@dreamtree-org/landing-kit 0.9.0 → 0.10.1

package/MIGRATION.md

@@ -173,3 +173,19 @@ version-2 document (`validateStore` from `/schema`). Nothing changes for apps th
   Required slots cannot be hidden or removed.
 - `safeHref` now rejects links containing a backslash, and registry lookups (`blockDef`, `templatePage`) ignore
   inherited keys, so `__proto__` or `constructor` is an unknown type.
+
+## 0.10.0 — Platform console: plans, settings, support access, domains (additive)
+
+The console now shows the v1.1 features that `@dreamtree-org/tenancy` 0.5.0 serves. Nothing appears until the
+server advertises it in `GET /me`, so a product on tenancy 0.4.0 sees no change.
+
+- **New pages:** Plans (`/platform/plans`, `plans.read`) and Support access (`/platform/support-access`,
+  `support.request`).
+- **New company tabs**, between Admins and the product's `companyTabs`: Subscription, Domains, Settings and
+  Support. Each needs its feature and read permission.
+- `'domains'` joins `PLATFORM_FEATURES` and the `PlatformFeature` type. `usePlatform()` gains `features`.
+- New exports: `formatPrice`, `PlansView`, `SupportAccessView`, `SupportGrants`, `SubscriptionTab`,
+  `DomainsTab`, `SettingsTab`, `SupportTab`.
+- A product that already has its own settings or subscription tab in `companyTabs` should drop it once the
+  server serves the built-in one, or the company page shows both.
+

package/PLATFORM-API.md

@@ -5,7 +5,7 @@ server only through this contract. The server side is `createPlatformApi` in `@d
 mounted with `./next` (`app/api/platform/[...path]/route.ts`) or `./express` (`app.use('/api/platform', …)`).
 A product that implements these endpoints itself gets the same console.
 
-**Server status.** `@dreamtree-org/tenancy` 0.4.0 implements everything marked shipped, plus these v1.1 items: TOTP, throttle, rotation, `/me`, roles and audit. Plans, settings, support access and domains come next.
+**Server status.** `@dreamtree-org/tenancy` 0.5.0 implements the whole contract: everything marked shipped, and every v1.1 item (TOTP, throttle, rotation, `/me`, roles, audit, plans, settings, support access and domains). The console in landing-kit 0.10.0 shows all of them.
 
 The contract was taken from procurementpro's `app/api/platform/**`, the reference console. Paths are
 relative to the base path, `/api/platform` by default (`createPlatformClient({ basePath })`).
@@ -63,14 +63,16 @@ relative to the base path, `/api/platform` by default (`createPlatformClient({ b
 ```json
 {
   "admin": { "id": "…", "email": "…", "roles": ["superadmin"], "totpEnrolled": true },
-  "permissions": ["companies.read", "companies.write", "admins.write", "jobs.write", "db.reveal", "plans.write", "settings.write", "support.grant"],
+  "permissions": ["companies.read", "companies.write", "admins.write", "jobs.write", "db.reveal", "plans.write", "settings.write", "support.grant", "domains.write"],
   "access": { "console": true, "stepUpFresh": false },
   "features": { "jobs": true, "plans": true, "settings": true, "support": true, "domains": true, "audit": true },
   "app": { "key": "procurementpro", "name": "ProcurementPro", "companyLoginPath": "/c/:slug/login" }
 }
 ```
 
-**Roles.** `superadmin` holds every permission. `support` holds `companies.read`, `admins.read`, `jobs.read`, `audit.read`, `plans.read` and `support.request`.
+**Roles.** `superadmin` holds every permission. `support` holds `companies.read`, `admins.read`, `jobs.read`, `audit.read`, `plans.read`, `domains.read` and `support.request`.
+
+**Permissions per v1.1 feature:** plans and subscriptions use `plans.read` / `plans.write`; settings use `settings.read` / `settings.write`; support access uses `support.request` (list and request) and `support.grant` (approve and revoke); domains use `domains.read` / `domains.write`.
 
