@zitadel/components 0.1.0-alpha.5 → 0.1.0-alpha.8

package/dist/orchestrator/locales/index.d.ts

@@ -1,13 +0,0 @@
-/**
- * Built-in locale registry.
- *
- * Re-exports the individual dictionaries and provides a `builtinLocales`
- * map so the orchestrator can resolve a BCP 47 language tag to the
- * matching dictionary at runtime.
- */
-export { en, type Locale } from "./en.js";
-export { de } from "./de.js";
-export { it } from "./it.js";
-import { type Locale } from "./en.js";
-export declare const builtinLocales: Readonly<Record<string, Locale>>;
-//# sourceMappingURL=index.d.ts.map

package/dist/orchestrator/locales/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/locales/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,EAAE,EAAE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAM,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAI1C,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAkB,CAAC"}

package/dist/orchestrator/locales/it.d.ts

@@ -1,14 +0,0 @@
-/**
- * Italian locale dictionary.
- *
- * Structure mirrors {@link en} — same keys, translated values.
- *
- * Text keys are auto-generated by the server from the flow definition:
- *   - Step titles:       `<step>.title`
- *   - Step descriptions: `<step>.description`
- *   - Field labels:      `<step>.field.<field>`
- *   - Action labels:     `<step>.action.<action>`
- */
-import type { Locale } from "./en.js";
-export declare const it: Locale;
-//# sourceMappingURL=it.d.ts.map

package/dist/orchestrator/locales/it.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"it.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/locales/it.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC,eAAO,MAAM,EAAE,EAAE,MAgKhB,CAAC"}

package/dist/orchestrator/mandatory-gates.d.ts

@@ -1,26 +0,0 @@
-/**
- * `{% mandatory_gates %}` runtime patcher.
- *
- * Per `docs/design/branding/validator.md` §Runtime safety net:
- *
- *   "After the template finishes rendering, the tag inspects the produced DOM
- *    and appends:
- *      - Any required `fields[*]` without a matching `<zl-field>`.
- *      - Any required `gates[*]` without a matching consumer.
- *      - A primary `<zl-button type="submit">` if none was reached."
- *
- * Implementation: the LiquidJS `{% mandatory_gates %}` tag emits a unique
- * marker comment. After Liquid renders, this patcher parses the produced
- * HTML into a `<template>`, builds any missing atoms as real DOM elements,
- * replaces the marker with them, and serialises back to a string.
- *
- * Building elements via the DOM (`document.createElement` + `setAttribute`)
- * delegates HTML attribute escaping to the browser's serialiser — no manual
- * string-escaping in this module.
- */
-import type { CreateFlow201Step } from "@zitadel/api/generated/model";
-import type { Locale } from "./locales/en.js";
-export declare const MANDATORY_GATES_MARKER = "ZL_MANDATORY_GATES";
-export declare const mandatoryGatesMarkerComment = "<!--ZL_MANDATORY_GATES-->";
-export declare function patchMandatoryGates(html: string, step: CreateFlow201Step, locale: Locale): string;
-//# sourceMappingURL=mandatory-gates.d.ts.map

package/dist/orchestrator/mandatory-gates.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mandatory-gates.d.ts","sourceRoot":"","sources":["../../src/orchestrator/mandatory-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,eAAO,MAAM,2BAA2B,8BAAqC,CAAC;AAE9E,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,MAAM,GACb,MAAM,CAoBR"}

