@memberjunction/ng-auth-services 6.1.0-edge.1 → 6.1.0-edge.3

package/dist/lib/auth-services.module.js

@@ -1,47 +1,93 @@
-import { NgModule } from '@angular/core';
+import { NgModule, InjectionToken } from '@angular/core';
 import { CommonModule } from '@angular/common';
 import { MJAuthBase } from './mjexplorer-auth-base.service';
 import { AngularAuthProviderFactory } from './AngularAuthProviderFactory';
 import { MJMagicLinkProvider } from './providers/mjexplorer-magic-link-provider.service';
 import { MJGlobal } from '@memberjunction/global';
+import { AuthProviderCatalog } from './auth-provider-catalog';
+import { mergeCatalogEnvironment } from './catalog-environment';
+import { MJLoginPickerComponent } from './login-picker.component';
 // Import our generic redirect component
 import { RedirectComponent } from './redirect.component';
 import * as i0 from "@angular/core";
 // Export the generic redirect component for backward compatibility
 export { RedirectComponent };
+/**
+ * Injection token carrying how authentication resolved for this page load.
+ *
+ * A login surface injects this to decide whether to render the multi-provider picker or the
+ * single sign-in button, and whether to start the login flow immediately after a picker
+ * choice caused a reload.
+ */
+export const MJ_AUTH_PROVIDER_RESOLUTION = new InjectionToken('MJ_AUTH_PROVIDER_RESOLUTION');
+/** The resolution used when no catalog is supplied — i.e. the pre-existing single-provider path. */
+const NO_CATALOG_RESOLUTION = { active: null, choices: [], showPicker: false, autoLogin: false };
 /**
  * Extensible authentication module that supports N providers
  * Uses MJGlobal ClassFactory pattern for dynamic provider creation
  */
 export class AuthServicesModule {
-    static forRoot(environment) {
+    /**
+     * Wires the authentication provider into DI.
+     *
+     * @param environment The app's compiled environment. Typed loosely on purpose: every app
+     *        declares its own environment shape (`MJEnvironmentConfig` and downstream equivalents
+     *        are interfaces, which TypeScript will not assign to an indexed record), so narrowing
+     *        this parameter would break every existing caller. It is narrowed once, below.
+     * @param catalog Optional pre-auth provider catalog. Defaults to whatever the app preloaded
+     *        via {@link AuthProviderCatalog.Preload} in its bootstrap entry point — passing it
+     *        explicitly is for tests and for apps that source the catalog some other way. Callers
+     *        must NOT pass `AuthProviderCatalog.GetPreloaded()` themselves: Angular's compiler
+     *        requires every `imports` entry to be statically analyzable, and a function call in
+     *        the argument list fails AOT with "Value could not be determined statically".
+     *
+     *        When the catalog is empty — an older server, a failed fetch, or a deployment that
+     *        never adopted the entity — resolution falls back to `environment.AUTH_TYPE` and
+     *        behaviour is byte-for-byte what it was before the catalog existed, which is what
+     *        keeps every existing deployment working untouched.
+     */
+    static forRoot(environment, catalog) {
+        const env = environment;
         const providers = [];
-        const configuredType = environment.AUTH_TYPE?.toLowerCase();
+        const configuredType = env['AUTH_TYPE']?.toLowerCase();
+        const resolvedCatalog = catalog ?? AuthProviderCatalog.GetPreloaded();
         // Coexistence resolution: a single Explorer deployment can serve both SSO
         // users and magic-link guests. If a magic-link session token is present for
         // this page load (URL fragment from /redeem, or stored earlier this tab), use
         // the magic-link provider regardless of the configured primary IdP. Otherwise
-        // use the configured AUTH_TYPE. This auto-falls-back to the IdP once a guest's
-        // token is gone (expired/logged out), so the normal login button works again.
+        // use the catalog selection, then the configured AUTH_TYPE. This auto-falls-back
+        // to the IdP once a guest's token is gone (expired/logged out), so the normal
+        // login button works again.
         const magicLinkActive = MJMagicLinkProvider.hasSessionToken();
-        const authType = magicLinkActive ? MJMagicLinkProvider.PROVIDER_TYPE : configuredType;
+        // The catalog resolves which provider this load uses; it never overrides an active
+        // magic-link session, which is a property of THIS page load rather than a configured choice.
+        const resolution = resolvedCatalog.length ? AuthProviderCatalog.Resolve(resolvedCatalog) : NO_CATALOG_RESOLUTION;
+        providers.push({ provide: MJ_AUTH_PROVIDER_RESOLUTION, useValue: resolution });
+        const catalogType = resolution.active?.driverClass?.toLowerCase();
+        const authType = magicLinkActive ? MJMagicLinkProvider.PROVIDER_TYPE : (catalogType ?? configuredType);
         if (!authType) {
-            console.error('No AUTH_TYPE specified in environment');
+            console.error('No authentication provider available: the server published no catalog and no AUTH_TYPE is set in the environment');
             return {
                 ngModule: AuthServicesModule,
-                providers: []
+                providers: providers
             };
         }
-        if (magicLinkActive && authType !== configuredType) {
-            console.log(`[Auth] Magic-link session token detected — using the magic-link provider for this load (configured primary: '${configuredType ?? 'none'}').`);
+        if (magicLinkActive && authType !== (catalogType ?? configuredType)) {
+            console.log(`[Auth] Magic-link session token detected — using the magic-link provider for this load (configured primary: '${catalogType ?? configuredType ?? 'none'}').`);
         }
-        // Use the factory to get provider-specific Angular services
-        // This uses the static method on each provider class for extensibility
-        const angularServices = AngularAuthProviderFactory.getProviderAngularServices(authType, environment);
-        providers.push(...angularServices);
         // Get the provider class from ClassFactory for extensibility
         const registration = MJGlobal.Instance.ClassFactory.GetRegistration(MJAuthBase, authType);
         const providerClass = registration?.SubClass;
+        // A catalog-selected provider takes its settings from metadata rather than from the compiled
+        // environment, so the driver receives the row's values overlaid on the app's environment.