 Until `/me` exists, the console falls back to the shipped feature set (overview, companies, admins, and
 jobs when `GET /jobs` answers `enabled: true`).
@@ -157,14 +159,16 @@ advertised.
 | POST | `/plans` | `Plan` without `id` | **step-up** | v1.1 |
 | PATCH | `/plans/:id` | any `Plan` field | Archive with `{ status: "archived" }`; plans are never deleted. **step-up** | v1.1 |
 | GET | `/companies/:id/subscription` | — | `{ subscription: Subscription \| null, history: Subscription[] }` | v1.1 |
-| PUT | `/companies/:id/subscription` | `{ planId, status, startsAt?, endsAt?, seats?, notes? }` | **step-up** | v1.1 |
+| PUT | `/companies/:id/subscription` | `{ planId, status, startsAt?, endsAt?, seats?, notes? }` | `{ subscription, history }`. Appends a row; an archived plan is refused unless the company is already on it. **step-up** | v1.1 |
 
-### Platform settings
+### Company settings
 
 | Method | Path | Body | Response / notes | Status |
 |---|---|---|---|---|
-| GET | `/settings` | `?company=` (omit for platform defaults) | `{ families: SettingsFamily[] }`, with secret values masked | v1.1 |
-| PUT | `/settings/:family` | `{ companyId?, values }` | Secret fields are write-only. **step-up** | v1.1 |
+| GET | `/settings` | `?company=` (required) | `{ families: SettingsFamily[], version }`. Secret fields carry `set`, never a value | v1.1 |
+| PUT | `/settings/:family` | `{ companyId, values, version }` | `{ ok, changed, families, version }`. A blank secret keeps the stored one; a stale `version` answers 409 `CONFLICT`. The audit records the keys changed, never the values. **step-up** | v1.1 |
+
+Settings are per company. Platform-wide settings are not part of the contract yet.
 
 ### Support access
 
@@ -174,8 +178,8 @@ data (knowledge doc §5.8).
 | Method | Path | Body | Response / notes | Status |
 |---|---|---|---|---|
 | GET | `/support-access` | `?company&status` | `{ grants: SupportGrant[] }` | v1.1 |
-| POST | `/support-access` | `{ companyId, reason, minutes }` | Request a grant | v1.1 |
-| POST | `/support-access/:id` | `{ action: "approve" \| "revoke" }` | **step-up** | v1.1 |
+| POST | `/support-access` | `{ companyId, reason, minutes }` | `{ grant }`. Reason 8–255 characters; minutes 15–480. An unapproved request lapses after a day | v1.1 |
+| POST | `/support-access/:id` | `{ action: "approve" \| "revoke" }` | `{ grant }`. The requester cannot approve their own grant; the window starts at approval. **step-up** | v1.1 |
 
 ### Domains
 
@@ -183,7 +187,7 @@ data (knowledge doc §5.8).
 |---|---|---|---|---|
 | GET | `/companies/:id/domains` | — | `{ domains: CompanyDomain[] }` | v1.1 |
 | POST | `/companies/:id/domains` | `{ host }` | `{ domain, verification: { type: "TXT", name, value } }` | v1.1 |
-| POST | `/companies/:id/domains/:domainId` | `{ action: "verify" \| "make-primary" \| "remove" }` | `remove` needs **step-up** | v1.1 |
+| POST | `/companies/:id/domains/:domainId` | `{ action: "verify" \| "make-primary" \| "remove" }` | `verify` answers `{ ok, verified, domain }` (`verified: false` until the TXT record is published). The first verified domain becomes primary. `remove` needs **step-up** | v1.1 |
 
 ## Shapes
 
@@ -206,8 +210,8 @@ The server writes one `platform_audit_events` row per mutating call. Action name
 - `company.admin.create`, `branch.create`
 - `database.test`, `database.replace`, `database.credentials.reveal`
 - `job.run`, `job.retry`, `schedule.create`
-- `plan.update`, `subscription.update`, `settings.update`
-- `support.grant.request`, `support.grant.approve`
-- `domain.add`
+- `plan.create`, `plan.update`, `subscription.update`, `settings.update`
+- `support.grant.request`, `support.grant.approve`, `support.grant.revoke`
+- `domain.add`, `domain.verify`, `domain.primary`, `domain.remove`
 