package/dist/orchestrator/resolve-api.d.ts

@@ -1,37 +0,0 @@
-import { type ZitadelApi, type ZitadelProject } from "@zitadel/api/config";
-/**
- * Declarative configuration read from an element's HTML attributes
- * (`project-id` / `proxy-path` / `url`). Empty strings mean "unset".
- */
-export interface ProjectAttrs {
-    readonly projectId: string;
-    readonly proxyPath: string;
-    readonly url: string;
-}
-/**
- * Resolves the effective SDK project handle and its typed API client for an
- * orchestrator element. Precedence, highest first:
- *
- * 1. the element's `project` property (an SDK handle set from JS / a framework),
- * 2. the global handle from `configureZitadel()`,
- * 3. the `project-id` / `proxy-path` / `url` attributes set declaratively in HTML.
- *
- * Both JS paths (property and global) win over the declarative attributes, so a
- * deliberate `configureZitadel()` is never silently overridden by fallback or
- * stale HTML attributes; the attributes are the no-JS fallback.
- *
- * Both `<zitadel-login>` and `<zitadel-logout>` need the same resolution and
- * the same "no config" failure, so it lives here rather than being copied
- * into each element. Callers run this inside their try/catch so a missing
- * configuration surfaces through the element's normal error path rather than
- * as an unhandled rejection.
- *
- * @param project Optional per-element override handle.
- * @param attrs Declarative config read from the element's attributes.
- * @param element Tag name used in the thrown error (e.g. `<zitadel-login>`).
- */
-export declare function resolveApi(project: ZitadelProject | undefined, attrs: ProjectAttrs, element: string): {
-    project: ZitadelProject;
-    api: ZitadelApi;
-};
-//# sourceMappingURL=resolve-api.d.ts.map

package/dist/orchestrator/resolve-api.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-api.d.ts","sourceRoot":"","sources":["../../src/orchestrator/resolve-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAC;AAK7B;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAuCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE,CAS9C"}

package/dist/orchestrator/sanitiser.d.ts

@@ -1,6 +0,0 @@
-/**
- * Returns a sanitiser bound to the current manifest registry. Callers should
- * cache the result; rebuilding is cheap but allocates a fresh DOMPurify config.
- */
-export declare function createSanitiser(): (html: string) => string;
-//# sourceMappingURL=sanitiser.d.ts.map

package/dist/orchestrator/sanitiser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitiser.d.ts","sourceRoot":"","sources":["../../src/orchestrator/sanitiser.ts"],"names":[],"mappings":"AA0GA;;;GAGG;AACH,wBAAgB,eAAe,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAsB1D"}

package/dist/orchestrator/template-context.d.ts

@@ -1,55 +0,0 @@
-/**
- * Liquid template context contract.
- *
- * The orchestrator feeds tenant Liquid templates a stable, renderer-friendly
- * projection of the wire `CreateFlow201` shape. Capability dictionaries
- * (`fields`, `actions`, `gates`, `sso_providers`) are typed straight from
- * the orval-generated wire so templates iterate over the same schema the
- * server promises.
- *
- * The orchestrator owns three projections that don't exist on the wire:
- *
- * 1. `errors` — lifted from `step.error: string | null` so templates iterate
- *    uniformly even though the wire only carries one error string.
- * 2. `messages` — populated by orchestrator decoration hooks (info banners,
- *    sticky notices); not on the wire.
- * 3. `identity` — resolved client-side for greet-by-name; not on the wire.
- */
-import type { CreateFlow201Step, CreateFlow201StepActions, CreateFlow201StepChallenge, CreateFlow201StepFields, CreateFlow201StepGates, CreateFlow201StepSsoProvidersItem } from "@zitadel/api/generated/model";
-import type { Branding } from "./branding.js";
-export type FlowMessage = {
-    level: "info" | "warning";
-    text_key: string;
-};
-export type FlowError = {
-    code?: string;
-    text_key?: string;
-    message?: string;
-};
-export type FlowIdentity = {
-    display_name?: string;
-    email_address?: string;
-    avatar_url?: string;
-};
-/**
- * Liquid render context. The orchestrator builds this from the wire
- * `CreateFlow201` payload before invoking the engine.
- *
- * Capability dictionaries point at the orval wire shapes directly. The only
- * client-only pieces are `messages`, `identity`, `errors`, the resolved
- * `branding` (v2 superset), and `loading`.
- */
-export type LiquidContext = {
-    step: Pick<CreateFlow201Step, "name" | "complete" | "texts">;
-    fields: CreateFlow201StepFields;
-    actions: CreateFlow201StepActions;
-    gates: CreateFlow201StepGates;
-    sso_providers: readonly CreateFlow201StepSsoProvidersItem[];
-    challenge: CreateFlow201StepChallenge | null;
-    messages: readonly FlowMessage[];
-    identity: FlowIdentity | null;
-    errors: readonly FlowError[];
-    branding: Branding | Record<string, never>;
-    loading: boolean;
-};
-//# sourceMappingURL=template-context.d.ts.map

