier.trim();
+    }
+    w.busy = true;
+    // Beacon at the moment of submit — behaviour is richest here.
+    beacon(w, w.state.attempt?.id);
+    (0, render_1.render)(w);
+    w.state = await (0, js_1.advance)(w.client, w.state, values);
+    // §5 the server withheld the attempt pending a captcha (an always-on sign-in
+    // gate, or a risk-triggered challenge): render the provider's widget and
+    // resubmit the identifier with the token. `always` so a risk challenge renders
+    // even when the sign-in flow's always-on toggle is off.
+    if (w.state.attempt && (0, js_1.nextStep)(w.state.attempt).kind === 'collect_captcha') {
+        const token = await captchaToken(w, 'signIn', true);
+        if (token) {
+            w.state = await (0, js_1.advance)(w.client, w.state, {
+                identifier: w.enteredIdentifier ?? values.identifier ?? '',
+                captcha_token: token,
+            });
+        }
+    }
+    // Single-screen sign-in: the identifier POST just landed on the first-factor
+    // step and the user already typed their password on the same form — send it
+    // now so it's one click, not two screens. Only when the server actually
+    // asked for the first factor and the identifier step raised no error.
+    const step = w.state.attempt ? (0, js_1.nextStep)(w.state.attempt) : null;
+    if (step?.kind === 'collect_first_factor' && values.password && w.state.errors.length === 0) {
+        w.state = await (0, js_1.advance)(w.client, w.state, { password: values.password });
+    }
+    w.busy = false;
+    // §single-screen: a sign-in box that shows email + password TOGETHER must not
+    // collapse to a password-only screen after a wrong password — that reads as
+    // "the email field just vanished". Return to the combined box (email prefilled
+    // from what they typed) carrying any error, so a wrong credential reads as "try
+    // again" in the same box. The next submit starts a fresh attempt — cheaper than
+    // stranding the user on a field-less screen.
+    const endStep = w.state.attempt ? (0, js_1.nextStep)(w.state.attempt) : null;
+    if (w.mode === 'sign-in' && w.passwordEnabled && endStep?.kind === 'collect_first_factor') {
+        w.state = { ...js_1.initialFlow, errors: w.state.errors };
+    }
+    const attempt = w.state.attempt;
+    if (attempt?.status === 'complete') {
+        const attemptId = attempt.id ?? null;
+        if (w.state.ticket && attemptId)
+            await exchange(w, attemptId, w.state.ticket);
+        await complete(w, attemptId);
+        return;
+    }
+    (0, render_1.render)(w);
+}
+async function startOAuth(w, provider, identifier) {
+    // §bot — beacon before we navigate away to the provider.
+    beacon(w);
+    const win = w.root.ownerDocument?.defaultView ?? (typeof window !== 'undefined' ? window : null);
+    // The OAuth callback must return to a page that runs the widget so it can
+    // exchange the ticket — this page. The server additionally requires this
+    // URL to be one of the instance's allowedOrigins.
+    const redirectUrl = win ? (0, js_1.stripRedirectParams)(win.location.href) : w.options.frontendApi;
+    const response = await w.client.post('/v1/client/sign_ins/oauth', 
+    // Bluesky (AT-Proto) resolves the user's PDS from their handle, so it is
+    // sent up front; every other provider ignores `identifier`.
+    { provider, redirect_url: redirectUrl, ...(identifier ? { identifier } : {}) });
+    const url = response.data?.authorization_url;
+    if (url && win)
+        win.location.assign(url);
+    else {
+        w.handlePrompt = null;
+        (0, render_1.renderErrors)(w, response.errors);
+    }
+}
+/**
+ * Start a "Sign in with Atlas" (or any SSO connection) sign-in: POST the
+ * connection id, then navigate to the authorize URL the server returns. The OIDC
+ * callback returns to this page (an allowed origin) to exchange the ticket — the
+ * same completion path startOAuth uses.
+ *
+ * `opts.popup` runs the flow in a GSI-style popup window instead of a full-page
+ * redirect; the callback hands the ticket back via postMessage and this page
+ * exchanges it in place. A blocked popup falls back to the redirect flow.
