@zitadel/components 0.1.0-alpha.4 → 0.1.0-alpha.8

package/dist/orchestrator/zitadel-login.d.ts

@@ -1,213 +0,0 @@
-import { type ZitadelProject } from "@zitadel/api/config";
-import type { CreateFlowBodyPurpose } from "@zitadel/api/generated/model";
-import { LitElement, type PropertyValues } from "lit";
-import "../atoms/index.js";
-import { type Locale } from "./locales/index.js";
-/**
- * `<zitadel-login>` — the auth-UI orchestrator.
- *
- * Drives the typed `@zitadel/api` Flow API directly: `POST /flow`
- * starts a flow, `POST /flow/{id}/submit` advances it. Renders each step
- * through LiquidJS, sanitises the output via DOMPurify, and mounts the
- * result inside a real `<form>` element in its Shadow DOM via Lit's
- * `unsafeHTML` directive. Atom CustomEvents (`zl-input` / `zl-submit`)
- * and the form's native `submit` event feed back into the
- * submit cycle.
- *
- * Form participation: the orchestrator owns the `<form>` so Enter submits,
- * browsers offer "save password" prompts, and password managers / autofill
- * see a real form. Each `<zl-field>` is form-associated (see
- * `docs/design/branding/form-participation.md`) so its value participates in
- * the form even though it lives inside its own shadow root. The shadow root
- * also delegates focus, and after each step swap focus moves to the first
- * field so screen-reader and keyboard users land in a sensible spot.
- *
- * Session/state: the server is stateless between requests — a `_zflow`
- * HttpOnly cookie carries orchestration state. We always run with
- * `credentials: "include"` (set in `api-client.ts`). The flow handle (`id`)
- * may rotate on pivots/pops; we re-read it from every response.
- *
- * Spec sources:
- * - `docs/design/flowengine/flow-engine-guide.md`
- * - `docs/design/branding/templates.md`
- * - `docs/design/branding/tokens.md`
- * - `docs/design/branding/schema.md`
- * - `docs/design/branding/form-participation.md`
- * - `docs/design/flowengine/template-security.md`
- */
-export declare class ZitadelLogin extends LitElement {
-    static shadowRootOptions: ShadowRootInit;
-    static styles: import("lit").CSSResult;
-    accessor purpose: CreateFlowBodyPurpose;
-    /**
-     * SDK project handle returned by `configureZitadel()`. Set from JS (or a
-     * framework binding). When set, takes precedence over both the
-     * `project-id`/`proxy-path`/`url` attributes and the global singleton from
-     * `getZitadelConfig()`.
-     */
-    accessor project: ZitadelProject | undefined;
-    /**
-     * Project ID, set declaratively in HTML. Lets the component be configured on
-     * a plain page without JS or `configureZitadel()`. Ignored when the `project`
-     * property or a `configureZitadel()` global is set. See {@link projectAttrs}.
-     */
-    accessor projectId: string;
-    /**
-     * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.
-     * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.
-     */
-    accessor proxyPath: string;
-    /**
-     * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —
-     * not needed in client-only setups.
-     */
-    accessor url: string;
-    /**
-     * URL to navigate to after a successful embedded sign-in. When set, the
-     * orchestrator exchanges the terminal `handoff_token` via the generated
-     * API client (setting the session cookie) and then performs a full
-     * navigation to this URL so host middleware can observe the cookie.
-     * For `complete: "redirect"` the orchestrator follows `redirect_uri`
-     * instead and does not run the exchange.
-     */
-    accessor postSignInUrl: string;
-    /**
-     * Existing flow handle to resume rather than start a new flow. When set,
-     * the orchestrator hits `GET /flow/{id}` instead of `POST /flow` on
-     * mount, so a page reload after a network blip can re-render the same
-     * step without losing collected state.
-     */
-    accessor resumeFlowId: string;
-    /**
-     * BCP 47 language tag (e.g. `"de"`, `"en-US"`). The widget resolves this
-     * to a built-in locale dictionary. Falls back to auto-detection from
-     * `document.documentElement.lang` or `navigator.language` when empty.
-     */
-    accessor lang: string;
-    /**
-     * Custom locale dictionaries keyed by language code. When set, these take
-     * precedence over the built-in dictionaries for matching language codes.
-     *
-     * ```ts
-     * import { en } from "@zitadel/components";
-     * const locales = {
-     *   en: { ...en, "identifier.title": "Welcome" },
-     *   de: myGermanDict,
-     * };
-     * ```
-     */
-    accessor locales: Record<string, Locale> | undefined;
-    private accessor response;
-    private accessor branding;
-    private accessor loading;
-    private accessor startupError;
-    private accessor formValues;
-    private readonly themeController;
-    private engine;
-    private readonly sanitise;
-    /**
-     * Cached compiled tenant template, keyed by source string. Re-rendering on
-     * every `formValues` change otherwise re-parses the same template.