package/dist/orchestrator/template-context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"template-context.d.ts","sourceRoot":"","sources":["../../src/orchestrator/template-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,EACtB,iCAAiC,EAClC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,CAAC;IAC7D,MAAM,EAAE,uBAAuB,CAAC;IAChC,OAAO,EAAE,wBAAwB,CAAC;IAClC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,aAAa,EAAE,SAAS,iCAAiC,EAAE,CAAC;IAC5D,SAAS,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAC7C,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IACjC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IAC7B,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC"}

package/dist/orchestrator/template-names.d.ts

@@ -1,16 +0,0 @@
-/**
- * Names of the bundled Liquid templates the `<zitadel-login>` orchestrator
- * registers.
- *
- * This lives in its own module — separate from `liquid.ts` — so the public
- * barrel can re-export `TEMPLATE_NAMES` without dragging LiquidJS' `Liquid`
- * type (and its Node ambient-type requirements) into the published
- * declaration surface. See `liquid.ts` / the orchestrator barrel.
- */
-export declare const TEMPLATE_NAMES: {
-    readonly default: "default";
-    readonly authForm: "auth-form";
-    readonly passkeyUpsell: "passkey-upsell";
-    readonly signedIn: "signed-in";
-};
-//# sourceMappingURL=template-names.d.ts.map

package/dist/orchestrator/template-names.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"template-names.d.ts","sourceRoot":"","sources":["../../src/orchestrator/template-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;aACzB,OAAO,EAAE,SAAS;aAClB,QAAQ,EAAE,WAAW;aACrB,aAAa,EAAE,gBAAgB;aAC/B,QAAQ,EAAE,WAAW;CACb,CAAC"}

package/dist/orchestrator/theme-controller.d.ts

@@ -1,30 +0,0 @@
-/**
- * `ThemeController` — Lit ReactiveController that resolves the active
- * `light | dark` theme from the current `Branding` payload and keeps it in
- * sync with the OS-level `prefers-color-scheme` when the tenant opts into
- * `theme.mode = "auto"`.
- *
- * Per `docs/design/branding/tokens.md` the orchestrator owns theming entirely.
- * Subscribing here is what makes "auto" actually reactive instead of a
- * one-shot read at first paint.
- */
-import type { ReactiveController, ReactiveControllerHost } from "lit";
-import type { Branding } from "./branding.js";
-export type ResolvedTheme = "light" | "dark";
-export declare class ThemeController implements ReactiveController {
-    private readonly host;
-    private branding;
-    private mediaQuery;
-    private _theme;
-    constructor(host: ReactiveControllerHost);
-    get theme(): ResolvedTheme;
-    setBranding(branding: Branding | undefined): void;
-    hostConnected(): void;
-    hostDisconnected(): void;
-    private refresh;
-    private attach;
-    private detach;
-    private onMediaChange;
-    private update;
-}
-//# sourceMappingURL=theme-controller.d.ts.map