+        // Magic-link is excluded: its session is established by the redeem flow, not by catalog config.
+        const effectiveEnvironment = resolution.active && !magicLinkActive
+            ? mergeCatalogEnvironment(environment, resolution.active, providerClass)
+            : environment;
+        // Use the factory to get provider-specific Angular services
+        // This uses the static method on each provider class for extensibility
+        const angularServices = AngularAuthProviderFactory.getProviderAngularServices(authType, effectiveEnvironment);
+        providers.push(...angularServices);
         if (providerClass) {
             // Add the provider itself
             providers.push({
@@ -56,7 +102,7 @@ export class AuthServicesModule {
         providers.push(AngularAuthProviderFactory);
         return {
             ngModule: AuthServicesModule,
-            providers
+            providers: providers
         };
     }
     static ɵfac = function AuthServicesModule_Factory(__ngFactoryType__) { return new (__ngFactoryType__ || AuthServicesModule)(); };
@@ -66,10 +112,10 @@ export class AuthServicesModule {
 (() => { (typeof ngDevMode === "undefined" || ngDevMode) && i0.ɵsetClassMetadata(AuthServicesModule, [{
         type: NgModule,
         args: [{
-                imports: [CommonModule],
+                imports: [CommonModule, MJLoginPickerComponent],
                 declarations: [RedirectComponent],
-                exports: [RedirectComponent]
+                exports: [RedirectComponent, MJLoginPickerComponent]
             }]
     }], null, null); })();
-(function () { (typeof ngJitMode === "undefined" || ngJitMode) && i0.ɵɵsetNgModuleScope(AuthServicesModule, { declarations: [RedirectComponent], imports: [CommonModule], exports: [RedirectComponent] }); })();
+(function () { (typeof ngJitMode === "undefined" || ngJitMode) && i0.ɵɵsetNgModuleScope(AuthServicesModule, { declarations: [RedirectComponent], imports: [CommonModule, MJLoginPickerComponent], exports: [RedirectComponent, MJLoginPickerComponent] }); })();
 //# sourceMappingURL=auth-services.module.js.map

package/dist/lib/auth-services.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-services.module.js","sourceRoot":"","sources":["../../src/lib/auth-services.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAuB,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,wCAAwC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;;AAEzD,mEAAmE;AACnE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;GAGG;AAMH,MAAM,OAAO,kBAAkB;IAC7B,MAAM,CAAC,OAAO,CAAC,WAAgB;QAE7B,MAAM,SAAS,GAAU,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;QAE5D,0EAA0E;QAC1E,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,8EAA8E;QAC9E,MAAM,eAAe,GAAG,mBAAmB,CAAC,eAAe,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;QAEtF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,SAAS,EAAE,EAAE;aACd,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,gHAAgH,cAAc,IAAI,MAAM,KAAK,CAAC,CAAC;QAC7J,CAAC;QAED,4DAA4D;QAC5D,uEAAuE;QACvE,MAAM,eAAe,GAAG,0BAA0B,CAAC,0BAA0B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACrG,SAAS,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAEnC,6DAA6D;QAC7D,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,CACjE,UAAU,EACV,QAAQ,CACT,CAAC;QACF,MAAM,aAAa,GAAG,YAAY,EAAE,QAAQ,CAAC;QAE7C,IAAI,aAAa,EAAE,CAAC;YAClB,0BAA0B;YAC1B,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,aAAa;aACxB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,yBAAyB;QACzB,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAE3C,OAAO;YACL,QAAQ,EAAE,kBAAkB;YAC5B,SAAS;SACV,CAAC;IACJ,CAAC;4GAxDU,kBAAkB;4DAAlB,kBAAkB;gEAJnB,YAAY;;iFAIX,kBAAkB;cAL9B,QAAQ;eAAC;gBACR,OAAO,EAAE,CAAC,YAAY,CAAC;gBACvB,YAAY,EAAE,CAAC,iBAAiB,CAAC;gBACjC,OAAO,EAAE,CAAC,iBAAiB,CAAC;aAC7B;;wFACY,kBAAkB,mBAHd,iBAAiB,aADtB,YAAY,aAEZ,iBAAiB","sourcesContent":["import { NgModule, ModuleWithProviders } from '@angular/core';\nimport { CommonModule } from '@angular/common';\nimport { MJAuthBase } from './mjexplorer-auth-base.service';\nimport { AngularAuthProviderFactory } from './AngularAuthProviderFactory';\nimport { MJMagicLinkProvider } from './providers/mjexplorer-magic-link-provider.service';\nimport { MJGlobal } from '@memberjunction/global';\n\n// Import our generic redirect component\nimport { RedirectComponent } from './redirect.component';\n\n// Export the generic redirect component for backward compatibility\nexport { RedirectComponent };\n\n/**\n * Extensible authentication module that supports N providers\n * Uses MJGlobal ClassFactory pattern for dynamic provider creation\n */\n@NgModule({\n  imports: [CommonModule],\n  declarations: [RedirectComponent],\n  exports: [RedirectComponent]\n})\nexport class AuthServicesModule {\n  static forRoot(environment: any): ModuleWithProviders<AuthServicesModule> {\n\n    const providers: any[] = [];\n    const configuredType = environment.AUTH_TYPE?.toLowerCase();\n\n    // Coexistence resolution: a single Explorer deployment can serve both SSO\n    // users and magic-link guests. If a magic-link session token is present for\n    // this page load (URL fragment from /redeem, or stored earlier this tab), use\n    // the magic-link provider regardless of the configured primary IdP. Otherwise\n    // use the configured AUTH_TYPE. This auto-falls-back to the IdP once a guest's\n    // token is gone (expired/logged out), so the normal login button works again.