@descope/web-component 3.70.5 → 3.70.6

package/dist/esm/mixins/passwordManagerMixin.js

@@ -0,0 +1,2 @@
+import{__classPrivateFieldSet as e,__classPrivateFieldGet as t}from"tslib";import{createSingletonMixin as o,compose as r}from"@descope/sdk-helpers";import{loggerMixin as n}from"@descope/sdk-mixins";import{DESCOPE_LAST_SUBMITTED_LOGIN_ID_SESSION_STORAGE_KEY as i,DESCOPE_ATTRIBUTE_EXCLUDE_FIELD as s}from"../constants/index.js";import{getFirstNonEmptyValue as a}from"../helpers/helpers.js";import"../helpers/state.js";import"@descope/escape-markdown";import"../helpers/webauthn.js";const d=["externalId","email","phone"],l=["newPassword","password"],u="data-username-anchor",c=e=>{var t;if(!e)return"";try{const o=null===(t=window.sessionStorage)||void 0===t?void 0:t.getItem(i);if(!o)return"";const r=JSON.parse(o);return r.executionId===e&&r.loginId||""}catch(e){return""}},m=(e,t,o,r)=>{var n;const i=(null==o?void 0:o.email)||(null===(n=null==o?void 0:o.loginIds)||void 0===n?void 0:n[0]);(e=>e.querySelector("descope-new-password")||e.querySelector("descope-password"))(t)?i?(e=>{const t=['input[autocomplete="username"]',...d.map((e=>`[name="${e}"]`))].join(", ");return e.some((e=>e.querySelector(t)))})([e,t])?r.debug("Username anchor: screen already has an identifier field"):(r.debug("Username anchor: injecting hidden username input"),e.appendChild((e=>{const t=document.createElement("input");return t.setAttribute("autocomplete","username"),t.setAttribute("name","username"),t.setAttribute("type","email"),t.setAttribute("readonly","true"),t.setAttribute("tabindex","-1"),t.setAttribute("aria-hidden","true"),t.setAttribute(s,"true"),t.setAttribute(u,"true"),t.setAttribute("value",e),t.value=e,Object.assign(t.style,{position:"absolute",opacity:"0",pointerEvents:"none",height:"0",border:"0"}),t})(i))):r.debug("Username anchor: no user identifier available"):r.debug("Username anchor: no password component on screen")},v=o((o=>{var s,v,p,h,g;const b=r(n)(o);return g=class extends b{constructor(){super(...arguments),s.add(this),v.set(this,void 0)}updateScreenUser(o){var r,n,i;e(this,v,{email:null==o?void 0:o.email,loginIds:(null===(r=null==o?void 0:o.loginIds)||void 0===r?void 0:r.length)?o.loginIds:[c(t(this,s,"a",h))||(null===(i=null===(n=t(this,s,"a",p).sdk)||void 0===n?void 0:n.getLastUserLoginId)||void 0===i?void 0:i.call(n))].filter(Boolean)},"f")}updateUsernameAnchor(){document.querySelectorAll(`[${u}="true"]`).forEach((e=>e.remove())),m(this,t(this,s,"a",p).contentRootElement,t(this,v,"f"),this.logger)}captureLastSubmittedLoginId(e={},o){const r=a(e,d);r&&((e,t)=>{var o;if(e&&t)try{null===(o=window.sessionStorage)||void 0===o||o.setItem(i,JSON.stringify({executionId:t,loginId:e}))}catch(e){}})(r,o||t(this,s,"a",h))}storeCredentials(e={}){var o,r,n,i,s;const u=a(e,d)||(null===(o=t(this,v,"f"))||void 0===o?void 0:o.email)||(null===(n=null===(r=t(this,v,"f"))||void 0===r?void 0:r.loginIds)||void 0===n?void 0:n[0]),c=a(e,l);if(u&&c)try{if(!globalThis.PasswordCredential)return;const e=new globalThis.PasswordCredential({id:u,password:c});null===(s=null===(i=null===navigator||void 0===navigator?void 0:navigator.credentials)||void 0===i?void 0:i.store)||void 0===s||s.call(i,e)}catch(e){this.logger.error("Could not store credentials",e.message)}}},v=new WeakMap,s=new WeakSet,p=function(){return this},h=function(){var e,o;return(null===(o=null===(e=t(this,s,"a",p).flowState)||void 0===e?void 0:e.current)||void 0===o?void 0:o.executionId)||""},g}));export{v as passwordManagerMixin};
+//# sourceMappingURL=passwordManagerMixin.js.map

package/dist/esm/mixins/passwordManagerMixin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordManagerMixin.js","sources":["../../../src/lib/mixins/passwordManagerMixin.ts"],"sourcesContent":["/* eslint-disable import/prefer-default-export */\nimport { compose, createSingletonMixin } from '@descope/sdk-helpers';\nimport { loggerMixin } from '@descope/sdk-mixins';\nimport {\n  DESCOPE_ATTRIBUTE_EXCLUDE_FIELD,\n  DESCOPE_LAST_SUBMITTED_LOGIN_ID_SESSION_STORAGE_KEY,\n} from '../constants';\nimport { getFirstNonEmptyValue } from '../helpers';\nimport type { ScreenStateUser } from '../types';\n\nconst LOGIN_ID_FIELDS = ['externalId', 'email', 'phone'];\nconst PASSWORD_FIELDS = ['newPassword', 'password'];\n\nconst USERNAME_ANCHOR_ATTRIBUTE = 'data-username-anchor';\n\n// What the mixin needs from its host. Defined as an interface (not imported)\n// to avoid a circular dependency on DescopeWc. Exported so declaration emit\n// can name it from BaseDescopeWc's composed base class.\nexport interface PasswordManagerHost {\n  contentRootElement?: HTMLElement;\n  flowState?: { current?: { executionId?: string } };\n  sdk?: { getLastUserLoginId?: () => string };\n}\n\n// the last identifier the user submitted on a previous screen in this flow\n// (e.g. the email entered before a magic link was sent), used when neither\n// the flow state nor a previous authentication provides one.