@atlasauth/lit 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# @atlasauth/lit
+
+## 0.1.0
+
+- First release: `<atlas-provider>`, `<atlas-signed-in>`, `<atlas-signed-out>`, `<atlas-loading>`, `<atlas-protect>`, `<atlas-sign-in>`, `<atlas-sign-up>` and `<atlas-sign-out-button>`, plus `createAtlasClient` and the context for building your own elements.

package/README.md

@@ -1,3 +1,34 @@
-# Temporary Holding Version
+# @atlasauth/lit
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Atlas for web components. Lit elements over `@atlasauth/js`: a provider, signed-in and signed-out gates, a permission gate, and the sign-in and sign-up panels. They are plain custom elements, so they work in any framework or in none.
+
+```html
+<script type="module">
+  import '@atlasauth/lit';
+</script>
+
+<atlas-provider publishable-key="pk_live_..." frontend-api="https://auth.example.com">
+  <atlas-signed-out>
+    <atlas-sign-in redirect="/app"></atlas-sign-in>
+  </atlas-signed-out>
+
+  <atlas-signed-in>
+    <p>Welcome back.</p>
+    <atlas-protect permission="org:billing:read">
+      <a href="/billing">Billing</a>
+      <span slot="fallback">Ask an admin for billing access.</span>
+    </atlas-protect>
+    <atlas-sign-out-button>Sign out</atlas-sign-out-button>
+  </atlas-signed-in>
+</atlas-provider>
+```
+
+| Element | Does |
+| --- | --- |
+| `<atlas-provider publishable-key frontend-api>` | Creates the client, boots the session, refreshes the token before it expires, shares the state. `frontend-api` is required. |
+| `<atlas-signed-in>` / `<atlas-signed-out>` / `<atlas-loading>` | Render their children for that state. Signed-out renders only after the first boot settles, so a network blip never flashes a sign-in form. |
+| `<atlas-protect permission require-role>` | Children when the session satisfies the condition, else the `fallback` slot. Hides UI only; your API enforces access. |
+| `<atlas-sign-in redirect locale>` / `<atlas-sign-up>` | Mount the Atlas panel. |
+| `<atlas-sign-out-button>` | Revokes the session and fires `atlas-signed-out`. |
+
+For your own elements, extend `AtlasElement` and read `this.atlas` (`client`, `snapshot`, `publishableKey`, `frontendApi`), or use `createAtlasClient` directly. Get a fresh token for an API call with `client.getToken()`; verify it on the server with `@atlasauth/backend`.

package/dist/client.d.ts

@@ -0,0 +1,81 @@
+import { type ProtectCondition, type ProviderToken, type SignOutOptions, type SignOutResult } from '@atlasauth/js';
+import type { AtlasSnapshot } from './types';
+/**
+ * The browser Atlas client — the framework-agnostic heart of the Lit SDK.
+ *
+ * The live auth engine is a plain object with a change-listener, built on the
+ * `@atlasauth/js` primitives (`FapiClient`, `TokenCache`, the redirect and token
+ * helpers). `<atlas-provider>` creates one in the browser and republishes each
+ * snapshot to the elements below it through {@link AtlasClient.subscribe}.
+ *
+ * It holds exactly one thing that matters in memory: the token. Not
+ * localStorage, not a cookie this code writes — the refresh token is HttpOnly
+ * so browser script never touches it, and the short-lived JWT lives only as
+ * long as the tab. A client that persisted either would survive the tab and
+ * become the thing an XSS reads first.
+ */
+export interface AtlasClient {
+    readonly publishableKey: string;
+    /** The instance's FAPI origin. */
+    readonly frontendApi: string;
+    /** A snapshot of the current auth state — a plain, serializable value. */
+    snapshot(): AtlasSnapshot;
+    /**
+     * Subscribe to state changes. The listener fires on every transition with the
+     * fresh snapshot, and once synchronously is NOT implied — call {@link snapshot}
+     * for the current value. Returns an unsubscribe function.
+     */
+    subscribe(listener: (snapshot: AtlasSnapshot) => void): () => void;
+    /**
+     * §5.3: a sign-in attempt handed back by an OAuth redirect that still needs a
+     * second factor (no session was issued). Null in the ordinary case. Captured
+     * synchronously at construction — before any component reads it.
+     */
+    readonly pendingAttempt: {
+        id: string;
+        status: string;
+    } | null;
+    /** Always fresh: refreshes first if the cached token is close to expiry. */
+    getToken(): Promise<string | null>;
+    /**
+     * §6.6 the signed-in user's OWN live token at a connected provider (Google,
+     * GitHub, …), so the app can call that provider's API. Null when there is no
+     * usable token. The server refreshes a stale token on read; the refresh token
+     * is never exposed.
+     */
+    getProviderToken(provider: string): Promise<ProviderToken | null>;
+    /** Evaluate a role/permission condition against the live claims. */
+    has(condition: ProtectCondition): boolean;
+    /**
+     * Sign out: revoke the session on the Frontend API (retried once), run OIDC
+     * front-channel logout, then drop all local state. Resolves whether the
+     * server confirmed the revoke (`{ revoked, activeSessionId? }`); with
+     * `{ strict: true }` an unconfirmed revoke rejects with a `SignOutError`
+     * AFTER the local sign-out. Either way this browser remembers the session id
+     * and never re-adopts it on a reload, refresh, sibling tab or new tab.
+     */
+    signOut(options?: SignOutOptions): Promise<SignOutResult>;
+    setActiveOrganization(organizationId: string | null): Promise<void>;
+    reload(): Promise<void>;
+    /**
+     * §6.3: complete a redirect-based sign-in (or, inside the OAuth popup, hand
+     * the result back to the opener), then boot the session.
+     */
+    boot(): Promise<void>;
+    /** Tear down the refresh timer, the sibling-tab watch and all listeners. */
+    destroy(): void;
+}
+export interface CreateAtlasClientOptions {
+    publishableKey: string;
+    /**
+     * The instance's Frontend API: an absolute URL such as
+     * `"https://auth.example.com"`, or `"same-origin"` / a path such as `"/atlas"`
+     * behind a reverse proxy on the app's own origin. Required at runtime — a
+     * missing or malformed value throws an `AtlasConfigError`
+     * (`FRONTEND_API_REQUIRED` / `FRONTEND_API_INVALID`). Optional in the type
+     * only so existing call sites keep compiling.
+     */
+    frontendApi?: string;
+    fetchImpl?: typeof fetch;
+}
+export declare function createAtlasClient(options: CreateAtlasClientOptions): AtlasClient;