\n    const magicLinkActive = MJMagicLinkProvider.hasSessionToken();\n    const authType = magicLinkActive ? MJMagicLinkProvider.PROVIDER_TYPE : configuredType;\n\n    if (!authType) {\n      console.error('No AUTH_TYPE specified in environment');\n      return {\n        ngModule: AuthServicesModule,\n        providers: []\n      };\n    }\n\n    if (magicLinkActive && authType !== configuredType) {\n      console.log(`[Auth] Magic-link session token detected — using the magic-link provider for this load (configured primary: '${configuredType ?? 'none'}').`);\n    }\n\n    // Use the factory to get provider-specific Angular services\n    // This uses the static method on each provider class for extensibility\n    const angularServices = AngularAuthProviderFactory.getProviderAngularServices(authType, environment);\n    providers.push(...angularServices);\n\n    // Get the provider class from ClassFactory for extensibility\n    const registration = MJGlobal.Instance.ClassFactory.GetRegistration(\n      MJAuthBase,\n      authType\n    );\n    const providerClass = registration?.SubClass;\n\n    if (providerClass) {\n      // Add the provider itself\n      providers.push({\n        provide: MJAuthBase,\n        useClass: providerClass\n      });\n    } else {\n      console.error(`No provider class registered for auth type: ${authType}`);\n    }\n\n    // Add the factory itself\n    providers.push(AngularAuthProviderFactory);\n\n    return {\n      ngModule: AuthServicesModule,\n      providers\n    };\n  }\n}\n"]}
+{"version":3,"file":"auth-services.module.js","sourceRoot":"","sources":["../../src/lib/auth-services.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAuB,cAAc,EAAY,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAA+B,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAiC,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,wCAAwC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;;AAEzD,mEAAmE;AACnE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,cAAc,CAAyB,6BAA6B,CAAC,CAAC;AAErH,oGAAoG;AACpG,MAAM,qBAAqB,GAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAEzH;;;GAGG;AAMH,MAAM,OAAO,kBAAkB;IAC7B;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,OAAO,CAAC,WAAgB,EAAE,OAAkC;QACjE,MAAM,GAAG,GAAG,WAAsC,CAAC;QACnD,MAAM,SAAS,GAAe,EAAE,CAAC;QACjC,MAAM,cAAc,GAAI,GAAG,CAAC,WAAW,CAAwB,EAAE,WAAW,EAAE,CAAC;QAC/E,MAAM,eAAe,GAAG,OAAO,IAAI,mBAAmB,CAAC,YAAY,EAAE,CAAC;QAEtE,0EAA0E;QAC1E,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,iFAAiF;QACjF,8EAA8E;QAC9E,4BAA4B;QAC5B,MAAM,eAAe,GAAG,mBAAmB,CAAC,eAAe,EAAE,CAAC;QAE9D,mFAAmF;QACnF,6FAA6F;QAC7F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACjH,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAE/E,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;QAEvG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,kHAAkH,CAAC,CAAC;YAClI,OAAO;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,SAAS,EAAE,SAAoB;aAChC,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,IAAI,QAAQ,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,gHAAgH,WAAW,IAAI,cAAc,IAAI,MAAM,KAAK,CAAC,CAAC;QAC5K,CAAC;QAED,6DAA6D;QAC7D,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,CACjE,UAAU,EACV,QAAQ,CACT,CAAC;QACF,MAAM,aAAa,GAAG,YAAY,EAAE,QAAQ,CAAC;QAE7C,6FAA6F;QAC7F,0FAA0F;QAC1F,gGAAgG;QAChG,MAAM,oBAAoB,GACxB,UAAU,CAAC,MAAM,IAAI,CAAC,eAAe;YACnC,CAAC,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,aAAqD,CAAC;YAChH,CAAC,CAAC,WAAW,CAAC;QAElB,4DAA4D;QAC5D,uEAAuE;QACvE,MAAM,eAAe,GAAG,0BAA0B,CAAC,0BAA0B,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QAC9G,SAAS,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAEnC,IAAI,aAAa,EAAE,CAAC;YAClB,0BAA0B;YAC1B,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,aAAa;aACxB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,yBAAyB;QACzB,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAE3C,OAAO;YACL,QAAQ,EAAE,kBAAkB;YAC5B,SAAS,EAAE,SAAoB;SAChC,CAAC;IACJ,CAAC;4GA5FU,kBAAkB;4DAAlB,kBAAkB;gEAJnB,YAAY;;iFAIX,kBAAkB;cAL9B,QAAQ;eAAC;gBACR,OAAO,EAAE,CAAC,YAAY,EAAE,sBAAsB,CAAC;gBAC/C,YAAY,EAAE,CAAC,iBAAiB,CAAC;gBACjC,OAAO,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;aACrD;;wFACY,kBAAkB,mBAHd,iBAAiB,aADtB,YAAY,EAAE,sBAAsB,aAEpC,iBAAiB,EAAE,sBAAsB","sourcesContent":["import { NgModule, ModuleWithProviders, InjectionToken, Provider } from '@angular/core';\nimport { CommonModule } from '@angular/common';\nimport { MJAuthBase } from './mjexplorer-auth-base.service';\nimport { AngularAuthProviderFactory } from './AngularAuthProviderFactory';\nimport { MJMagicLinkProvider } from './providers/mjexplorer-magic-link-provider.service';\nimport { MJGlobal } from '@memberjunction/global';\nimport type { PublicAuthProviderInfo } from '@memberjunction/core';\nimport { AuthProviderCatalog, type AuthProviderResolution } from './auth-provider-catalog';\nimport { mergeCatalogEnvironment, type CatalogEnvironmentMapper } from './catalog-environment';\nimport { MJLoginPickerComponent } from './login-picker.component';\n\n// Import our generic redirect component\nimport { RedirectComponent } from './redirect.component';\n\n// Export the generic redirect component for backward compatibility\nexport { RedirectComponent };\n\n/**\n * Injection token carrying how authentication resolved for this page load.\n *\n * A login surface injects this to decide whether to render the multi-provider picker or the\n * single sign-in button, and whether to start the login flow immediately after a picker\n * choice caused a reload.\n */\nexport const MJ_AUTH_PROVIDER_RESOLUTION = new InjectionToken<AuthProviderResolution>('MJ_AUTH_PROVIDER_RESOLUTION');\n\n/** The resolution used when no catalog is supplied — i.e. the pre-existing single-provider path. */\nconst NO_CATALOG_RESOLUTION: AuthProviderResolution = { active: null, choices: [], showPicker: false, autoLogin: false };\n\n/**\n * Extensible authentication module that supports N providers\n * Uses MJGlobal ClassFactory pattern for dynamic provider creation\n */\n@NgModule({\n  imports: [CommonModule, MJLoginPickerComponent],\n  declarations: [RedirectComponent],\n  exports: [RedirectComponent, MJLoginPickerComponent]\n})\nexport class AuthServicesModule {\n  /**\n   * Wires the authentication provider into DI.\n   *\n   * @param environment The app's compiled environment. Typed loosely on purpose: every app\n   *        declares its own environment shape (`MJEnvironmentConfig` and downstream equivalents\n   *        are interfaces, which TypeScript will not assign to an indexed record), so narrowing\n   *        this parameter would break every existing caller. It is narrowed once, below.\n   * @param catalog Optional pre-auth provider catalog. Defaults to whatever the app preloaded\n   *        via {@link AuthProviderCatalog.Preload} in its bootstrap entry point — passing it\n   *        explicitly is for tests and for apps that source the catalog some other way. Callers\n   *        must NOT pass `AuthProviderCatalog.GetPreloaded()` themselves: Angular's compiler\n   *        requires every `imports` entry to be statically analyzable, and a function call in\n   *        the argument list fails AOT with \"Value could not be determined statically\".\n   *\n   *        When the catalog is empty — an older server, a failed fetch, or a deployment that\n   *        never adopted the entity — resolution falls back to `environment.AUTH_TYPE` and\n   *        behaviour is byte-for-byte what it was before the catalog existed, which is what\n   *        keeps every existing deployment working untouched.\n   */\n  static forRoot(environment: any, catalog?: PublicAuthProviderInfo[]): ModuleWithProviders<AuthServicesModule> {\n    const env = environment as Record<string, unknown>;\n    const providers: Provider[] = [];\n    const configuredType = (env['AUTH_TYPE'] as string | undefined)?.toLowerCase();\n    const resolvedCatalog = catalog ?? AuthProviderCatalog.GetPreloaded();\n\n    // Coexistence resolution: a single Explorer deployment can serve both SSO\n    // users and magic-link guests. If a magic-link session token is present for\n    // this page load (URL fragment from /redeem, or stored earlier this tab), use\n    // the magic-link provider regardless of the configured primary IdP. Otherwise\n    // use the catalog selection, then the configured AUTH_TYPE. This auto-falls-back\n    // to the IdP once a guest's token is gone (expired/logged out), so the normal\n    // login button works again.\n    const magicLinkActive = MJMagicLinkProvider.hasSessionToken();\n\n    // The catalog resolves which provider this load uses; it never overrides an active\n    // magic-link session, which is a property of THIS page load rather than a configured choice.\n    const resolution = resolvedCatalog.length ? AuthProviderCatalog.Resolve(resolvedCatalog) : NO_CATALOG_RESOLUTION;\n    providers.push({ provide: MJ_AUTH_PROVIDER_RESOLUTION, useValue: resolution });\n\n    const catalogType = resolution.active?.driverClass?.toLowerCase();\n    const authType = magicLinkActive ? MJMagicLinkProvider.PROVIDER_TYPE : (catalogType ?? configuredType);\n\n    if (!authType) {\n      console.error('No authentication provider available: the server published no catalog and no AUTH_TYPE is set in the environment');\n      return {\n        ngModule: AuthServicesModule,\n        providers: providers as never[]\n      };\n    }\n\n    if (magicLinkActive && authType !