 Products may add their own actions under their app key.

package/README.md

@@ -54,7 +54,7 @@ Every star ⭐, share, and contribution helps more than you know. Thank you for
   - `<LandingPage brand={brand} content={content} />` — a product's landing page is a content file.
   - `<AuthShell brand={brand} title="Welcome back">…</AuthShell>` (also available at `@dreamtree-org/landing-kit/auth` + `@dreamtree-org/landing-kit/auth.css`).
   - The built-in `brands` / `getBrand(id)` registry is **deprecated** (warns once, removed in 0.5.0).
-- **Platform admin console** (`@dreamtree-org/landing-kit/platform`, 0.8.0+): one HTTP contract ([PLATFORM-API.md](./PLATFORM-API.md)) that every product's super-administrator console speaks, and its browser client (`createPlatformClient`, `createStepUp`). The server half is `createPlatformApi` in `@dreamtree-org/tenancy`. The shared React shell and views (overview, companies, jobs, admins, audit, plans, settings, support access) build on this client.
+- **Platform admin console** (`@dreamtree-org/landing-kit/platform`, 0.8.0+): one HTTP contract ([PLATFORM-API.md](./PLATFORM-API.md)) that every product's super-administrator console speaks, and its browser client (`createPlatformClient`, `createStepUp`). The server half is `createPlatformApi` in `@dreamtree-org/tenancy`. The shared React shell and views (overview, companies, jobs, admins, audit; and from 0.10.0 plans, subscriptions, company settings, support access and domains) build on this client.
 - Plain CSS (`--dt-*` custom properties). It looks the same under Tailwind 3, Tailwind 4 (preflight or not) or no Tailwind. Dark mode via `[data-theme="dark"]` or `.dark`.
 - Built for prerendered, **un-hydrated** pages (fast and crawlable): `enhanceLanding()` wires the menu and the demo button in a few hundred bytes. It also works hydrated in an SPA or Next.js (`'use client'`, `onBookDemo`, `linkComponent`).
 - Responsive from 320px up. The nav folds into a menu below 1024px. Checked with Playwright at 320/375/768/1024/1440, light and dark.
@@ -261,6 +261,7 @@ export default function Login() {
 | `legalLinks` | `{label, href}[]` | Privacy, Terms, Data Policy | `[]` hides them |
 | `linkComponent` | component | `<a>` | receives both `to` and `href` |
 | `demoAccounts` | `{ load, onSelect, taps? }` | | hidden demo-accounts panel (below) |
+| `ssoProvider` | `{ startUrl, mode, label?, companySlug?, returnTo?, autoRedirect? }` | | "Continue with Dreamtree" (Dreamtree ID single sign-on, below) |
 
 #### Hidden demo accounts (every product, same behaviour)
 
@@ -321,6 +322,45 @@ Company-first logins pick the chip on the company step: call `stashDemoFill(acco
 `takeDemoFill()` when the password step mounts (sessionStorage, read once). Outside AuthShell, render
 `<DemoAccounts load onSelect />` behind `useTapReveal()` yourself.
 