package/dist/client.js

@@ -0,0 +1,269 @@
+import { FapiClient, SignOutGuard, TokenCache, closeOAuthPopupAfterSignIn, completeOAuthPopupLanding, getProviderToken as fetchProviderToken, mapOAuthPopupPayload, msUntilRefresh, readExpiry, readRedirectResult, resolveFrontendApi, stripRedirectParams, evaluate, } from '@atlasauth/js';
+export function createAtlasClient(options) {
+    const publishableKey = options.publishableKey;
+    // Throws on a missing/invalid value rather than quietly sending every request
+    // to a relative path on the app's origin.
+    const baseUrl = resolveFrontendApi(options.frontendApi, { component: 'createAtlasClient()' });
+    const doFetch = options.fetchImpl ?? fetch;
+    // The live state. Plain fields, not reactive — changes are broadcast to
+    // subscribers, who copy a fresh snapshot into whatever reactive store they own.
+    let status = 'loading';
+    let user = null;
+    let session = null;
+    let claims = null;
+    let memberships = [];
+    const cache = new TokenCache();
+    let timer = null;
+    const listeners = new Set();
+    const snapshot = () => ({
+        status,
+        user,
+        session,
+        claims,
+        memberships,
+    });
+    const emit = () => {
+        const snap = snapshot();
+        for (const listener of listeners)
+            listener(snap);
+        scheduleRefresh();
+    };
+    const pendingAttempt = (() => {
+        if (typeof window === 'undefined')
+            return null;
+        const result = readRedirectResult(window.location.search);
+        return result?.status && !result.ticket
+            ? { id: result.attemptId, status: result.status }
+            : null;
+    })();
+    const call = (path, init) => doFetch(`${baseUrl}${path}`, {
+        ...init,
+        // Cookies carry the session; a fetch without this looks identical to being
+        // signed out.
+        credentials: 'include',
+        headers: {
+            'x-publishable-key': publishableKey,
+            ...(init?.body ? { 'content-type': 'application/json' } : {}),
+            ...init?.headers,
+        },
+    });
+    // Safer sign-out: tombstones (localStorage, per FAPI origin, shared by every
+    // tab) of the sessions this browser signed out of, the revoke with retry, and
+    // the background re-try of a revoke that did not land.
+    const guard = new SignOutGuard({ request: call, frontendApi: baseUrl });
+    const clearLocal = () => {
+        cache.clear();
+        status = 'signed_out';
+        user = null;
+        session = null;
+        claims = null;
+        memberships = [];
+    };
+    const applyToken = (jwt, sessionId) => {
+        // An in-flight refresh must not resurrect a session signed out meanwhile.
+        if (guard.isSignedOut(sessionId))
+            return;
+        const expiresAt = readExpiry(jwt);
+        if (!expiresAt)
+            return;
+        cache.set({ jwt, expiresAt, sessionId });
+        claims = decodeClaims(jwt);
+    };
+    const reload = async () => {
+        try {
+            const response = await call('/v1/client');
+            if (!response.ok)
+                throw new Error('boot failed');
+            const body = (await response.json());
+            // A session this browser signed out of is never re-adopted from a refresh
+            // cookie the revoke did not clear; the guard re-tries the revoke.
+            const refused = !!body.session && guard.refuse(body.session.id);
+            if (!body.session || !body.user || refused) {
+                clearLocal();
+                emit();
+                return;
+            }
+            user = body.user;
+            session = body.session;
+            memberships = body.organization_memberships ?? [];
+            if (body.jwt)
+                applyToken(body.jwt, body.session.id);
+            status = 'signed_in';
+            emit();
+        }
+        catch {
+            // A failed boot is NOT signed-out. Rendering a sign-in form because the
+            // network hiccuped throws away a perfectly good session and makes the user
+            // re-authenticate for no reason.
+            if (status === 'loading') {
+                status = 'signed_out';
+                emit();
+            }
+        }
+    };
+    const refresh = async () => {
+        const current = cache.peek();
+        if (!current)
+            return;
+        try {
+            const response = await call(`/v1/client/sessions/${current.sessionId}/tokens`, {
+                method: 'POST',
+            });
+            if (!response.ok)
+                throw new Error('refresh failed');
+            const body = (await response.json());
+            applyToken(body.jwt, body.session_id);
+            emit();
+        }
+        catch {
+            // The session may genuinely be gone. Re-boot rather than guess.
+            await reload();
+        }
+    };
+    /** §7.4: proactive, jittered refresh scheduled from the token's own expiry. */
+    function scheduleRefresh() {
+        if (timer) {
+            clearTimeout(timer);
+            timer = null;
+        }
+        if (status !== 'signed_in')
+            return;
+        const token = cache.peek();
+        if (!token)
+            return;
+        const delay = msUntilRefresh({ token, now: Date.now() });
+        timer = setTimeout(() => void refresh(), delay);
+    }
+    const getToken = async () => {
+        // A 5s skew so a token that would die inside the caller's request is
+        // refreshed first rather than handed over.
+        const usable = cache.get(5_000);
+        if (usable)
+            return usable.jwt;
+        await refresh();
+        return cache.get(5_000)?.jwt ?? null;
+    };
+    // The FAPI client for the token-vault read. Reuses the same publishable key
+    // and fetch so the framework-agnostic `@atlasauth/js` helper is the single
+    // implementation this SDK surfaces.
+    const fapiClient = new FapiClient({ publishableKey, baseUrl, fetchImpl: doFetch });
+    const getProviderToken = (provider) => fetchProviderToken(fapiClient, provider);
+    const signOut = async (options) => {
+        // The session to end: from the token cache, else the booted session, else
+        // (none known yet) whatever session the cookies carry — the guard looks it
+        // up, so a missing in-memory token never skips the server-side sign-out. It
+        // tombstones the id first, revokes (retried once) and runs OIDC
+        // front-channel logout.
+        const attempt = await guard.revoke(cache.peek()?.sessionId ?? session?.id ?? null, options);
+        clearLocal();
+        emit();
+        // §L1 the server promoted another account signed in on this browser: adopt
+        // it deliberately (the revoke response already set its cookies).
+        if (guard.promoted(attempt))
+            await reload();
+        return guard.settle(attempt, options);
+    };
+    // Another tab signed out of THIS session (its tombstone reached the shared
+    // store): drop the token and re-check, which refuses the session.
+    const stopWatching = guard.watch(() => cache.peek()?.sessionId ?? session?.id, () => {
+        cache.clear();
+        void reload();
+    });
+    const setActiveOrganization = async (organizationId) => {
+        const current = cache.peek();
+        if (!current)
+            return;
+        const response = await call(`/v1/client/sessions/${current.sessionId}/touch`, {
+            method: 'POST',
+            body: JSON.stringify({ active_organization_id: organizationId }),
+        });
+        if (!response.ok)
+            return;
+        const body = (await response.json());
+        // The new token carries the new org claims; re-boot would work too but costs
+        // a round trip for information already in hand.
+        applyToken(body.jwt, current.sessionId);
