@zitadel/sdk-core 1.0.0-alpha.25 → 1.0.0-alpha.28

package/dist/middleware.d.ts

@@ -1,206 +0,0 @@
-/**
- * Shared constants and utility functions for the SDK middleware proxy layer.
- *
- * These are consumed by both `sdk-next` and `sdk-nuxt` to avoid duplicating
- * pure, framework-agnostic logic.
- */
-/**
- * Headers that must never be forwarded to an upstream service.
- * These are connection-level headers that are meaningful only between
- * two directly connected peers and become invalid when proxied.
- */
-export declare const HOP_BY_HOP: ReadonlySet<string>;
-/**
- * SDK-internal headers that must never be forwarded to the upstream backend.
- * These headers carry session data between the middleware and server components;
- * forwarding them upstream would expose internal state and allow header injection.
- */
-export declare const INTERNAL_HEADERS: ReadonlySet<string>;
-/**
- * Returns `true` when `pathname` matches at least one entry in `routes`.
- *
- * An entry ending with `*` matches any path that starts with the prefix
- * before the `*`. All other entries require an exact match.
- *
- * @param pathname - The URL pathname to test.
- * @param routes   - The list of route patterns to match against.
- * @returns `true` if at least one pattern matches.
- */
-export declare function matchesRoutes(pathname: string, routes: readonly string[]): boolean;
-/**
- * Filters upstream response headers for proxying: strips hop-by-hop headers
- * and `set-cookie` (handled separately via `getSetCookie()`), and reduces
- * `location` to a redirect that can only land on this app.
- *
- * `location` was stripped outright until the identity-provider callback
- * needed it: the provider returns the browser to `/__nextgen/idp/callback`,
- * and the engine answers `303` back to the page the sign-in started on. That
- * is a top-level navigation with no JavaScript in the loop, so a dropped
- * `Location` leaves the browser on an empty page. Outbound redirects to a
- * provider do not travel this way -- they arrive as `step.redirect_url` in a
- * JSON body and the widget navigates -- so nothing legitimate points off-origin.
- *
- * @param upstream - The upstream response headers.
- * @param selfUrl - The app's own request URL, which is both the origin a
- *   redirect must land on and the base a relative one resolves against.
- *   Omitting it keeps the old behaviour of dropping every redirect.
- * @returns A new `Headers` object with filtered headers.
- */
-export declare function filterResponseHeaders(upstream: Headers, selfUrl?: string): Headers;
-/**
- * The authenticated session for a signed-in user. Identity follows the
- * user-ref vocabulary (ADR 058): render `display`, falling back to
- * `identifier`, then `userId`.
- */
-export type NextgenSession = {
-    /** The user's unique identifier (`sub` claim). */
-    userId: string;
-    /**
-     * The user schema's designated identifier value (the login identifier,
-     * e.g. an email address or username), or `null` when unresolved. On the
-     * JWT path this carries the `email` claim.
-     */
-    identifier: string | null;
-    /**
-     * The schema property `identifier` came from (e.g. `"email"`), or `null`
-     * when unknown — JWT-claim identities carry no property attribution.
-     */
-    identifierProperty: string | null;
-    /** The user's display name rendering, or `null` when the schema designates none. */
-    display: string | null;
-    /** The raw verified JWT. */
-    token: string;
-};
-/** Auth state when the user is signed in. */
-export type AuthState = {
-    isAuthenticated: true;
-    session: NextgenSession;
-};
-/** Auth state when the user is not signed in. */
-export type UnauthState = {
-    isAuthenticated: false;
-    session: null;
-};
-/** Union of all possible auth states. */
-export type AuthResult = AuthState | UnauthState;
-/**
- * The client-safe session exposed to app UI (headers, account menus).
- * Identical to {@link NextgenSession} but omits `token` — the raw session
- * token must never reach client-side JavaScript, whether through an SSR
- * payload or a client-side fetch result.
