@memberjunction/ng-auth-services 6.1.0-edge.1 → 6.1.0-edge.3

package/LICENSE

@@ -1,7 +1,183 @@
-ISC License
+Business Source License 1.1
 
-Copyright (c) 2023 MemberJunction
+License text copyright (c) 2024 MariaDB plc, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB plc.
 
-Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+-----------------------------------------------------------------------------
 
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+Parameters
+
+Licensor:             Blue Cypress, Inc.
+
+Licensed Work:        MemberJunction.
+                      The Licensed Work is (c) 2023-2026 Blue Cypress, Inc.
+
+Additional Use Grant: Subject to the terms of this License, Licensor grants
+                      you the following additional rights to make Production
+                      Use of the Licensed Work.
+
+                      1. Internal Use
+
+                      You may make production use of the Licensed Work for
+                      your own internal business or organizational operations.
+
+                      2. Nonprofit Use
+
+                      If you are a Nonprofit, you may make production use of
+                      the Licensed Work for the operations and activities of
+                      your Organizational Family.
+
+                      3. MemberJunction Certified Program Use
+
+                      If you are authorized by Licensor under the
+                      MemberJunction Certified Program to provide professional
+                      services using the Licensed Work, you may make
+                      production use of the Licensed Work in providing such
+                      professional services to a client, provided that:
+
+                      (a) the Licensed Work is deployed in, and the applicable
+                      production use occurs within, an environment owned,
+                      leased, licensed, subscribed to, or otherwise controlled
+                      by that client; and
+
+                      (b) the production use is for that client's own internal
+                      business or organizational operations or is otherwise
+                      independently permitted to that client under this
+                      Additional Use Grant.
+
+                      4. Definitions Applicable to the Additional Use Grant
+
+                      "Affiliate" means, with respect to a specified Person,
+                      any other Person that directly or indirectly Controls,
+                      is Controlled by, or is under common Control with such
+                      specified Person.
+
+                      "Control" (including the terms "Controls," "Controlled
+                      by," and "under common Control with") means the direct
+                      or indirect possession of the power to direct or cause
+                      the direction of the management and policies of a
+                      Person, whether through ownership of voting interests,
+                      by contract, or otherwise.
+
+                      "Organizational Family" means, with respect to a Person,
+                      (a) such Person and its Affiliates, and (b) any
+                      nonprofit organization, governmental entity, chapter,
+                      division, local affiliate, regional affiliate, state
+                      affiliate, national affiliate, or other entity that is
+                      formally affiliated with such Person through governing
+                      documents, a charter, bylaws, a membership agreement, or
+                      another written organizational instrument, and is
+                      recognized under such documents as part of the same
+                      organizational structure.
+
+                      "Nonprofit" means a Person recognized by the Internal
+                      Revenue Service as exempt from federal income taxation
+                      under Section 501(c)(3), 501(c)(4), 501(c)(5), or
+                      501(c)(6) of the Internal Revenue Code, or a foreign
+                      organization recognized under substantially equivalent
+                      laws.
+
+                      A Person claiming eligibility as a Nonprofit shall, upon
+                      Licensor's reasonable request, provide documentation
+                      reasonably sufficient to demonstrate that it qualifies
+                      as a Nonprofit. If such Person materially misrepresents,
+                      or is unable to demonstrate, its qualification as a
+                      Nonprofit, the rights granted to such Person under
+                      Section 2 of this Additional Use Grant shall terminate.
+
+                      "MemberJunction Certified Program" means Licensor's
+                      then-current program for certifying and authorizing a
+                      Person to provide professional services using the
+                      Licensed Work.
+
+                      "Person" means any individual, corporation, limited
+                      liability company, partnership, association, nonprofit
+                      organization, governmental entity, or other legal or
+                      organizational entity.
+
+Change Date:          Four (4) years from the date the Licensed Work is first
+                      made available.
+
+Change License:       MIT License.
+
+For information about alternative licensing arrangements for the Licensed
+Work, please contact Blue Cypress, Inc.
+
+-----------------------------------------------------------------------------
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License's text to license
+your works, and to refer to it using the trademark "Business Source License",
+as long as you comply with the Covenants of Licensor below.
+
+-----------------------------------------------------------------------------
+
+Covenants of Licensor
+
+In consideration of the right to use this License's text and the "Business
+Source License" name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where "compatible" means that software provided under the Change License
+   can be included in a program with software provided under GPL Version 2.0
+   or a later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text "None".
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.
+
+-----------------------------------------------------------------------------
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.