+ */
+async function startSso(w, connectionId, opts = {}) {
+    beacon(w);
+    const win = w.root.ownerDocument?.defaultView ?? (typeof window !== 'undefined' ? window : null);
+    const baseRedirect = win ? (0, js_1.stripRedirectParams)(win.location.href) : w.options.frontendApi;
+    if (opts.popup && win) {
+        await startSsoPopup(w, connectionId, win, baseRedirect);
+        return;
+    }
+    const response = await w.client.post('/v1/client/sign_ins/sso', { connection_id: connectionId, redirect_url: baseRedirect });
+    const url = response.data?.authorization_url;
+    if (url && win)
+        win.location.assign(url);
+    else
+        (0, render_1.renderErrors)(w, response.errors);
+}
+/** The origin the popup handoff posts from — the widget's own FAPI origin. */
+function fapiOrigin(w) {
+    const fa = w.options.frontendApi;
+    try {
+        return new URL(/^https?:\/\//.test(fa) ? fa : `https://${fa}`).origin;
+    }
+    catch {
+        return fa;
+    }
+}
+/**
+ * The GSI-style popup variant. The popup is opened SYNCHRONOUSLY (before the
+ * async POST) so the browser treats it as user-initiated and does not block it;
+ * a blocked popup falls back to the full-page redirect. The callback lands in
+ * the popup, posts the ticket to this window (origin-checked), and we finish the
+ * sign-in here — the same exchange→complete path the redirect landing uses.
+ */
+async function startSsoPopup(w, connectionId, win, baseRedirect) {
+    const popup = win.open('about:blank', 'atlas-sso', 'width=480,height=640,menubar=no,toolbar=no,location=no,status=no');
+    if (!popup) {
+        // Popup blocked — fall back to the reliable redirect flow.
+        await startSso(w, connectionId);
+        return;
+    }
+    const sep = baseRedirect.includes('?') ? '&' : '?';
+    const redirectUrl = `${baseRedirect}${sep}__atlas_display=popup`;
+    const expectedOrigin = fapiOrigin(w);
+    const onMessage = (event) => {
+        if (event.origin !== expectedOrigin)
+            return;
+        const data = event.data;
+        if (!data || data.type !== 'atlas-sso')
+            return;
+        win.removeEventListener('message', onMessage);
+        try {
+            popup.close();
+        }
+        catch {
+            /* a cross-origin popup may already be gone */
+        }
+        if (data.error) {
+            (0, render_1.renderErrors)(w, [{ code: 'sso_popup_cancelled', message: 'Sign-in was cancelled.' }]);
+            return;
+        }
+        if (data.status === 'complete' && data.ticket && data.attempt_id) {
+            const attemptId = data.attempt_id;
+            const ticket = data.ticket;
+            void (async () => {
+                await exchange(w, attemptId, ticket);
+                await complete(w, attemptId);
+            })();
+            return;
+        }
+        // Owes a second factor — resume the flow in THIS window at that step.
+        if (data.attempt_id && data.status) {
+            w.state = (0, js_1.flowFromPending)({ id: data.attempt_id, status: data.status });
+            (0, render_1.render)(w);
+        }
+    };
+    win.addEventListener('message', onMessage);
+    const response = await w.client.post('/v1/client/sign_ins/sso', { connection_id: connectionId, redirect_url: redirectUrl });
+    const url = response.data?.authorization_url;
+    if (url) {
+        try {
+            popup.location.assign(url);
+        }
+        catch {
+            // Some browsers disallow scripting a popup we just navigated cross-origin;
+            // fall back to navigating this window instead.
+            try {
+                popup.close();
+            }
+            catch {
+                /* ignore */
+            }
+            win.removeEventListener('message', onMessage);
+            win.location.assign(url);
+        }
+    }
+    else {
+        win.removeEventListener('message', onMessage);
+        try {
+            popup.close();
+        }
+        catch {
+            /* ignore */
+        }
+        (0, render_1.renderErrors)(w, response.errors);
+    }
+}
+/**
+ * Complete a native / One-Tap sign-in: POST the provider id_token, then either
+ * exchange the returned ticket for cookies (complete) or resume at the second
+ * factor the attempt still owes — the SAME completion paths the redirect flow
+ * uses, so GSI and the redirect flow finish identically.
+ */
+async function completeIdToken(w, provider, idToken) {
+    const res = await w.client.post('/v1/client/sign_ins/id_token', (0, js_1.nativeSignInBody)({ provider, idToken }));
+    const parsed = (0, js_1.parseNativeSignInResponse)(res.data);
+    if (!parsed) {
+        (0, render_1.renderErrors)(w, res.errors);
+        return;
+    }
+    if (parsed.status === 'complete' && parsed.ticket) {
+        await exchange(w, parsed.attemptId, parsed.ticket);
+        await complete(w, parsed.attemptId);
+        return;
+    }
+    // Owes a second factor — resume at that step, bound to the same attempt.