\n// kept in sessionStorage (tab scoped, cleared when the tab closes) so it\n// survives page reloads during the flow, and scoped to the flow execution so\n// a stale identifier is never carried into another flow (or another user)\n// running in the same tab\nconst getLastSubmittedLoginId = (executionId: string): string => {\n  // a missing execution id must never match anything, otherwise two flows\n  // without one would share the stored identifier\n  if (!executionId) {\n    return '';\n  }\n  try {\n    const raw = window.sessionStorage?.getItem(\n      DESCOPE_LAST_SUBMITTED_LOGIN_ID_SESSION_STORAGE_KEY,\n    );\n    if (!raw) {\n      return '';\n    }\n    const stored = JSON.parse(raw);\n    return stored.executionId === executionId ? stored.loginId || '' : '';\n  } catch (e) {\n    return '';\n  }\n};\n\nconst setLastSubmittedLoginId = (loginId: string, executionId: string) => {\n  if (!loginId || !executionId) {\n    return;\n  }\n  try {\n    window.sessionStorage?.setItem(\n      DESCOPE_LAST_SUBMITTED_LOGIN_ID_SESSION_STORAGE_KEY,\n      JSON.stringify({ executionId, loginId }),\n    );\n  } catch (e) {\n    // sessionStorage unavailable, losing reload persistence is acceptable\n  }\n};\n\nconst clearUsernameAnchorIfExists = () => {\n  document\n    .querySelectorAll(`[${USERNAME_ANCHOR_ATTRIBUTE}=\"true\"]`)\n    .forEach((ele) => ele.remove());\n};\n\nconst findPasswordComponent = (contentRootEle: Element) =>\n  contentRootEle.querySelector('descope-new-password') ||\n  contentRootEle.querySelector('descope-password');\n\n// an identifier is already on screen when there is an autocomplete=\"username\"\n// input, or a component collecting one of the login id fields (e.g.\n// descope-email-field renders its input inside a closed shadow root, so only\n// its name attribute is visible from here)\nconst hasLoginIdField = (roots: Element[]) => {\n  const selector = [\n    'input[autocomplete=\"username\"]',\n    ...LOGIN_ID_FIELDS.map((field) => `[name=\"${field}\"]`),\n  ].join(', ');\n  return roots.some((root) => root.querySelector(selector));\n};\n\nconst createUsernameAnchor = (loginId: string) => {\n  const input = document.createElement('input');\n  input.setAttribute('autocomplete', 'username');\n  input.setAttribute('name', 'username');\n  input.setAttribute('type', 'email');\n  input.setAttribute('readonly', 'true');\n  input.setAttribute('tabindex', '-1');\n  input.setAttribute('aria-hidden', 'true');\n  // never collect the anchor's value into the submitted form data\n  input.setAttribute(DESCOPE_ATTRIBUTE_EXCLUDE_FIELD, 'true');\n  // cleaned up by clearUsernameAnchorIfExists between screens\n  input.setAttribute(USERNAME_ANCHOR_ATTRIBUTE, 'true');\n  // some password managers read the markup value rather than the property\n  input.setAttribute('value', loginId);\n  input.value = loginId;\n  // real input hidden via CSSOM: managers ignore type=\"hidden\", and strict\n  // CSP style-src blocks style attributes\n  Object.assign(input.style, {\n    position: 'absolute',\n    opacity: '0',\n    pointerEvents: 'none',\n    height: '0',\n    border: '0',\n  });\n  return input;\n};\n\n// Anchors a hidden autocomplete=\"username\" input on password screens that\n// have no identifier input, so password managers can associate the credential\n// with a user (descope/etc#16712). Appended to the host light DOM — password\n// manager save heuristics (verified on WebKit) do not scan shadow trees\nconst injectUsernameAnchorIfNeeded = (\n  hostEle: HTMLElement,\n  contentRootEle: Element,\n  user: ScreenStateUser | undefined,\n  logger: { debug: (...args: string[]) => void },\n) => {\n  const loginId = user?.email || user?.loginIds?.[0];\n\n  if (!findPasswordComponent(contentRootEle)) {\n    logger.debug('Username anchor: no password component on screen');\n    return;\n  }\n  if (!loginId) {\n    logger.debug('Username anchor: no user identifier available');\n    return;\n  }\n  if (hasLoginIdField([hostEle, contentRootEle])) {\n    logger.debug('Username anchor: screen already has an identifier field');\n    return;\n  }\n\n  logger.debug('Username anchor: injecting hidden username input');\n  hostEle.appendChild(createUsernameAnchor(loginId));\n};\n\n/**\n * Password manager integrations: keeps track of the current screen's user\n * identifier, anchors a hidden username input on password screens that have\n * no identifier input, and stores submitted credentials via the Credential\n * Management API.\n */\nexport const passwordManagerMixin = createSingletonMixin(\n  <T extends CustomElementConstructor>(superclass: T) => {\n    const BaseClass = compose(loggerMixin)(superclass);\n\n    return class PasswordManagerMixinClass extends BaseClass {\n      // the authenticated user of the current screen (if any), used as a\n      // fallback identifier for password manager integrations on screens that\n      // have no identifier input (e.g. step-up password change)\n      #screenUser?: ScreenStateUser;\n\n      get #host() {\n        return this as unknown as PasswordManagerHost;\n      }\n\n      get #executionId() {\n        return this.