package/README.md

@@ -38,6 +38,57 @@ graph TD
 - **Observable State**: Reactive authentication state, user info, and email streams
 - **Configuration Validation**: Each provider declares and validates its required configuration
 - **Angular 21+ Compatible**: Built for modern Angular applications
+- **Metadata-driven provider catalog**: the server publishes its configured providers pre-auth, and the app resolves which one to bootstrap from that catalog (falling back to `AUTH_TYPE`)
+- **Multi-IdP login picker**: reusable, app-agnostic `<mj-login-picker>` rendered when 2+ providers are available
+
+## Metadata-driven providers and the login picker
+
+The server can define providers as data (`MJ: Authentication Providers`) and publishes the
+non-secret subset at `GET /auth/providers`. The browser reads that **before login** and decides
+which provider to wire into DI.
+
+**Bootstrap.** `AuthServicesModule.forRoot()` runs at module-definition time, so the catalog must
+be fetched before the root module is imported:
+
+```typescript
+// main.ts
+await AuthProviderCatalog.Preload(environment.GRAPHQL_URI);
+const { AppModule } = await import('./app/app.module');   // dynamic import is REQUIRED — see below
+platformBrowserDynamic().bootstrapModule(AppModule);
+```
+
+The dynamic import is not stylistic: a static import is hoisted and would evaluate `AppModule`
+(and `forRoot`) before the `await`, making the preload pointless. `forRoot()` reads the preload
+itself — do **not** pass `AuthProviderCatalog.GetPreloaded()` as an argument, because Angular's
+compiler rejects a function call in an `imports` array (`Value could not be determined statically`).
+
+`Preload` never rejects. A 404 (older server), a network failure or a malformed body all yield an
+empty catalog, and resolution falls back to `environment.AUTH_TYPE` — behaviour identical to before
+the catalog existed.
+
+**Rendering the picker.** Inject `MJ_AUTH_PROVIDER_RESOLUTION` and embed the shared component in
+your own login surface:
+
+```html
+@if (resolution.showPicker) {
+  <mj-login-picker [Providers]="resolution.choices" [Busy]="SigningIn"
+                   (ProviderSelected)="OnProviderSelected($event)"></mj-login-picker>
+}
+```
+
+`showPicker` is true only with 2+ providers — one option is not a choice, so single-provider
+deployments render exactly as they always have.
+
+**Switching providers reloads the page**, by necessity: each browser SDK contributes Angular
+providers (interceptors, guards, config tokens) at module-definition time, so a live injector
+cannot be re-composed. `AuthProviderCatalog.Select()` reports whether a reload is needed — choosing
+the already-active provider logs in immediately; choosing another persists the choice, reloads, and
+resumes login automatically.
+
+**Catalog → driver config.** A row's values are projected onto the prefixed environment keys the
+drivers already read (`AUTH0_DOMAIN`, `WORKOS_CLIENTID`, …), which covers Auth0/Okta/Cognito/WorkOS
+with no per-driver code. A driver that reads different keys (MSAL uses unprefixed `CLIENT_ID` /
+`CLIENT_AUTHORITY`) supplies a static `EnvironmentFromCatalog(info)` and maps the row itself.
 
 ## Installation
 
@@ -176,6 +227,12 @@ try {
 | `AuthErrorType` | Enum | Semantic error categories |
 | `TokenRefreshResult` | Interface | Token refresh operation result |
 | `AuthState` | Interface | Complete authentication state snapshot |
+| `AuthProviderCatalog` | Class (static) | Pre-auth catalog fetch, provider resolution, and selection persistence |
+| `AuthProviderResolution` | Interface | Which provider this page load bootstrapped, the choices, and whether to show the picker |
+| `MJ_AUTH_PROVIDER_RESOLUTION` | InjectionToken | The resolution, for login surfaces |
+| `MJLoginPickerComponent` | Component | Reusable `<mj-login-picker>` multi-IdP picker |
+| `CatalogEnvironmentMapper` | Interface | Optional `EnvironmentFromCatalog` static for drivers with non-conventional keys |
+| `mergeCatalogEnvironment` | Function | Projects a catalog row onto a driver's environment keys |
 
 ## Build
 
@@ -185,4 +242,4 @@ cd packages/Angular/Explorer/auth-services && npm run build
 
 ## License
 
-ISC
+Business Source License 1.1 — see [LICENSE](../../../../LICENSE) for details.