- */
-export type ClientSession = {
-    /** The user's unique identifier (`sub` claim). */
-    userId: string;
-    /** The designated identifier value (login identifier), or `null`. */
-    identifier: string | null;
-    /** The schema property the identifier came from, or `null`. */
-    identifierProperty: string | null;
-    /** The display name rendering, or `null`. */
-    display: string | null;
-};
-/** Client-safe auth state when the user is signed in. */
-export type ClientAuthState = {
-    isAuthenticated: true;
-    session: ClientSession;
-};
-/**
- * Union of all possible client-safe auth states. Returned by the client
- * session reads (`useAuth()` in sdk-nuxt, `getSession()` in sdk-next).
- * Token is intentionally absent — use the server-side helpers when the raw
- * token is needed.
- */
-export type ClientAuthResult = ClientAuthState | UnauthState;
-/**
- * Options passed to the SDK middleware factory (`nextgenMiddleware` in
- * sdk-next, `createNextgenMiddleware` in sdk-nuxt).
- */
-export type NextgenMiddlewareOptions = {
-    /**
-     * Full URL of the Zitadel auth backend.
-     * @default process.env.ZITADEL_URL ?? "http://localhost:8080"
-     */
-    url?: string;
-    /**
-     * URL path prefix that is reverse-proxied to the auth backend.
-     *
-     * Sign-in with an external provider currently requires the default: the
-     * provider returns to `/__nextgen/idp/callback`, which is proxied only under
-     * the default prefix.
-     * @default "/__nextgen"
-     */
-    proxyPath?: string;
-    /**
-     * Pathnames that require a valid session. Requests to these routes without
-     * a valid token are redirected to {@link loginPath}.
-     * Entries ending with `*` match any sub-path (e.g. `"/admin*"`).
-     * @default []
-     */
-    protectedRoutes?: string[];
-    /**
-     * Pathnames that are completely skipped by the middleware — no JWT
-     * verification, no protection check, no header tunnelling.
-     * Useful for webhooks, health-check endpoints, or any route where
-     * running auth logic is undesirable.
-     * Entries ending with `*` match any sub-path (e.g. `"/public*"`).
-     * @default []
-     */
-    ignoredRoutes?: string[];
-    /**
-     * Pathname to redirect unauthenticated users to.
-     * A `next` query parameter is appended with the originally requested path.
-     * @default "/login"
-     */
-    loginPath?: string;
-    /**
-     * Reserved for future use. Local PEM public key for offline JWT verification.
-     */
-    jwtKey?: string;
-    /**
-     * Restrict accepted JWT `alg` header values. Tokens whose algorithm is not
-     * in this list are rejected before JWKS is fetched.
-     * @default ["RS256", "ES256"]
-     */
-    allowedAlgorithms?: string[];
-    /**
-     * Clock skew tolerance in milliseconds applied to `exp`, `nbf`, and `iat`
-     * claim validation.
-     * @default 5000
-     */
-    clockSkewMs?: number;
-    /**
-     * Expected value(s) of the `aud` claim. When omitted, audience is not
-     * validated. Pass a single string or an array when a token may carry
-     * multiple audiences.
-     */
-    audience?: string | string[];
-    /**
-     * Accepted values for the JWT header `typ` claim (case-insensitive).
-     * Tokens whose `typ` is not in this list are rejected.
-     * Set to `[]` to disable token-type checking entirely.
-     * @default ["JWT", "at+JWT"]
-     */
-    allowedTokenTypes?: string[];
-    /**
-     * Timeout in milliseconds for JWKS endpoint requests.
-     * Requests that do not complete within this window are aborted and the
-     * token is rejected, treating the request as unauthenticated.
-     * @default 5000
-     */
-    jwksTimeoutMs?: number;
-    /**
-     * Timeout in milliseconds for upstream proxy requests.
-     * Requests that do not complete within this window are aborted with a
-     * network error. Defaults to 5 000 ms.
-     * @default 5000
-     */
-    proxyTimeoutMs?: number;
-    /**
-     * Timeout in milliseconds for opaque (non-JWT) session token validation
-     * via the backend's `GET /sessions/me` endpoint. Tokens that cannot be
-     * validated within this window are treated as invalid.