#host.flowState?.current?.executionId || '';\n      }\n\n      // called on every screen render. flow state does not always carry the\n      // user (e.g. after magic link auth), so fall back to the login id\n      // submitted earlier in this flow, then to the last authenticated user\n      updateScreenUser(stateUser?: ScreenStateUser) {\n        this.#screenUser = {\n          email: stateUser?.email,\n          loginIds: stateUser?.loginIds?.length\n            ? stateUser.loginIds\n            : [\n                getLastSubmittedLoginId(this.#executionId) ||\n                  this.#host.sdk?.getLastUserLoginId?.(),\n              ].filter(Boolean),\n        };\n      }\n\n      updateUsernameAnchor() {\n        // clear the previous screen's anchor, so each screen gets an anchor\n        // only if it needs one\n        clearUsernameAnchorIfExists();\n\n        injectUsernameAnchorIfNeeded(\n          this,\n          this.#host.contentRootElement,\n          this.#screenUser,\n          this.logger,\n        );\n      }\n\n      // called after a successful next(): on flows that render their first\n      // screen before the flow starts, the execution id only exists on the\n      // response, so prefer it over the current flow state\n      captureLastSubmittedLoginId(formData = {}, responseExecutionId?: string) {\n        const loginId = getFirstNonEmptyValue(formData, LOGIN_ID_FIELDS);\n        if (loginId) {\n          setLastSubmittedLoginId(\n            loginId,\n            responseExecutionId || this.#executionId,\n          );\n        }\n      }\n\n      // handle storing passwords in password managers\n      storeCredentials(formData = {}) {\n        const id =\n          getFirstNonEmptyValue(formData, LOGIN_ID_FIELDS) ||\n          this.#screenUser?.email ||\n          this.#screenUser?.loginIds?.[0];\n        const password = getFirstNonEmptyValue(formData, PASSWORD_FIELDS);\n\n        // PasswordCredential not supported in Firefox\n        if (id && password) {\n          try {\n            if (!globalThis.PasswordCredential) {\n              return;\n            }\n            const cred = new globalThis.PasswordCredential({ id, password });\n\n            navigator?.credentials?.store?.(cred);\n          } catch (e) {\n            this.logger.error('Could not store credentials', e.message);\n          }\n        }\n      }\n    };\n  },\n);\n"],"names":["LOGIN_ID_FIELDS","PASSWORD_FIELDS","USERNAME_ANCHOR_ATTRIBUTE","getLastSubmittedLoginId","executionId","raw","_a","window","sessionStorage","getItem","DESCOPE_LAST_SUBMITTED_LOGIN_ID_SESSION_STORAGE_KEY","stored","JSON","parse","loginId","e","injectUsernameAnchorIfNeeded","hostEle","contentRootEle","user","logger","email","loginIds","querySelector","findPasswordComponent","roots","selector","map","field","join","some","root","hasLoginIdField","debug","appendChild","input","document","createElement","setAttribute","DESCOPE_ATTRIBUTE_EXCLUDE_FIELD","value","Object","assign","style","position","opacity","pointerEvents","height","border","createUsernameAnchor","passwordManagerMixin","createSingletonMixin","superclass","BaseClass","compose","loggerMixin","constructor","_PasswordManagerMixinClass_screenUser","set","this","updateScreenUser","stateUser","__classPrivateFieldSet","_b","length","__classPrivateFieldGet","_PasswordManagerMixinClass_instances","_PasswordManagerMixinClass_executionId_get","_d","_c","_PasswordManagerMixinClass_host_get","sdk","getLastUserLoginId","call","filter","Boolean","updateUsernameAnchor","querySelectorAll","forEach","ele","remove","contentRootElement","captureLastSubmittedLoginId","formData","responseExecutionId","getFirstNonEmptyValue","setItem","stringify","setLastSubmittedLoginId","storeCredentials","id","password","globalThis","PasswordCredential","cred","_f","_e","navigator","credentials","store","error","message","flowState","current"],"mappings":"ieAUA,MAAMA,EAAkB,CAAC,aAAc,QAAS,SAC1CC,EAAkB,CAAC,cAAe,YAElCC,EAA4B,uBAkB5BC,EAA2BC,UAG/B,IAAKA,EACH,MAAO,GAET,IACE,MAAMC,EAA2B,QAArBC,EAAAC,OAAOC,sBAAc,IAAAF,OAAA,EAAAA,EAAEG,QACjCC,GAEF,IAAKL,EACH,MAAO,GAET,MAAMM,EAASC,KAAKC,MAAMR,GAC1B,OAAOM,EAAOP,cAAgBA,GAAcO,EAAOG,SAAgB,EACpE,CAAC,MAAOC,GACP,MAAO,EACR,GAsEGC,EAA+B,CACnCC,EACAC,EACAC,EACAC,WAEA,MAAMN,GAAUK,aAAI,EAAJA,EAAME,SAA0B,UAAjBF,aAAI,EAAJA,EAAMG,gBAAW,IAAAhB,OAAA,EAAAA,EAAA,IArDpB,CAACY,GAC7BA,EAAeK,cAAc,yBAC7BL,EAAeK,cAAc,oBAqDxBC,CAAsBN,GAItBJ,EAnDiB,CAACW,IACvB,MAAMC,EAAW,CACf,oCACG1B,EAAgB2B,KAAKC,GAAU,UAAUA,SAC5CC,KAAK,MACP,OAAOJ,EAAMK,MAAMC,GAASA,EAAKR,cAAcG,IAAU,EAkDrDM,CAAgB,CAACf,EAASC,IAC5BE,EAAOa,MAAM,4DAIfb,EAAOa,MAAM,oDACbhB,EAAQiB,YArDmB,CAACpB,IAC5B,MAAMqB,EAAQC,SAASC,cAAc,SAuBrC,OAtBAF,EAAMG,aAAa,eAAgB,YACnCH,EAAMG,aAAa,OAAQ,YAC3BH,EAAMG,aAAa,OAAQ,SAC3BH,EAAMG,aAAa,WAAY,QAC/BH,EAAMG,aAAa,WAAY,MAC/BH,EAAMG,aAAa,cAAe,QAElCH,EAAMG,aAAaC,EAAiC,QAEpDJ,EAAMG,aAAapC,EAA2B,QAE9CiC,EAAMG,aAAa,QAASxB,GAC5BqB,EAAMK,MAAQ1B,EAGd2B,OAAOC,OAAOP,EAAMQ,MAAO,CACzBC,SAAU,WACVC,QAAS,IACTC,cAAe,OACfC,OAAQ,IACRC,OAAQ,MAEHb,CAAK,EA6BQc,CAAqBnC,KATvCM,EAAOa,MAAM,iDAJbb,EAAOa,MAAM,mDAamC,EASvCiB,EAAuBC,GACGC,kBACnC,MAAMC,EAAYC,EAAQC,EAARD,CAAqBF,GAEvC,OAAO9C,EAAA,cAAwC+C,EAAxC,WAAAG,mCAILC,EAA8BC,IAAAC,UAAA,EAyE/B,CA5DC,gBAAAC,CAAiBC,aACfC,EAAAH,KAAmBF,EAAA,CACjBpC,MAAOwC,aAAA,EAAAA,EAAWxC,MAClBC,UAA6B,QAAnByC,EAAAF,aAAS,EAATA,EAAWvC,gBAAQ,IAAAyC,OAAA,EAAAA,EAAEC,QAC3BH,EAAUvC,SACV,CACEnB,EAAwB8D,EAAAN,KAAIO,EAAA,IAAAC,MACQ,QAAlCC,EAAc,QAAdC,EAAAJ,EAAAN,KAAIO,EAAA,IAAAI,GAAOC,WAAG,IAAAF,OAAA,EAAAA,EAAEG,0BAAkB,IAAAJ,OAAA,EAAAA,EAAAK,KAAAJ,KACpCK,OAAOC,UACd,IACF,CAED,oBAAAC,GApHJxC,SACGyC,iBAAiB,IAAI3E,aACrB4E,SAASC,GAAQA,EAAIC,WAuHlBhE,EACE2C,KACAM,EAAAN,cAAWsB,mBACXhB,EAAAN,KAAgBF,EAAA,KAChBE,KAAKvC,OAER,CAKD,2BAAA8D,CAA4BC,EAAW,CAAE,EAAEC,GACzC,MAAMtE,EAAUuE,EAAsBF,EAAUnF,GAC5Cc,GArJoB,EAACA,EAAiBV,WAChD,GAAKU,GAAYV,EAGjB,YACEE,EAAAC,OAAOC,+BAAgB8E,QACrB5E,EACAE,KAAK2E,UAAU,CAAEnF,cAAaU,YAEjC,CAAC,MAAOC,GAER,GA2IOyE,CACE1E,EACAsE,GAAuBnB,EAAAN,KAAiBO,EAAA,IAAAC,GAG7C,CAGD,gBAAAsB,CAAiBN,EAAW,kBAC1B,MAAMO,EACJL,EAAsBF,EAAUnF,KAChB,QAAhB+D,EAAAE,EAAAN,KAAgBF,EAAA,YAAA,IAAAM,OAAA,EAAAA,EAAE1C,SACW,QAA7B+C,EAAgB,QAAhBC,EAAAJ,EAAAN,KAAgBF,EAAA,YAAA,IAAAY,OAAA,EAAAA,EAAE/C,gBAAW,IAAA8C,OAAA,EAAAA,EAAA,IACzBuB,EAAWN,EAAsBF,EAAUlF,GAGjD,GAAIyF,GAAMC,EACR,IACE,IAAKC,WAAWC,mBACd,OAEF,MAAMC,EAAO,IAAIF,WAAWC,mBAAmB,CAAEH,KAAIC,aAErB,QAAhCI,EAAwB,QAAxBC,EAAA,OAAAC,gBAAA,IAAAA,eAAA,EAAAA,UAAWC,mBAAa,IAAAF,OAAA,EAAAA,EAAAG,aAAQ,IAAAJ,GAAAA,EAAAtB,KAAAuB,EAAAF,EACjC,CAAC,MAAO/E,GACP4C,KAAKvC,OAAOgF,MAAM,8BAA+BrF,EAAEsF,QACpD,CAEJ,4CArEC,OAAO1C,IACR,uBAGC,OAAoC,QAA7BU,EAAoB,QAApBN,EAAAE,EAAAN,KAAUO,EAAA,IAAAI,GAACgC,iBAAS,IAAAvC,OAAA,EAAAA,EAAEwC,eAAO,IAAAlC,OAAA,EAAAA,EAAEjE,cAAe,EACtD,EAiEDE,CAAA"}

package/dist/esm/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sources":["../../src/lib/types.ts"],"sourcesContent":["/* istanbul ignore file */\n\nimport type { JWTResponse } from '@descope/web-js-sdk';\nimport { createSdk } from '@descope/web-js-sdk';\n\nexport type SdkConfig = Parameters<typeof createSdk>[0];\nexport type Sdk = ReturnType<typeof createSdk>;\n\nexport type SdkFlowNext = Sdk['flow']['next'];\n\nexport type ComponentsDynamicAttrs = {\n  attributes: Record<string, any>;\n};\n\nexport type ComponentsConfig = Record<string, any> & {\n  componentsDynamicAttrs?: Record<string, ComponentsDynamicAttrs>;\n};\nexport type CssVars = Record<string, any>;\n\ntype KeepArgsByIndex<F, Indices extends readonly number[]> = F extends (\n  ...args: infer A\n) => infer R\n  ? (...args: PickArgsByIndex<A, Indices>) => R\n  : never;\n\ntype PickArgsByIndex<\n  All extends readonly any[],\n  Indices extends readonly number[],\n> = {\n  [K in keyof Indices]: Indices[K] extends keyof All ? All[Indices[K]] : never;\n};\n\ntype Project = {\n  name: string;\n};\n\nexport enum Direction {\n  backward = 'backward',\n  forward = 'forward',\n}\n\nexport type LastAuthState = NonNullable<\n  NextFnReturnPromiseValue['data']['lastAuth']\n> & {\n  loginId?: string;\n  name?: string;\n  lastUsedPerScreen?: Record<string, string>;\n};\n\nexport type RealtimeOperandKind = 'value' | 'form' | 'list';\n\n// Operators the SDK is allowed to evaluate locally. The server's\n// clientSupportedRealtimeOperators must stay in sync — anything outside this\n// list is pre-evaluated server-side and shipped as a value operand.\n//\n// is-email / is-phone are intentionally absent: the server validates them\n// with dedicated libraries (contact.IsValid*); the client has no equivalent,\n// so the server keeps these CCs server-only.\nexport type RealtimeOperator =\n  | 'equal'\n  | 'not-equal'\n  | 'contains'\n  | 'doesnt-contains'\n  | 'greater-than'\n  | 'greater-than-or-equal'\n  | 'less-than'\n  | 'less-than-or-equal'\n  | 'empty'\n  | 'not-empty'\n  | 'is-true'\n  | 'is-false'\n  | 'in'\n  | 'not-in'\n  | 'matches';\n\nexport interface RealtimeOperand {\n  kind: RealtimeOperandKind;\n  // Form is the context key the client looks up from the live form snapshot\n  // (e.g. \"form.phone\"). Set only when kind === 'form'.\n  form?: string;\n  // Items is the operand list when kind === 'list'. Each element is a nested\n  // operand — either a form placeholder or a resolved literal. Used when the\n  // server detects an `in` / `not-in` / `contains` predicate whose array\n  // contains `{{form.X}}` references; the client resolves them at eval time.\n  items?: RealtimeOperand[];\n  // Pre-resolved literal. Set only when kind === 'value', and may legitimately\n  // be false / 0 / \"\" — do not treat absence as \"no value\" without checking\n  // kind first.\n  value?: unknown;\n}\n\nexport interface RealtimeAtomicCondition {\n  operator: RealtimeOperator;\n  target?: RealtimeOperand;\n  predicate?: RealtimeOperand;\n}\n\nexport interface RealtimeRule {\n  logicalOr?: boolean;\n  atomicConditions: RealtimeAtomicCondition[];\n}\n\nexport interface RealtimeComponentsCondition {\n  id?: string;\n  componentIds: string[];\n  action: string;\n  rules: RealtimeRule[];\n}\n\nexport interface ScreenState {\n  errorText?: string;\n  errorType?: string;\n  componentsConfig?: ComponentsConfig;\n  cssVars?: CssVars;\n  form?: Record<string, string>;\n  inputs?: Record<string, string>; // Backward compatibility\n  lastAuth?: LastAuthState;\n  project?: Project;\n  totp?: { image?: string; provisionUrl?: string };\n  notp?: { image?: string; redirectUrl?: string };\n  selfProvisionDomains?: unknown;\n  user?: unknown;\n  sso?: unknown;\n  dynamicSelects?: unknown;\n  keysInUse?: unknown;\n  genericForm?: unknown;\n  linkId?: unknown;\n  sentTo?: unknown;\n  clientScripts?: ClientScript[];\n  // map of component IDs to their state — the FULL last-wins verdict over\n  // all CCs (server-only + client-eligible) the BE evaluated at screen-init.