package/dist/lib/auth-provider-catalog.d.ts

@@ -0,0 +1,103 @@
+/**
+ * @fileoverview Pre-authentication provider catalog.
+ *
+ * The browser needs to know which identity providers exist BEFORE anyone is signed in,
+ * so this module deliberately contains no Angular DI and no MJ data access — it runs
+ * before `bootstrapModule()`, using only `fetch` and web storage.
+ *
+ * @module @memberjunction/ng-auth-services
+ */
+import { type PublicAuthProviderInfo } from '@memberjunction/core';
+/**
+ * How the app should bootstrap authentication, derived from the catalog plus any prior
+ * user selection.
+ */
+export interface AuthProviderResolution {
+    /**
+     * The provider to wire into Angular DI for this page load. Null when the catalog is
+     * empty, in which case the caller falls back to `environment.AUTH_TYPE`.
+     */
+    active: PublicAuthProviderInfo | null;
+    /**
+     * Every provider the user may choose from. Empty or single-entry lists mean the picker
+     * should not render — one provider is not a choice.
+     */
+    choices: PublicAuthProviderInfo[];
+    /** True when the picker should be shown (2+ providers available). */
+    showPicker: boolean;
+    /**
+     * True when the previous page load persisted a selection and asked for the login flow to
+     * start immediately. The surface should consume this once and call `login()`.
+     */
+    autoLogin: boolean;
+}
+/**
+ * Fetches, caches, and resolves the public authentication-provider catalog.
+ *
+ * All members are static: this runs before the Angular injector exists.
+ */
+export declare class AuthProviderCatalog {
+    /**
+     * Catalog fetched during app startup, before the Angular module graph is evaluated.
+     *
+     * A holder is needed because `AuthServicesModule.forRoot(...)` runs at module-DEFINITION time
+     * — while the `@NgModule` decorator's `imports` array is being built — which is far too early
+     * to await anything. The app fetches the catalog first (see {@link Preload}) and the module
+     * reads the result synchronously.
+     */
+    private static _preloaded;
+    /**
+     * Fetches the catalog and stores it for {@link GetPreloaded}. Call this from the app's
+     * bootstrap entry point BEFORE the root module is imported.
+     */
+    static Preload(graphqlUri: string, timeoutMs?: number): Promise<PublicAuthProviderInfo[]>;
+    /** The catalog stored by {@link Preload}; empty when preloading never ran or found nothing. */
+    static GetPreloaded(): PublicAuthProviderInfo[];
+    /**
+     * Builds the catalog URL from the app's GraphQL endpoint. The catalog is served by the
+     * same MJServer instance, mounted ahead of the auth middleware.
+     */
+    static BuildCatalogUrl(graphqlUri: string): string;
+    /**
+     * Fetches the public provider catalog.
+     *
+     * Never throws and never rejects: a deployment whose server predates this endpoint, or
+     * whose network is briefly unavailable, must still reach its login screen through the
+     * compiled `AUTH_TYPE` path. Failure is reported as an empty list.
+     */
+    static Fetch(graphqlUri: string, timeoutMs?: number): Promise<PublicAuthProviderInfo[]>;
+    /**
+     * Decides which provider this page load should bootstrap with.
+     *
+     * Precedence: the user's persisted choice, then the row flagged `IsDefault`, then the
+     * first by sequence. A persisted choice that no longer exists in the catalog (the admin
+     * disabled it) is discarded rather than honoured, so a removed provider cannot strand a
+     * returning user on a login screen that can never succeed.
+     */
+    static Resolve(catalog: PublicAuthProviderInfo[]): AuthProviderResolution;
+    /**
+     * Records the user's picker choice and reports whether the page must reload to apply it.
+     *
+     * A reload is required whenever the chosen provider differs from the one already wired
+     * into DI: each browser SDK contributes Angular providers (interceptors, guards, config
+     * tokens) at module-definition time, so switching providers cannot be done in a live
+     * injector. Choosing the provider that is already active needs no reload — the caller
+     * simply calls `login()`.
+     */
+    static Select(provider: PublicAuthProviderInfo, activeProviderName: string | null): {
+        requiresReload: boolean;
+    };
+    /** The provider name persisted by a previous picker choice, if any. */
+    static GetSelectedProviderName(): string | null;
+    /** Forgets the persisted choice so the next load resolves the default again. */
+    static ClearSelection(): void;
+    /**
+     * Reads and clears the "start login immediately" flag. Clearing on read is what keeps a
+     * failed or cancelled login from re-triggering the redirect on every subsequent load.
+     */
+    private static consumePendingLogin;
+    private static readStorage;
+    private static writeStorage;
+    private static removeStorage;
+}
+//# sourceMappingURL=auth-provider-catalog.d.ts.map

package/dist/lib/auth-provider-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider-catalog.d.ts","sourceRoot":"","sources":["../../src/lib/auth-provider-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAuD,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAsBxH;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAEtC;;;OAGG;IACH,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAElC,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC;IAEpB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU,CAAgC;IAEzD;;;OAGG;WACiB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAKtG,+FAA+F;WACjF,YAAY,IAAI,sBAAsB,EAAE;IAItD;;;OAGG;WACW,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAIzD;;;;;;OAMG;WACiB,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,GAAE,MAAiC,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IA0B9H;;;;;;;OAOG;WACW,OAAO,CAAC,OAAO,EAAE,sBAAsB,EAAE,GAAG,sBAAsB;IAwBhF;;;;;;;;OAQG;WACW,MAAM,CAAC,QAAQ,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAAG;QAAE,cAAc,EAAE,OAAO,CAAA;KAAE;IAWtH,uEAAuE;WACzD,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAItD,gFAAgF;WAClE,cAAc,IAAI,IAAI;IAKpC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAYlC,OAAO,CAAC,MAAM,CAAC,WAAW;IAQ1B,OAAO,CAAC,MAAM,CAAC,YAAY;IAQ3B,OAAO,CAAC,MAAM,CAAC,aAAa;CAO7B"}