package/dist/orchestrator/theme-controller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"theme-controller.d.ts","sourceRoot":"","sources":["../../src/orchestrator/theme-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,KAAK,CAAC;AAEtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAI7C,qBAAa,eAAgB,YAAW,kBAAkB;IACxD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAE9C,OAAO,CAAC,QAAQ,CAAuB;IAEvC,OAAO,CAAC,UAAU,CAA+B;IAKjD,OAAO,CAAC,MAAM,CAAyB;IAEvC,YAAY,IAAI,EAAE,sBAAsB,EAGvC;IAED,IAAI,KAAK,IAAI,aAAa,CAEzB;IAED,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAGhD;IAED,aAAa,IAAI,IAAI,CAEpB;IAED,gBAAgB,IAAI,IAAI,CAEvB;IAED,OAAO,CAAC,OAAO;IAcf,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,aAAa,CAInB;IAEF,OAAO,CAAC,MAAM;CAKf"}

package/dist/orchestrator/zitadel-login.d.ts

@@ -1,213 +0,0 @@
-import { type ZitadelProject } from "@zitadel/api/config";
-import type { CreateFlowBodyPurpose } from "@zitadel/api/generated/model";
-import { LitElement, type PropertyValues } from "lit";
-import "../atoms/index.js";
-import { type Locale } from "./locales/index.js";
-/**
- * `<zitadel-login>` — the auth-UI orchestrator.
- *
- * Drives the typed `@zitadel/api` Flow API directly: `POST /flow`
- * starts a flow, `POST /flow/{id}/submit` advances it. Renders each step
- * through LiquidJS, sanitises the output via DOMPurify, and mounts the
- * result inside a real `<form>` element in its Shadow DOM via Lit's
- * `unsafeHTML` directive. Atom CustomEvents (`zl-input` / `zl-submit`)
- * and the form's native `submit` event feed back into the
- * submit cycle.
- *
- * Form participation: the orchestrator owns the `<form>` so Enter submits,
- * browsers offer "save password" prompts, and password managers / autofill
- * see a real form. Each `<zl-field>` is form-associated (see
- * `docs/design/branding/form-participation.md`) so its value participates in
- * the form even though it lives inside its own shadow root. The shadow root
- * also delegates focus, and after each step swap focus moves to the first
- * field so screen-reader and keyboard users land in a sensible spot.
- *
- * Session/state: the server is stateless between requests — a `_zflow`
- * HttpOnly cookie carries orchestration state. We always run with
- * `credentials: "include"` (set in `api-client.ts`). The flow handle (`id`)
- * may rotate on pivots/pops; we re-read it from every response.
- *
- * Spec sources:
- * - `docs/design/flowengine/flow-engine-guide.md`
- * - `docs/design/branding/templates.md`
- * - `docs/design/branding/tokens.md`
- * - `docs/design/branding/schema.md`
- * - `docs/design/branding/form-participation.md`
- * - `docs/design/flowengine/template-security.md`
- */
-export declare class ZitadelLogin extends LitElement {
-    static shadowRootOptions: ShadowRootInit;
-    static styles: import("lit").CSSResult;
-    accessor purpose: CreateFlowBodyPurpose;
-    /**
-     * SDK project handle returned by `configureZitadel()`. Set from JS (or a
-     * framework binding). When set, takes precedence over both the
-     * `project-id`/`proxy-path`/`url` attributes and the global singleton from
-     * `getZitadelConfig()`.
-     */
-    accessor project: ZitadelProject | undefined;
-    /**
-     * Project ID, set declaratively in HTML. Lets the component be configured on
-     * a plain page without JS or `configureZitadel()`. Ignored when the `project`
-     * property or a `configureZitadel()` global is set. See {@link projectAttrs}.
-     */
-    accessor projectId: string;
-    /**
-     * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.
-     * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.
-     */
-    accessor proxyPath: string;
-    /**
-     * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —
-     * not needed in client-only setups.
-     */
-    accessor url: string;
-    /**
-     * URL to navigate to after a successful embedded sign-in. When set, the
-     * orchestrator exchanges the terminal `handoff_token` via the generated
-     * API client (setting the session cookie) and then performs a full
-     * navigation to this URL so host middleware can observe the cookie.
-     * For `complete: "redirect"` the orchestrator follows `redirect_uri`
-     * instead and does not run the exchange.
-     */
-    accessor postSignInUrl: string;
-    /**
-     * Existing flow handle to resume rather than start a new flow. When set,
-     * the orchestrator hits `GET /flow/{id}` instead of `POST /flow` on
-     * mount, so a page reload after a network blip can re-render the same
-     * step without losing collected state.
-     */
-    accessor resumeFlowId: string;
-    /**
-     * BCP 47 language tag (e.g. `"de"`, `"en-US"`). The widget resolves this
-     * to a built-in locale dictionary. Falls back to auto-detection from
-     * `document.documentElement.lang` or `navigator.language` when empty.
-     */
-    accessor lang: string;
-    /**
-     * Custom locale dictionaries keyed by language code. When set, these take
-     * precedence over the built-in dictionaries for matching language codes.
-     *
-     * ```ts
-     * import { en } from "@zitadel/components";
-     * const locales = {
-     *   en: { ...en, "identifier.title": "Welcome" },
-     *   de: myGermanDict,
