@zitadel/components 0.1.0-alpha.9 → 1.0.0-alpha.21

package/dist/index-DB_JTtln.d.mts

@@ -1,1000 +0,0 @@
-import { $ as GetFlowStep200, A as CreateFlowDefinitionBody, At as RevokeTokenBody, B as CreateTeamBody, Bt as VerifyChallengeProofBody, C as CreateFlow201StepChallenge, Ct as ListFlowDefinitions200, D as CreateFlowBody, Dt as ListUsers200Item, E as CreateFlow201StepSsoProvidersItem, Et as ListSessionsParams, F as CreateSchemaBody, Ft as SubmitFlowStepBody, G as DeleteFlowDefinitionParams, H as CreateUser201, I as CreateSchemaParams, It as UpdateFlowDefinition200, J as ExchangeHandoffBody, K as EndSessionParams, L as CreateSession201, Lt as UpdateFlowDefinitionBody, M as CreateProject201, Mt as SetUserPasswordParams, N as CreateProjectBody, Nt as SubmitFlowEventBody, O as CreateFlowBodyPurpose, Ot as ListUsersParams, P as CreateSchema201, Pt as SubmitFlowStep200, Q as GetFlowDefinitionParams, R as CreateSessionBody, Rt as UpdateFlowDefinitionParams, S as CreateFlow201StepActionsItem, St as IssueChallengeBody, T as CreateFlow201StepGates, Tt as ListSessions200, U as CreateUserBody, V as CreateTeamParams, W as CreateUserParams, X as GetAuthAttempt200, Y as ExchangeHandoffParams, Z as GetFlowDefinition200, _ as CreateAuthAttemptBody, _t as GetUserByIDParams, at as GetOpenIDConfiguration200, b as CreateFlow201BrandingLayout, bt as IntrospectBody, ct as GetSchemaById200, dt as GetSessionParams, et as GetHealthDefault, f as AuthorizeDevice200, ft as GetTeam200, g as CreateAuthAttempt201, gt as GetUserByID200, h as AuthorizeGetParams, ht as GetTokenBody, it as GetMyUser200, j as CreateHandoff200, jt as SetUserPasswordBody, k as CreateFlowDefinition201, kt as RevokeSessionParams, lt as GetSchemaByIdParams, m as AuthorizeGetDefault, mt as GetToken200, nt as GetLiveDefault, ot as GetProject200, p as AuthorizeDeviceParams, pt as GetTeamParams, q as ExchangeHandoff200, rt as GetMySession200, st as GetReadyDefault, tt as GetKeys200, ut as GetSession200, v as CreateFlow201, vt as GetUserInfo200, w as CreateFlow201StepFieldsItem, wt as ListFlowDefinitionsParams, x as CreateFlow201Step, xt as IssueChallenge201, y as CreateFlow201Branding, yt as Introspect200, z as CreateTeam201, zt as VerifyChallengeProof200 } from "./index-DVDCrfkv.mjs";
-import * as _$lit from "lit";
-import { LitElement, PropertyValues, ReactiveController, ReactiveControllerHost, nothing } from "lit";
-import layoutChromeCss from "./templates/layout-chrome.css?inline";
-
-//#region ../api/dist/zitadelNextGen-BS4VE7_Y.d.mts
-//#region src/generated/endpoints/zitadelNextGen.d.ts
-declare namespace zitadelNextGen_d_exports {
-  export { authorizeDevice, authorizeGet, createAuthAttempt, createFlow, createFlowDefinition, createHandoff, createProject, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, endSession, exchangeHandoff, getAuthAttempt, getAuthorizeDeviceUrl, getAuthorizeGetUrl, getCreateAuthAttemptUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getEndSessionUrl, getExchangeHandoffUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetHealthUrl, getGetKeysUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetOpenIDConfigurationUrl, getGetProjectUrl, getGetReadyUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetTokenUrl, getGetUserByIDUrl, getGetUserInfoUrl, getHealth, getIntrospectUrl, getIssueChallengeUrl, getKeys, getListFlowDefinitionsUrl, getListSessionsUrl, getListUsersUrl, getLive, getMySession, getMyUser, getOpenIDConfiguration, getProject, getReady, getRevokeMySessionUrl, getRevokeSessionUrl, getRevokeTokenUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowEventUrl, getSubmitFlowStepUrl, getTeam, getToken, getUpdateFlowDefinitionUrl, getUserByID, getUserInfo, getVerifyChallengeProofUrl, introspect, issueChallenge, listFlowDefinitions, listSessions, listUsers, revokeMySession, revokeSession, revokeToken, setUserPassword, submitFlowEvent, submitFlowStep, updateFlowDefinition, verifyChallengeProof };
-}
-declare const getGetOpenIDConfigurationUrl: () => string;
-/**
- * Retrieve the OpenID Connect configuration
- * @summary Get OpenID Connect configuration
- */
-declare const getOpenIDConfiguration: (options?: RequestInit) => Promise<GetOpenIDConfiguration200>;
-declare const getAuthorizeGetUrl: (params: AuthorizeGetParams) => string;
-/**
- * @summary Authorize a user
- */
-declare const authorizeGet: (params: AuthorizeGetParams, options?: RequestInit) => Promise<AuthorizeGetDefault>;
-declare const getAuthorizeDeviceUrl: (params: AuthorizeDeviceParams) => string;
-/**
- * @summary Authorize a device
- */
-declare const authorizeDevice: (params: AuthorizeDeviceParams, options?: RequestInit) => Promise<AuthorizeDevice200>;
-declare const getEndSessionUrl: (params?: EndSessionParams) => string;
-/**
- * @summary End a session
- */
-declare const endSession: (params?: EndSessionParams, options?: RequestInit) => Promise<void>;
-declare const getIntrospectUrl: () => string;
-/**
- * @summary Introspect a token
- */
-declare const introspect: (introspectBody: IntrospectBody, options?: RequestInit) => Promise<Introspect200>;
-declare const getGetKeysUrl: () => string;
-/**
- * @summary Get public keys
- */
-declare const getKeys: (options?: RequestInit) => Promise<GetKeys200>;
-declare const getRevokeTokenUrl: () => string;
-/**
- * @summary Revoke an access token or refresh token
- */
-declare const revokeToken: (revokeTokenBody: RevokeTokenBody, options?: RequestInit) => Promise<void>;
-declare const getGetTokenUrl: () => string;
-/**
- * @summary Get accesstoken
- */
-declare const getToken: (getTokenBody: GetTokenBody, options?: RequestInit) => Promise<GetToken200>;
-declare const getGetUserInfoUrl: () => string;