package/dist/lib/auth-provider-catalog.js

@@ -0,0 +1,186 @@
+/**
+ * @fileoverview Pre-authentication provider catalog.
+ *
+ * The browser needs to know which identity providers exist BEFORE anyone is signed in,
+ * so this module deliberately contains no Angular DI and no MJ data access — it runs
+ * before `bootstrapModule()`, using only `fetch` and web storage.
+ *
+ * @module @memberjunction/ng-auth-services
+ */
+import { LogError, LogStatus } from '@memberjunction/core';
+/**
+ * Storage key holding the provider the user last chose from the login picker.
+ *
+ * **Why web storage and not `UserInfoEngine`** (which is the rule for user preferences):
+ * this value is read and written while the user is ANONYMOUS. There is no `UserInfo`, no
+ * provider, and no API session to persist a preference into — resolving the provider is
+ * precisely what has to happen before any of those exist. This is the same documented
+ * exception the auth SDKs already rely on for their own session storage.
+ */
+const SELECTED_PROVIDER_KEY = 'mj_auth_selected_provider';
+/**
+ * Storage key set when a picker choice requires a page reload, so the reloaded app knows
+ * to go straight into the provider's login flow instead of showing the picker again.
+ */
+const PENDING_LOGIN_KEY = 'mj_auth_pending_login';
+/** How long to wait for the catalog before falling back to the compiled configuration. */
+const DEFAULT_FETCH_TIMEOUT_MS = 5000;
+/**
+ * Fetches, caches, and resolves the public authentication-provider catalog.
+ *
+ * All members are static: this runs before the Angular injector exists.
+ */
+export class AuthProviderCatalog {
+    /**
+     * Catalog fetched during app startup, before the Angular module graph is evaluated.
+     *
+     * A holder is needed because `AuthServicesModule.forRoot(...)` runs at module-DEFINITION time
+     * — while the `@NgModule` decorator's `imports` array is being built — which is far too early
+     * to await anything. The app fetches the catalog first (see {@link Preload}) and the module
+     * reads the result synchronously.
+     */
+    static _preloaded = [];
+    /**
+     * Fetches the catalog and stores it for {@link GetPreloaded}. Call this from the app's
+     * bootstrap entry point BEFORE the root module is imported.
+     */
+    static async Preload(graphqlUri, timeoutMs) {
+        this._preloaded = await this.Fetch(graphqlUri, timeoutMs);
+        return this._preloaded;
+    }
+    /** The catalog stored by {@link Preload}; empty when preloading never ran or found nothing. */
+    static GetPreloaded() {
+        return this._preloaded;
+    }
+    /**
+     * Builds the catalog URL from the app's GraphQL endpoint. The catalog is served by the
+     * same MJServer instance, mounted ahead of the auth middleware.
+     */
+    static BuildCatalogUrl(graphqlUri) {
+        return new URL('/auth/providers', graphqlUri).toString();
+    }
+    /**
+     * Fetches the public provider catalog.
+     *
+     * Never throws and never rejects: a deployment whose server predates this endpoint, or
+     * whose network is briefly unavailable, must still reach its login screen through the
+     * compiled `AUTH_TYPE` path. Failure is reported as an empty list.
+     */
+    static async Fetch(graphqlUri, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+        const url = this.BuildCatalogUrl(graphqlUri);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const response = await fetch(url, { method: 'GET', signal: controller.signal, credentials: 'omit' });
+            if (!response.ok) {
+                // A 404 is the expected, benign answer from a server older than this feature.
+                if (response.status !== 404) {
+                    LogError(`[Auth] Provider catalog request to ${url} failed with HTTP ${response.status}; falling back to configured AUTH_TYPE.`);
+                }
+                return [];
+            }
+            const body = (await response.json());
+            return Array.isArray(body?.providers) ? body.providers : [];