+    w.state = (0, js_1.flowFromPending)({ id: parsed.attemptId, status: parsed.status });
+    (0, render_1.render)(w);
+}
+/** §5.4 enter the "forgot password" sub-flow. */
+function startReset(w) {
+    w.resetFlow = { ...js_1.initialResetFlow };
+    (0, render_1.render)(w);
+}
+/** Drive the reset one step: start it, or advance it, then complete on success. */
+async function submitReset(w, values) {
+    if (w.busy || !w.resetFlow)
+        return;
+    w.busy = true;
+    beacon(w);
+    (0, render_1.render)(w);
+    if ((0, js_1.resetStep)(w.resetFlow) === 'request') {
+        if (typeof values.email === 'string' && values.email.trim()) {
+            w.enteredIdentifier = values.email.trim();
+        }
+        const token = await captchaToken(w, 'passwordReset');
+        w.resetFlow = await (0, js_1.startPasswordReset)(w.client, values.email ?? '', token ?? undefined);
+    }
+    else {
+        w.resetFlow = await (0, js_1.advancePasswordReset)(w.client, w.resetFlow, {
+            code: values.code,
+            password: values.password,
+        });
+    }
+    w.busy = false;
+    const done = w.resetFlow;
+    if (done?.attempt?.status === 'complete') {
+        const attemptId = done.attempt.id;
+        w.resetFlow = null;
+        if (done.ticket) {
+            // Auto sign-in: exchange the ticket for a session, exactly like a normal
+            // sign-in completion.
+            await exchange(w, attemptId, done.ticket);
+            await complete(w, attemptId);
+        }
+        else {
+            // Force-login: no session was issued. Return to the sign-in box (email
+            // already prefilled) with a confirmation, so the user signs in with the
+            // new password.
+            w.flash = 'Password updated. Sign in with your new password.';
+            w.state = js_1.initialFlow;
+            (0, render_1.render)(w);
+        }
+        return;
+    }
+    (0, render_1.render)(w);
+}
+async function submitSignUp(w, values, consent = true) {
+    if (w.busy)
+        return;
+    w.busy = true;
+    beacon(w);
+    (0, render_1.render)(w);
+    const { identifier, password, ...rest } = values;
+    // Drop blank optional fields so we never send empty strings to the server.
+    const fields = {};
+    for (const [key, value] of Object.entries(rest))
+        if (value)
+            fields[key] = value;
+    const token = await captchaToken(w, 'signUp');
+    w.state = await (0, js_1.startSignUp)(w.client, {
+        email: identifier ?? '',
+        password: password ?? '',
+        fields,
+        consent,
+        captchaToken: token ?? undefined,
+    });
+    w.busy = false;
+    const attempt = w.state.attempt;
+    if (attempt?.status === 'complete') {
+        const attemptId = attempt.id ?? null;
+        if (w.state.ticket && attemptId)
+            await exchange(w, attemptId, w.state.ticket);
+        await complete(w, attemptId);
+        return;
+    }
+    (0, render_1.render)(w);
+}
+//# sourceMappingURL=flow.js.map

package/dist/widget/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/widget/flow.ts"],"names":[],"mappings":";;AAwDA,sDAqBC;AAYD,4BAWC;AAOD,4BAwBC;AAQD,wBASC;AAED,wBA6DC;AAED,gCAqBC;AAYD,4BAqBC;AA6GD,0CAkBC;AAGD,gCAGC;AAGD,kCAwCC;AAED,oCA6BC;AA1dD,sCAeuB;AACvB,0CAA+C;AAG/C,uCAA4E;AAC5E,qCAA4D;AAE5D;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CACzB,CAAc,EACd,GAAmB,EACnB,MAAM,GAAG,KAAK;IAEd,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAA,sBAAY,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,0BAAgB,EAAC,IAAI,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,GAAG,qBAAqB,CAAC;IACvC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,yBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,6EAA6E;AAEtE,KAAK,UAAU,qBAAqB,CAAC,CAAc;IACxD,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,MAAM,MAAM,GAAG,IAAA,uBAAkB,EAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjB,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,CAAC,CAAC,KAAK,GAAG,IAAA,oBAAe,EAAC,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,CAAc,EAAE,GAAW;IAC3C,IAAI,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAA,wBAAmB,EAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC;AAED,6EAA6E;AAEtE,KAAK,UAAU,QAAQ,CAAC,CAAc,EAAE,SAAiB,EAAE,MAAc;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO;IAC9B,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;QACjD,UAAU,EAAE,SAAS;QACrB,MAAM;QACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,QAAQ,CAAC,CAAc,EAAE,SAAwB;IACrE,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,IAAA,2BAAgB,EAC7B,CAAC,CAAC,OAAO,CAAC,QAAQ,EAClB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CACtC,CAAC;IAEF,CAAC,CAAC,IAAI,CAAC,aAAa,CAClB,IAAI,WAAW,CAAC,gBAAgB,EAAE;QAChC,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;KACnD,CAAC,CACH,CAAC;IAEF,6EAA6E;IAC7E,