-     */
-    private tenantTemplateCache;
-    createRenderRoot(): HTMLElement | DocumentFragment;
-    /**
-     * Start the flow after the first render rather than in `connectedCallback`.
-     * Frameworks that wrap web components (e.g. `@lit/react` in the console)
-     * attach the element first and then assign object properties (`branding`,
-     * `locale`) via setters. `connectedCallback` runs synchronously on attach
-     * — before any setters from a wrapper's effects/refs — so reading those
-     * properties there sees stale defaults. `firstUpdated` runs after Lit's
-     * first render, by which time setters from the wrapping framework have
-     * fired.
-     */
-    protected firstUpdated(): void;
-    /**
-     * Resolves the effective locale dictionary. The built-in dictionary for the
-     * resolved language is used as the base; entries from the `locales` map (if
-     * set) are spread on top so partial overrides work without importing and
-     * spreading the full base dictionary.
-     *
-     * Priority: explicit `lang` attr → `navigator.language` (user preference)
-     * → `document.documentElement.lang` (page default) → English fallback.
-     */
-    private resolveLocale;
-    willUpdate(changed: PropertyValues<this>): void;
-    updated(changed: PropertyValues<this>): void;
-    private hydrateStepAfterRender;
-    render(): import("lit").TemplateResult<1>;
-    /**
-     * Inject the attribution badge into the rendered template's
-     * `<zl-page-shell>` footer slot. The attribution must live INSIDE the
-     * page-shell so it sits within the 100vh viewport rhythm (matching the
-     * Figma sign-in frame where the pill sits 24px below the card, both
-     * centred on the page). It can't be a sibling of the page-shell because
-     * the page-shell already occupies the full viewport height.
-     *
-     * This markup is appended AFTER `renderStep` has sanitised the Liquid
-     * output, so it is not run through DOMPurify. It is orchestrator-owned and
-     * any tenant-supplied values (`custom_link`) are escaped via `escapeHtml`.
-     */
-    private injectAttribution;
-    /**
-     * "Secured with Zitadel" attribution chrome injected into every
-     * template's page-shell footer slot. Controlled by
-     * `branding.attribution.show_zitadel` — defaults to `true` for
-     * community / OSS deployments. Licensed tenants can suppress the badge
-     * entirely or swap it for a `custom_link` value.
-     */
-    private renderAttributionHtml;
-    /** Declarative config read from this element's attributes. */
-    private get projectAttrs();
-    private startFlow;
-    private applyResponse;
-    private maybeCompleteFlow;
-    private renderStep;
-    /**
-     * Build a `FlowIdentity` from the orchestrator's captured form values so
-     * the signed-in template can greet the user by email without the API
-     * having to round-trip identity claims. Email comes from the
-     * identifier step; display name composes from `given_name` /
-     * `family_name` when the register step ran.
-     */
-    private deriveIdentity;
-    private applyValuesToFields;
-    private captureValuesFromFields;
-    private currentFieldValue;
-    private handleAtomInput;
-    private syncFieldElementValue;
-    private handleAtomSubmit;
-    /** Secondary navigation rows (`data-action` on `.zl-card-nav__link`). */
-    private handleDelegatedAction;
-    private handleFormSubmit;
-    /**
-     * Handle a successful WebAuthn ceremony. Auto-submit with the proof
-     * as `challenge_response` so the flow advances without extra user
-     * interaction — the ceremony IS the factor verification (ADR 013).
-     */
-    private handlePasskeyResult;
-    /**
-     * Handle a WebAuthn ceremony error. Re-render the current step with
-     * an error message so the user sees feedback and can retry or skip.
-     *
-     * Guard: if the step already carries the same error key, skip the update.
-     * Mutating `this.response` triggers `unsafeHTML` to replace the DOM tree,
-     * which reconnects a fresh `<zl-passkey>` that immediately re-starts the
-     * ceremony — creating an infinite loop. The guard breaks the cycle.
-     *
-     * We also strip the `challenge` from the step so the template does not
-     * render a new `<zl-passkey>` on re-render. Without this, the first
-     * cancel would trigger a second ceremony (the guard prevents a third).