+#### Dreamtree ID single sign-on (`ssoProvider`)
+
+Each app maps its `AUTH_MODE` env to `ssoProvider`: `local` → leave it out (the card is byte-for-byte what it
+was), `hybrid` → a **Continue with Dreamtree** button and an "or" divider above your form, `sso` → no form, a
+"Redirecting to Dreamtree ID…" status (`role="status"`) and `window.location.assign` after mount, with the
+same button kept as the fallback if JS or the redirect fails.
+
+```jsx
+// hybrid: the local form stays, Dreamtree goes on top
+<AuthShell
+  brand={brand}
+  title="Sign in"
+  ssoProvider={{ startUrl: '/auth/sso/start', mode: 'hybrid', companySlug: slug, returnTo: '/dashboard' }}
+>
+  <LoginForm />
+</AuthShell>
+
+// sso: Dreamtree only; children (and the demo-accounts panel) are not rendered
+<AuthShell
+  brand={brand}
+  title="Sign in"
+  ssoProvider={{ startUrl: '/auth/sso/start', mode: 'sso', companySlug: params.slug, returnTo: searchParams.get('next') ?? '/' }}
+/>
+```
+
+| Field | Type | Default | Meaning |
+|---|---|---|---|
+| `startUrl` | `string` | required | the app's SSO entry point (`/auth/sso/start`); may already have a query or `#hash` |
+| `mode` | `'hybrid' \| 'sso'` | required | see above |
+| `label` | `string` | `"Continue with Dreamtree"` | button text (its accessible name) |
+| `companySlug` | `string` | | sent as `dt_company` (the `/c/[slug]/login` company) |
+| `returnTo` | `string` | | sent as `return_to`; leave it out and the app's start route picks its default |
+| `autoRedirect` | `boolean` | `true` in `sso` | `false` shows only the button (no status, no redirect); ignored in `hybrid` |
+
+The link is `buildSsoUrl(startUrl, { returnTo, companySlug })` (also exported): both values are URI-encoded,
+replace same-named params already on `startUrl`, and every other param and the `#hash` are kept. It is pure
+string work, so server rendering never touches `window`; the redirect happens only in an effect, once per
+mount. The spinner does not animate under `prefers-reduced-motion`.
+
 ### `@dreamtree-org/landing-kit/enhance`
 
 `enhanceLanding(root = document, { openDemo | loadDemo, warmDemo, hash = '#book-demo' })`: wires

package/ai-skills/landing-kit.md

@@ -59,7 +59,7 @@ const { password } = await sensitive(() => api.post(`admins/${id}`, { action: 'r
 - **Cancelled step-up.** A step-up the admin cancels rejects with `code: 'CANCELLED'`. Treat it as a no-op, not an error toast.
 - **Enrollment gate.** A 403 `TOTP_ENROLLMENT_REQUIRED`, or `me.access.console === false`, means show the authenticator enrolment screen (`POST me/totp` with `begin`, then `verify`), not an error.
 - **One-time secrets.** New passwords and revealed DB URLs come back exactly once. Show them in a copy-once panel, and never log them or put them in state that persists.
-- **Feature gating.** Call `GET me` (v1.1 servers) and pass the result to `enabledFeatures(PLATFORM_FEATURES, me)`. That decides which nav items to show: jobs, plans, audit, support, settings. Older servers fall back to overview, companies, jobs and admins.
+- **Feature gating.** Call `GET me` (v1.1 servers) and pass the result to `enabledFeatures(PLATFORM_FEATURES, me)`. That decides which nav items and company tabs to show: jobs, plans, audit, support, settings, domains. Older servers fall back to overview, companies, jobs and admins.
 
 ## React console
 
@@ -76,13 +76,14 @@ const { password } = await sensitive(() => api.post(`admins/${id}`, { action: 'r
   - Companies: list, 4-step new-company wizard, detail with overview, branches, database (test, sync, replace, reveal), admins, jobs and activity
   - Background jobs: runs, schedules, workers and queues
   - Platform admins
-- **v1.1:**
+- **v1.1** (served by tenancy 0.5.0, shown by landing-kit 0.10.0):
   - TOTP sign-in and enrolment, login throttle, `GET /me` with a role-based permission list
   - Global audit viewer and CSV export
-  - Plans and per-company subscriptions
-  - Platform and company settings (secret fields are write-only)
-  - Support-access grants
-  - Company domains
+  - Plans page, and a Subscription tab on each company
+  - Settings tab on each company (secret fields are write-only; saves carry `version`)
+  - Support access page, and a Support tab on each company (a second admin approves)
+  - Domains tab on each company (TXT verification, primary, remove)
+- **Built in, not product tabs.** Subscription, Domains, Settings and Support are console built-ins that appear when `GET /me` advertises the feature. Don't re-implement them in `companyTabs`.
 