+        await reload();
+    };
+    /*
+     * §oauth popup mode: this page may also be running INSIDE the sign-in popup.
+     *   - As the landing of a popup whose opener was severed by a
+     *     Cross-Origin-Opener-Policy (`#atlas_popup_result=…`): relay the result
+     *     to the opener over BroadcastChannel and close. If no opener takes it
+     *     (its tab is gone), finish the sign-in here like a redirect.
+     *   - After finishing a sign-in here (the redirect flow ran in the popup): tell
+     *     the waiting opener and close the popup.
+     */
+    const boot = async () => {
+        const browser = typeof window !== 'undefined';
+        const fromUrl = browser ? readRedirectResult(window.location.search) : null;
+        let result = fromUrl;
+        const landing = browser ? await completeOAuthPopupLanding().catch(() => null) : null;
+        if (landing && !landing.delivered) {
+            const outcome = mapOAuthPopupPayload(landing.payload);
+            if (outcome?.ticket && outcome.attemptId) {
+                result = { attemptId: outcome.attemptId, ticket: outcome.ticket };
+            }
+            else if (outcome?.continuationUrl) {
+                // A second factor / connect / provider error: the redirect flow's page.
+                window.location.replace(outcome.continuationUrl);
+                return;
+            }
+        }
+        // When the landing was delivered the opener redeems the ticket, not us.
+        let exchanged = false;
+        if (result?.ticket) {
+            const response = await call('/v1/client/tickets/exchange', {
+                method: 'POST',
+                body: JSON.stringify({ attempt_id: result.attemptId, ticket: result.ticket }),
+            }).catch(() => undefined);
+            exchanged = !!response?.ok;
+        }
+        if (fromUrl && browser) {
+            window.history.replaceState({}, document.title, stripRedirectParams(window.location.href));
+        }
+        await reload();
+        // Signed in inside the Atlas popup: hand back to the opener and close.
+        if (exchanged)
+            void closeOAuthPopupAfterSignIn();
+    };
+    const destroy = () => {
+        if (timer) {
+            clearTimeout(timer);
+            timer = null;
+        }
+        stopWatching();
+        guard.dispose();
+        listeners.clear();
+    };
+    return {
+        publishableKey,
+        frontendApi: baseUrl,
+        snapshot,
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        pendingAttempt,
+        getToken,
+        getProviderToken,
+        has: (condition) => evaluate(claims, condition).allowed,
+        signOut,
+        setActiveOrganization,
+        reload,
+        boot,
+        destroy,
+    };
+}
+function decodeClaims(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        return JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,YAAY,EACZ,UAAU,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,IAAI,kBAAkB,EACtC,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,QAAQ,GAMT,MAAM,eAAe,CAAC;AAuFvB,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC9C,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE3C,wEAAwE;IACxE,gFAAgF;IAChF,IAAI,MAAM,GAAe,SAAS,CAAC;IACnC,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,IAAI,OAAO,GAAwB,IAAI,CAAC;IACxC,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,WAAW,GAAkC,EAAE,CAAC;IAEpD,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE/D,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,CAAC;QACrC,MAAM;QACN,IAAI;QACJ,OAAO;QACP,MAAM;QACN,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,cAAc,GAA0C,CAAC,GAAG,EAAE;QAClE,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM;YACrC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YACjD,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAkB,EAAE,EAAE,CAChD,OAAO,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;QAC3B,GAAG,IAAI;QACP,2EAA2E;QAC3E,cAAc;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,mBAAmB,EAAE,cAAc;YACnC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,IAAI,EAAE,OAAO;SACjB;KACF,CAAC,CAAC;IAEL,6EAA6E;IAC7E,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAExE,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,GAAG,YAAY,CAAC;QACtB,IAAI,GAAG,IAAI,CAAC;QACZ,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;QACd,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,SAAiB,EAAE,EAAE;QACpD,0EAA0E;QAC1E,IAAI,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;YAAE,OAAO;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YAEjD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;YAEF,0EAA0E;YAC1E,kEAAkE;YAClE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3C,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,WAAW,GAAG,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,GAAG;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,WAAW,CAAC;YACrB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,2EAA2E;YAC3E,iCAAiC;YACjC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,YAAY,CAAC;gBACtB,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,OAAO,CAAC,SAAS,SAAS,EAAE;gBAC7E,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAEpD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwC,CAAC;YAC5E,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,+EAA+E;IAC/E,SAAS,eAAe;QACtB,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACzD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,qEAAqE;QACrE,2CAA2C;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC;QAC9B,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;IACvC,CAAC,CAAC;IAEF,4EAA4E;IAC5E,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAExF,MAAM,OAAO,GAAG,KAAK,EAAE,OAAwB,EAA0B,EAAE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,gEAAgE;QAChE,wBAAwB;QACxB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,IAAI,OAAO,EAAE,EAAE,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5F,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,CAAC;QACP,2EAA2E;QAC3E,iEAAiE;QACjE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,MAAM,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAC9B,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,IAAI,OAAO,EAAE,EAAE,EAC5C,GAAG,EAAE;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,MAAM,EAAE,CAAC;IAChB,CAAC,CACF,CAAC;IAEF,MAAM,qBAAqB,GAAG,KAAK,EAAE,cAA6B,EAAE,EAAE;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,OAAO,CAAC,SAAS,QAAQ,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,sBAAsB,EAAE,cAAc,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO;QAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;QACxD,6EAA6E;QAC7E,gDAAgD;QAChD,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;QAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE5E,IAAI,MAAM,GAA0B,OAAO,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,yBAAyB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACzC,MAAM,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACpE,CAAC;iBAAM,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;gBACpC,wEAAwE;gBACxE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,6BAA6B,EAAE;gBACzD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAC9E,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1B,SAAS,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,MAAM,EAAE,CAAC;QACf,uEAAuE;QACvE,IAAI,SAAS;YAAE,KAAK,0BAA0B,EAAE,CAAC;IACnD,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,YAAY,EAAE,CAAC;QACf,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO;QACL,cAAc;QACd,WAAW,EAAE,OAAO;QACpB,QAAQ;QACR,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,cAAc;QACd,QAAQ;QACR,gBAAgB;QAChB,GAAG,EAAE,CAAC,SAA2B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,OAAO;QACzE,OAAO;QACP,qBAAqB;QACrB,MAAM;QACN,IAAI;QACJ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAkB,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/context.d.ts