-     * };
-     * ```
-     */
-    accessor locales: Record<string, Locale> | undefined;
-    private accessor response;
-    private accessor branding;
-    private accessor loading;
-    private accessor startupError;
-    private accessor formValues;
-    private readonly themeController;
-    private engine;
-    private readonly sanitise;
-    /**
-     * Cached compiled tenant template, keyed by source string. Re-rendering on
-     * every `formValues` change otherwise re-parses the same template.
-     */
-    private tenantTemplateCache;
-    createRenderRoot(): HTMLElement | DocumentFragment;
-    /**
-     * Start the flow after the first render rather than in `connectedCallback`.
-     * Frameworks that wrap web components (e.g. `@lit/react` in the console)
-     * attach the element first and then assign object properties (`branding`,
-     * `locale`) via setters. `connectedCallback` runs synchronously on attach
-     * — before any setters from a wrapper's effects/refs — so reading those
-     * properties there sees stale defaults. `firstUpdated` runs after Lit's
-     * first render, by which time setters from the wrapping framework have
-     * fired.
-     */
-    protected firstUpdated(): void;
-    /**
-     * Resolves the effective locale dictionary. The built-in dictionary for the
-     * resolved language is used as the base; entries from the `locales` map (if
-     * set) are spread on top so partial overrides work without importing and
-     * spreading the full base dictionary.
-     *
-     * Priority: explicit `lang` attr → `navigator.language` (user preference)
-     * → `document.documentElement.lang` (page default) → English fallback.
-     */
-    private resolveLocale;
-    willUpdate(changed: PropertyValues<this>): void;
-    updated(changed: PropertyValues<this>): void;
-    private hydrateStepAfterRender;
-    render(): import("lit").TemplateResult<1>;
-    /**
-     * Inject the attribution badge into the rendered template's
-     * `<zl-page-shell>` footer slot. The attribution must live INSIDE the
-     * page-shell so it sits within the 100vh viewport rhythm (matching the
-     * Figma sign-in frame where the pill sits 24px below the card, both
-     * centred on the page). It can't be a sibling of the page-shell because
-     * the page-shell already occupies the full viewport height.
-     *
-     * This markup is appended AFTER `renderStep` has sanitised the Liquid
-     * output, so it is not run through DOMPurify. It is orchestrator-owned and
-     * any tenant-supplied values (`custom_link`) are escaped via `escapeHtml`.
-     */
-    private injectAttribution;
-    /**
-     * "Secured with Zitadel" attribution chrome injected into every
-     * template's page-shell footer slot. Controlled by
-     * `branding.attribution.show_zitadel` — defaults to `true` for
-     * community / OSS deployments. Licensed tenants can suppress the badge
-     * entirely or swap it for a `custom_link` value.
-     */
-    private renderAttributionHtml;
-    /** Declarative config read from this element's attributes. */
-    private get projectAttrs();
-    private startFlow;
-    private applyResponse;
-    private maybeCompleteFlow;
-    private renderStep;
-    /**
-     * Build a `FlowIdentity` from the orchestrator's captured form values so
-     * the signed-in template can greet the user by email without the API
-     * having to round-trip identity claims. Email comes from the
-     * identifier step; display name composes from `given_name` /
-     * `family_name` when the register step ran.
-     */
-    private deriveIdentity;
-    private applyValuesToFields;
-    private captureValuesFromFields;
-    private currentFieldValue;
-    private handleAtomInput;
-    private syncFieldElementValue;
-    private handleAtomSubmit;
-    /** Secondary navigation rows (`data-action` on `.zl-card-nav__link`). */
-    private handleDelegatedAction;
-    private handleFormSubmit;
-    /**
-     * Handle a successful WebAuthn ceremony. Auto-submit with the proof
-     * as `challenge_response` so the flow advances without extra user
-     * interaction — the ceremony IS the factor verification (ADR 013).
-     */
-    private handlePasskeyResult;
-    /**
-     * Handle a WebAuthn ceremony error. Re-render the current step with
-     * an error message so the user sees feedback and can retry or skip.
-     *
-     * Guard: if the step already carries the same error key, skip the update.
-     * Mutating `this.response` triggers `unsafeHTML` to replace the DOM tree,
-     * which reconnects a fresh `<zl-passkey>` that immediately re-starts the
-     * ceremony — creating an infinite loop. The guard breaks the cycle.
-     *
-     * We also strip the `challenge` from the step so the template does not
-     * render a new `<zl-passkey>` on re-render. Without this, the first
-     * cancel would trigger a second ceremony (the guard prevents a third).
-     */
-    private handlePasskeyError;
-    private findPrimaryAction;
-    private moveFocusToFirstField;
-    private submit;
-    private handleTransportError;
-}
-declare global {
-    interface HTMLElementTagNameMap {
-        "zitadel-login": ZitadelLogin;
-    }
-}
-//# sourceMappingURL=zitadel-login.d.ts.map