-     * @default 5000
-     */
-    opaqueTokenTimeoutMs?: number;
-};
-//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,MAAM,CAazC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAC;AAIvF;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAUlF;AA2CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAiBlF;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oFAAoF;IACpF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,SAAS,GAAG;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG;IAAE,eAAe,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC;AAEpE,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6CAA6C;IAC7C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,WAAW,CAAC;AAE7D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC"}

package/dist/middleware.js

@@ -1,131 +0,0 @@
-/**
- * Shared constants and utility functions for the SDK middleware proxy layer.
- *
- * These are consumed by both `sdk-next` and `sdk-nuxt` to avoid duplicating
- * pure, framework-agnostic logic.
- */
-// ─── Constants ────────────────────────────────────────────────────────────────
-/**
- * Headers that must never be forwarded to an upstream service.
- * These are connection-level headers that are meaningful only between
- * two directly connected peers and become invalid when proxied.
- */
-export const HOP_BY_HOP = new Set([
-    "connection",
-    // host is not a hop-by-hop header per RFC 7230, but it must be stripped so
-    // the fetch implementation derives the correct Host from the upstream URL
-    // rather than forwarding the client's Host and causing SNI/vhost mismatches.
-    "host",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-]);
-/**
- * SDK-internal headers that must never be forwarded to the upstream backend.
- * These headers carry session data between the middleware and server components;
- * forwarding them upstream would expose internal state and allow header injection.
- */
-export const INTERNAL_HEADERS = new Set(["x-nextgen-auth-token"]);
-// ─── Route matching ──────────────────────────────────────────────────────────
-/**
- * Returns `true` when `pathname` matches at least one entry in `routes`.
- *
- * An entry ending with `*` matches any path that starts with the prefix
- * before the `*`. All other entries require an exact match.
- *
- * @param pathname - The URL pathname to test.
- * @param routes   - The list of route patterns to match against.
- * @returns `true` if at least one pattern matches.
- */
-export function matchesRoutes(pathname, routes) {
-    if (routes.length === 0) {
-        return false;
-    }
-    return routes.some((pattern) => {
-        if (pattern.endsWith("*")) {
-            return pathname.startsWith(pattern.slice(0, -1));
-        }
-        return pathname === pattern;
-    });
-}
-// ─── Response header filtering ───────────────────────────────────────────────
-/**
- * An upstream `Location`, pointed back at this app.
- *
- * Only the path, query and fragment survive; whatever origin the upstream
- * named is discarded and the result is re-based onto the request's own URL.
- * That keeps both properties the blanket strip was protecting -- an internal
- * hostname can never reach the browser, and the redirect can only ever land on
- * this app -- without needing to know what this app's public origin is.
- *
- * Comparing origins instead would have required that knowledge, and there is
- * no reliable source for it: `X-Forwarded-Host` is attacker-settable on a
- * direct request, and the request's own host is wrong behind a proxy that
- * terminates TLS or rewrites it. Discarding the origin sidesteps the question
- * -- a redirect to another origin becomes the same path on this one rather
- * than being dropped, so a deployment behind such a proxy works instead of
- * landing on a blank page.
- *
- * Nothing legitimate on this path points off-origin anyway: an outbound
- * redirect to a provider travels as `step.redirect_url` in a JSON body and the
- * widget performs it, never as a proxied header.
- *
- * A relative reference resolves against the path it came from (RFC 3986 §5),
- * so `next?flow=x` answered to `/__nextgen/idp/callback` means
- * `/__nextgen/idp/next?flow=x`. An unparseable value is the one case with
- * nothing to forward.
- */
-function ontoThisApp(location, selfUrl) {
-    if (selfUrl === undefined || selfUrl === "") {
-        return undefined;
-    }
-    try {
-        const base = new URL(selfUrl);
-        const target = new URL(location, base);
-        return new URL(`${target.pathname}${target.search}${target.hash}`, base).toString();
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Filters upstream response headers for proxying: strips hop-by-hop headers
- * and `set-cookie` (handled separately via `getSetCookie()`), and reduces
- * `location` to a redirect that can only land on this app.
- *
- * `location` was stripped outright until the identity-provider callback
- * needed it: the provider returns the browser to `/__nextgen/idp/callback`,
- * and the engine answers `303` back to the page the sign-in started on. That
- * is a top-level navigation with no JavaScript in the loop, so a dropped
- * `Location` leaves the browser on an empty page. Outbound redirects to a
- * provider do not travel this way -- they arrive as `step.redirect_url` in a
- * JSON body and the widget navigates -- so nothing legitimate points off-origin.