@@ -0,0 +1,16 @@
+import type { AtlasClient } from './client';
+import type { AtlasSnapshot } from './types';
+/**
+ * What `<atlas-provider>` shares with every element below it. `client` is null on the server and
+ * before the provider connects; `snapshot.status` is `loading` until the first boot settles.
+ */
+export interface AtlasState {
+    client: AtlasClient | null;
+    snapshot: AtlasSnapshot;
+    publishableKey: string;
+    frontendApi: string;
+}
+export declare const atlasContext: {
+    __context__: AtlasState;
+};
+export declare const loadingSnapshot: AtlasSnapshot;

package/dist/context.js

@@ -0,0 +1,10 @@
+import { createContext } from '@lit/context';
+export const atlasContext = createContext(Symbol.for('atlasauth.lit.state'));
+export const loadingSnapshot = {
+    status: 'loading',
+    user: null,
+    session: null,
+    claims: null,
+    memberships: [],
+};
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAe7C,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAa,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,MAAM,EAAE,SAAS;IACjB,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,EAAE;CAChB,CAAC"}

package/dist/elements.d.ts

@@ -0,0 +1,113 @@
+import { LitElement, nothing, type PropertyValues } from 'lit';
+import { type AtlasState } from './context';
+import { type WidgetMode, type WidgetMounter } from './widget';
+/**
+ * `<atlas-provider publishable-key="pk_…" frontend-api="https://auth.example.com">`
+ *
+ * Creates the Atlas client in the browser, boots the session (completing an OAuth redirect if the
+ * page is one), refreshes the token before it expires, and shares the state with every Atlas
+ * element below it. Put it once near the top of the page. `frontend-api` is required; a missing
+ * or malformed value throws an `AtlasConfigError` when the element connects.
+ */
+export declare class AtlasProvider extends LitElement {
+    static properties: {
+        publishableKey: {
+            type: StringConstructor;
+            attribute: string;
+        };
+        frontendApi: {
+            type: StringConstructor;
+            attribute: string;
+        };
+    };
+    publishableKey: string;
+    frontendApi: string;
+    /** Replace `fetch` (tests, custom transports). */
+    fetchImpl?: typeof fetch;
+    private client;
+    private unsubscribe;
+    private readonly provider;
+    constructor();
+    connectedCallback(): void;
+    disconnectedCallback(): void;
+    protected willUpdate(changed: PropertyValues): void;
+    private start;
+    private stop;
+    protected render(): import("lit").TemplateResult<1>;
+}
+/** Base class for elements that read the Atlas state: re-renders on every change. */
+export declare abstract class AtlasElement extends LitElement {
+    private readonly consumer;
+    protected get atlas(): AtlasState;
+}
+/** `<atlas-signed-in>…</atlas-signed-in>` renders its children only for a signed-in user. */
+export declare class AtlasSignedIn extends AtlasElement {
+    protected render(): import("lit").TemplateResult<1> | typeof nothing;
+}
+/** `<atlas-signed-out>…</atlas-signed-out>` renders its children only once the session is known to be signed out. */
+export declare class AtlasSignedOut extends AtlasElement {
+    protected render(): import("lit").TemplateResult<1> | typeof nothing;
+}
+/** `<atlas-loading>…</atlas-loading>` renders its children until the first boot settles. */
+export declare class AtlasLoading extends AtlasElement {
+    protected render(): import("lit").TemplateResult<1> | typeof nothing;
+}
+/**
+ * `<atlas-protect permission="org:billing:read">…</atlas-protect>` renders its children when the
+ * signed-in session satisfies the condition, else the `fallback` slot. Conditions: `permission`,
+ * `require-role` (the `role` attribute is ARIA's). A signed-out visitor, or an unknown state, never passes. This hides UI only; your API
+ * is what enforces access.
+ */
+export declare class AtlasProtect extends AtlasElement {
+    static properties: {
+        permission: {
+            type: StringConstructor;
+        };
+        requireRole: {
+            type: StringConstructor;
+            attribute: string;
+        };
+    };
+    permission: string | undefined;
+    requireRole: string | undefined;
+    protected render(): import("lit").TemplateResult<1>;
+}
+/** `<atlas-sign-out-button>Sign out</atlas-sign-out-button>` signs out and fires `atlas-signed-out`. */
+export declare class AtlasSignOutButton extends AtlasElement {
+    protected render(): import("lit").TemplateResult<1> | typeof nothing;
+    private readonly onClick;
+}
+/** Shared by the two widget elements: mounts the Atlas panel into this element's light DOM. */
+declare abstract class AtlasWidgetElement extends AtlasElement {
+    static properties: {
+        redirect: {
+            type: StringConstructor;
+        };
+        locale: {
+            type: StringConstructor;
+        };
+    };
+    redirect: string | undefined;
+    locale: string | undefined;
+    /** Replace the mount function (tests). */
+    mounter?: WidgetMounter;
+    protected abstract readonly mode: WidgetMode;
+    private cleanup;
+    private mountedFor;
+    private readonly slotEl;
+    protected createRenderRoot(): HTMLElement;
+    protected updated(): void;
+    disconnectedCallback(): void;
+    protected render(): symbol;
+}
+/** `<atlas-sign-in redirect="/app">` mounts the Atlas sign-in panel. */
+export declare class AtlasSignIn extends AtlasWidgetElement {
+    protected readonly mode: "sign-in";
+}
+/** `<atlas-sign-up redirect="/app">` mounts the Atlas sign-up panel. */
+export declare class AtlasSignUp extends AtlasWidgetElement {
+    protected readonly mode: "sign-up";
+}
+/** Register every element (idempotent). Importing the package already does this. */
+export declare function defineAtlasElements(): void;
+export {};