== (catalogType ?? configuredType)) {\n      console.log(`[Auth] Magic-link session token detected — using the magic-link provider for this load (configured primary: '${catalogType ?? configuredType ?? 'none'}').`);\n    }\n\n    // Get the provider class from ClassFactory for extensibility\n    const registration = MJGlobal.Instance.ClassFactory.GetRegistration(\n      MJAuthBase,\n      authType\n    );\n    const providerClass = registration?.SubClass;\n\n    // A catalog-selected provider takes its settings from metadata rather than from the compiled\n    // environment, so the driver receives the row's values overlaid on the app's environment.\n    // Magic-link is excluded: its session is established by the redeem flow, not by catalog config.\n    const effectiveEnvironment =\n      resolution.active && !magicLinkActive\n        ? mergeCatalogEnvironment(environment, resolution.active, providerClass as CatalogEnvironmentMapper | undefined)\n        : environment;\n\n    // Use the factory to get provider-specific Angular services\n    // This uses the static method on each provider class for extensibility\n    const angularServices = AngularAuthProviderFactory.getProviderAngularServices(authType, effectiveEnvironment);\n    providers.push(...angularServices);\n\n    if (providerClass) {\n      // Add the provider itself\n      providers.push({\n        provide: MJAuthBase,\n        useClass: providerClass\n      });\n    } else {\n      console.error(`No provider class registered for auth type: ${authType}`);\n    }\n\n    // Add the factory itself\n    providers.push(AngularAuthProviderFactory);\n\n    return {\n      ngModule: AuthServicesModule,\n      providers: providers as never[]\n    };\n  }\n}\n"]}

package/dist/lib/catalog-environment.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @fileoverview Bridges a metadata provider row to the flat `environment` record that the
+ * browser auth drivers already consume.
+ *
+ * Every `MJAuthBase` subclass exposes `static angularProviderFactory(environment)` and reads
+ * its settings from prefixed keys on that record (`AUTH0_DOMAIN`, `WORKOS_CLIENTID`, ...).
+ * Rather than rewrite each driver to accept a catalog row, the catalog is projected INTO that
+ * record — so a provider configured from metadata and one configured from `environment.ts`
+ * take an identical code path, and drivers keep working untouched.
+ *
+ * @module @memberjunction/ng-auth-services
+ */
+import type { PublicAuthProviderInfo } from '@memberjunction/core';
+/**
+ * Optional hook a provider class may expose when the generic prefixed-key convention does not
+ * describe its configuration. MSAL is the built-in example: it reads unprefixed `CLIENT_ID` /
+ * `CLIENT_AUTHORITY`, so it maps the catalog row itself.
+ */
+export interface CatalogEnvironmentMapper {
+    EnvironmentFromCatalog?: (info: PublicAuthProviderInfo) => Record<string, unknown>;
+}
+/**
+ * Projects a catalog row onto the conventional prefixed environment keys.
+ *
+ * The convention — `<DRIVER>_CLIENTID`, `<DRIVER>_DOMAIN`, `<DRIVER>_SCOPES`, plus one key per
+ * `clientConfiguration` entry — is exactly what the Auth0, Okta, Cognito and WorkOS drivers
+ * already read, so those four need no per-driver mapping at all. A driver that deviates
+ * supplies `EnvironmentFromCatalog`.
+ *
+ * Only defined values are emitted, so a catalog row never blanks out a key the app's compiled
+ * environment legitimately supplies. `clientConfiguration` entries are projected FIRST so the
+ * modelled columns win a key collision — the same precedence the server enforces in
+ * `buildProviderConfig`, where a blob must not silently redefine a described, reviewable column
+ * (`{"scopes": "..."}` in the blob would otherwise clobber the parsed `Scopes` column).
+ */
+export declare function buildGenericEnvironmentOverlay(info: PublicAuthProviderInfo): Record<string, unknown>;
+/**
+ * Produces the environment record to hand a driver for a catalog-selected provider.
+ *
+ * The app's compiled environment stays the base layer — it carries app-wide settings such as
+ * `GRAPHQL_URI` that have nothing to do with the identity provider — and the catalog overlays
+ * only the provider's own keys on top. Metadata therefore wins over a stale compiled value for
+ * the settings it owns, without the catalog having to restate the whole environment.
+ *
+ * @param environment The app's compiled environment object.
+ * @param info The provider selected from the catalog.
+ * @param providerClass The resolved `MJAuthBase` subclass, consulted for a custom mapper.