- *
- * @param upstream - The upstream response headers.
- * @param selfUrl - The app's own request URL, which is both the origin a
- *   redirect must land on and the base a relative one resolves against.
- *   Omitting it keeps the old behaviour of dropping every redirect.
- * @returns A new `Headers` object with filtered headers.
- */
-export function filterResponseHeaders(upstream, selfUrl) {
-    const filtered = new Headers();
-    upstream.forEach((value, key) => {
-        const name = key.toLowerCase();
-        if (HOP_BY_HOP.has(name) || name === "set-cookie") {
-            return;
-        }
-        if (name === "location") {
-            const onThisApp = ontoThisApp(value, selfUrl);
-            if (onThisApp !== undefined) {
-                filtered.set("location", onThisApp);
-            }
-            return;
-        }
-        filtered.set(key, value);
-    });
-    return filtered;
-}

package/dist/types.d.ts

@@ -1,226 +0,0 @@
-import type { ZitadelProject } from "@zitadel/api/config";
-import type { CreateFlow201Step, CreateFlow201StepComplete, CreateFlowBodyPurpose } from "@zitadel/api/generated/model";
-/** Re-exported so consumers can type the `purpose` prop without a deep import. */
-export type { CreateFlowBodyPurpose } from "@zitadel/api/generated/model";
-/**
- * The SPA widget contract shared by every SPA SDK (`sdk-react`, `sdk-vue`,
- * `sdk-angular`, `sdk-solid`, `sdk-svelte`, `sdk-qwik`): the widget event detail
- * types plus the config/handler/props types derived from them. Each SPA SDK
- * re-exports these from its own public surface so consumers don't need a direct
- * `sdk-core` dependency. The middleware-layer types (`sdk-next`, `sdk-nuxt`) now
- * live in `@zitadel/sdk-core/middleware`.
- */
-/** Payload of the `zitadel-flow-step` event. */
-export interface ZitadelFlowStepDetail {
-    readonly step: CreateFlow201Step;
-}
-/** Payload of the `zitadel-flow-input` event. */
-export interface ZitadelFlowInputDetail {
-    readonly name: string;
-    readonly value: string;
-}
-/** Payload of the `zitadel-flow-complete` event. */
-export interface ZitadelFlowCompleteDetail {
-    readonly behavior: CreateFlow201StepComplete;
-    readonly redirect_uri?: string;
-    readonly handoff_token?: string;
-    readonly handoff_token_expires_at?: string;
-}
-/**
- * Payload of the `zitadel-flow-redirect` event — the widget is handing the
- * browser to an identity provider. Distinct from `zitadel-flow-complete`:
- * nobody is signed in yet, and the flow resumes when the provider returns.
- */
-export interface ZitadelFlowRedirectDetail {
-    readonly redirect_url: string;
-    readonly step: CreateFlow201Step;
-}
-/** Payload of the `zitadel-flow-error` event. */
-export interface ZitadelFlowErrorDetail {
-    readonly message: string;
-}
-/** Payload of the `zitadel-signout` event. */
-export interface ZitadelSignoutDetail {
-    /** The signed-out user's display rendering ("" when none was resolved). */
-    readonly display: string;
-    /** The signed-out user's login identifier ("" when none was resolved). */
-    readonly identifier: string;
-}
-/** Events emitted by `<zitadel-login>`, keyed to their detail payload. */
-export interface ZitadelLoginEventMap {
-    "zitadel-flow-step": ZitadelFlowStepDetail;
-    "zitadel-flow-input": ZitadelFlowInputDetail;
-    "zitadel-flow-complete": ZitadelFlowCompleteDetail;
-    "zitadel-flow-redirect": ZitadelFlowRedirectDetail;
-    "zitadel-flow-error": ZitadelFlowErrorDetail;
-}
-/** Events emitted by `<zitadel-logout>`, keyed to their detail payload. */
-export interface ZitadelLogoutEventMap {
-    "zitadel-signout": ZitadelSignoutDetail;
-}
-/**
- * Events emitted by `<zitadel-session>`, keyed to their detail payload.