-/**
- * @summary Get user info
- */
-declare const getUserInfo: (options?: RequestInit) => Promise<GetUserInfo200>;
-declare const getGetHealthUrl: () => string;
-/**
- * Check whether the server is healthy
- * @summary Check server health
- */
-declare const getHealth: (options?: RequestInit) => Promise<GetHealthDefault>;
-declare const getGetLiveUrl: () => string;
-/**
- * Check whether the server is started
- * @summary Check server liveness
- */
-declare const getLive: (options?: RequestInit) => Promise<GetLiveDefault>;
-declare const getGetReadyUrl: () => string;
-/**
- * Check whether the server is ready to accept requests
- * @summary Check server readiness
- */
-declare const getReady: (options?: RequestInit) => Promise<GetReadyDefault>;
-declare const getCreateUserUrl: (params: CreateUserParams) => string;
-/**
- * @summary Create user
- */
-declare const createUser: (createUserBody: CreateUserBody, params: CreateUserParams, options?: RequestInit) => Promise<CreateUser201>;
-declare const getListUsersUrl: (params?: ListUsersParams) => string;
-/**
- * @summary List users
- */
-declare const listUsers: (params?: ListUsersParams, options?: RequestInit) => Promise<ListUsers200Item[]>;
-declare const getGetUserByIDUrl: (userId: string, params: GetUserByIDParams) => string;
-/**
- * @summary Get user by ID
- */
-declare const getUserByID: (userId: string, params: GetUserByIDParams, options?: RequestInit) => Promise<GetUserByID200>;
-declare const getSetUserPasswordUrl: (userId: string, params: SetUserPasswordParams) => string;
-/**
- * @summary Set user password
- */
-declare const setUserPassword: (userId: string, setUserPasswordBody: SetUserPasswordBody, params: SetUserPasswordParams, options?: RequestInit) => Promise<void>;
-declare const getGetMyUserUrl: () => string;
-/**
- * @summary Get my user information
- */
-declare const getMyUser: (options?: RequestInit) => Promise<GetMyUser200>;
-declare const getCreateFlowUrl: () => string;
-/**
- * Resolves a flow definition based on purpose + audience context and returns
-the first capability step. Creates a new session implicitly unless
-`session_id` is provided (for step-up / reauth on an existing session).
-
-The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
-
-The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
-the flow's orchestration state (current step, collected data, history).
-The server is stateless between requests — all flow state lives in this
-cookie. The browser sends it automatically on subsequent requests.
-
- * @summary Start a new flow
- */
-declare const createFlow: (createFlowBody: CreateFlowBody, options?: RequestInit) => Promise<CreateFlow201>;
-declare const getGetFlowStepUrl: (id: string) => string;
-/**
- * Returns the current capability step without advancing the state machine.
-Useful for page reloads or re-rendering after a network error.
-
- * @summary Get current step (re-render)
- */
-declare const getFlowStep: (id: string, options?: RequestInit) => Promise<GetFlowStep200>;
-declare const getSubmitFlowStepUrl: (id: string) => string;
-/**
- * Submits user input for the current step. The server validates,
-processes (e.g., verifies a credential), advances the state machine
-through any invisible steps, and returns the next visible step.
-
-The response sets an updated encrypted `HttpOnly` cookie (`_zflow`)
-with the new flow state. The server is stateless — all orchestration
-state is carried in this cookie between requests.
-
-**Important:** The `id` in the response may differ from the `id` used in
-the request. This happens when a flow pivots (pushes a new flow onto the
-stack) or when a stacked flow completes (auto-pops to the parent flow).
-Always use the `id` from the latest response for the next request.
-
-## Flow completion
-
-When `step.type` is `complete`, the flow is terminal. The `step.behavior`
-field tells the frontend what to do:
-
-| `behavior`   | Action                                                     |
-|------------- |------------------------------------------------------------|
-| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |
-| `show`       | Render the step as a success screen (e.g., registration).  |
-
-A `complete` step is only returned when the **entire flow stack** is done.
-If a stacked flow (e.g., recovery pivoted from login) finishes, the server
-auto-pops to the parent flow and returns the parent's next step — the
-frontend never sees a `complete` for intermediate flows.
-
- * @summary Submit step data and advance
- */
-declare const submitFlowStep: (id: string, submitFlowStepBody: SubmitFlowStepBody, options?: RequestInit) => Promise<SubmitFlowStep200>;
-declare const getSubmitFlowEventUrl: (id: string) => string;
-/**
- * Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
- * @summary Submit client-side event
- */
-declare const submitFlowEvent: (id: string, submitFlowEventBody: SubmitFlowEventBody, options?: RequestInit) => Promise<void>;
-declare const getCreateAuthAttemptUrl: () => string;
-/**
- * Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
-
-An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
-It accepts factor challenges, verifies proofs, and completes into a session or handoff token.
-
-Accepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,
-also include session_id to add factors to an existing session.
-
- * @summary Create a new authentication attempt
- */
-declare const createAuthAttempt: (createAuthAttemptBody: CreateAuthAttemptBody, options?: RequestInit) => Promise<CreateAuthAttempt201>;
-declare const getGetAuthAttemptUrl: (attemptId: string) => string;
-/**
- * Polls the current state of an authentication attempt.