+ */
+export declare function mergeCatalogEnvironment(environment: Record<string, unknown>, info: PublicAuthProviderInfo, providerClass?: CatalogEnvironmentMapper): Record<string, unknown>;
+//# sourceMappingURL=catalog-environment.d.ts.map

package/dist/lib/catalog-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-environment.d.ts","sourceRoot":"","sources":["../../src/lib/catalog-environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpF;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6BpG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,IAAI,EAAE,sBAAsB,EAC5B,aAAa,CAAC,EAAE,wBAAwB,GACvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB"}

package/dist/lib/catalog-environment.js

@@ -0,0 +1,87 @@
+/**
+ * @fileoverview Bridges a metadata provider row to the flat `environment` record that the
+ * browser auth drivers already consume.
+ *
+ * Every `MJAuthBase` subclass exposes `static angularProviderFactory(environment)` and reads
+ * its settings from prefixed keys on that record (`AUTH0_DOMAIN`, `WORKOS_CLIENTID`, ...).
+ * Rather than rewrite each driver to accept a catalog row, the catalog is projected INTO that
+ * record — so a provider configured from metadata and one configured from `environment.ts`
+ * take an identical code path, and drivers keep working untouched.
+ *
+ * @module @memberjunction/ng-auth-services
+ */
+/**
+ * `redirectUri` → `REDIRECT_URI`, `apiHostname` → `API_HOSTNAME`, `userPoolId` → `USER_POOL_ID`.
+ */
+function camelToUpperSnake(key) {
+    return key
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .replace(/[-\s]+/g, '_')
+        .toUpperCase();
+}
+/**
+ * The environment-key prefix for a driver: `workos` → `WORKOS`, `magic-link` → `MAGIC_LINK`.
+ */
+function environmentPrefix(driverClass) {
+    return camelToUpperSnake(driverClass);
+}
+/**
+ * Projects a catalog row onto the conventional prefixed environment keys.
+ *
+ * The convention — `<DRIVER>_CLIENTID`, `<DRIVER>_DOMAIN`, `<DRIVER>_SCOPES`, plus one key per
+ * `clientConfiguration` entry — is exactly what the Auth0, Okta, Cognito and WorkOS drivers
+ * already read, so those four need no per-driver mapping at all. A driver that deviates
+ * supplies `EnvironmentFromCatalog`.
+ *
+ * Only defined values are emitted, so a catalog row never blanks out a key the app's compiled
+ * environment legitimately supplies. `clientConfiguration` entries are projected FIRST so the
+ * modelled columns win a key collision — the same precedence the server enforces in
+ * `buildProviderConfig`, where a blob must not silently redefine a described, reviewable column
+ * (`{"scopes": "..."}` in the blob would otherwise clobber the parsed `Scopes` column).
+ */
+export function buildGenericEnvironmentOverlay(info) {
+    const prefix = environmentPrefix(info.driverClass);
+    const overlay = {};
+    for (const [key, value] of Object.entries(info.clientConfiguration ?? {})) {
+        if (value !== null && value !== undefined) {
+            overlay[`${prefix}_${camelToUpperSnake(key)}`] = value;
+        }
+    }
+    if (info.clientId) {
+        overlay[`${prefix}_CLIENTID`] = info.clientId;
+    }
+    if (info.domain) {
+        overlay[`${prefix}_DOMAIN`] = info.domain;
+    }
+    if (Array.isArray(info.scopes) && info.scopes.length > 0) {
+        // The catalog publishes scopes pre-parsed (the server splits the delimited column at the
+        // trust boundary). The drivers that read this key — Okta and Cognito — hand it straight to
+        // SDK config typed `string[]`. The Array.isArray guard keeps a malformed or older server's
+        // string value from reaching those SDKs: this module runs at bootstrap, where the contract
+        // is degrade-to-compiled-environment, never throw.
+        overlay[`${prefix}_SCOPES`] = info.scopes;
+    }
+    if (info.issuer) {
+        overlay[`${prefix}_ISSUER`] = info.issuer;
+    }
+    return overlay;
+}
+/**
+ * Produces the environment record to hand a driver for a catalog-selected provider.
+ *
+ * The app's compiled environment stays the base layer — it carries app-wide settings such as
+ * `GRAPHQL_URI` that have nothing to do with the identity provider — and the catalog overlays
+ * only the provider's own keys on top. Metadata therefore wins over a stale compiled value for
+ * the settings it owns, without the catalog having to restate the whole environment.
+ *
+ * @param environment The app's compiled environment object.
+ * @param info The provider selected from the catalog.
+ * @param providerClass The resolved `MJAuthBase` subclass, consulted for a custom mapper.