- * `zitadel-signout` reuses {@link ZitadelSignoutDetail} so the post-sign-in
- * card and the avatar menu speak the same sign-out contract.
- */
-export interface ZitadelSessionEventMap {
-    "zitadel-signout": ZitadelSignoutDetail;
-}
-/**
- * Maps each `<zitadel-login>` event to the callback prop the SDKs expose. The
- * `satisfies Record<keyof ZitadelLoginEventMap, …>` is the drift lock: every
- * event needs exactly one handler entry — a missing one, or an extra one left
- * behind for a removed event, fails `tsc`. Everything below derives from this.
- */
-export declare const ZITADEL_LOGIN_EVENT_HANDLERS: {
-    readonly "zitadel-flow-step": "onFlowStep";
-    readonly "zitadel-flow-input": "onFlowInput";
-    readonly "zitadel-flow-complete": "onFlowComplete";
-    readonly "zitadel-flow-redirect": "onFlowRedirect";
-    readonly "zitadel-flow-error": "onFlowError";
-};
-/** Maps the `<zitadel-logout>` event to the callback prop the SDKs expose. */
-export declare const ZITADEL_LOGOUT_EVENT_HANDLERS: {
-    readonly "zitadel-signout": "onSignout";
-};
-/** Maps the `<zitadel-session>` event to the callback prop the SDKs expose. */
-export declare const ZITADEL_SESSION_EVENT_HANDLERS: {
-    readonly "zitadel-signout": "onSignout";
-};
-/** Runtime list of `<zitadel-login>` event names (drives wiring + drift tests). */
-export declare const ZITADEL_LOGIN_EVENTS: (keyof ZitadelLoginEventMap)[];
-/** Runtime list of `<zitadel-logout>` event names. */
-export declare const ZITADEL_LOGOUT_EVENTS: (keyof ZitadelLogoutEventMap)[];
-/** Runtime list of `<zitadel-session>` event names. */
-export declare const ZITADEL_SESSION_EVENTS: (keyof ZitadelSessionEventMap)[];
-/** Configuration props shared by every `ZitadelLogin` wrapper. */
-export interface ZitadelLoginConfig {
-    /** The SDK handle from `configureZitadel(...)`. */
-    readonly project?: ZitadelProject;
-    /** Discrete project id, read when no {@link project} handle is supplied. */
-    readonly projectId?: string;
-    /** Reverse-proxy path prefix the widget calls. */
-    readonly proxyPath?: string;
-    /**
-     * Sizing/chrome mode. `widget` (default) is content-sized and paints no
-     * page chrome — for embedding inside an existing layout. `page` claims
-     * the viewport, paints the surface background, loads the brand font, and
-     * focuses the first field — for dedicated login routes.
-     * @default "widget"
-     */
-    readonly variant?: "widget" | "page";
-    /**
-     * Colour mode. Unset defers to the tenant's `branding.theme.mode`, then to
-     * the variant default — `dark` for `page`, `auto` (follow
-     * `prefers-color-scheme`) for `widget`. Set it when your app's surface is
-     * fixed so the widget doesn't render a dark card on a light page.
-     */
-    readonly theme?: "light" | "dark" | "auto";
-    /**
-     * Visually hide the widget's own heading block while keeping it in the
-     * accessibility tree — for embeds whose page already carries the heading
-     * (a brand-voice title above the card) so the card doesn't repeat it.
-     * @default false
-     */
-    readonly suppressHeader?: boolean;
-    /** Flow purpose. @default "login" */
-    readonly purpose?: CreateFlowBodyPurpose;
-    /**
-     * Selects a specific flow definition by its `name` (the `name` field in
-     * the flow file). Omit to run the project's default flow for the purpose.