-
-Returns the attempt's state, available factors for the next challenge,
-challenges issued so far, and any errors preventing progress.
-
-Use this for polling during long-running factor verifications (e.g., waiting for
-a federated IdP callback or a device flow).
-
- * @summary Get authentication attempt state
- */
-declare const getAuthAttempt: (attemptId: string, options?: RequestInit) => Promise<GetAuthAttempt200>;
-declare const getIssueChallengeUrl: (attemptId: string) => string;
-/**
- * Issues a single-factor verification challenge within an auth attempt.
-
-This advances the authentication state machine by requesting a specific factor method
-(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details
-including method, metadata, and any UI hints. The client then verifies the proof
-by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
-
- * @summary Issue a factor challenge
- */
-declare const issueChallenge: (attemptId: string, issueChallengeBody: IssueChallengeBody, options?: RequestInit) => Promise<IssueChallenge201>;
-declare const getVerifyChallengeProofUrl: (attemptId: string, challengeId: string) => string;
-/**
- * Submits a proof (credential, code, assertion) to verify a factor challenge.
-
-The proof format depends on the challenge method. For example:
-- `password` method: { password: "…" }
-- `totp` method: { totp: { code: "123456" } }
-- `passkey` method: { passkey: { assertion: "…" } }
-- `recovery_code` method: { recovery_code: "…" }
-
-On successful verification, the factor is written to the auth attempt.
-The attempt moves to the next pending challenge or completes if all required factors are verified.
-
- * @summary Verify a factor proof
- */
-declare const verifyChallengeProof: (attemptId: string, challengeId: string, verifyChallengeProofBody: VerifyChallengeProofBody, options?: RequestInit) => Promise<VerifyChallengeProof200>;
-declare const getCreateHandoffUrl: (attemptId: string) => string;
-/**
- * Completes the authentication attempt and mints a `handoff_token`.
-
-Call this after all required factors have been verified and the attempt is in `completed` state.
-The handoff token is short-lived (≤60 seconds) and must be exchanged at
-POST /sessions/exchange to receive the final session and session_token.
-
-The handoff token is:
-- Single-use (atomic exchange, no retry)
-- Audience-bound (requires matching project key for exchange)
-- Idempotency-safe within a 5-minute window (see conventions)
-
- * @summary Complete authentication and create handoff token
- */
-declare const createHandoff: (attemptId: string, options?: RequestInit) => Promise<CreateHandoff200>;
-declare const getCreateProjectUrl: () => string;
-/**
- * @summary Create project
- */
-declare const createProject: (createProjectBody: CreateProjectBody, options?: RequestInit) => Promise<CreateProject201>;
-declare const getGetProjectUrl: (projectId: string) => string;
-/**
- * Returns the current state of a project.
-
- * @summary Get project
- */
-declare const getProject: (projectId: string, options?: RequestInit) => Promise<GetProject200>;
-declare const getCreateSessionUrl: () => string;
-/**
- * Creates an anonymous session shell with no user and no factors (`state: building`).
-
-This is optional — an `auth_attempt` will create a session implicitly if none is provided.
-Use this explicitly when you want to:
-- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
-  can be correlated with the eventual authenticated session from the start.
-- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
-
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
-
-Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
-full session TTL when the first authentication factor is written via a completing `auth_attempt`.
-
- * @summary Create an anonymous session shell
- */
-declare const createSession: (createSessionBody: CreateSessionBody, options?: RequestInit) => Promise<CreateSession201>;
-declare const getListSessionsUrl: (params: ListSessionsParams) => string;
-/**
- * Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
-
- * @summary List sessions
- */
-declare const listSessions: (params: ListSessionsParams, options?: RequestInit) => Promise<ListSessions200>;
-declare const getExchangeHandoffUrl: (params: ExchangeHandoffParams) => string;
-/**
- * Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`
-and returns the resulting session and a `session_token`.
-
-The server resolves the originating `auth_attempt` from the token and then:
-
-| Originating auth_attempt | Outcome |
-|---|---|
-| No `session_id` | A new authenticated session is **created**. |
-| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |
-| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |
-
-The response shape is identical in all three cases.
-
-The `session_token` supersedes any previously issued `session_token` for the same session.
-Clients must replace their stored token at this point.
-
-Requires a project service key (OAuth2 client credentials).
-
- * @summary Exchange handoff token for a session
- */
-declare const exchangeHandoff: (exchangeHandoffBody: ExchangeHandoffBody, params: ExchangeHandoffParams, options?: RequestInit) => Promise<ExchangeHandoff200>;
-declare const getGetSessionUrl: (sessionId: string, params: GetSessionParams) => string;
-/**
- * Returns the current state of a session including its factors and all currently
-satisfied assurance levels.
-
-`assurance_levels[]` may shrink over time as factor freshness windows expire,
-without the session itself expiring. Use step-up authentication (a new `auth_attempt`
-against the same `session_id`) to restore a dropped assurance level.
-
- * @summary Get session state
- */
-declare const getSession: (sessionId: string, params: GetSessionParams, options?: RequestInit) => Promise<GetSession200>;
-declare const getRevokeSessionUrl: (sessionId: string, params: RevokeSessionParams) => string;
-/**
- * Revokes the session immediately (`state: revoked`). This is the logout operation.
-
-The session_token issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated.
-
- * @summary Revoke session
- */
-declare const revokeSession: (sessionId: string, params: RevokeSessionParams, options?: RequestInit) => Promise<void>;
-declare const getGetMySessionUrl: () => string;
-/**
- * Returns the current state of the current session including its factors and all currently
-satisfied assurance levels.
-
-`assurance_levels[]` may shrink over time as factor freshness windows expire,
-without the session itself expiring. Use step-up authentication (a new `auth_attempt`
-against the same `session_id`) to restore a dropped assurance level.