package/dist/elements.js

@@ -0,0 +1,211 @@
+import { ContextConsumer, ContextProvider } from '@lit/context';
+import { LitElement, html, nothing } from 'lit';
+import { resolveFrontendApi } from '@atlasauth/js';
+import { createAtlasClient } from './client';
+import { atlasContext, loadingSnapshot } from './context';
+import { mountAtlasWidget } from './widget';
+/**
+ * `<atlas-provider publishable-key="pk_…" frontend-api="https://auth.example.com">`
+ *
+ * Creates the Atlas client in the browser, boots the session (completing an OAuth redirect if the
+ * page is one), refreshes the token before it expires, and shares the state with every Atlas
+ * element below it. Put it once near the top of the page. `frontend-api` is required; a missing
+ * or malformed value throws an `AtlasConfigError` when the element connects.
+ */
+export class AtlasProvider extends LitElement {
+    static { this.properties = {
+        publishableKey: { type: String, attribute: 'publishable-key' },
+        frontendApi: { type: String, attribute: 'frontend-api' },
+    }; }
+    constructor() {
+        super();
+        this.client = null;
+        this.unsubscribe = null;
+        this.provider = new ContextProvider(this, {
+            context: atlasContext,
+            initialValue: { client: null, snapshot: loadingSnapshot, publishableKey: '', frontendApi: '' },
+        });
+        this.publishableKey = '';
+        this.frontendApi = '';
+    }
+    connectedCallback() {
+        super.connectedCallback();
+        this.start();
+    }
+    disconnectedCallback() {
+        this.stop();
+        super.disconnectedCallback();
+    }
+    willUpdate(changed) {
+        // A changed key or API origin means a different instance: rebuild the client.
+        if (this.isConnected && this.client && (changed.has('publishableKey') || changed.has('frontendApi'))) {
+            this.stop();
+            this.start();
+        }
+    }
+    start() {
+        if (this.client || !this.publishableKey)
+            return;
+        const frontendApi = resolveFrontendApi(this.frontendApi, { component: '<atlas-provider>' });
+        const client = createAtlasClient({
+            publishableKey: this.publishableKey,
+            frontendApi: this.frontendApi,
+            ...(this.fetchImpl ? { fetchImpl: this.fetchImpl } : {}),
+        });
+        this.client = client;
+        const publish = () => this.provider.setValue({ client, snapshot: client.snapshot(), publishableKey: this.publishableKey, frontendApi });
+        this.unsubscribe = client.subscribe(publish);
+        publish();
+        void client.boot();
+    }
+    stop() {
+        this.unsubscribe?.();
+        this.unsubscribe = null;
+        this.client?.destroy();
+        this.client = null;
+        this.provider.setValue({ client: null, snapshot: loadingSnapshot, publishableKey: '', frontendApi: '' });
+    }
+    render() {
+        return html `<slot></slot>`;
+    }
+}
+/** Base class for elements that read the Atlas state: re-renders on every change. */
+export class AtlasElement extends LitElement {
+    constructor() {
+        super(...arguments);
+        this.consumer = new ContextConsumer(this, { context: atlasContext, subscribe: true });
+    }
+    get atlas() {
+        return this.consumer.value ?? { client: null, snapshot: loadingSnapshot, publishableKey: '', frontendApi: '' };
+    }
+}
+/** `<atlas-signed-in>…</atlas-signed-in>` renders its children only for a signed-in user. */
+export class AtlasSignedIn extends AtlasElement {
+    render() {
+        return this.atlas.snapshot.status === 'signed_in' ? html `<slot></slot>` : nothing;
+    }
+}
+/** `<atlas-signed-out>…</atlas-signed-out>` renders its children only once the session is known to be signed out. */
+export class AtlasSignedOut extends AtlasElement {
+    render() {
+        return this.atlas.snapshot.status === 'signed_out' ? html `<slot></slot>` : nothing;
+    }
+}
+/** `<atlas-loading>…</atlas-loading>` renders its children until the first boot settles. */
+export class AtlasLoading extends AtlasElement {
+    render() {
+        return this.atlas.snapshot.status === 'loading' ? html `<slot></slot>` : nothing;
+    }
+}
+/**
+ * `<atlas-protect permission="org:billing:read">…</atlas-protect>` renders its children when the