package/dist/orchestrator/zitadel-login.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"zitadel-login.d.ts","sourceRoot":"","sources":["../../src/orchestrator/zitadel-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAGV,qBAAqB,EAGtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAa,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,KAAK,CAAC;AAKjE,OAAO,mBAAmB,CAAC;AAgB3B,OAAO,EAAsB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBACa,YAAa,SAAQ,UAAU;IAC1C,OAAgB,iBAAiB,EAAE,cAAc,CAG/C;IAOF,OAAgB,MAAM,0BAMpB;IAE0B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAW;IAE9E;;;;;OAKG;IAC6B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IAE7E;;;;OAIG;IACkD,QAAQ,CAAC,SAAS,SAAM;IAE7E;;;OAGG;IACkD,QAAQ,CAAC,SAAS,SAAM;IAE7E;;;OAGG;IACyB,QAAQ,CAAC,GAAG,SAAM;IAE9C;;;;;;;OAOG;IACwD,QAAQ,CAAC,aAAa,SAAM;IAEvF;;;;;OAKG;IACsD,QAAQ,CAAC,YAAY,SAAM;IAEpF;;;;OAIG;IACH,SAA8C,IAAI,SAAM;IAExD;;;;;;;;;;;OAWG;IAC6B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAE5E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IAEvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAE5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IAEpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAElE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D,OAAO,CAAC,MAAM,CAAuB;IAErC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C;;;OAGG;IACH,OAAO,CAAC,mBAAmB,CAAyD;IAE3E,gBAAgB,IAAI,WAAW,GAAG,gBAAgB,CA+B1D;IAED;;;;;;;;;OASG;IACH,UAAmB,YAAY,IAAI,IAAI,CAItC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAYZ,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAavD;IAEQ,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAIpD;YASa,sBAAsB;IAU3B,MAAM,oCAkBd;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAe7B,8DAA8D;IAC9D,OAAO,KAAK,YAAY,GAEvB;YAEa,SAAS;IA4BvB,OAAO,CAAC,aAAa;YA0BP,iBAAiB;IAoC/B,OAAO,CAAC,UAAU;IAuDlB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,uBAAuB;IAyB/B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,eAAe,CAOrB;IAEF,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,gBAAgB,CAGtB;IAEF,yEAAyE;IACzE,OAAO,CAAC,qBAAqB,CAO3B;IAEF,OAAO,CAAC,gBAAgB,CAatB;IAEF;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAUzB;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,kBAAkB,CAexB;IAEF,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;YAQf,MAAM;IAqCpB,OAAO,CAAC,oBAAoB;CAO7B;AAWD,OAAO,CAAC,MAAM,CAAC,CAAC;IACd,UAAU,qBAAqB;QAC7B,eAAe,EAAE,YAAY,CAAC;KAC/B;CACF"}