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            LogError(`[Auth] Could not load the provider catalog from ${url} (${message}); falling back to configured AUTH_TYPE.`);
+            return [];
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * Decides which provider this page load should bootstrap with.
+     *
+     * Precedence: the user's persisted choice, then the row flagged `IsDefault`, then the
+     * first by sequence. A persisted choice that no longer exists in the catalog (the admin
+     * disabled it) is discarded rather than honoured, so a removed provider cannot strand a
+     * returning user on a login screen that can never succeed.
+     */
+    static Resolve(catalog) {
+        const choices = [...catalog].sort((a, b) => a.sequence - b.sequence || a.displayName.localeCompare(b.displayName));
+        if (choices.length === 0) {
+            return { active: null, choices: [], showPicker: false, autoLogin: false };
+        }
+        const selectedName = this.GetSelectedProviderName();
+        const selected = selectedName ? choices.find((p) => p.name === selectedName) : undefined;
+        if (selectedName && !selected) {
+            LogStatus(`[Auth] Previously selected provider '${selectedName}' is no longer available; falling back to the default.`);
+            this.ClearSelection();
+        }
+        const active = selected ?? choices.find((p) => p.isDefault) ?? choices[0];
+        return {
+            active,
+            choices,
+            showPicker: choices.length > 1,
+            autoLogin: Boolean(selected) && this.consumePendingLogin()
+        };
+    }
+    /**
+     * Records the user's picker choice and reports whether the page must reload to apply it.
+     *
+     * A reload is required whenever the chosen provider differs from the one already wired
+     * into DI: each browser SDK contributes Angular providers (interceptors, guards, config
+     * tokens) at module-definition time, so switching providers cannot be done in a live
+     * injector. Choosing the provider that is already active needs no reload — the caller
+     * simply calls `login()`.
+     */
+    static Select(provider, activeProviderName) {
+        this.writeStorage(SELECTED_PROVIDER_KEY, provider.name);
+        if (activeProviderName && provider.name === activeProviderName) {
+            return { requiresReload: false };
+        }
+        this.writeStorage(PENDING_LOGIN_KEY, '1');
+        return { requiresReload: true };
+    }
+    /** The provider name persisted by a previous picker choice, if any. */
+    static GetSelectedProviderName() {
+        return this.readStorage(SELECTED_PROVIDER_KEY);
+    }
+    /** Forgets the persisted choice so the next load resolves the default again. */
+    static ClearSelection() {
+        this.removeStorage(SELECTED_PROVIDER_KEY);
+        this.removeStorage(PENDING_LOGIN_KEY);
+    }
+    /**
+     * Reads and clears the "start login immediately" flag. Clearing on read is what keeps a
+     * failed or cancelled login from re-triggering the redirect on every subsequent load.
+     */
+    static consumePendingLogin() {
+        const pending = this.readStorage(PENDING_LOGIN_KEY) === '1';
+        if (pending) {
+            this.removeStorage(PENDING_LOGIN_KEY);
+        }
+        return pending;
+    }
+    // ── Storage access ────────────────────────────────────────────────────────
+    // Wrapped because localStorage throws on access in some privacy modes and in
+    // sandboxed iframes. Auth must degrade to "ask every time", never crash.
+    static readStorage(key) {
+        try {
+            return window.localStorage.getItem(key);
+        }
+        catch {
+            return null;
+        }
+    }
+    static writeStorage(key, value) {
+        try {
+            window.localStorage.setItem(key, value);
+        }
+        catch {
+            /* Non-fatal: the choice simply won't survive this page load. */
+        }
+    }
+    static removeStorage(key) {
+        try {
+            window.localStorage.removeItem(key);
+        }
+        catch {
+            /* Non-fatal. */
+        }
+    }
+}
+//# sourceMappingURL=auth-provider-catalog.js.map