-     */
-    private handlePasskeyError;
-    private findPrimaryAction;
-    private moveFocusToFirstField;
-    private submit;
-    private handleTransportError;
-}
-declare global {
-    interface HTMLElementTagNameMap {
-        "zitadel-login": ZitadelLogin;
-    }
-}
-//# sourceMappingURL=zitadel-login.d.ts.map

package/dist/orchestrator/zitadel-login.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"zitadel-login.d.ts","sourceRoot":"","sources":["../../src/orchestrator/zitadel-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAGV,qBAAqB,EAGtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAa,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,KAAK,CAAC;AAKjE,OAAO,mBAAmB,CAAC;AAgB3B,OAAO,EAAsB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBACa,YAAa,SAAQ,UAAU;IAC1C,OAAgB,iBAAiB,EAAE,cAAc,CAG/C;IAOF,OAAgB,MAAM,0BAMpB;IAE0B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAW;IAE9E;;;;;OAKG;IAC6B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IAE7E;;;;OAIG;IACkD,QAAQ,CAAC,SAAS,SAAM;IAE7E;;;OAGG;IACkD,QAAQ,CAAC,SAAS,SAAM;IAE7E;;;OAGG;IACyB,QAAQ,CAAC,GAAG,SAAM;IAE9C;;;;;;;OAOG;IACwD,QAAQ,CAAC,aAAa,SAAM;IAEvF;;;;;OAKG;IACsD,QAAQ,CAAC,YAAY,SAAM;IAEpF;;;;OAIG;IACH,SAA8C,IAAI,SAAM;IAExD;;;;;;;;;;;OAWG;IAC6B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAE5E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IAEvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAE5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IAEpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAElE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D,OAAO,CAAC,MAAM,CAAuB;IAErC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C;;;OAGG;IACH,OAAO,CAAC,mBAAmB,CAAyD;IAE3E,gBAAgB,IAAI,WAAW,GAAG,gBAAgB,CA+B1D;IAED;;;;;;;;;OASG;IACH,UAAmB,YAAY,IAAI,IAAI,CAItC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAYZ,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAavD;IAEQ,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAIpD;YASa,sBAAsB;IAU3B,MAAM,oCAkBd;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAe7B,8DAA8D;IAC9D,OAAO,KAAK,YAAY,GAEvB;YAEa,SAAS;IA4BvB,OAAO,CAAC,aAAa;YA0BP,iBAAiB;IAoC/B,OAAO,CAAC,UAAU;IAuDlB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,uBAAuB;IAyB/B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,eAAe,CAOrB;IAEF,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,gBAAgB,CAGtB;IAEF,yEAAyE;IACzE,OAAO,CAAC,qBAAqB,CAO3B;IAEF,OAAO,CAAC,gBAAgB,CAatB;IAEF;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAUzB;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,kBAAkB,CAexB;IAEF,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;YAQf,MAAM;IAqCpB,OAAO,CAAC,oBAAoB;CAO7B;AAWD,OAAO,CAAC,MAAM,CAAC,CAAC;IACd,UAAU,qBAAqB;QAC7B,eAAe,EAAE,YAAY,CAAC;KAC/B;CACF"}

package/dist/orchestrator/zitadel-logout.d.ts

@@ -1,114 +0,0 @@
-import { LitElement, nothing } from "lit";
-import { type ZitadelProject } from "@zitadel/api/config";
-/**
- * `<zitadel-logout>` — orchestrator-tier element that lets the signed-in user
- * sign out without touching the flow API.
- *
- * Reads the user's display name + email from the `__nextgen_display` cookie
- * (set by the auth backend on sign-in), renders an avatar trigger with a
- * dropdown that exposes a "Sign out" action, and calls the typed
- * `revokeMySession` operation in `@zitadel/api`
- * (`DELETE /sessions/me`). The server clears the session cookie via
- * `Set-Cookie: Max-Age=0`; on success the element fires `zitadel-signout`
- * and optionally navigates to `post-sign-out-url`. (`getEndSessionUrl()`
- * additionally exposes the OIDC end-session URL for consumers that prefer a
- * user-agent-driven redirect.)
- *
- * ## Template-slot mode
- *
- * When the consumer projects a `<template>` child the element renders the
- * template's clone into its light DOM with `{{name}}`, `{{email}}`, and
- * `{{initial}}` substituted. Any element with `data-action="logout"` inside
- * the cloned template triggers the sign-out flow. This mirrors the
- * placeholder `<nextgen-logout>`'s contract so existing markup keeps working.
- *
- * Default styles consume the `--zl-*` design tokens so tenant branding
- * applies automatically — there is no hardcoded brand colour, radius, or
- * shadow.
- */
-export declare class ZitadelLogout extends LitElement {
-    static styles: import("lit").CSSResult[];
-    /**
-     * SDK project handle returned by `configureZitadel()`. Set from JS (or a
-     * framework binding). When set, takes precedence over both the
-     * `project-id`/`proxy-path`/`url` attributes and the global singleton from
-     * `getZitadelConfig()`.
-     */
-    accessor project: ZitadelProject | undefined;
-    /**
-     * Project ID, set declaratively in HTML. Lets the component be configured on
-     * a plain page without JS or `configureZitadel()`. Ignored when the `project`
-     * property or a `configureZitadel()` global is set.