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtB,IAAA,mBAAU,EAAC,CAAC,EAAE,+DAA+D,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,IAAA,mBAAU,EAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACtC,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,SAAgB,MAAM,CAAC,CAAc,EAAE,SAAyB;IAC9D,KAAK,IAAA,kBAAa,EAAC;QACjB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;QAC1B,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc;QACxC,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAClD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS;KAC/B,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,MAAM,CAAC,CAAc,EAAE,MAA8B;IACzE,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO;IACnB,4EAA4E;IAC5E,0DAA0D;IAC1D,CAAC,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,oDAAoD;IAEpE,6EAA6E;IAC7E,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACtE,CAAC,CAAC,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACd,8DAA8D;IAC9D,MAAM,CAAC,CAAC,EAAG,CAAC,CAAC,KAAK,CAAC,OAAuC,EAAE,EAAE,CAAC,CAAC;IAChE,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;IAEV,CAAC,CAAC,KAAK,GAAG,MAAM,IAAA,YAAO,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEnD,6EAA6E;IAC7E,yEAAyE;IACzE,+EAA+E;IAC/E,wDAAwD;IACxD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,IAAA,aAAQ,EAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,KAAK,GAAG,MAAM,IAAA,YAAO,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;gBACzC,UAAU,EAAE,CAAC,CAAC,iBAAiB,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE;gBAC1D,aAAa,EAAE,KAAK;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,aAAQ,EAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,IAAI,IAAI,EAAE,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,CAAC,CAAC,KAAK,GAAG,MAAM,IAAA,YAAO,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IAEf,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,6CAA6C;IAC7C,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,aAAQ,EAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,IAAI,OAAO,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC1F,CAAC,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAW,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAChC,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAI,OAA2B,CAAC,EAAE,IAAI,IAAI,CAAC;QAC1D,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9E,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,CAAc,EAAE,QAAgB,EAAE,UAAmB;IACpF,yDAAyD;IACzD,MAAM,CAAC,CAAC,CAAC,CAAC;IACV,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjG,0EAA0E;IAC1E,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,wBAAmB,EAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAEzF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAClC,2BAA2B;IAC3B,yEAAyE;IACzE,4DAA4D;IAC5D,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC/E,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAC7C,IAAI,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SACpC,CAAC;QACJ,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC;QACtB,IAAA,qBAAY,EAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,QAAQ,CAC5B,CAAc,EACd,YAAoB,EACpB,OAA4B,EAAE;IAE9B,MAAM,CAAC,CAAC,CAAC,CAAC;IACV,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,wBAAmB,EAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAE1F,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAClC,yBAAyB,EACzB,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,CAC5D,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAC7C,IAAI,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;QACpC,IAAA,qBAAY,EAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,CAAc;IAChC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAC1B,CAAc,EACd,YAAoB,EACpB,GAAW,EACX,YAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CACpB,aAAa,EACb,WAAW,EACX,kEAAkE,CACnE,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,2DAA2D;QAC3D,MAAM,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnD,MAAM,WAAW,GAAG,GAAG,YAAY,GAAG,GAAG,uBAAuB,CAAC;IACjE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAErC,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAQ,EAAE;QAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc;YAAE,OAAO;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAEX,CAAC;QACT,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO;QAC/C,GAAG,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAA,qBAAY,EAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBACrC,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC,CAAC,EAAE,CAAC;YACL,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACnC,CAAC,CAAC,KAAK,GAAG,IAAA,oBAAe,EAAC,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAClC,yBAAyB,EACzB,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,CAC3D,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAC7C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,+CAA+C;YAC/C,IAAI,CAAC;gBACH,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