+ * signed-in session satisfies the condition, else the `fallback` slot. Conditions: `permission`,
+ * `require-role` (the `role` attribute is ARIA's). A signed-out visitor, or an unknown state, never passes. This hides UI only; your API
+ * is what enforces access.
+ */
+export class AtlasProtect extends AtlasElement {
+    static { this.properties = {
+        permission: { type: String },
+        requireRole: { type: String, attribute: 'require-role' },
+    }; }
+    render() {
+        const { client, snapshot } = this.atlas;
+        const allowed = snapshot.status === 'signed_in' &&
+            !!client &&
+            client.has({
+                ...(this.permission ? { permission: this.permission } : {}),
+                ...(this.requireRole ? { role: this.requireRole } : {}),
+            });
+        return allowed ? html `<slot></slot>` : html `<slot name="fallback"></slot>`;
+    }
+}
+/** `<atlas-sign-out-button>Sign out</atlas-sign-out-button>` signs out and fires `atlas-signed-out`. */
+export class AtlasSignOutButton extends AtlasElement {
+    constructor() {
+        super(...arguments);
+        this.onClick = async () => {
+            await this.atlas.client?.signOut();
+            this.dispatchEvent(new CustomEvent('atlas-signed-out', { bubbles: true, composed: true }));
+        };
+    }
+    render() {
+        if (this.atlas.snapshot.status !== 'signed_in')
+            return nothing;
+        return html `<button type="button" @click=${this.onClick}><slot>Sign out</slot></button>`;
+    }
+}
+/** Shared by the two widget elements: mounts the Atlas panel into this element's light DOM. */
+class AtlasWidgetElement extends AtlasElement {
+    constructor() {
+        super(...arguments);
+        this.cleanup = null;
+        this.mountedFor = '';
+        this.slotEl = document.createElement('div');
+    }
+    static { this.properties = {
+        redirect: { type: String },
+        locale: { type: String },
+    }; }
+    // The widget draws its own panel, so render into this element, not a shadow root.
+    createRenderRoot() {
+        return this;
+    }
+    updated() {
+        const { publishableKey, frontendApi } = this.atlas;
+        const key = `${publishableKey}|${frontendApi}|${this.redirect ?? ''}|${this.locale ?? ''}`;
+        if (!publishableKey || !frontendApi || key === this.mountedFor)
+            return;
+        this.cleanup?.();
+        this.mountedFor = key;
+        // Mount into a child Lit does not manage: writing into `this` would wipe Lit's own render markers.
+        if (!this.slotEl.isConnected)
+            this.append(this.slotEl);
+        this.cleanup = mountAtlasWidget(this.slotEl, this.mode, {
+            publishableKey,
+            frontendApi,
+            ...(this.redirect ? { redirect: this.redirect } : {}),
+            ...(this.locale ? { locale: this.locale } : {}),
+            ...(this.mounter ? { mounter: this.mounter } : {}),
+        });
+    }
+    disconnectedCallback() {
+        this.cleanup?.();
+        this.cleanup = null;
+        this.mountedFor = '';
+        super.disconnectedCallback();
+    }
+    render() {
+        return nothing;
+    }
+}
+/** `<atlas-sign-in redirect="/app">` mounts the Atlas sign-in panel. */
+export class AtlasSignIn extends AtlasWidgetElement {
+    constructor() {
+        super(...arguments);
+        this.mode = 'sign-in';
+    }
+}
+/** `<atlas-sign-up redirect="/app">` mounts the Atlas sign-up panel. */
+export class AtlasSignUp extends AtlasWidgetElement {
+    constructor() {
+        super(...arguments);
+        this.mode = 'sign-up';
+    }
+}
+const TAGS = [
+    ['atlas-provider', AtlasProvider],
+    ['atlas-signed-in', AtlasSignedIn],
+    ['atlas-signed-out', AtlasSignedOut],
+    ['atlas-loading', AtlasLoading],
+    ['atlas-protect', AtlasProtect],
+    ['atlas-sign-out-button', AtlasSignOutButton],
+    ['atlas-sign-in', AtlasSignIn],
+    ['atlas-sign-up', AtlasSignUp],
+];
+/** Register every element (idempotent). Importing the package already does this. */
+export function defineAtlasElements() {
+    for (const [tag, ctor] of TAGS)
+        if (!customElements.get(tag))
+            customElements.define(tag, ctor);
+}
+//# sourceMappingURL=elements.js.map