package/dist/orchestrator/zitadel-logout.d.ts

@@ -1,114 +0,0 @@
-import { LitElement, nothing } from "lit";
-import { type ZitadelProject } from "@zitadel/api/config";
-/**
- * `<zitadel-logout>` — orchestrator-tier element that lets the signed-in user
- * sign out without touching the flow API.
- *
- * Reads the user's display name + email from the `__nextgen_display` cookie
- * (set by the auth backend on sign-in), renders an avatar trigger with a
- * dropdown that exposes a "Sign out" action, and calls the typed
- * `revokeMySession` operation in `@zitadel/api`
- * (`DELETE /sessions/me`). The server clears the session cookie via
- * `Set-Cookie: Max-Age=0`; on success the element fires `zitadel-signout`
- * and optionally navigates to `post-sign-out-url`. (`getEndSessionUrl()`
- * additionally exposes the OIDC end-session URL for consumers that prefer a
- * user-agent-driven redirect.)
- *
- * ## Template-slot mode
- *
- * When the consumer projects a `<template>` child the element renders the
- * template's clone into its light DOM with `{{name}}`, `{{email}}`, and
- * `{{initial}}` substituted. Any element with `data-action="logout"` inside
- * the cloned template triggers the sign-out flow. This mirrors the
- * placeholder `<nextgen-logout>`'s contract so existing markup keeps working.
- *
- * Default styles consume the `--zl-*` design tokens so tenant branding
- * applies automatically — there is no hardcoded brand colour, radius, or
- * shadow.
- */
-export declare class ZitadelLogout extends LitElement {
-    static styles: import("lit").CSSResult[];
-    /**
-     * SDK project handle returned by `configureZitadel()`. Set from JS (or a
-     * framework binding). When set, takes precedence over both the
-     * `project-id`/`proxy-path`/`url` attributes and the global singleton from
-     * `getZitadelConfig()`.
-     */
-    accessor project: ZitadelProject | undefined;
-    /**
-     * Project ID, set declaratively in HTML. Lets the component be configured on
-     * a plain page without JS or `configureZitadel()`. Ignored when the `project`
-     * property or a `configureZitadel()` global is set.
-     */
-    accessor projectId: string;
-    /**
-     * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.
-     * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.
-     */
-    accessor proxyPath: string;
-    /**
-     * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —
-     * not needed in client-only setups.
-     */
-    accessor url: string;
-    /** URL to navigate to after a successful sign-out. */
-    accessor postSignOutUrl: string;
-    /**
-     * OIDC `client_id` to forward as a query parameter on the end-session
-     * request, mirroring the standard end-session contract. Optional —
-     * leaving this empty is fine when the backend can resolve the client
-     * from the session cookie alone.
-     */
-    accessor clientId: string;
-    private accessor displayName;
-    private accessor displayEmail;
-    private accessor open;
-    private accessor loading;
-    private accessor errorMessage;
-    private templateMode;
-    connectedCallback(): void;
-    disconnectedCallback(): void;
-    updated(): void;
-    /**
-     * Decodes the `__nextgen_display` cookie (base64-encoded JSON, set by the
-     * auth backend on sign-in) and populates `displayName` / `displayEmail`.
-     * A missing or malformed cookie is intentionally non-fatal — the dropdown
-     * still renders, just with empty values.
-     */
-    private readDisplayCookie;
-    private get initial();
-    /**
-     * Clones a consumer-supplied `<template>` into the light DOM, fills the
-     * `{{name}}`, `{{email}}`, and `{{initial}}` tokens via a TreeWalker, and
-     * wires every element with `data-action="logout"` to trigger sign-out.
-     * Light-DOM mounting is deliberate so the consumer's existing CSS applies.
-     */
-    private renderTemplate;
-    private readonly handleDocumentClick;
-    private readonly handleDocumentKeydown;
-    private toggleOpen;
-    /**
-     * Calls `DELETE /sessions/me` (`revokeMySession`) with `credentials: "include"`.
-     * The server validates the `__nextgen_session` cookie, deletes the session, and
-     * clears the cookie via `Set-Cookie: Max-Age=0`. On success this element fires
-     * `zitadel-signout` and optionally navigates to `postSignOutUrl`.
-     */
-    /** Declarative config read from this element's attributes. */
-    private get projectAttrs();
-    private doLogout;
-    /**
-     * Returns the absolute URL the end-session request will hit. Useful for
-     * test assertions and for consumers that prefer to navigate the browser
-     * directly (instead of fetching) so the OIDC session-end redirect is
-     * driven by the user agent.
-     */
-    getEndSessionUrl(): string;
-    private handleSignOutClick;
-    render(): typeof nothing | import("lit").TemplateResult<1>;
-}
-declare global {
-    interface HTMLElementTagNameMap {
-        "zitadel-logout": ZitadelLogout;
-    }
-}
-//# sourceMappingURL=zitadel-logout.d.ts.map