+ */
+export function mergeCatalogEnvironment(environment, info, providerClass) {
+    const overlay = typeof providerClass?.EnvironmentFromCatalog === 'function'
+        ? providerClass.EnvironmentFromCatalog(info)
+        : buildGenericEnvironmentOverlay(info);
+    return { ...environment, ...overlay, AUTH_TYPE: info.driverClass };
+}
+//# sourceMappingURL=catalog-environment.js.map

package/dist/lib/catalog-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-environment.js","sourceRoot":"","sources":["../../src/lib/catalog-environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAA4B;IACzE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,mDAAmD;QACnD,OAAO,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAoC,EACpC,IAA4B,EAC5B,aAAwC;IAExC,MAAM,OAAO,GACX,OAAO,aAAa,EAAE,sBAAsB,KAAK,UAAU;QACzD,CAAC,CAAC,aAAa,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAE3C,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;AACrE,CAAC","sourcesContent":["/**\n * @fileoverview Bridges a metadata provider row to the flat `environment` record that the\n * browser auth drivers already consume.\n *\n * Every `MJAuthBase` subclass exposes `static angularProviderFactory(environment)` and reads\n * its settings from prefixed keys on that record (`AUTH0_DOMAIN`, `WORKOS_CLIENTID`, ...).\n * Rather than rewrite each driver to accept a catalog row, the catalog is projected INTO that\n * record — so a provider configured from metadata and one configured from `environment.ts`\n * take an identical code path, and drivers keep working untouched.\n *\n * @module @memberjunction/ng-auth-services\n */\n\nimport type { PublicAuthProviderInfo } from '@memberjunction/core';\n\n/**\n * Optional hook a provider class may expose when the generic prefixed-key convention does not\n * describe its configuration. MSAL is the built-in example: it reads unprefixed `CLIENT_ID` /\n * `CLIENT_AUTHORITY`, so it maps the catalog row itself.\n */\nexport interface CatalogEnvironmentMapper {\n  EnvironmentFromCatalog?: (info: PublicAuthProviderInfo) => Record<string, unknown>;\n}\n\n/**\n * `redirectUri` → `REDIRECT_URI`, `apiHostname` → `API_HOSTNAME`, `userPoolId` → `USER_POOL_ID`.\n */\nfunction camelToUpperSnake(key: string): string {\n  return key\n    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')\n    .replace(/[-\\s]+/g, '_')\n    .toUpperCase();\n}\n\n/**\n * The environment-key prefix for a driver: `workos` → `WORKOS`, `magic-link` → `MAGIC_LINK`.\n */\nfunction environmentPrefix(driverClass: string): string {\n  return camelToUpperSnake(driverClass);\n}\n\n/**\n * Projects a catalog row onto the conventional prefixed environment keys.\n *\n * The convention — `<DRIVER>_CLIENTID`, `<DRIVER>_DOMAIN`, `<DRIVER>_SCOPES`, plus one key per\n * `clientConfiguration` entry — is exactly what the Auth0, Okta, Cognito and WorkOS drivers\n * already read, so those four need no per-driver mapping at all. A driver that deviates\n * supplies `EnvironmentFromCatalog`.\n *\n * Only defined values are emitted, so a catalog row never blanks out a key the app's compiled\n * environment legitimately supplies. `clientConfiguration` entries are projected FIRST so the\n * modelled columns win a key collision — the same precedence the server enforces in\n * `buildProviderConfig`, where a blob must not silently redefine a described, reviewable column\n * (`{\"scopes\": \"...\"}` in the blob would otherwise clobber the parsed `Scopes` column).\n */\nexport function buildGenericEnvironmentOverlay(info: PublicAuthProviderInfo): Record<string, unknown> {\n  const prefix = environmentPrefix(info.driverClass);\n  const overlay: Record<string, unknown> = {};\n\n  for (const [key, value] of Object.entries(info.clientConfiguration ?? {})) {\n    if (value !== null && value !== undefined) {\n      overlay[`${prefix}_${camelToUpperSnake(key)}`] = value;\n    }\n  }\n\n  if (info.clientId) {\n    overlay[`${prefix}_CLIENTID`] = info.clientId;\n  }\n  if (info.domain) {\n    overlay[`${prefix}_DOMAIN`] = info.domain;\n  }\n  if (Array.isArray(info.scopes) && info.scopes.length > 0) {\n    // The catalog publishes scopes pre-parsed (the server splits the delimited column at the\n    // trust boundary). The drivers that read this key — Okta and Cognito — hand it straight to\n    // SDK config typed `string[]`. The Array.isArray guard keeps a malformed or older server's\n    // string value from reaching those SDKs: this module runs at bootstrap, where the contract\n    // is degrade-to-compiled-environment, never throw.\n    overlay[`${prefix}_SCOPES`] = info.scopes;\n  }\n  if (info.issuer) {\n    overlay[`${prefix}_ISSUER`] = info.issuer;\n  }\n\n  return overlay;\n}\n\n/**\n * Produces the environment record to hand a driver for a catalog-selected provider.\n *\n * The app's compiled environment stays the base layer — it carries app-wide settings such as\n * `GRAPHQL_URI` that have nothing to do with the identity provider — and the catalog overlays\n * only the provider's own keys on top. Metadata therefore wins over a stale compiled value for\n * the settings it owns, without the catalog having to restate the whole environment.\n *\n * @param environment The app's compiled environment object.\n * @param info The provider selected from the catalog.\n * @param providerClass The resolved `MJAuthBase` subclass, consulted for a custom mapper.\n */\nexport function mergeCatalogEnvironment(\n  environment: Record<string, unknown>,\n  info: PublicAuthProviderInfo,\n  providerClass?: CatalogEnvironmentMapper\n): Record<string, unknown> {\n  const overlay =\n    typeof providerClass?.EnvironmentFromCatalog === 'function'\n      ? providerClass.EnvironmentFromCatalog(info)\n      : buildGenericEnvironmentOverlay(info);\n\n  return { ...environment, ...overlay, AUTH_TYPE: info.driverClass };\n}\n"]}

package/dist/lib/login-picker.component.d.ts

@@ -0,0 +1,72 @@
+import { EventEmitter } from '@angular/core';
+import type { PublicAuthProviderInfo } from '@memberjunction/core';
+import * as i0 from "@angular/core";
+/**
+ * Reusable, app-agnostic multi-IdP login picker.