-     */
-    readonly flowName?: string;
-    /** Where to navigate after a completed sign-in. */
-    readonly postSignInUrl?: string;
-    /**
-     * Copy overrides merged over the builtin locale dictionaries, keyed by
-     * primary language subtag. Each dictionary may be partial — the widget
-     * merges it over the builtin copy — so presets like the components'
-     * `businessLocales` overlay are directly assignable. This is how custom
-     * flow steps and actions get labels (keys follow `<step>.title`,
-     * `<step>.action.<name>`, `<step>.field.<field>`):
-     *
-     * ```tsx
-     * <ZitadelLogin locales={{ en: { "identifier.title": "Welcome back" } }} />
-     * ```
-     */
-    readonly locales?: Record<string, Partial<Record<string, string>>>;
-    /** BCP-47 language override; defaults to the browser language. */
-    readonly lang?: string;
-}
-/** Configuration props shared by every `ZitadelLogout` wrapper. */
-export interface ZitadelLogoutConfig {
-    /** The SDK handle from `configureZitadel(...)`. */
-    readonly project?: ZitadelProject;
-    /** Discrete project id, read when no {@link project} handle is supplied. */
-    readonly projectId?: string;
-    /** Reverse-proxy path prefix the widget calls. */
-    readonly proxyPath?: string;
-    /** Where to navigate after sign-out. */
-    readonly postSignOutUrl?: string;
-    /**
-     * Colour mode. Unset defaults to `auto` (follow `prefers-color-scheme`) —
-     * the control lives inside the app's own chrome. Set it when the
-     * surrounding surface is fixed.
-     */
-    readonly theme?: "light" | "dark" | "auto";
-}
-/** Configuration props shared by every `ZitadelSession` wrapper. */
-export interface ZitadelSessionConfig {
-    /** The SDK handle from `configureZitadel(...)`. */
-    readonly project?: ZitadelProject;
-    /** Discrete project id, read when no {@link project} handle is supplied. */
-    readonly projectId?: string;
-    /** Reverse-proxy path prefix the widget calls. */
-    readonly proxyPath?: string;
-    /** Where to navigate after sign-out. */
-    readonly postSignOutUrl?: string;
-    /** Heading text override. */
-    readonly heading?: string;
-    /** Logout action label override. */
-    readonly logoutLabel?: string;
-    /**
-     * Sizing/chrome mode. `widget` (default) is content-sized and paints no
-     * page chrome — for embedding the signed-in card inside an existing
-     * layout. `page` claims the viewport and paints the surface background —
-     * for dedicated signed-in routes.
-     * @default "widget"
-     */
-    readonly variant?: "widget" | "page";
-    /**
-     * Colour mode. Unset defers to the variant default — `dark` for `page`,
-     * `auto` (follow `prefers-color-scheme`) for `widget`. Set it when your
-     * app's surface is fixed so the card doesn't render dark on a light page.
-     */
-    readonly theme?: "light" | "dark" | "auto";
-    /**
-     * Visually hide the widget's own heading block while keeping it in the
-     * accessibility tree — for embeds whose page already carries the heading
-     * (a brand-voice title above the card) so the card doesn't repeat it.
-     * @default false
-     */
-    readonly suppressHeader?: boolean;
-}
-/**
- * Plain-callback handlers for the `<zitadel-login>` events, derived from
- * {@link ZitadelLoginEventMap} and {@link ZITADEL_LOGIN_EVENT_HANDLERS} so the
- * prop set can never drift from the events it forwards.