package/dist/orchestrator/zitadel-logout.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"zitadel-logout.d.ts","sourceRoot":"","sources":["../../src/orchestrator/zitadel-logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAa,OAAO,EAAE,MAAM,KAAK,CAAC;AAErD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBACa,aAAc,SAAQ,UAAU;IAC3C,OAAgB,MAAM,4BA2IpB;IAEF;;;;;OAKG;IAC6B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IAE7E;;;;OAIG;IACkD,QAAQ,CAAC,SAAS,SAAM;IAE7E;;;OAGG;IACkD,QAAQ,CAAC,SAAS,SAAM;IAE7E;;;OAGG;IACyB,QAAQ,CAAC,GAAG,SAAM;IAE9C,sDAAsD;IACM,QAAQ,CAAC,cAAc,SAAM;IAEzF;;;;;OAKG;IACiD,QAAQ,CAAC,QAAQ,SAAM;IAElE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAM;IAElC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAM;IAEnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAE9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAM;IAK5C,OAAO,CAAC,YAAY,CAAS;IAEpB,iBAAiB,IAAI,IAAI,CAajC;IAEQ,oBAAoB,IAAI,IAAI,CAIpC;IAEQ,OAAO,IAAI,IAAI,CAKvB;IAED;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAazB,OAAO,KAAK,OAAO,GAGlB;IAED;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAIlC;IAEF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAKpC;IAEF,OAAO,CAAC,UAAU;IAKlB;;;;;OAKG;IACH,8DAA8D;IAC9D,OAAO,KAAK,YAAY,GAEvB;YAEa,QAAQ;IAwBtB;;;;;OAKG;IACH,gBAAgB,IAAI,MAAM,CAOzB;IAED,OAAO,CAAC,kBAAkB;IAKjB,MAAM,qDAsEd;CACF;AA0BD,OAAO,CAAC,MAAM,CAAC,CAAC;IACd,UAAU,qBAAqB;QAC7B,gBAAgB,EAAE,aAAa,CAAC;KACjC;CACF"}