 ## Security invariants (do not weaken)
 

package/auth.css

@@ -209,6 +209,63 @@
 .dt-auth-demo-note { margin: 0.625rem 0 0; font-size: 0.75rem; color: var(--dt-auth-muted); }
 .dt-auth-demo-note code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 0.75rem; color: inherit; }
 
+/* ---- Dreamtree ID single sign-on (ssoProvider, DTID-32) ---- */
+.dt-auth-sso-btn {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+  width: 100%;
+  min-height: 2.75rem;
+  padding: 0.625rem 1rem;
+  border: 1px solid var(--dt-brand);
+  border-radius: 0.5rem;
+  background: var(--dt-brand);
+  color: #fff;
+  font: inherit;
+  font-size: 0.9375rem;
+  font-weight: 600;
+  text-decoration: none;
+  transition: background-color 120ms;
+}
+.dt-auth-sso-btn:hover { background: color-mix(in oklab, var(--dt-brand) 88%, black); }
+.dt-auth-sso-btn:focus-visible { outline: 2px solid var(--dt-brand); outline-offset: 2px; }
+.dt-auth-sso-icon { flex: none; }
+.dt-auth-or {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  margin: 1.25rem 0;
+  font-size: 0.75rem;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  color: var(--dt-auth-muted);
+}
+.dt-auth-or::before,
+.dt-auth-or::after { content: ''; flex: 1; border-top: 1px solid var(--dt-auth-border); }
+.dt-auth-sso-status {
+  display: flex;
+  align-items: center;
+  gap: 0.625rem;
+  margin: 0 0 1rem;
+  font-size: 0.875rem;
+  color: var(--dt-auth-muted);
+}
+.dt-auth-sso-spinner {
+  flex: none;
+  width: 1rem;
+  height: 1rem;
+  border: 2px solid var(--dt-brand-soft);
+  border-top-color: var(--dt-brand);
+  border-radius: 999px;
+  animation: dt-auth-sso-spin 0.8s linear infinite;
+}
+@keyframes dt-auth-sso-spin { to { transform: rotate(360deg); } }
+@media (prefers-reduced-motion: reduce) {
+  .dt-auth-sso-spinner { animation: none; }
+  .dt-auth-sso-btn { transition: none; }
+}
+
 /* ---- phones ---- */
 .dt-auth-column,
 .dt-auth-card { min-width: 0; }

package/auth.d.ts

@@ -1,3 +1,3 @@
-export type { BrandId, Brand, LegalLink, AuthShellProps, AuthDemoAccounts, DemoAccount, DemoAccountsResponse, DemoAccountsProps } from './index.js';
-export { AuthShell, brandStyle, brands, getBrand, toLandingBrand, DemoAccounts, useTapReveal, DEMO_ACCOUNTS_URL, fetchDemoAccounts, normalizeDemoAccounts, stashDemoFill, takeDemoFill } from './index.js';
+export type { BrandId, Brand, LegalLink, AuthShellProps, SsoProvider, AuthDemoAccounts, DemoAccount, DemoAccountsResponse, DemoAccountsProps } from './index.js';
+export { AuthShell, buildSsoUrl, brandStyle, brands, getBrand, toLandingBrand, DemoAccounts, useTapReveal, DEMO_ACCOUNTS_URL, fetchDemoAccounts, normalizeDemoAccounts, stashDemoFill, takeDemoFill } from './index.js';
 export type { BrandFile, BrandCopy } from './index.js';

package/dist/auth.cjs

@@ -25,6 +25,7 @@ __export(auth_exports, {
   DemoAccounts: () => DemoAccounts,
   brandStyle: () => brandStyle,
   brands: () => brands,
+  buildSsoUrl: () => buildSsoUrl,
   fetchDemoAccounts: () => fetchDemoAccounts,
   getBrand: () => getBrand,
   normalizeDemoAccounts: () => normalizeDemoAccounts,
@@ -36,7 +37,7 @@ __export(auth_exports, {
 module.exports = __toCommonJS(auth_exports);
 
 // src/AuthShell.jsx
-var import_react3 = require("react");
+var import_react5 = require("react");
 