\n  // Used by `applyComponentsState` for the first DOM paint.\n  componentsState?: Record<string, string>;\n  // Subset of `componentsState` contributed by SERVER-ONLY CCs — those the\n  // client cannot re-evaluate locally (operators on the server-only\n  // allow-list like `is-email`, or rules referencing context the client\n  // doesn't have). Parallels `componentsState` in structure but excludes\n  // contributions from client-eligible CCs that also ship in\n  // `realtimeComponentsConditions`.\n  //\n  // The realtime layer uses this as the fallback action to restore when a\n  // realtime CC stops firing on a touched component — without it the SDK\n  // can't tell whether the action in `componentsState` came from a\n  // server-only CC (must persist) or from a realtime CC also re-shipped\n  // (must clear).\n  //\n  // Absent on old backends; new SDKs fall back to a legacy heuristic that\n  // infers the same information from `componentsState`, so the old-BE /\n  // new-SDK combination still works correctly.\n  serverOnlyComponentsState?: Record<string, string>;\n  // Client-evaluable visibility conditions, populated only by new backends.\n  // Absent on old backends; new SDKs ignore when absent.\n  realtimeComponentsConditions?: RealtimeComponentsCondition[];\n}\n\nexport type SSOQueryParams = {\n  oidcIdpStateId?: string;\n  samlIdpStateId?: string;\n  wsfedIdpStateId?: string;\n  samlIdpUsername?: string;\n  descopeIdpInitiated?: boolean;\n  ssoAppId?: string;\n  customAppId?: string;\n  thirdPartyAppId: string;\n  thirdPartyAppStateId?: string;\n  applicationScopes?: string;\n} & OIDCOptions;\n\nexport type OIDCOptions = {\n  oidcLoginHint?: string;\n  oidcPrompt?: string;\n  oidcErrorRedirectUri?: string;\n  oidcResource?: string;\n};\n\nexport type FlowState = {\n  flowId: string;\n  projectId: string;\n  baseUrl: string;\n  tenant: string;\n  stepId: string;\n  stepName: string;\n  executionId: string;\n  action: string;\n  redirectTo: string;\n  redirectIsPopup: boolean;\n  openInNewTabUrl?: string;\n  redirectUrl: string;\n  screenId: string;\n  screenState: ScreenState;\n  token: string;\n  code: string;\n  isPopup: boolean;\n  exchangeError: string;\n  webauthnTransactionId: string;\n  webauthnOptions: string;\n  redirectAuthCodeChallenge: string;\n  redirectAuthCallbackUrl: string;\n  redirectAuthBackupCallbackUri: string;\n  redirectAuthInitiator: string;\n  deferredRedirect: boolean;\n  deferredPolling: boolean;\n  locale: string;\n  samlIdpResponseUrl: string;\n  samlIdpResponseSamlResponse: string;\n  samlIdpResponseRelayState: string;\n  wsFedIdpResponseUrl: string;\n  wsFedIdpResponseWresult: string;\n  wsFedIdpResponseWctx: string;\n  nativeResponseType: string;\n  nativePayload: Record<string, any>;\n  reqTimestamp: number;\n} & SSOQueryParams;\n\nexport type StepState = {\n  screenState: ScreenState;\n  screenId: string;\n  stepName: string;\n  htmlFilename: string;\n  htmlLocaleFilename: string;\n  next: NextFn;\n  direction: Direction | undefined;\n  samlIdpUsername: string;\n  action?: string;\n  locale?: string;\n} & OIDCOptions;\n\nexport type CustomScreenState = Omit<\n  ScreenState,\n  'cssVars' | 'componentsConfig' | 'inputs'\n> & {\n  error?: {\n    text: ScreenState['errorText'];\n    type: ScreenState['errorType'];\n  };\n  action?: string;\n  inboundAppApproveScopes?: {\n    desc: string;\n    id: string;\n    required: boolean;\n  }[];\n};\n\nexport type DebugState = {\n  isDebug: boolean;\n};\n\nexport interface ScriptElement extends HTMLDivElement {\n  moduleRes?: ScriptModule;\n}\n\nexport type ScriptModule = {\n  /**\n   * Unique identifier of the module.\n   */\n  id: string;\n  /**\n   * Notifies the module that it should start any profiling or monitoring.\n   */\n  start?: () => void;\n  /**\n   * Notifies the module that it should stop any profiling or monitoring.\n   */\n  stop?: () => void;\n  /**\n   * Presents the user with any required interaction to get a refreshed token or state,\n   * e.g., a challenge or captcha.\n   *\n   * Modules should return a value of true if the presentation completed successfully,\n   * false if it was cancelled by the user, and throw an error in case of failure.\n   *\n   * This is called before form submission (via a next call) after a button click.\n   */\n  present?: () => Promise<boolean>;\n  /**\n   * Refreshes any tokens or state that might be needed before form submission.\n   *\n   * Modules should throw an error in case of failure.