package/dist/lib/auth-provider-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider-catalog.js","sourceRoot":"","sources":["../../src/lib/auth-provider-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAA+D,MAAM,sBAAsB,CAAC;AAExH;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D;;;GAGG;AACH,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAElD,0FAA0F;AAC1F,MAAM,wBAAwB,GAAG,IAAI,CAAC;AA6BtC;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;;;;;;OAOG;IACK,MAAM,CAAC,UAAU,GAA6B,EAAE,CAAC;IAEzD;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,SAAkB;QAChE,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,+FAA+F;IACxF,MAAM,CAAC,YAAY;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,eAAe,CAAC,UAAkB;QAC9C,OAAO,IAAI,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3D,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,YAAoB,wBAAwB;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;YACrG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,8EAA8E;gBAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,QAAQ,CAAC,sCAAsC,GAAG,qBAAqB,QAAQ,CAAC,MAAM,yCAAyC,CAAC,CAAC;gBACnI,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;YAClE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CAAC,mDAAmD,GAAG,KAAK,OAAO,0CAA0C,CAAC,CAAC;YACvH,OAAO,EAAE,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,OAAO,CAAC,OAAiC;QACrD,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAEnH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5E,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,IAAI,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,SAAS,CAAC,wCAAwC,YAAY,wDAAwD,CAAC,CAAC;YACxH,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QAE1E,OAAO;YACL,MAAM;YACN,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,mBAAmB,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,MAAM,CAAC,QAAgC,EAAE,kBAAiC;QACtF,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAExD,IAAI,kBAAkB,IAAI,QAAQ,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC/D,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC1C,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,uEAAuE;IAChE,MAAM,CAAC,uBAAuB;QACnC,OAAO,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACjD,CAAC;IAED,gFAAgF;IACzE,MAAM,CAAC,cAAc;QAC1B,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;QAC1C,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,mBAAmB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,KAAK,GAAG,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IAEjE,MAAM,CAAC,WAAW,CAAC,GAAW;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,GAAW,EAAE,KAAa;QACpD,IAAI,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,aAAa,CAAC,GAAW;QACtC,IAAI,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC","sourcesContent":["/**\n * @fileoverview Pre-authentication provider catalog.\n *\n * The browser needs to know which identity providers exist BEFORE anyone is signed in,\n * so this module deliberately contains no Angular DI and no MJ data access — it runs\n * before `bootstrapModule()`, using only `fetch` and web storage.\n *\n * @module @memberjunction/ng-auth-services\n */\n\nimport { LogError, LogStatus, type PublicAuthProviderCatalog, type PublicAuthProviderInfo } from '@memberjunction/core';\n\n/**\n * Storage key holding the provider the user last chose from the login picker.\n *\n * **Why web storage and not `UserInfoEngine`** (which is the rule for user preferences):\n * this value is read and written while the user is ANONYMOUS. There is no `UserInfo`, no\n * provider, and no API session to persist a preference into — resolving the provider is\n * precisely what has to happen before any of those exist. This is the same documented\n * exception the auth SDKs already rely on for their own session storage.\n */\nconst SELECTED_PROVIDER_KEY = 'mj_auth_selected_provider';\n\n/**\n * Storage key set when a picker choice requires a page reload, so the reloaded app knows\n * to go straight into the provider's login flow instead of showing the picker again.\n */\nconst PENDING_LOGIN_KEY = 'mj_auth_pending_login';\n\n/** How long to wait for the catalog before falling back to the compiled configuration. */\nconst DEFAULT_FETCH_TIMEOUT_MS = 5000;\n\n/**\n * How the app should bootstrap authentication, derived from the catalog plus any prior\n * user selection.\n */\nexport interface AuthProviderResolution {\n  /**\n   * The provider to wire into Angular DI for this page load. Null when the catalog is\n   * empty, in which case the caller falls back to `environment.AUTH_TYPE`.\n   */\n  active: PublicAuthProviderInfo | null;\n\n  /**\n   * Every provider the user may choose from. Empty or single-entry lists mean the picker\n   * should not render — one provider is not a choice.\n   */\n  choices: PublicAuthProviderInfo[];\n\n  /** True when the picker should be shown (2+ providers available). */\n  showPicker: boolean;\n\n  /**\n   * True when the previous page load persisted a selection and asked for the login flow to\n   * start immediately. The surface should consume this once and call `login()`.\n   */\n  autoLogin: boolean;\n}\n\n/**\n * Fetches, caches, and resolves the public authentication-provider catalog.\n *\n * All members are static: this runs before the Angular injector exists.\n */\nexport class AuthProviderCatalog {\n  /**\n   * Catalog fetched during app startup, before the Angular module graph is evaluated.\n   *\n   * A holder is needed because `AuthServicesModule.forRoot(...)` runs at module-DEFINITION time\n   * — while the `@NgModule` decorator's `imports` array is being built — which is far too early\n   * to await anything. The app fetches the catalog first (see {@link Preload}) and the module\n   * reads the result synchronously.\n   */\n  private static _preloaded: PublicAuthProviderInfo[] = [];\n\n  /**\n   * Fetches the catalog and stores it for {@link GetPreloaded}. Call this from the app's\n   * bootstrap entry point BEFORE the root module is imported.