-
- * @summary Get my session state
- */
-declare const getMySession: (options?: RequestInit) => Promise<GetMySession200>;
-declare const getRevokeMySessionUrl: () => string;
-/**
- * Revokes the session immediately (`state: revoked`). This is the logout operation.
-
-The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
-
- * @summary Revoke my session
- */
-declare const revokeMySession: (options?: RequestInit) => Promise<void>;
-declare const getCreateSchemaUrl: (params: CreateSchemaParams) => string;
-/**
- * Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
-
-The schema can either be a concrete schema, e.g. a user schema, or a
-schema-url which will be resolved by the server.
-
- * @summary Create new schema
- */
-declare const createSchema: (createSchemaBody: CreateSchemaBody, params: CreateSchemaParams, options?: RequestInit) => Promise<CreateSchema201>;
-declare const getGetSchemaByIdUrl: (id: string, params: GetSchemaByIdParams) => string;
-/**
- * Get a schema by its ID. This will return the default revision of the schema.
- * @summary Get schema by ID
- */
-declare const getSchemaById: (id: string, params: GetSchemaByIdParams, options?: RequestInit) => Promise<GetSchemaById200>;
-declare const getCreateFlowDefinitionUrl: () => string;
-/**
- * Creates a new flow definition.
-Flow definitions are templates that define the sequence of steps (capabilities)
-for a particular user journey (e.g., registration, login, password reset).
-
-Flow definitions are created based on the flow meta schema, which includes the flow's purpose, audience, and the steps involved.
-
- * @summary Create a new flow definition
- */
-declare const createFlowDefinition: (createFlowDefinitionBody: CreateFlowDefinitionBody, options?: RequestInit) => Promise<CreateFlowDefinition201>;
-declare const getListFlowDefinitionsUrl: (params: ListFlowDefinitionsParams) => string;
-/**
- * Retrieves a list of all flow definitions.
-This endpoint can be used to view existing flow definitions and their configurations.
-
- * @summary List flow definitions
- */
-declare const listFlowDefinitions: (params: ListFlowDefinitionsParams, options?: RequestInit) => Promise<ListFlowDefinitions200>;
-declare const getGetFlowDefinitionUrl: (id: string, params: GetFlowDefinitionParams) => string;
-/**
- * Get a flow definition by id
- * @summary Get a flow definition by id
- */
-declare const getFlowDefinition: (id: string, params: GetFlowDefinitionParams, options?: RequestInit) => Promise<GetFlowDefinition200>;
-declare const getUpdateFlowDefinitionUrl: (id: string, params: UpdateFlowDefinitionParams) => string;
-/**
- * Update a flow definition by id
- * @summary Update a flow definition by id
- */
-declare const updateFlowDefinition: (id: string, updateFlowDefinitionBody: UpdateFlowDefinitionBody, params: UpdateFlowDefinitionParams, options?: RequestInit) => Promise<UpdateFlowDefinition200>;
-declare const getDeleteFlowDefinitionUrl: (id: string, params: DeleteFlowDefinitionParams) => string;
-/**
- * Delete a flow definition by id
- * @summary Delete a flow definition by id
- */
-declare const deleteFlowDefinition: (id: string, params: DeleteFlowDefinitionParams, options?: RequestInit) => Promise<void>;
-declare const getCreateTeamUrl: (params: CreateTeamParams) => string;
-/**
- * @summary Create team
- */
-declare const createTeam: (params: CreateTeamParams, createTeamBody?: CreateTeamBody, options?: RequestInit) => Promise<CreateTeam201>;
-declare const getGetTeamUrl: (teamId: string, params: GetTeamParams) => string;
-/**
- * Returns the current state of a team.
-
- * @summary Get team
- */
-declare const getTeam: (teamId: string, params: GetTeamParams, options?: RequestInit) => Promise<GetTeam200>; //#endregion
-//#endregion
-//#region ../api/dist/runtime/api-factory.d.mts
-//#region src/runtime/api-factory.d.ts
-/**
- * Typed Zitadel client returned by {@link createZitadelClient}.
- * Mirrors the orval-generated endpoints module 1:1.
- */
-type ZitadelClient = typeof zitadelNextGen_d_exports;
-/** Re-exported under the legacy name some consumers (`runtime/config.ts`) still import. */
-type ZitadelApi = ZitadelClient;
-/** Options for {@link createZitadelClient}. */
-//#endregion
-//#region ../api/dist/runtime/config.d.mts
-/**
- * The initialized project handle returned by {@link configureZitadel}.
- * Pure data — use factory functions like {@link getApi} to derive services.
- */
-interface ZitadelProject {
-  /** Proxy path for API requests. */
-  readonly proxyPath: string;
-  /** Project ID passed to flow creation. */
-  readonly projectId: string;
-  /** Full URL of the Zitadel auth backend. */
-  readonly url?: string;
-}
-/**
- * Initializes app-wide SDK configuration and returns the frozen
- * {@link ZitadelProject} handle.
- *
- * Write-once — subsequent calls with the same values return the original
- * handle; calls with different values log a warning and return the
- * original. This prevents accidental overwrites while remaining safe
- * for HMR and framework double-mounts.
- */
-//#endregion
-//#region src/orchestrator/locales/en.d.ts
-/**
- * Minimal English locale dictionary.
- *
- * The `| t` filter looks up `text_key` strings here. Missing keys fall through
- * to the raw key (matches the spec in
- * `docs/design/flowengine/flow-engine-guide.md`).
- *
- * Text keys are auto-generated by the server from the flow definition:
- *   - Step titles:       `<step>.title`
- *   - Step descriptions: `<step>.description`
- *   - Field labels:      `<step>.field.<field>`
- *   - Action labels:     `<step>.action.<action>`
- *
- * Copy aligned to Figma screens file `xkvBjkOJ8ENuHdTGZHXezK` (May 2026).