\n   */\n  refresh?: () => Promise<void>;\n};\n\nexport type ClientScript = {\n  id: string;\n  initArgs: Record<string, any>;\n  resultKey?: string;\n};\n\nexport type NextFn = KeepArgsByIndex<SdkFlowNext, [2, 5]> & {\n  isCustomScreen?: boolean;\n};\nexport type NextFnReturnPromiseValue = Awaited<ReturnType<NextFn>>;\n\nexport type DebuggerMessage = {\n  title: string;\n  description?: string;\n};\n\nexport type FlowStateUpdateFn = (state: FlowState) => void;\n\ntype Operator =\n  | 'equal'\n  | 'not-equal'\n  | 'contains'\n  | 'greater-than'\n  | 'greater-than-or-equal'\n  | 'less-than'\n  | 'less-than-or-equal'\n  | 'empty'\n  | 'not-empty'\n  | 'is-true'\n  | 'is-false'\n  | 'in'\n  | 'not-in'\n  | 'in-range'\n  | 'not-in-range'\n  | 'devised-by';\n\nexport interface ClientConditionResult {\n  screenId: string;\n  screenName: string;\n  clientScripts?: ClientScript[];\n  componentsConfig?: ComponentsConfig;\n  interactionId: string;\n}\n\nexport interface ClientCondition {\n  operator: Operator;\n  key: string;\n  predicate?: string | number;\n  met: ClientConditionResult;\n  unmet?: ClientConditionResult;\n}\n\nexport type AutoFocusOptions = true | false | 'skipFirstScreen';\n\nexport type ThemeOptions = 'light' | 'dark' | 'os';\n\nexport type Key =\n  | 'lastAuth.loginId'\n  | 'idpInitiated'\n  | 'externalToken'\n  | 'abTestingKey';\n\ntype CheckFunction = (ctx: Context, predicate?: string | number) => boolean;\n\nexport type ConditionsMap = {\n  [key in Key]: {\n    [operator in Operator]?: CheckFunction;\n  };\n};\n\nexport interface Context {\n  loginId?: string;\n  code?: string;\n  token?: string;\n  abTestingKey?: number;\n  lastAuth?: LastAuthState;\n}\n\nexport type DescopeUI = Record<string, () => Promise<void>> & {\n  componentsThemeManager: Record<string, any>;\n};\n\ntype Font = {\n  family: string[];\n  label: string;\n  url?: string;\n};\n\ntype ThemeTemplate = {\n  fonts: {\n    font1: Font;\n    font2: Font;\n  };\n};\n\ntype ThemeColor = {\n  main: string;\n  dark: string;\n  light: string;\n  highlight: string;\n  contrast: string;\n};\n\nexport type OverrideTheme = {\n  globals?: {\n    colors?: {\n      primary?: ThemeColor;\n      secondary?: ThemeColor;\n    };\n  };\n};\n\nexport type OverrideThemes = {\n  dark?: OverrideTheme;\n  light?: OverrideTheme;\n};\n\nexport type FlowConfig = {\n  startScreenId?: string;\n  startScreenName?: string;\n  version: number;\n  targetLocales?: string[];\n  conditions?: ClientCondition[];\n  condition?: ClientCondition;\n  fingerprintEnabled?: boolean;\n  fingerprintKey?: string;\n  sdkScripts?: [\n    {\n      id: string;\n      initArgs: Record<string, any>;\n      resultKey?: string;\n    },\n  ];\n  clientScripts?: ClientScript[];\n  componentsConfig?: ComponentsConfig;\n};\n\nexport interface ProjectConfiguration {\n  componentsVersion: string;\n  cssTemplate: {\n    dark: ThemeTemplate;\n    light: ThemeTemplate;\n  };\n  flows: {\n    [key: string]: FlowConfig; // dynamic key names for flows\n  };\n}\n\nexport type FlowStatus = 'loading' | 'error' | 'success' | 'ready' | 'initial';\n\nexport type CustomStorage = {\n  getItem: (key: string) => string | null;\n  setItem: (key: string, value: string) => void;\n  removeItem: (key: string) => void;\n};\n\nexport type FlowJWTResponse = JWTResponse & {\n  flowOutput?: Record<string, any>;\n};\n"],"names":["Direction"],"mappings":"IAoCYA,GAAZ,SAAYA,GACVA,EAAA,SAAA,WACAA,EAAA,QAAA,SACD,CAHD,CAAYA,IAAAA,EAGX,CAAA"}
+{"version":3,"file":"types.js","sources":["../../src/lib/types.ts"],"sourcesContent":["/* istanbul ignore file */\n\nimport type { JWTResponse } from '@descope/web-js-sdk';\nimport { createSdk } from '@descope/web-js-sdk';\n\nexport type SdkConfig = Parameters<typeof createSdk>[0];\nexport type Sdk = ReturnType<typeof createSdk>;\n\nexport type SdkFlowNext = Sdk['flow']['next'];\n\nexport type ComponentsDynamicAttrs = {\n  attributes: Record<string, any>;\n};\n\nexport type ComponentsConfig = Record<string, any> & {\n  componentsDynamicAttrs?: Record<string, ComponentsDynamicAttrs>;\n};\nexport type CssVars = Record<string, any>;\n\ntype KeepArgsByIndex<F, Indices extends readonly number[]> = F extends (\n  ...args: infer A\n) => infer R\n  ? (...args: PickArgsByIndex<A, Indices>) => R\n  : never;\n\ntype PickArgsByIndex<\n  All extends readonly any[],\n  Indices extends readonly number[],\n> = {\n  [K in keyof Indices]: Indices[K] extends keyof All ? All[Indices[K]] : never;\n};\n\ntype Project = {\n  name: string;\n};\n\nexport enum Direction {\n  backward = 'backward',\n  forward = 'forward',\n}\n\nexport type LastAuthState = NonNullable<\n  NextFnReturnPromiseValue['data']['lastAuth']\n> & {\n  loginId?: string;\n  name?: string;\n  lastUsedPerScreen?: Record<string, string>;\n};\n\nexport type RealtimeOperandKind = 'value' | 'form' | 'list';\n\n// Operators the SDK is allowed to evaluate locally. The server's\n// clientSupportedRealtimeOperators must stay in sync — anything outside this\n// list is pre-evaluated server-side and shipped as a value operand.\n//\n// is-email / is-phone are intentionally absent: the server validates them\n// with dedicated libraries (contact.IsValid*); the client has no equivalent,\n// so the server keeps these CCs server-only.