\n   */\n  public static async Preload(graphqlUri: string, timeoutMs?: number): Promise<PublicAuthProviderInfo[]> {\n    this._preloaded = await this.Fetch(graphqlUri, timeoutMs);\n    return this._preloaded;\n  }\n\n  /** The catalog stored by {@link Preload}; empty when preloading never ran or found nothing. */\n  public static GetPreloaded(): PublicAuthProviderInfo[] {\n    return this._preloaded;\n  }\n\n  /**\n   * Builds the catalog URL from the app's GraphQL endpoint. The catalog is served by the\n   * same MJServer instance, mounted ahead of the auth middleware.\n   */\n  public static BuildCatalogUrl(graphqlUri: string): string {\n    return new URL('/auth/providers', graphqlUri).toString();\n  }\n\n  /**\n   * Fetches the public provider catalog.\n   *\n   * Never throws and never rejects: a deployment whose server predates this endpoint, or\n   * whose network is briefly unavailable, must still reach its login screen through the\n   * compiled `AUTH_TYPE` path. Failure is reported as an empty list.\n   */\n  public static async Fetch(graphqlUri: string, timeoutMs: number = DEFAULT_FETCH_TIMEOUT_MS): Promise<PublicAuthProviderInfo[]> {\n    const url = this.BuildCatalogUrl(graphqlUri);\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n\n    try {\n      const response = await fetch(url, { method: 'GET', signal: controller.signal, credentials: 'omit' });\n      if (!response.ok) {\n        // A 404 is the expected, benign answer from a server older than this feature.\n        if (response.status !== 404) {\n          LogError(`[Auth] Provider catalog request to ${url} failed with HTTP ${response.status}; falling back to configured AUTH_TYPE.`);\n        }\n        return [];\n      }\n\n      const body = (await response.json()) as PublicAuthProviderCatalog;\n      return Array.isArray(body?.providers) ? body.providers : [];\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      LogError(`[Auth] Could not load the provider catalog from ${url} (${message}); falling back to configured AUTH_TYPE.`);\n      return [];\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  /**\n   * Decides which provider this page load should bootstrap with.\n   *\n   * Precedence: the user's persisted choice, then the row flagged `IsDefault`, then the\n   * first by sequence. A persisted choice that no longer exists in the catalog (the admin\n   * disabled it) is discarded rather than honoured, so a removed provider cannot strand a\n   * returning user on a login screen that can never succeed.\n   */\n  public static Resolve(catalog: PublicAuthProviderInfo[]): AuthProviderResolution {\n    const choices = [...catalog].sort((a, b) => a.sequence - b.sequence || a.displayName.localeCompare(b.displayName));\n\n    if (choices.length === 0) {\n      return { active: null, choices: [], showPicker: false, autoLogin: false };\n    }\n\n    const selectedName = this.GetSelectedProviderName();\n    const selected = selectedName ? choices.find((p) => p.name === selectedName) : undefined;\n    if (selectedName && !selected) {\n      LogStatus(`[Auth] Previously selected provider '${selectedName}' is no longer available; falling back to the default.`);\n      this.ClearSelection();\n    }\n\n    const active = selected ?? choices.find((p) => p.isDefault) ?? choices[0];\n\n    return {\n      active,\n      choices,\n      showPicker: choices.length > 1,\n      autoLogin: Boolean(selected) && this.consumePendingLogin()\n    };\n  }\n\n  /**\n   * Records the user's picker choice and reports whether the page must reload to apply it.\n   *\n   * A reload is required whenever the chosen provider differs from the one already wired\n   * into DI: each browser SDK contributes Angular providers (interceptors, guards, config\n   * tokens) at module-definition time, so switching providers cannot be done in a live\n   * injector. Choosing the provider that is already active needs no reload — the caller\n   * simply calls `login()`.\n   */\n  public static Select(provider: PublicAuthProviderInfo, activeProviderName: string | null): { requiresReload: boolean } {\n    this.writeStorage(SELECTED_PROVIDER_KEY, provider.name);\n\n    if (activeProviderName && provider.name === activeProviderName) {\n      return { requiresReload: false };\n    }\n\n    this.writeStorage(PENDING_LOGIN_KEY, '1');\n    return { requiresReload: true };\n  }\n\n  /** The provider name persisted by a previous picker choice, if any. */\n  public static GetSelectedProviderName(): string | null {\n    return this.readStorage(SELECTED_PROVIDER_KEY);\n  }\n\n  /** Forgets the persisted choice so the next load resolves the default again. */\n  public static ClearSelection(): void {\n    this.removeStorage(SELECTED_PROVIDER_KEY);\n    this.removeStorage(PENDING_LOGIN_KEY);\n  }\n\n  /**\n   * Reads and clears the \"start login immediately\" flag. Clearing on read is what keeps a\n   * failed or cancelled login from re-triggering the redirect on every subsequent load.\n   */\n  private static consumePendingLogin(): boolean {\n    const pending = this.readStorage(PENDING_LOGIN_KEY) === '1';\n    if (pending) {\n      this.removeStorage(PENDING_LOGIN_KEY);\n    }\n    return pending;\n  }\n\n  // ── Storage access ────────────────────────────────────────────────────────\n  // Wrapped because localStorage throws on access in some privacy modes and in\n  // sandboxed iframes. Auth must degrade to \"ask every time\", never crash.\n\n  private static readStorage(key: string): string | null {\n    try {\n      return window.localStorage.getItem(key);\n    } catch {\n      return null;\n    }\n  }\n\n  private static writeStorage(key: string, value: string): void {\n    try {\n      window.localStorage.setItem(key, value);\n    } catch {\n      /* Non-fatal: the choice simply won't survive this page load. */\n    }\n  }\n\n  private static removeStorage(key: string): void {\n    try {\n      window.localStorage.removeItem(key);\n    } catch {\n      /* Non-fatal. */\n    }\n  }\n}\n"]}