- * MVP only — multi-locale support is deferred.
- */
-declare const en: Record<string, string>;
-type Locale = Record<string, string>;
-//#endregion
-//#region src/orchestrator/locales/de.d.ts
-declare const de: Locale;
-//#endregion
-//#region src/orchestrator/locales/it.d.ts
-declare const it: Locale;
-//#endregion
-//#region src/orchestrator/locales/index.d.ts
-declare const builtinLocales: Readonly<Record<string, Locale>>;
-//#endregion
-//#region src/orchestrator/zitadel-login.d.ts
-/**
- * `<zitadel-login>` — the auth-UI orchestrator.
- *
- * Drives the typed `@zitadel/api` Flow API directly: `POST /flow`
- * starts a flow, `POST /flow/{id}/submit` advances it. Renders each step
- * through LiquidJS, sanitises the output via DOMPurify, and mounts the
- * result inside a real `<form>` element in its Shadow DOM via Lit's
- * `unsafeHTML` directive. Atom CustomEvents (`zl-input` / `zl-submit`)
- * and the form's native `submit` event feed back into the
- * submit cycle.
- *
- * Form participation: the orchestrator owns the `<form>` so Enter submits,
- * browsers offer "save password" prompts, and password managers / autofill
- * see a real form. Each `<zl-field>` is form-associated (see
- * `docs/design/branding/form-participation.md`) so its value participates in
- * the form even though it lives inside its own shadow root. The shadow root
- * also delegates focus, and after each step swap focus moves to the first
- * field so screen-reader and keyboard users land in a sensible spot.
- *
- * Session/state: the server is stateless between requests — a `_zflow`
- * HttpOnly cookie carries orchestration state. We always run with
- * `credentials: "include"` (set in `api-client.ts`). The flow handle (`id`)
- * may rotate on pivots/pops; we re-read it from every response.
- *
- * Spec sources:
- * - `docs/design/flowengine/flow-engine-guide.md`
- * - `docs/design/branding/templates.md`
- * - `docs/design/branding/tokens.md`
- * - `docs/design/branding/schema.md`
- * - `docs/design/branding/form-participation.md`
- * - `docs/design/flowengine/template-security.md`
- */
-declare class ZitadelLogin extends LitElement {
-  static shadowRootOptions: ShadowRootInit;
-  static styles: _$lit.CSSResult;
-  accessor purpose: CreateFlowBodyPurpose;
-  /**
-   * SDK project handle returned by `configureZitadel()`. Set from JS (or a
-   * framework binding). When set, takes precedence over both the
-   * `project-id`/`proxy-path`/`url` attributes and the global singleton from
-   * `getZitadelConfig()`.
-   */
-  accessor project: ZitadelProject | undefined;
-  /**
-   * Project ID, set declaratively in HTML. Lets the component be configured on
-   * a plain page without JS or `configureZitadel()`. Ignored when the `project`
-   * property or a `configureZitadel()` global is set. See {@link projectAttrs}.
-   */
-  accessor projectId: string;
-  /**
-   * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.
-   * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.
-   */
-  accessor proxyPath: string;
-  /**
-   * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —
-   * not needed in client-only setups.
-   */
-  accessor url: string;
-  /**
-   * URL to navigate to after a successful embedded sign-in. When set, the
-   * orchestrator exchanges the terminal `handoff_token` via the generated
-   * API client (setting the session cookie) and then performs a full
-   * navigation to this URL so host middleware can observe the cookie.
-   * For `complete: "redirect"` the orchestrator follows `redirect_uri`
-   * instead and does not run the exchange.
-   */
-  accessor postSignInUrl: string;
-  /**
-   * Existing flow handle to resume rather than start a new flow. When set,
-   * the orchestrator hits `GET /flow/{id}` instead of `POST /flow` on
-   * mount, so a page reload after a network blip can re-render the same
-   * step without losing collected state.
-   */
-  accessor resumeFlowId: string;
-  /**
-   * BCP 47 language tag (e.g. `"de"`, `"en-US"`). The widget resolves this
-   * to a built-in locale dictionary. Falls back to auto-detection from
-   * `document.documentElement.lang` or `navigator.language` when empty.
-   */
-  accessor lang: string;
-  /**
-   * Custom locale dictionaries keyed by language code. When set, these take
-   * precedence over the built-in dictionaries for matching language codes.
-   *
-   * ```ts
-   * import { en } from "@zitadel/components";
-   * const locales = {
-   *   en: { ...en, "identifier.title": "Welcome" },
-   *   de: myGermanDict,
-   * };
-   * ```
-   */
-  accessor locales: Record<string, Locale> | undefined;
-  private accessor response;
-  private accessor branding;
-  private accessor loading;
-  private accessor startupError;
-  private accessor formValues;
-  private readonly themeController;
-  private engine;
-  private readonly sanitise;
-  /**
-   * Cached compiled tenant template, keyed by source string. Re-rendering on
-   * every `formValues` change otherwise re-parses the same template.
-   */
-  private tenantTemplateCache;
-  createRenderRoot(): HTMLElement | DocumentFragment;
-  /**
-   * Start the flow after the first render rather than in `connectedCallback`.
-   * Frameworks that wrap web components (e.g. `@lit/react` in the console)
-   * attach the element first and then assign object properties (`branding`,
-   * `locale`) via setters. `connectedCallback` runs synchronously on attach
-   * — before any setters from a wrapper's effects/refs — so reading those
-   * properties there sees stale defaults. `firstUpdated` runs after Lit's
-   * first render, by which time setters from the wrapping framework have
-   * fired.
-   */
-  protected firstUpdated(): void;
-  /**
-   * Resolves the effective locale dictionary. The built-in dictionary for the
-   * resolved language is used as the base; entries from the `locales` map (if
-   * set) are spread on top so partial overrides work without importing and
-   * spreading the full base dictionary.