- */
-export type ZitadelLoginHandlers = {
-    readonly [E in keyof ZitadelLoginEventMap as (typeof ZITADEL_LOGIN_EVENT_HANDLERS)[E]]?: (detail: ZitadelLoginEventMap[E]) => void;
-};
-/** Plain-callback handler for the `<zitadel-logout>` event (derived, as above). */
-export type ZitadelLogoutHandlers = {
-    readonly [E in keyof ZitadelLogoutEventMap as (typeof ZITADEL_LOGOUT_EVENT_HANDLERS)[E]]?: (detail: ZitadelLogoutEventMap[E]) => void;
-};
-/** Plain-callback handlers for the `<zitadel-session>` events (derived, as above). */
-export type ZitadelSessionHandlers = {
-    readonly [E in keyof ZitadelSessionEventMap as (typeof ZITADEL_SESSION_EVENT_HANDLERS)[E]]?: (detail: ZitadelSessionEventMap[E]) => void;
-};
-/** Full prop set for a `ZitadelLogin` wrapper (config + plain-callback handlers). */
-export type ZitadelLoginProps = ZitadelLoginConfig & ZitadelLoginHandlers;
-/** Full prop set for a `ZitadelLogout` wrapper (config + plain-callback handlers). */
-export type ZitadelLogoutProps = ZitadelLogoutConfig & ZitadelLogoutHandlers;
-/** Full prop set for a `ZitadelSession` wrapper (config + plain-callback handlers). */
-export type ZitadelSessionProps = ZitadelSessionConfig & ZitadelSessionHandlers;
-//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AAEtC,kFAAkF;AAClF,YAAY,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;;;GAOG;AAEH,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AAED,iDAAiD;AACjD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AAED,iDAAiD;AACjD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAYD,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,oBAAoB,EAAE,sBAAsB,CAAC;IAC7C,uBAAuB,EAAE,yBAAyB,CAAC;IACnD,uBAAuB,EAAE,yBAAyB,CAAC;IACnD,oBAAoB,EAAE,sBAAsB,CAAC;CAC9C;AAED,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,oBAAoB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,iBAAiB,EAAE,oBAAoB,CAAC;CACzC;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;;;;;;CAM6B,CAAC;AAEvE,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B;;CAE6B,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,8BAA8B;;CAE6B,CAAC;AAEzE,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,EAE5B,CAAC,MAAM,oBAAoB,CAAC,EAAE,CAAC;AAEpC,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,EAE7B,CAAC,MAAM,qBAAqB,CAAC,EAAE,CAAC;AAErC,uDAAuD;AACvD,eAAO,MAAM,sBAAsB,EAE9B,CAAC,MAAM,sBAAsB,CAAC,EAAE,CAAC;AAEtC,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,qCAAqC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnE,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC5C;AAED,oEAAoE;AACpE,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oCAAoC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,CAAC,IAAI,MAAM,oBAAoB,IAAI,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CACvF,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,KAC5B,IAAI;CACV,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,CAAC,IAAI,MAAM,qBAAqB,IAAI,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CACzF,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAC7B,IAAI;CACV,CAAC;AAEF,sFAAsF;AACtF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,CAAC,IAAI,MAAM,sBAAsB,IAAI,CAAC,OAAO,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3F,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,KAC9B,IAAI;CACV,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAE1E,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,qBAAqB,CAAC;AAE7E,uFAAuF;AACvF,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,sBAAsB,CAAC"}

package/dist/types.js

@@ -1,27 +0,0 @@
-/**
- * Maps each `<zitadel-login>` event to the callback prop the SDKs expose. The
- * `satisfies Record<keyof ZitadelLoginEventMap, …>` is the drift lock: every
- * event needs exactly one handler entry — a missing one, or an extra one left
- * behind for a removed event, fails `tsc`. Everything below derives from this.
- */
-export const ZITADEL_LOGIN_EVENT_HANDLERS = {
-    "zitadel-flow-step": "onFlowStep",
-    "zitadel-flow-input": "onFlowInput",
-    "zitadel-flow-complete": "onFlowComplete",
-    "zitadel-flow-redirect": "onFlowRedirect",
-    "zitadel-flow-error": "onFlowError",
-};
-/** Maps the `<zitadel-logout>` event to the callback prop the SDKs expose. */
-export const ZITADEL_LOGOUT_EVENT_HANDLERS = {
-    "zitadel-signout": "onSignout",
-};
-/** Maps the `<zitadel-session>` event to the callback prop the SDKs expose. */
-export const ZITADEL_SESSION_EVENT_HANDLERS = {
-    "zitadel-signout": "onSignout",
-};
-/** Runtime list of `<zitadel-login>` event names (drives wiring + drift tests). */
-export const ZITADEL_LOGIN_EVENTS = Object.keys(ZITADEL_LOGIN_EVENT_HANDLERS);
-/** Runtime list of `<zitadel-logout>` event names. */
-export const ZITADEL_LOGOUT_EVENTS = Object.keys(ZITADEL_LOGOUT_EVENT_HANDLERS);
-/** Runtime list of `<zitadel-session>` event names. */
-export const ZITADEL_SESSION_EVENTS = Object.keys(ZITADEL_SESSION_EVENT_HANDLERS);