-     */
-    accessor projectId: string;
-    /**
-     * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.
-     * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.
-     */
-    accessor proxyPath: string;
-    /**
-     * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —
-     * not needed in client-only setups.
-     */
-    accessor url: string;
-    /** URL to navigate to after a successful sign-out. */
-    accessor postSignOutUrl: string;
-    /**
-     * OIDC `client_id` to forward as a query parameter on the end-session
-     * request, mirroring the standard end-session contract. Optional —
-     * leaving this empty is fine when the backend can resolve the client
-     * from the session cookie alone.
-     */
-    accessor clientId: string;
-    private accessor displayName;
-    private accessor displayEmail;
-    private accessor open;
-    private accessor loading;
-    private accessor errorMessage;
-    private templateMode;
-    connectedCallback(): void;
-    disconnectedCallback(): void;
-    updated(): void;
-    /**
-     * Decodes the `__nextgen_display` cookie (base64-encoded JSON, set by the
-     * auth backend on sign-in) and populates `displayName` / `displayEmail`.
-     * A missing or malformed cookie is intentionally non-fatal — the dropdown
-     * still renders, just with empty values.
-     */
-    private readDisplayCookie;
-    private get initial();
-    /**
-     * Clones a consumer-supplied `<template>` into the light DOM, fills the
-     * `{{name}}`, `{{email}}`, and `{{initial}}` tokens via a TreeWalker, and
-     * wires every element with `data-action="logout"` to trigger sign-out.
-     * Light-DOM mounting is deliberate so the consumer's existing CSS applies.
-     */
-    private renderTemplate;
-    private readonly handleDocumentClick;
-    private readonly handleDocumentKeydown;
-    private toggleOpen;
-    /**
-     * Calls `DELETE /sessions/me` (`revokeMySession`) with `credentials: "include"`.
-     * The server validates the `__nextgen_session` cookie, deletes the session, and
-     * clears the cookie via `Set-Cookie: Max-Age=0`. On success this element fires
-     * `zitadel-signout` and optionally navigates to `postSignOutUrl`.
-     */
-    /** Declarative config read from this element's attributes. */
-    private get projectAttrs();
-    private doLogout;
-    /**
-     * Returns the absolute URL the end-session request will hit. Useful for
-     * test assertions and for consumers that prefer to navigate the browser
-     * directly (instead of fetching) so the OIDC session-end redirect is
-     * driven by the user agent.
-     */
-    getEndSessionUrl(): string;
-    private handleSignOutClick;
-    render(): typeof nothing | import("lit").TemplateResult<1>;
-}
-declare global {
-    interface HTMLElementTagNameMap {
-        "zitadel-logout": ZitadelLogout;
-    }
-}
-//# sourceMappingURL=zitadel-logout.d.ts.map

package/dist/orchestrator/zitadel-logout.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"zitadel-logout.d.ts","sourceRoot":"","sources":["../../src/orchestrator/zitadel-logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAa,OAAO,EAAE,MAAM,KAAK,CAAC;AAErD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBACa,aAAc,SAAQ,UAAU;IAC3C,OAAgB,MAAM,4BA2IpB;IAEF;;;;;OAKG;IAC6B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IAE7E;;;;OAIG;IACkD,QAAQ,CAAC,SAAS,SAAM;IAE7E;;;OAGG;IACkD,QAAQ,CAAC,SAAS,SAAM;IAE7E;;;OAGG;IACyB,QAAQ,CAAC,GAAG,SAAM;IAE9C,sDAAsD;IACM,QAAQ,CAAC,cAAc,SAAM;IAEzF;;;;;OAKG;IACiD,QAAQ,CAAC,QAAQ,SAAM;IAElE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAM;IAElC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAM;IAEnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAE9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAM;IAK5C,OAAO,CAAC,YAAY,CAAS;IAEpB,iBAAiB,IAAI,IAAI,CAajC;IAEQ,oBAAoB,IAAI,IAAI,CAIpC;IAEQ,OAAO,IAAI,IAAI,CAKvB;IAED;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAazB,OAAO,KAAK,OAAO,GAGlB;IAED;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAIlC;IAEF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAKpC;IAEF,OAAO,CAAC,UAAU;IAKlB;;;;;OAKG;IACH,8DAA8D;IAC9D,OAAO,KAAK,YAAY,GAEvB;YAEa,QAAQ;IAwBtB;;;;;OAKG;IACH,gBAAgB,IAAI,MAAM,CAOzB;IAED,OAAO,CAAC,kBAAkB;IAKjB,MAAM,qDAsEd;CACF;AA0BD,OAAO,CAAC,MAAM,CAAC,CAAC;IACd,UAAU,qBAAqB;QAC7B,gBAAgB,EAAE,aAAa,CAAC;KACjC;CACF"}