,GAAG,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC9C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,IAAA,qBAAY,EAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CAAC,CAAc,EAAE,QAAgB,EAAE,OAAe;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAC7B,8BAA8B,EAC9B,IAAA,qBAAgB,EAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CACxC,CAAC;IACF,MAAM,MAAM,GAAG,IAAA,8BAAyB,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAA,qBAAY,EAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,yEAAyE;IACzE,CAAC,CAAC,KAAK,GAAG,IAAA,oBAAe,EAAC,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,iDAAiD;AACjD,SAAgB,UAAU,CAAC,CAAc;IACvC,CAAC,CAAC,SAAS,GAAG,EAAE,GAAG,qBAAgB,EAAE,CAAC;IACtC,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,WAAW,CAAC,CAAc,EAAE,MAA8B;IAC9E,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO;IACnC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACd,MAAM,CAAC,CAAC,CAAC,CAAC;IACV,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;IAEV,IAAI,IAAA,cAAS,EAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC,CAAC,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QACrD,CAAC,CAAC,SAAS,GAAG,MAAM,IAAA,uBAAkB,EAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,SAAS,GAAG,MAAM,IAAA,yBAAoB,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IAEf,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC;IACzB,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,yEAAyE;YACzE,sBAAsB;YACtB,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,wEAAwE;YACxE,gBAAgB;YAChB,CAAC,CAAC,KAAK,GAAG,mDAAmD,CAAC;YAC9D,CAAC,CAAC,KAAK,GAAG,gBAAW,CAAC;YACtB,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;QACZ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,CAAc,EAAE,MAA8B,EAAE,OAAO,GAAG,IAAI;IAC/F,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO;IACnB,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACd,MAAM,CAAC,CAAC,CAAC,CAAC;IACV,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;IAEV,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACjD,2EAA2E;IAC3E,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAEhF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC,CAAC,KAAK,GAAG,MAAM,IAAA,gBAAW,EAAC,CAAC,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,UAAU,IAAI,EAAE;QACvB,QAAQ,EAAE,QAAQ,IAAI,EAAE;QACxB,MAAM;QACN,OAAO;QACP,YAAY,EAAE,KAAK,IAAI,SAAS;KACjC,CAAC,CAAC;IACH,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IAEf,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAChC,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAI,OAA2B,CAAC,EAAE,IAAI,IAAI,CAAC;QAC1D,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9E,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,IAAA,eAAM,EAAC,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/dist/widget/forms.d.ts

@@ -0,0 +1,35 @@
+import { type FieldError } from '@atlasauth/js';
+import type { AtlasWidget } from '../widget';
+/**
+ * §5.4 the reset sub-flow panel: email → emailed code → (2FA) → new password →
+ * signed in. Reuses the shared field builders + the segmented code input, and
+ * always offers a way back to sign in.
+ */
+export declare function renderReset(w: AtlasWidget): HTMLElement;
+/** A labelled text input, appended to `form` and registered in `inputs`. */
+export declare function fieldInto(w: AtlasWidget, form: HTMLElement, inputs: Map<string, HTMLInputElement>, errors: readonly FieldError[], name: string, label: string, type: string, autocomplete: string): void;
+/**
+ * A verification-code field. `boxes` (default) is a segmented one-box-per-digit
+ * input that auto-advances, accepts a paste, and auto-submits when full;
+ * `single` (or a non-6-digit code) is a plain field. Both feed the same `name`.
+ * Shared by the sign-in and the password-reset forms.
+ */
+export declare function codeFieldInto(w: AtlasWidget, form: HTMLElement, inputs: Map<string, HTMLInputElement>, errors: readonly FieldError[], name: string, label: string, autofocus: boolean): void;
+export declare function renderForm(w: AtlasWidget, stepKind: string): HTMLElement;
+/**
+ * §5.1 legal consent on sign-up: a line linking the Terms of Service / Privacy
+ * Policy the tenant configured. When `required`, it carries a checkbox that gates
+ * account creation. Returns null when the tenant set no links. The URLs are
+ * https-sanitised server-side, so they are safe to render as anchors.
+ */
+export declare function renderLegalConsent(w: AtlasWidget): {
+    row: HTMLElement;
+    checkbox: HTMLInputElement | null;
+} | null;
+/**
+ * §5 The create-account form: the tenant's configured fields (name, company,
+ * phone, custom…) followed by email + password. Submits to
+ * /v1/client/sign_ups; the server then emails a code and the shared flow drives
+ * verification to completion.
+ */
+export declare function renderSignUpForm(w: AtlasWidget): HTMLElement;