-   *
-   * Priority: explicit `lang` attr → `navigator.language` (user preference)
-   * → `document.documentElement.lang` (page default) → English fallback.
-   */
-  private resolveLocale;
-  willUpdate(changed: PropertyValues<this>): void;
-  updated(changed: PropertyValues<this>): void;
-  /**
-   * Apply captured values and move focus once the new step has fully
-   * rendered. This commit produces the step's `zl-field`/`zl-button` atoms,
-   * but those render their own shadow DOM on a later microtask — so await
-   * this element's update *and* the child atoms' first render before touching
-   * them, rather than guessing a frame with `requestAnimationFrame`.
-   */
-  private hydrateStepAfterRender;
-  render(): _$lit.TemplateResult<1>;
-  /**
-   * Inject the attribution badge into the rendered template's
-   * `<zl-page-shell>` footer slot. The attribution must live INSIDE the
-   * page-shell so it sits within the 100vh viewport rhythm (matching the
-   * Figma sign-in frame where the pill sits 24px below the card, both
-   * centred on the page). It can't be a sibling of the page-shell because
-   * the page-shell already occupies the full viewport height.
-   *
-   * This markup is appended AFTER `renderStep` has sanitised the Liquid
-   * output, so it is not run through DOMPurify. It is orchestrator-owned and
-   * any tenant-supplied values (`custom_link`) are escaped via `escapeHtml`.
-   */
-  private injectAttribution;
-  /**
-   * "Secured with Zitadel" attribution chrome injected into every
-   * template's page-shell footer slot. Controlled by
-   * `branding.attribution.show_zitadel` — defaults to `true` for
-   * community / OSS deployments. Licensed tenants can suppress the badge
-   * entirely or swap it for a `custom_link` value.
-   */
-  private renderAttributionHtml;
-  /** Declarative config read from this element's attributes. */
-  private get projectAttrs();
-  private startFlow;
-  private applyResponse;
-  /**
-   * Acts on terminal flow steps. The wire surfaces two kinds of completion:
-   *
-   * - `step.complete === "redirect"` — navigate the browser to
-   *   `response.redirect_uri` (OIDC/SAML `auth_request_id` resolved). This
-   *   takes precedence over `post-sign-in-url`.
-   * - `step.complete === "show"` — when `post-sign-in-url` is set, exchange
-   *   the `handoff_token` for a session cookie and navigate there.
-   *
-   * `zitadel-flow-complete` is always emitted so hosts with custom post-sign-in
-   * flows can handle the handoff themselves when `post-sign-in-url` is omitted.
-   */
-  private maybeCompleteFlow;
-  private renderStep;
-  /**
-   * Build a `FlowIdentity` from the orchestrator's captured form values so
-   * the signed-in template can greet the user by email without the API
-   * having to round-trip identity claims. Email comes from the
-   * identifier step; display name composes from `given_name` /
-   * `family_name` when the register step ran.
-   */
-  private deriveIdentity;
-  private applyValuesToFields;
-  private captureValuesFromFields;
-  private currentFieldValue;
-  private handleAtomInput;
-  private syncFieldElementValue;
-  private handleAtomSubmit;
-  /** Secondary navigation rows (`data-action` on `.zl-card-nav__link`). */
-  private handleDelegatedAction;
-  private handleFormSubmit;
-  /**
-   * Handle a successful WebAuthn ceremony. Auto-submit with the proof
-   * as `challenge_response` so the flow advances without extra user
-   * interaction — the ceremony IS the factor verification (ADR 013).
-   */
-  private handlePasskeyResult;
-  /**
-   * Handle a WebAuthn ceremony error. Re-render the current step with
-   * an error message so the user sees feedback and can retry or skip.
-   *
-   * Guard: if the step already carries the same error key, skip the update.
-   * Mutating `this.response` triggers `unsafeHTML` to replace the DOM tree,
-   * which reconnects a fresh `<zl-passkey>` that immediately re-starts the
-   * ceremony — creating an infinite loop. The guard breaks the cycle.
-   *
-   * We also strip the `challenge` from the step so the template does not
-   * render a new `<zl-passkey>` on re-render. Without this, the first
-   * cancel would trigger a second ceremony (the guard prevents a third).
-   */
-  private handlePasskeyError;
-  private findPrimaryAction;
-  private moveFocusToFirstField;
-  private submit;
-  private handleTransportError;
-}
-declare global {
-  interface HTMLElementTagNameMap {
-    "zitadel-login": ZitadelLogin;
-  }
-} //# sourceMappingURL=zitadel-login.d.ts.map
-//#endregion
-//#region src/orchestrator/zitadel-logout.d.ts
-/**
- * `<zitadel-logout>` — orchestrator-tier element that lets the signed-in user
- * sign out without touching the flow API.
- *
- * Reads the user's display name + email from the `__nextgen_display` cookie
- * (set by the auth backend on sign-in), renders an avatar trigger with a
- * dropdown that exposes a "Sign out" action, and calls the typed
- * `revokeMySession` operation in `@zitadel/api`
- * (`DELETE /sessions/me`). The server clears the session cookie via
- * `Set-Cookie: Max-Age=0`; on success the element fires `zitadel-signout`
- * and optionally navigates to `post-sign-out-url`. (`getEndSessionUrl()`
- * additionally exposes the OIDC end-session URL for consumers that prefer a
- * user-agent-driven redirect.)
- *
- * ## Template-slot mode
- *
- * When the consumer projects a `<template>` child the element renders the
- * template's clone into its light DOM with `{{name}}`, `{{email}}`, and
- * `{{initial}}` substituted. Any element with `data-action="logout"` inside
- * the cloned template triggers the sign-out flow. This mirrors the
- * placeholder `<nextgen-logout>`'s contract so existing markup keeps working.