+ *
+ * Presentational by design: it takes a provider catalog in and emits the user's choice out. It
+ * owns no routing, no branding, and no knowledge of which app embeds it, so Explorer and any
+ * other MJ application get the identical accessible picker by dropping in the element and
+ * supplying their own surrounding login surface.
+ *
+ * Accessibility comes from the shared `mjButton` directive (focus ring, hit target, disabled
+ * semantics) rather than from styles restated here, so it cannot drift from the rest of the app.
+ *
+ * @example
+ * ```html
+ * <mj-login-picker
+ *   [Providers]="Catalog"
+ *   [Busy]="SigningIn"
+ *   (ProviderSelected)="OnProviderSelected($event)">
+ * </mj-login-picker>
+ * ```
+ */
+export declare class MJLoginPickerComponent {
+    /** Providers to offer, already ordered by the caller. */
+    Providers: PublicAuthProviderInfo[];
+    /** Optional heading rendered above the list. */
+    Heading: string | null;
+    /** Optional supporting line rendered under the heading. */
+    Subheading: string | null;
+    /**
+     * Disables every row — set while a sign-in is being initiated so a second click cannot
+     * start a competing redirect.
+     */
+    Busy: boolean;
+    /**
+     * Whether to render the "Powered by MemberJunction" attribution.
+     *
+     * On by default, and a host-supplied flag rather than a code change, because full
+     * white-labelling is a commercial entitlement: a tenant that has paid to remove the
+     * attribution must be satisfiable by configuration alone.
+     */
+    ShowPoweredBy: boolean;
+    /**
+     * Label for the call to action shown when the catalog published nothing.
+     *
+     * Lets one component cover all three states — 2+ providers (a list), exactly one (a single
+     * primary CTA naming it), and none at all (this generic CTA, for deployments still configured
+     * through `mj.config.cjs` / `AUTH_TYPE`). Null renders nothing, which is the prior behaviour
+     * for hosts that handle the empty case themselves.
+     */
+    FallbackCtaLabel: string | null;
+    /** Emitted with the chosen provider. The host decides what signing in means. */
+    ProviderSelected: EventEmitter<PublicAuthProviderInfo>;
+    /** Emitted when the empty-catalog CTA is clicked. The host starts its configured sign-in. */
+    FallbackSelected: EventEmitter<void>;
+    /** A single option is not a choice — it renders as one primary call to action. */
+    get IsSingleProvider(): boolean;
+    /** "Continue with Okta" — the conventional modern auth phrasing. */
+    LabelFor(provider: PublicAuthProviderInfo): string;
+    /**
+     * Resolves the icon class for a provider: an explicit `Icon` from metadata wins, otherwise
+     * a known brand mapping for the driver, otherwise null (the chip falls back to an initial).
+     */
+    IconClassFor(provider: PublicAuthProviderInfo): string | null;
+    /** Fallback chip content when no icon resolves. */
+    InitialFor(provider: PublicAuthProviderInfo): string;
+    Select(provider: PublicAuthProviderInfo): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<MJLoginPickerComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<MJLoginPickerComponent, "mj-login-picker", never, { "Providers": { "alias": "Providers"; "required": false; }; "Heading": { "alias": "Heading"; "required": false; }; "Subheading": { "alias": "Subheading"; "required": false; }; "Busy": { "alias": "Busy"; "required": false; }; "ShowPoweredBy": { "alias": "ShowPoweredBy"; "required": false; }; "FallbackCtaLabel": { "alias": "FallbackCtaLabel"; "required": false; }; }, { "ProviderSelected": "ProviderSelected"; "FallbackSelected": "FallbackSelected"; }, never, never, true, never>;
+}
+//# sourceMappingURL=login-picker.component.d.ts.map

package/dist/lib/login-picker.component.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-picker.component.d.ts","sourceRoot":"","sources":["../../src/lib/login-picker.component.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,YAAY,EAAiB,MAAM,eAAe,CAAC;AAEvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;;AAiBnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAgMa,sBAAsB;IACjC,yDAAyD;IAChD,SAAS,EAAE,sBAAsB,EAAE,CAAM;IAElD,gDAAgD;IACvC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAY;IAE3C,2DAA2D;IAClD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE1C;;;OAGG;IACM,IAAI,UAAS;IAEtB;;;;;;OAMG;IACM,aAAa,UAAQ;IAE9B;;;;;;;OAOG;IACM,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAQ;IAEhD,gFAAgF;IACtE,gBAAgB,uCAA8C;IAExE,6FAA6F;IACnF,gBAAgB,qBAA4B;IAEtD,kFAAkF;IAClF,IAAW,gBAAgB,IAAI,OAAO,CAErC;IAED,oEAAoE;IAC7D,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM;IAIzD;;;OAGG;IACI,YAAY,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI;IAOpE,mDAAmD;IAC5C,UAAU,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM;IAIpD,MAAM,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI;yCAnE1C,sBAAsB;2CAAtB,sBAAsB;CAwElC"}