package/dist/elements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elements.js","sourceRoot":"","sources":["../src/elements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAuB,MAAM,KAAK,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAoB,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAmB,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAuC,MAAM,UAAU,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,OAAO,aAAc,SAAQ,UAAU;aAC3B,eAAU,GAAG;QAC3B,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE;QAC9D,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE;KACzD,AAHyB,CAGxB;IAcF;QACE,KAAK,EAAE,CAAC;QARF,WAAM,GAAuB,IAAI,CAAC;QAClC,gBAAW,GAAwB,IAAI,CAAC;QAC/B,aAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE;YACpD,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAgB;SAC7G,CAAC,CAAC;QAID,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACxB,CAAC;IAEQ,iBAAiB;QACxB,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEQ,oBAAoB;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,KAAK,CAAC,oBAAoB,EAAE,CAAC;IAC/B,CAAC;IAEkB,UAAU,CAAC,OAAuB;QACnD,8EAA8E;QAC9E,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACrG,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK;QACX,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QAChD,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;QACpH,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IAEkB,MAAM;QACvB,OAAO,IAAI,CAAA,eAAe,CAAC;IAC7B,CAAC;;AAGH,qFAAqF;AACrF,MAAM,OAAgB,YAAa,SAAQ,UAAU;IAArD;;QACmB,aAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAKpG,CAAC;IAHC,IAAc,KAAK;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACjH,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC1B,MAAM;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAA,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;IACpF,CAAC;CACF;AAED,qHAAqH;AACrH,MAAM,OAAO,cAAe,SAAQ,YAAY;IAC3B,MAAM;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;IACrF,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,OAAO,YAAa,SAAQ,YAAY;IACzB,MAAM;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;IAClF,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,YAAa,SAAQ,YAAY;aAC5B,eAAU,GAAG;QAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC5B,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE;KACzD,CAAC;IAKiB,MAAM;QACvB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACxC,MAAM,OAAO,GACX,QAAQ,CAAC,MAAM,KAAK,WAAW;YAC/B,CAAC,CAAC,MAAM;YACR,MAAM,CAAC,GAAG,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA,eAAe,CAAC,CAAC,CAAC,IAAI,CAAA,+BAA+B,CAAC;IAC7E,CAAC;;AAGH,wGAAwG;AACxG,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAApD;;QAMmB,YAAO,GAAG,KAAK,IAAI,EAAE;YACpC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC;IACJ,CAAC;IAToB,MAAM;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC;QAC/D,OAAO,IAAI,CAAA,gCAAgC,IAAI,CAAC,OAAO,iCAAiC,CAAC;IAC3F,CAAC;CAMF;AAED,+FAA+F;AAC/F,MAAe,kBAAmB,SAAQ,YAAY;IAAtD;;QAYU,YAAO,GAAwB,IAAI,CAAC;QACpC,eAAU,GAAG,EAAE,CAAC;QACP,WAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAkC1D,CAAC;aA/CiB,eAAU,GAAG;QAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KACzB,AAHyB,CAGxB;IAYF,kFAAkF;IAC/D,gBAAgB;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAEkB,OAAO;QACxB,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,cAAc,IAAI,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC3F,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,GAAG,KAAK,IAAI,CAAC,UAAU;YAAE,OAAO;QACvE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,mGAAmG;QACnG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE;YACtD,cAAc;YACd,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAEQ,oBAAoB;QAC3B,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,KAAK,CAAC,oBAAoB,EAAE,CAAC;IAC/B,CAAC;IAEkB,MAAM;QACvB,OAAO,OAAO,CAAC;IACjB,CAAC;;AAGH,wEAAwE;AACxE,MAAM,OAAO,WAAY,SAAQ,kBAAkB;IAAnD;;QACqB,SAAI,GAAG,SAAkB,CAAC;IAC/C,CAAC;CAAA;AAED,wEAAwE;AACxE,MAAM,OAAO,WAAY,SAAQ,kBAAkB;IAAnD;;QACqB,SAAI,GAAG,SAAkB,CAAC;IAC/C,CAAC;CAAA;AAED,MAAM,IAAI,GAA8C;IACtD,CAAC,gBAAgB,EAAE,aAAa,CAAC;IACjC,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAClC,CAAC,kBAAkB,EAAE,cAAc,CAAC;IACpC,CAAC,eAAe,EAAE,YAAY,CAAC;IAC/B,CAAC,eAAe,EAAE,YAAY,CAAC;IAC/B,CAAC,uBAAuB,EAAE,kBAAkB,CAAC;IAC7C,CAAC,eAAe,EAAE,WAAW,CAAC;IAC9B,CAAC,eAAe,EAAE,WAAW,CAAC;CAC/B,CAAC;AAEF,oFAAoF;AACpF,MAAM,UAAU,mBAAmB;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACjG,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types';
+export * from './client';
+export * from './context';
+export * from './widget';
+export { AtlasProvider, AtlasElement, AtlasSignedIn, AtlasSignedOut, AtlasLoading, AtlasProtect, AtlasSignOutButton, AtlasSignIn, AtlasSignUp, defineAtlasElements, } from './elements';
+export { SignOutError } from '@atlasauth/js';
+export type { SignOutOptions, SignOutResult } from '@atlasauth/js';