 // src/DemoAccounts.jsx
 var import_react = require("react");
@@ -122,13 +123,116 @@ function DemoAccounts({ load, onSelect, className = "" }) {
   ] });
 }
 
-// src/useTapReveal.js
+// src/DreamtreeSso.jsx
+var import_react3 = require("react");
+
+// src/sso.js
+function decodeKey(part) {
+  const key = part.split("=")[0];
+  try {
+    return decodeURIComponent(key.replace(/\+/g, " "));
+  } catch {
+    return key;
+  }
+}
+function buildSsoUrl(startUrl, { returnTo, companySlug } = {}) {
+  const raw = String(startUrl != null ? startUrl : "");
+  const hashAt = raw.indexOf("#");
+  const hash = hashAt === -1 ? "" : raw.slice(hashAt);
+  const beforeHash = hashAt === -1 ? raw : raw.slice(0, hashAt);
+  const queryAt = beforeHash.indexOf("?");
+  const path = queryAt === -1 ? beforeHash : beforeHash.slice(0, queryAt);
+  const query = queryAt === -1 ? "" : beforeHash.slice(queryAt + 1);
+  const add = [
+    ["return_to", returnTo],
+    ["dt_company", companySlug]
+  ].filter(([, v]) => v != null && v !== "");
+  const replaced = new Set(add.map(([k]) => k));
+  const params = query.split("&").filter((p) => p && !replaced.has(decodeKey(p))).concat(add.map(([k, v]) => `${k}=${encodeURIComponent(String(v))}`));
+  return `${path}${params.length ? `?${params.join("&")}` : ""}${hash}`;
+}
+
+// src/icons.jsx
 var import_react2 = require("react");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+var base = {
+  viewBox: "0 0 24 24",
+  fill: "none",
+  stroke: "currentColor",
+  strokeWidth: 2,
+  strokeLinecap: "round",
+  strokeLinejoin: "round",
+  "aria-hidden": "true",
+  focusable: "false"
+};
+var make = (paths) => function Icon({ size = 16, className = "dt-lp-icon" }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("svg", { ...base, width: size, height: size, className, children: paths });
+};
+var ArrowRight = make(/* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "M5 12h14M13 6l6 6-6 6" }));
+var ChevronRight = make(/* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "m9 6 6 6-6 6" }));
+var Check = make(/* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "M20 6 9 17l-5-5" }));
+var Help = make(
+  /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("circle", { cx: "12", cy: "12", r: "10" }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "M9.1 9a3 3 0 0 1 5.8 1c0 2-3 3-3 3M12 17h.01" })
+  ] })
+);
+var Alert = make(
+  /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0Z" }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "M12 9v4M12 17h.01" })
+  ] })
+);
+var MenuIcon = make(/* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "M4 6h16M4 12h16M4 18h16" }));
+var Close = make(/* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "M18 6 6 18M6 6l12 12" }));
+var Calendar = make(
+  /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(import_jsx_runtime2.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("rect", { x: "3", y: "4", width: "18", height: "18", rx: "2" }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("path", { d: "M16 2v4M8 2v4M3 10h18m-12 6 2 2 4-4" })
+  ] })
+);
+
+// src/DreamtreeSso.jsx
+var import_jsx_runtime3 = require("react/jsx-runtime");
+var DEFAULT_SSO_LABEL = "Continue with Dreamtree";
+function DreamtreeSso({ provider, children }) {
+  const { startUrl, mode, label = DEFAULT_SSO_LABEL, companySlug, returnTo } = provider;
+  const isSso = mode === "sso";
+  const autoRedirect = isSso && provider.autoRedirect !== false;
+  const href = buildSsoUrl(startUrl, { returnTo, companySlug });
+  const redirected = (0, import_react3.useRef)(false);
+  (0, import_react3.useEffect)(() => {
+    if (!autoRedirect || redirected.current) return;
+    redirected.current = true;
+    window.location.assign(href);
+  }, [autoRedirect, href]);
+  const button = /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("a", { className: "dt-auth-sso-btn", href, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { children: label }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(ArrowRight, { size: 16, className: "dt-auth-sso-icon" })
+  ] });
+  if (isSso) {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: "dt-auth-sso dt-auth-sso--only", children: [
+      autoRedirect ? /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("p", { className: "dt-auth-sso-status", role: "status", "aria-live": "polite", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { className: "dt-auth-sso-spinner", "aria-hidden": "true" }),
+        "Redirecting to Dreamtree ID\u2026"
+      ] }) : null,
+      button
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { className: "dt-auth-sso", children: button }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { className: "dt-auth-or", children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { children: "or" }) }),
+    children
+  ] });
+}
+
+// src/useTapReveal.js
+var import_react4 = require("react");
 function useTapReveal({ taps = 4, windowMs = 1500 } = {}) {
-  const [revealed, setRevealed] = (0, import_react2.useState)(false);
-  const count = (0, import_react2.useRef)(0);
-  const last = (0, import_react2.useRef)(0);
-  const onClick = (0, import_react2.useCallback)(() => {
+  const [revealed, setRevealed] = (0, import_react4.useState)(false);
+  const count = (0, import_react4.useRef)(0);
+  const last = (0, import_react4.useRef)(0);
+  const onClick = (0, import_react4.useCallback)(() => {
     if (revealed) return;
     const now = Date.now();
     count.current = now - last.current <= windowMs ? count.current + 1 : 1;
@@ -139,7 +243,7 @@ function useTapReveal({ taps = 4, windowMs = 1500 } = {}) {
 }
 