- *
- * Default styles consume the `--zl-*` design tokens so tenant branding
- * applies automatically — there is no hardcoded brand colour, radius, or
- * shadow.
- */
-declare class ZitadelLogout extends LitElement {
-  static styles: _$lit.CSSResult[];
-  /**
-   * SDK project handle returned by `configureZitadel()`. Set from JS (or a
-   * framework binding). When set, takes precedence over both the
-   * `project-id`/`proxy-path`/`url` attributes and the global singleton from
-   * `getZitadelConfig()`.
-   */
-  accessor project: ZitadelProject | undefined;
-  /**
-   * Project ID, set declaratively in HTML. Lets the component be configured on
-   * a plain page without JS or `configureZitadel()`. Ignored when the `project`
-   * property or a `configureZitadel()` global is set.
-   */
-  accessor projectId: string;
-  /**
-   * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.
-   * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.
-   */
-  accessor proxyPath: string;
-  /**
-   * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —
-   * not needed in client-only setups.
-   */
-  accessor url: string;
-  /** URL to navigate to after a successful sign-out. */
-  accessor postSignOutUrl: string;
-  /**
-   * OIDC `client_id` to forward as a query parameter on the end-session
-   * request, mirroring the standard end-session contract. Optional —
-   * leaving this empty is fine when the backend can resolve the client
-   * from the session cookie alone.
-   */
-  accessor clientId: string;
-  private accessor displayName;
-  private accessor displayEmail;
-  private accessor open;
-  private accessor loading;
-  private accessor errorMessage;
-  private templateMode;
-  connectedCallback(): void;
-  disconnectedCallback(): void;
-  updated(): void;
-  /**
-   * Decodes the `__nextgen_display` cookie (base64-encoded JSON, set by the
-   * auth backend on sign-in) and populates `displayName` / `displayEmail`.
-   * A missing or malformed cookie is intentionally non-fatal — the dropdown
-   * still renders, just with empty values.
-   */
-  private readDisplayCookie;
-  private get initial();
-  /**
-   * Clones a consumer-supplied `<template>` into the light DOM, fills the
-   * `{{name}}`, `{{email}}`, and `{{initial}}` tokens via a TreeWalker, and
-   * wires every element with `data-action="logout"` to trigger sign-out.
-   * Light-DOM mounting is deliberate so the consumer's existing CSS applies.
-   */
-  private renderTemplate;
-  private readonly handleDocumentClick;
-  private readonly handleDocumentKeydown;
-  private toggleOpen;
-  /**
-   * Calls `DELETE /sessions/me` (`revokeMySession`) with `credentials: "include"`.
-   * The server validates the `__nextgen_session` cookie, deletes the session, and
-   * clears the cookie via `Set-Cookie: Max-Age=0`. On success this element fires
-   * `zitadel-signout` and optionally navigates to `postSignOutUrl`.
-   */
-  /** Declarative config read from this element's attributes. */
-  private get projectAttrs();
-  private doLogout;
-  /**
-   * Returns the absolute URL the end-session request will hit. Useful for
-   * test assertions and for consumers that prefer to navigate the browser
-   * directly (instead of fetching) so the OIDC session-end redirect is
-   * driven by the user agent.
-   */
-  getEndSessionUrl(): string;
-  private handleSignOutClick;
-  render(): _$lit.TemplateResult<1> | typeof nothing;
-}
-declare global {
-  interface HTMLElementTagNameMap {
-    "zitadel-logout": ZitadelLogout;
-  }
-} //# sourceMappingURL=zitadel-logout.d.ts.map
-//#endregion
-//#region src/orchestrator/branding.d.ts
-type FlowLayout = CreateFlow201BrandingLayout;
-type BrandingPalette = {
-  primary?: string;
-  on_primary?: string;
-  background?: string;
-  surface?: string;
-  muted?: string;
-  border?: string;
-  text?: string;
-  text_muted?: string;
-  link?: string;
-  success?: string;
-  warning?: string;
-  error?: string;
-};
-type BrandingTypography = {
-  font_family?: string;
-  font_family_mono?: string;
-  scale?: number;
-};
-type BrandingShape = {
-  radius?: "none" | "sm" | "md" | "lg" | "full";
-  density?: "compact" | "regular" | "comfortable";
-};
-type BrandingTheme = {
-  mode?: "light" | "dark" | "auto";
-  dark?: {
-    palette?: BrandingPalette;
-  };
-};
-type BrandingAssets = {
-  logo_dark?: string;
-  favicon?: string;
-  background_image?: string;
-};
-/**
- * Wire shape (`CreateFlow201Branding`) plus the v2 client-only extension.
- * Structurally a superset, so any `CreateFlow201Branding` payload from the
- * wire is assignable to `Branding` without a cast.
- *
- * `attribution.show_zitadel` controls the "Secured with Zitadel" pill in
- * the orchestrator footer. Tenants set it to `false` only when they have a
- * licence that permits removing attribution (community / OSS deployments
- * always show it). The flag intentionally lives on `Branding` so it can
- * be overridden per-flow alongside the rest of the visual surface.
- */
-type Branding = CreateFlow201Branding & {
-  palette?: BrandingPalette;
-  typography?: BrandingTypography;
-  shape?: BrandingShape;
-  assets?: BrandingAssets;
-  theme?: BrandingTheme;
-  attribution?: BrandingAttribution;
-};
-type BrandingAttribution = {
-  show_zitadel?: boolean;
-  custom_link?: {
-    label: string;
-    href: string;
-  };
-};
-//#endregion
-//#region src/orchestrator/theme-controller.d.ts
-type ResolvedTheme = "light" | "dark";
-declare class ThemeController implements ReactiveController {
-  private readonly host;
-  private branding;
-  private mediaQuery;
-  private _theme;
-  constructor(host: ReactiveControllerHost);
-  get theme(): ResolvedTheme;
-  setBranding(branding: Branding | undefined): void;
-  hostConnected(): void;
-  hostDisconnected(): void;
-  private refresh;
-  private attach;
-  private detach;
-  private onMediaChange;
-  private update;
-}
-//#endregion
-//#region src/orchestrator/branding-to-tokens.d.ts
-type BrandingToTokensOptions = {
-  resolvedTheme?: ResolvedTheme;
-};
-/**
- * Build a CSS string of `:host { --zl-* }` declarations from a Branding
- * payload. Light values land on `:host`; dark overrides land on
- * `:host([data-theme="dark"])`.