package/dist/index.js

@@ -0,0 +1,11 @@
+export * from './types';
+export * from './client';
+export * from './context';
+export * from './widget';
+export { AtlasProvider, AtlasElement, AtlasSignedIn, AtlasSignedOut, AtlasLoading, AtlasProtect, AtlasSignOutButton, AtlasSignIn, AtlasSignUp, defineAtlasElements, } from './elements';
+export { SignOutError } from '@atlasauth/js';
+import { defineAtlasElements } from './elements';
+// Registering on import is what makes `<atlas-provider>` work from a plain <script type="module">.
+if (typeof customElements !== 'undefined')
+    defineAtlasElements();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,mGAAmG;AACnG,IAAI,OAAO,cAAc,KAAK,WAAW;IAAE,mBAAmB,EAAE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The public auth shapes, identical to the React and Vue SDKs so a team moving
+ * between frameworks reads the same `user` / `session` / `claims` everywhere.
+ */
+export interface SessionClaims {
+    sub: string;
+    sid: string;
+    exp: number;
+    org_id?: string;
+    org_slug?: string;
+    org_role?: string;
+    org_permissions?: string[];
+    mfa?: boolean;
+    [claim: string]: unknown;
+}
+export interface AtlasUser {
+    id: string;
+    first_name: string | null;
+    last_name: string | null;
+    username: string | null;
+    image_url: string | null;
+    public_metadata: Record<string, unknown>;
+    unsafe_metadata: Record<string, unknown>;
+    mfa_enabled: boolean;
+    has_password: boolean;
+    email_addresses?: Array<{
+        id: string;
+        email_address: string;
+        verified: boolean;
+        primary: boolean;
+    }>;
+}
+export interface AtlasOrganizationMembership {
+    role: string;
+    organization: {
+        id: string;
+        name: string;
+        slug: string;
+        image_url: string | null;
+    };
+}
+export interface AtlasSession {
+    id: string;
+    status: string;
+    last_active_organization_id: string | null;
+}
+/** `loading` until the first boot settles, then `signed_in` / `signed_out`. */
+export type AuthStatus = 'loading' | 'signed_in' | 'signed_out';
+/** The plain snapshot of auth state: values only, never functions or timers. */
+export interface AtlasSnapshot {
+    status: AuthStatus;
+    user: AtlasUser | null;
+    session: AtlasSession | null;
+    claims: SessionClaims | null;
+    memberships: AtlasOrganizationMembership[];
+}

package/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * The public auth shapes, identical to the React and Vue SDKs so a team moving
+ * between frameworks reads the same `user` / `session` / `claims` everywhere.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/widget.d.ts

@@ -0,0 +1,21 @@
+import { type WidgetOptions } from '@atlasauth/embed';
+export type WidgetMode = 'sign-in' | 'sign-up';
+/** A mount function with the shape of `@atlasauth/embed`'s `mountSignIn`. */
+export type WidgetMounter = (host: HTMLElement, overrides: Partial<WidgetOptions>) => unknown;
+export interface MountWidgetOptions {
+    publishableKey: string;
+    frontendApi: string;
+    /** Where to go on success. Validated same-origin / absolute-https by the widget. */
+    redirect?: string;
+    /** The UI language as a BCP-47 tag (`"es"`). */
+    locale?: string;
+    localization?: WidgetOptions['localization'];
+    /** Replace the mount function (tests). */
+    mounter?: WidgetMounter;
+}
+/**
+ * Mount the Atlas DOM widget into `host` and return a cleanup function. The widget renders into
+ * the host's light DOM and has no `unmount()`, so cleanup clears the host's children, which lets
+ * the widget (and its background passkey AbortController) be garbage collected.
+ */
+export declare function mountAtlasWidget(host: HTMLElement, mode: WidgetMode, options: MountWidgetOptions): () => void;

package/dist/widget.js

@@ -0,0 +1,33 @@
+import { mountSignIn, mountSignUp } from '@atlasauth/embed';
+const DEFAULT_MOUNTERS = {
+    'sign-in': (host, overrides) => mountSignIn(host, overrides),
+    'sign-up': (host, overrides) => mountSignUp(host, overrides),
+};
+/**
+ * Mount the Atlas DOM widget into `host` and return a cleanup function. The widget renders into
+ * the host's light DOM and has no `unmount()`, so cleanup clears the host's children, which lets
+ * the widget (and its background passkey AbortController) be garbage collected.
+ */
+export function mountAtlasWidget(host, mode, options) {
+    const mounter = options.mounter ?? DEFAULT_MOUNTERS[mode];
+    const overrides = {
+        publishableKey: options.publishableKey,
+        frontendApi: options.frontendApi,
+    };
+    if (options.redirect)
+        overrides.redirect = options.redirect;
+    if (options.locale)
+        overrides.locale = options.locale;
+    if (options.localization)
+        overrides.localization = options.localization;
+    mounter(host, overrides);
+    return () => {
+        try {
+            host.replaceChildren();
+        }
+        catch {
+            // The host may already be gone (navigation); nothing to clean.
+        }
+    };
+}
+//# sourceMappingURL=widget.js.map

package/dist/widget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget.js","sourceRoot":"","sources":["../src/widget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,kBAAkB,CAAC;AAOhF,MAAM,gBAAgB,GAAsC;IAC1D,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC;IAC5D,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC;CAC7D,CAAC;AAcF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,IAAgB,EAAE,OAA2B;IAC/F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,SAAS,GAA2B;QACxC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ;QAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM;QAAE,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACtD,IAAI,OAAO,CAAC,YAAY;QAAE,SAAS,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IACxE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzB,OAAO,GAAG,EAAE;QACV,IAAI,CAAC;YACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "@atlasauth/lit",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Atlas for web components: Lit elements (provider, signed-in/out gates, permission gate, sign-in and sign-up widgets) over @atlasauth/js. Works in any framework or none.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "sideEffects": [
+    "./dist/index.js"
+  ],
+  "dependencies": {
+    "@lit/context": "^1.1.3",
+    "@atlasauth/js": "0.26.1",
+    "@atlasauth/embed": "^0.14.0"
+  },
+  "peerDependencies": {
+    "lit": ">=3"
+  },
+  "devDependencies": {
+    "happy-dom": "^15.11.0",
+    "lit": "^3.2.1",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "!dist/*.tsbuildinfo",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsgo -p tsconfig.json --noEmit --module preserve --moduleResolution bundler --incremental --tsBuildInfoFile node_modules/.cache/typecheck.tsbuildinfo",
+    "test": "vitest run"
+  }
 }