\nexport type RealtimeOperator =\n  | 'equal'\n  | 'not-equal'\n  | 'contains'\n  | 'doesnt-contains'\n  | 'greater-than'\n  | 'greater-than-or-equal'\n  | 'less-than'\n  | 'less-than-or-equal'\n  | 'empty'\n  | 'not-empty'\n  | 'is-true'\n  | 'is-false'\n  | 'in'\n  | 'not-in'\n  | 'matches';\n\nexport interface RealtimeOperand {\n  kind: RealtimeOperandKind;\n  // Form is the context key the client looks up from the live form snapshot\n  // (e.g. \"form.phone\"). Set only when kind === 'form'.\n  form?: string;\n  // Items is the operand list when kind === 'list'. Each element is a nested\n  // operand — either a form placeholder or a resolved literal. Used when the\n  // server detects an `in` / `not-in` / `contains` predicate whose array\n  // contains `{{form.X}}` references; the client resolves them at eval time.\n  items?: RealtimeOperand[];\n  // Pre-resolved literal. Set only when kind === 'value', and may legitimately\n  // be false / 0 / \"\" — do not treat absence as \"no value\" without checking\n  // kind first.\n  value?: unknown;\n}\n\nexport interface RealtimeAtomicCondition {\n  operator: RealtimeOperator;\n  target?: RealtimeOperand;\n  predicate?: RealtimeOperand;\n}\n\nexport interface RealtimeRule {\n  logicalOr?: boolean;\n  atomicConditions: RealtimeAtomicCondition[];\n}\n\nexport interface RealtimeComponentsCondition {\n  id?: string;\n  componentIds: string[];\n  action: string;\n  rules: RealtimeRule[];\n}\n\n// the server sends the full user object; only the fields the SDK reads are\n// typed here\nexport interface ScreenStateUser {\n  email?: string;\n  loginIds?: string[];\n  [key: string]: unknown;\n}\n\nexport interface ScreenState {\n  errorText?: string;\n  errorType?: string;\n  componentsConfig?: ComponentsConfig;\n  cssVars?: CssVars;\n  form?: Record<string, string>;\n  inputs?: Record<string, string>; // Backward compatibility\n  lastAuth?: LastAuthState;\n  project?: Project;\n  totp?: { image?: string; provisionUrl?: string };\n  notp?: { image?: string; redirectUrl?: string };\n  selfProvisionDomains?: unknown;\n  user?: ScreenStateUser;\n  sso?: unknown;\n  dynamicSelects?: unknown;\n  keysInUse?: unknown;\n  genericForm?: unknown;\n  linkId?: unknown;\n  sentTo?: unknown;\n  clientScripts?: ClientScript[];\n  // map of component IDs to their state — the FULL last-wins verdict over\n  // all CCs (server-only + client-eligible) the BE evaluated at screen-init.\n  // Used by `applyComponentsState` for the first DOM paint.\n  componentsState?: Record<string, string>;\n  // Subset of `componentsState` contributed by SERVER-ONLY CCs — those the\n  // client cannot re-evaluate locally (operators on the server-only\n  // allow-list like `is-email`, or rules referencing context the client\n  // doesn't have). Parallels `componentsState` in structure but excludes\n  // contributions from client-eligible CCs that also ship in\n  // `realtimeComponentsConditions`.\n  //\n  // The realtime layer uses this as the fallback action to restore when a\n  // realtime CC stops firing on a touched component — without it the SDK\n  // can't tell whether the action in `componentsState` came from a\n  // server-only CC (must persist) or from a realtime CC also re-shipped\n  // (must clear).\n  //\n  // Absent on old backends; new SDKs fall back to a legacy heuristic that\n  // infers the same information from `componentsState`, so the old-BE /\n  // new-SDK combination still works correctly.\n  serverOnlyComponentsState?: Record<string, string>;\n  // Client-evaluable visibility conditions, populated only by new backends.\n  // Absent on old backends; new SDKs ignore when absent.\n  realtimeComponentsConditions?: RealtimeComponentsCondition[];\n}\n\nexport type SSOQueryParams = {\n  oidcIdpStateId?: string;\n  samlIdpStateId?: string;\n  wsfedIdpStateId?: string;\n  samlIdpUsername?: string;\n  descopeIdpInitiated?: boolean;\n  ssoAppId?: string;\n  customAppId?: string;\n  thirdPartyAppId: string;\n  thirdPartyAppStateId?: string;\n  applicationScopes?: string;\n} & OIDCOptions;\n\nexport type OIDCOptions = {\n  oidcLoginHint?: string;\n  oidcPrompt?: string;\n  oidcErrorRedirectUri?: string;\n  oidcResource?: string;\n};\n\nexport type FlowState = {\n  flowId: string;\n  projectId: string;\n  baseUrl: string;\n  tenant: string;\n  stepId: string;\n  stepName: string;\n  executionId: string;\n  action: string;\n  redirectTo: string;\n  redirectIsPopup: boolean;\n  openInNewTabUrl?: string;\n  redirectUrl: string;\n  screenId: string;\n  screenState: ScreenState;\n  token: string;\n  code: string;\n  isPopup: boolean;\n  exchangeError: string;\n  webauthnTransactionId: string;\n  webauthnOptions: string;\n  redirectAuthCodeChallenge: string;\n  redirectAuthCallbackUrl: string;\n  redirectAuthBackupCallbackUri: string;\n  redirectAuthInitiator: string;\n  deferredRedirect: boolean;\n  deferredPolling: boolean;\n  locale: string;\n  samlIdpResponseUrl: string;\n  samlIdpResponseSamlResponse: string;\n  samlIdpResponseRelayState: string;\n  wsFedIdpResponseUrl: string;\n  wsFedIdpResponseWresult: string;\n  wsFedIdpResponseWctx: string;\n  nativeResponseType: string;\n  nativePayload: Record<string, any>;\n  reqTimestamp: number;\n} & SSOQueryParams;\n\nexport type StepState = {\n  