 // src/AuthShell.jsx
-var import_jsx_runtime2 = require("react/jsx-runtime");
+var import_jsx_runtime4 = require("react/jsx-runtime");
 var DEFAULT_LEGAL = [
   { label: "Privacy Policy", href: "/privacy" },
   { label: "Terms", href: "/terms" },
@@ -147,10 +251,10 @@ var DEFAULT_LEGAL = [
 ];
 function BrandMark({ brand, size }) {
   if (brand.logoSrc) {
-    return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("img", { className: "dt-auth-mark-img", src: brand.logoSrc, alt: "", width: size, height: size });
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("img", { className: "dt-auth-mark-img", src: brand.logoSrc, alt: "", width: size, height: size });
   }
-  if (brand.mark) return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "dt-auth-mark-node", children: brand.mark });
-  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "dt-auth-monogram", style: { width: size, height: size }, "aria-hidden": "true", children: brand.name.charAt(0) });
+  if (brand.mark) return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "dt-auth-mark-node", children: brand.mark });
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "dt-auth-monogram", style: { width: size, height: size }, "aria-hidden": "true", children: brand.name.charAt(0) });
 }
 function brandStyle(brand) {
   return {
@@ -169,52 +273,53 @@ function AuthShell({
   legalLinks = DEFAULT_LEGAL,
   linkComponent: LinkComponent,
   className = "",
-  demoAccounts
+  demoAccounts,
+  ssoProvider
 }) {
   var _a, _b;
-  const headingId = (0, import_react3.useId)();
+  const headingId = (0, import_react5.useId)();
   const { revealed, tapProps } = useTapReveal({ taps: (_a = demoAccounts == null ? void 0 : demoAccounts.taps) != null ? _a : 4 });
   const isPlatform = variant === "platform";
   const headline = isPlatform ? brand.platformHeadline || "Platform administration" : brand.headline;
   const pitch = isPlatform ? brand.platformPitch || `Super administrator console for ${brand.name}. Every action here is audited.` : brand.pitch;
-  const renderLink = (l) => LinkComponent ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(LinkComponent, { to: l.href, href: l.href, className: "dt-auth-legal-link", children: l.label }, l.href) : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("a", { href: l.href, className: "dt-auth-legal-link", children: l.label }, l.href);
-  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(
+  const renderLink = (l) => LinkComponent ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(LinkComponent, { to: l.href, href: l.href, className: "dt-auth-legal-link", children: l.label }, l.href) : /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("a", { href: l.href, className: "dt-auth-legal-link", children: l.label }, l.href);
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)(
     "div",
     {
       className: `dt-auth ${isPlatform ? "dt-auth--platform" : ""} ${className}`,
       style: brandStyle(brand),
       "data-product": brand.id,
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("aside", { className: "dt-auth-panel", children: [
-          /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("a", { href: "/", className: "dt-auth-brand", children: [
-            /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(BrandMark, { brand, size: 28 }),
-            /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "dt-auth-brand-name", children: brand.name }),
-            isPlatform ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "dt-auth-badge", children: "Platform" }) : null
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("aside", { className: "dt-auth-panel", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("a", { href: "/", className: "dt-auth-brand", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(BrandMark, { brand, size: 28 }),
+            /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "dt-auth-brand-name", children: brand.name }),
+            isPlatform ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "dt-auth-badge", children: "Platform" }) : null
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "dt-auth-pitch", children: [
-            /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h2", { children: headline }),
-            pitch ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { children: pitch }) : null,
-            !isPlatform && ((_b = brand.points) == null ? void 0 : _b.length) ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("ul", { children: brand.points.map((p) => /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("li", { children: p }, p)) }) : null