package/dist/lib/auth-services.module.d.ts

@@ -1,17 +1,47 @@
-import { ModuleWithProviders } from '@angular/core';
+import { ModuleWithProviders, InjectionToken } from '@angular/core';
+import type { PublicAuthProviderInfo } from '@memberjunction/core';
+import { type AuthProviderResolution } from './auth-provider-catalog';
 import { RedirectComponent } from './redirect.component';
 import * as i0 from "@angular/core";
 import * as i1 from "./redirect.component";
 import * as i2 from "@angular/common";
+import * as i3 from "./login-picker.component";
 export { RedirectComponent };
+/**
+ * Injection token carrying how authentication resolved for this page load.
+ *
+ * A login surface injects this to decide whether to render the multi-provider picker or the
+ * single sign-in button, and whether to start the login flow immediately after a picker
+ * choice caused a reload.
+ */
+export declare const MJ_AUTH_PROVIDER_RESOLUTION: InjectionToken<AuthProviderResolution>;
 /**
  * Extensible authentication module that supports N providers
  * Uses MJGlobal ClassFactory pattern for dynamic provider creation
  */
 export declare class AuthServicesModule {
-    static forRoot(environment: any): ModuleWithProviders<AuthServicesModule>;
+    /**
+     * Wires the authentication provider into DI.
+     *
+     * @param environment The app's compiled environment. Typed loosely on purpose: every app
+     *        declares its own environment shape (`MJEnvironmentConfig` and downstream equivalents
+     *        are interfaces, which TypeScript will not assign to an indexed record), so narrowing
+     *        this parameter would break every existing caller. It is narrowed once, below.
+     * @param catalog Optional pre-auth provider catalog. Defaults to whatever the app preloaded
+     *        via {@link AuthProviderCatalog.Preload} in its bootstrap entry point — passing it
+     *        explicitly is for tests and for apps that source the catalog some other way. Callers
+     *        must NOT pass `AuthProviderCatalog.GetPreloaded()` themselves: Angular's compiler
+     *        requires every `imports` entry to be statically analyzable, and a function call in
+     *        the argument list fails AOT with "Value could not be determined statically".
+     *
+     *        When the catalog is empty — an older server, a failed fetch, or a deployment that
+     *        never adopted the entity — resolution falls back to `environment.AUTH_TYPE` and
+     *        behaviour is byte-for-byte what it was before the catalog existed, which is what
+     *        keeps every existing deployment working untouched.
+     */
+    static forRoot(environment: any, catalog?: PublicAuthProviderInfo[]): ModuleWithProviders<AuthServicesModule>;
     static ɵfac: i0.ɵɵFactoryDeclaration<AuthServicesModule, never>;
-    static ɵmod: i0.ɵɵNgModuleDeclaration<AuthServicesModule, [typeof i1.RedirectComponent], [typeof i2.CommonModule], [typeof i1.RedirectComponent]>;
+    static ɵmod: i0.ɵɵNgModuleDeclaration<AuthServicesModule, [typeof i1.RedirectComponent], [typeof i2.CommonModule, typeof i3.MJLoginPickerComponent], [typeof i1.RedirectComponent, typeof i3.MJLoginPickerComponent]>;
     static ɵinj: i0.ɵɵInjectorDeclaration<AuthServicesModule>;
 }
 //# sourceMappingURL=auth-services.module.d.ts.map

package/dist/lib/auth-services.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-services.module.d.ts","sourceRoot":"","sources":["../../src/lib/auth-services.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAQ9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;;;;AAGzD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;GAGG;AACH,qBAKa,kBAAkB;IAC7B,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,GAAG,mBAAmB,CAAC,kBAAkB,CAAC;yCAD9D,kBAAkB;0CAAlB,kBAAkB;0CAAlB,kBAAkB;CAyD9B"}
+{"version":3,"file":"auth-services.module.d.ts","sourceRoot":"","sources":["../../src/lib/auth-services.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,mBAAmB,EAAE,cAAc,EAAY,MAAM,eAAe,CAAC;AAMxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAuB,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAK3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;;;;;AAGzD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,wCAA4E,CAAC;AAKrH;;;GAGG;AACH,qBAKa,kBAAkB;IAC7B;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,sBAAsB,EAAE,GAAG,mBAAmB,CAAC,kBAAkB,CAAC;yCApBlG,kBAAkB;0CAAlB,kBAAkB;0CAAlB,kBAAkB;CA6F9B"}