screenState: ScreenState;\n  screenId: string;\n  stepName: string;\n  htmlFilename: string;\n  htmlLocaleFilename: string;\n  next: NextFn;\n  direction: Direction | undefined;\n  samlIdpUsername: string;\n  action?: string;\n  locale?: string;\n} & OIDCOptions;\n\nexport type CustomScreenState = Omit<\n  ScreenState,\n  'cssVars' | 'componentsConfig' | 'inputs'\n> & {\n  error?: {\n    text: ScreenState['errorText'];\n    type: ScreenState['errorType'];\n  };\n  action?: string;\n  inboundAppApproveScopes?: {\n    desc: string;\n    id: string;\n    required: boolean;\n  }[];\n};\n\nexport type DebugState = {\n  isDebug: boolean;\n};\n\nexport interface ScriptElement extends HTMLDivElement {\n  moduleRes?: ScriptModule;\n}\n\nexport type ScriptModule = {\n  /**\n   * Unique identifier of the module.\n   */\n  id: string;\n  /**\n   * Notifies the module that it should start any profiling or monitoring.\n   */\n  start?: () => void;\n  /**\n   * Notifies the module that it should stop any profiling or monitoring.\n   */\n  stop?: () => void;\n  /**\n   * Presents the user with any required interaction to get a refreshed token or state,\n   * e.g., a challenge or captcha.\n   *\n   * Modules should return a value of true if the presentation completed successfully,\n   * false if it was cancelled by the user, and throw an error in case of failure.\n   *\n   * This is called before form submission (via a next call) after a button click.\n   */\n  present?: () => Promise<boolean>;\n  /**\n   * Refreshes any tokens or state that might be needed before form submission.\n   *\n   * Modules should throw an error in case of failure.\n   */\n  refresh?: () => Promise<void>;\n};\n\nexport type ClientScript = {\n  id: string;\n  initArgs: Record<string, any>;\n  resultKey?: string;\n};\n\nexport type NextFn = KeepArgsByIndex<SdkFlowNext, [2, 5]> & {\n  isCustomScreen?: boolean;\n};\nexport type NextFnReturnPromiseValue = Awaited<ReturnType<NextFn>>;\n\nexport type DebuggerMessage = {\n  title: string;\n  description?: string;\n};\n\nexport type FlowStateUpdateFn = (state: FlowState) => void;\n\ntype Operator =\n  | 'equal'\n  | 'not-equal'\n  | 'contains'\n  | 'greater-than'\n  | 'greater-than-or-equal'\n  | 'less-than'\n  | 'less-than-or-equal'\n  | 'empty'\n  | 'not-empty'\n  | 'is-true'\n  | 'is-false'\n  | 'in'\n  | 'not-in'\n  | 'in-range'\n  | 'not-in-range'\n  | 'devised-by';\n\nexport interface ClientConditionResult {\n  screenId: string;\n  screenName: string;\n  clientScripts?: ClientScript[];\n  componentsConfig?: ComponentsConfig;\n  interactionId: string;\n}\n\nexport interface ClientCondition {\n  operator: Operator;\n  key: string;\n  predicate?: string | number;\n  met: ClientConditionResult;\n  unmet?: ClientConditionResult;\n}\n\nexport type AutoFocusOptions = true | false | 'skipFirstScreen';\n\nexport type ThemeOptions = 'light' | 'dark' | 'os';\n\nexport type Key =\n  | 'lastAuth.loginId'\n  | 'idpInitiated'\n  | 'externalToken'\n  | 'abTestingKey';\n\ntype CheckFunction = (ctx: Context, predicate?: string | number) => boolean;\n\nexport type ConditionsMap = {\n  [key in Key]: {\n    [operator in Operator]?: CheckFunction;\n  };\n};\n\nexport interface Context {\n  loginId?: string;\n  code?: string;\n  token?: string;\n  abTestingKey?: number;\n  lastAuth?: LastAuthState;\n}\n\nexport type DescopeUI = Record<string, () => Promise<void>> & {\n  componentsThemeManager: Record<string, any>;\n};\n\ntype Font = {\n  family: string[];\n  label: string;\n  url?: string;\n};\n\ntype ThemeTemplate = {\n  fonts: {\n    font1: Font;\n    font2: Font;\n  };\n};\n\ntype ThemeColor = {\n  main: string;\n  dark: string;\n  light: string;\n  highlight: string;\n  contrast: string;\n};\n\nexport type OverrideTheme = {\n  globals?: {\n    colors?: {\n      primary?: ThemeColor;\n      secondary?: ThemeColor;\n    };\n  };\n};\n\nexport type OverrideThemes = {\n  dark?: OverrideTheme;\n  light?: OverrideTheme;\n};\n\nexport type FlowConfig = {\n  startScreenId?: string;\n  startScreenName?: string;\n  version: number;\n  targetLocales?: string[];\n  conditions?: ClientCondition[];\n  condition?: ClientCondition;\n  fingerprintEnabled?: boolean;\n  fingerprintKey?: string;\n  sdkScripts?: [\n    {\n      id: string;\n      initArgs: Record<string, any>;\n      resultKey?: string;\n    },\n  ];\n  clientScripts?: ClientScript[];\n  componentsConfig?: ComponentsConfig;\n};\n\nexport interface ProjectConfiguration {\n  componentsVersion: string;\n  cssTemplate: {\n    dark: ThemeTemplate;\n    light: ThemeTemplate;\n  };\n  flows: {\n    [key: string]: FlowConfig; // dynamic key names for flows\n  };\n}\n\nexport type FlowStatus = 'loading' | 'error' | 'success' | 'ready' | 'initial';\n\nexport type CustomStorage = {\n  getItem: (key: string) => string | null;\n  setItem: (key: string, value: string) => void;\n  removeItem: (key: string) => void;\n};\n\nexport type FlowJWTResponse = JWTResponse & {\n  flowOutput?: Record<string, any>;\n};\n"],"names":["Direction"],"mappings":"IAoCYA,GAAZ,SAAYA,GACVA,EAAA,SAAA,WACAA,EAAA,QAAA,SACD,CAHD,CAAYA,IAAAA,EAGX,CAAA"}