- */
-declare function buildBrandingStylesheet(branding: Branding | undefined, options?: BrandingToTokensOptions): string;
-/**
- * Apply a branding payload as a `--zl-*` overrides layer on top of the base
- * token sheet. Subsequent calls replace the previous override sheet so a new
- * branding payload paints cleanly without leaking older declarations.
- *
- * Callers should run `applyBaseTokens(shadowRoot)` first (once per shadow
- * root) so the base values exist before branding patches them.
- */
-declare function applyBrandingTokens(shadowRoot: ShadowRoot, branding: Branding | undefined, resolvedTheme: ResolvedTheme): void;
-declare function resolveTheme(branding: Branding | undefined): ResolvedTheme;
-//#endregion
-//#region src/orchestrator/font-loader.d.ts
-declare function applyFontUrl(shadowRoot: ShadowRoot, fontUrl: string | null | undefined): void;
-//#endregion
-//#region src/orchestrator/template-names.d.ts
-/**
- * Names of the bundled Liquid templates the `<zitadel-login>` orchestrator
- * registers.
- *
- * This lives in its own module — separate from `liquid.ts` — so the public
- * barrel can re-export `TEMPLATE_NAMES` without dragging LiquidJS' `Liquid`
- * type (and its Node ambient-type requirements) into the published
- * declaration surface. See `liquid.ts` / the orchestrator barrel.
- */
-declare const TEMPLATE_NAMES: {
-  readonly default: "default";
-  readonly authForm: "auth-form";
-  readonly passkeyUpsell: "passkey-upsell";
-  readonly signedIn: "signed-in";
-};
-//#endregion
-//#region src/orchestrator/mandatory-gates.d.ts
-declare const MANDATORY_GATES_MARKER = "ZL_MANDATORY_GATES";
-declare const mandatoryGatesMarkerComment = "<!--ZL_MANDATORY_GATES-->";
-declare function patchMandatoryGates(html: string, step: CreateFlow201Step, locale: Locale): string;
-//#endregion
-//#region src/orchestrator/sanitiser.d.ts
-/**
- * Returns a sanitiser bound to the current manifest registry. Callers should
- * cache the result; rebuilding is cheap but allocates a fresh DOMPurify config.
- */
-declare function createSanitiser(): (html: string) => string;
-//#endregion
-//#region src/orchestrator/api-client.d.ts
-declare function startFlow(api: ZitadelApi, input: CreateFlowBody): Promise<CreateFlow201>;
-declare function submitStep(api: ZitadelApi, id: string, body: SubmitFlowStepBody): Promise<CreateFlow201>;
-declare function getCurrentStep(api: ZitadelApi, id: string): Promise<CreateFlow201>;
-//#endregion
-//#region src/orchestrator/branding-validator.d.ts
-type BrandingValidationResult = {
-  branding: Branding | undefined;
-  issues: readonly string[];
-};
-declare function validateBranding(input: Branding | undefined): BrandingValidationResult;
-//#endregion
-//#region src/orchestrator/template-context.d.ts
-type FlowMessage = {
-  level: "info" | "warning";
-  text_key: string;
-};
-type FlowError = {
-  code?: string;
-  text_key?: string;
-  message?: string;
-};
-type FlowIdentity = {
-  display_name?: string;
-  email_address?: string;
-  avatar_url?: string;
-};
-/**
- * Liquid render context. The orchestrator builds this from the wire
- * `CreateFlow201` payload before invoking the engine.
- *
- * Capability dictionaries point at the orval wire shapes directly. The only
- * client-only pieces are `messages`, `identity`, `errors`, the resolved
- * `branding` (v2 superset), and `loading`.
- */
-type LiquidContext = {
-  step: Pick<CreateFlow201Step, "name" | "complete" | "texts">;
-  fields: readonly CreateFlow201StepFieldsItem[];
-  actions: readonly CreateFlow201StepActionsItem[];
-  gates: CreateFlow201StepGates;
-  sso_providers: readonly CreateFlow201StepSsoProvidersItem[];
-  challenge: CreateFlow201StepChallenge | null;
-  messages: readonly FlowMessage[];
-  identity: FlowIdentity | null;
-  errors: readonly FlowError[];
-  branding: Branding | Record<string, never>;
-  loading: boolean;
-};
-//#endregion
-export { ZitadelLogout as A, BrandingAssets as C, BrandingTheme as D, BrandingShape as E, Locale as F, en as I, builtinLocales as M, it as N, BrandingTypography as O, de as P, Branding as S, BrandingPalette as T, applyBrandingTokens as _, LiquidContext as a, ResolvedTheme as b, getCurrentStep as c, createSanitiser as d, MANDATORY_GATES_MARKER as f, applyFontUrl as g, TEMPLATE_NAMES as h, FlowMessage as i, ZitadelLogin as j, FlowLayout as k, startFlow as l, patchMandatoryGates as m, FlowError as n, BrandingValidationResult as o, mandatoryGatesMarkerComment as p, FlowIdentity as r, validateBranding as s, layoutChromeCss as t, submitStep as u, buildBrandingStylesheet as v, BrandingAttribution as w, ThemeController as x, resolveTheme as y };
-//# sourceMappingURL=index-DB_JTtln.d.mts.map