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { className: "dt-auth-pitch", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("h2", { children: headline }),
+            pitch ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { children: pitch }) : null,
+            !isPlatform && ((_b = brand.points) == null ? void 0 : _b.length) ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("ul", { children: brand.points.map((p) => /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("li", { children: p }, p)) }) : null
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "dt-auth-panel-foot", children: brand.category || "by Dreamtree-Org" })
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { className: "dt-auth-panel-foot", children: brand.category || "by Dreamtree-Org" })
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("main", { className: "dt-auth-main", children: /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "dt-auth-column", children: [
-          /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("a", { href: "/", className: "dt-auth-brand dt-auth-brand--mobile", children: [
-            /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(BrandMark, { brand, size: 24 }),
-            /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "dt-auth-brand-name", children: brand.name }),
-            isPlatform ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "dt-auth-badge", children: "Platform" }) : null
+        /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("main", { className: "dt-auth-main", children: /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("div", { className: "dt-auth-column", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("a", { href: "/", className: "dt-auth-brand dt-auth-brand--mobile", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(BrandMark, { brand, size: 24 }),
+            /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "dt-auth-brand-name", children: brand.name }),
+            isPlatform ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { className: "dt-auth-badge", children: "Platform" }) : null
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("section", { className: "dt-auth-card", "aria-labelledby": headingId, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("header", { className: "dt-auth-head", children: [
-              /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h1", { id: headingId, ...demoAccounts ? tapProps : {}, children: title }),
-              subtitle ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { children: subtitle }) : null
+          /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("section", { className: "dt-auth-card", "aria-labelledby": headingId, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("header", { className: "dt-auth-head", children: [
+              /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("h1", { id: headingId, ...demoAccounts ? tapProps : {}, children: title }),
+              subtitle ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { children: subtitle }) : null
             ] }),
-            children,
-            demoAccounts && revealed ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(DemoAccounts, { load: demoAccounts.load, onSelect: demoAccounts.onSelect }) : null
+            ssoProvider ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(DreamtreeSso, { provider: ssoProvider, children }) : children,
+            demoAccounts && revealed && (ssoProvider == null ? void 0 : ssoProvider.mode) !== "sso" ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(DemoAccounts, { load: demoAccounts.load, onSelect: demoAccounts.onSelect }) : null
           ] }),
-          footer ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: "dt-auth-footer", children: footer }) : null,
-          (legalLinks == null ? void 0 : legalLinks.length) ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("nav", { className: "dt-auth-legal", "aria-label": "Legal", children: legalLinks.map((l, i) => /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("span", { className: "dt-auth-legal-item", children: [
-            i > 0 ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { "aria-hidden": "true", children: "\xB7" }) : null,
+          footer ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("div", { className: "dt-auth-footer", children: footer }) : null,
+          (legalLinks == null ? void 0 : legalLinks.length) ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("nav", { className: "dt-auth-legal", "aria-label": "Legal", children: legalLinks.map((l, i) => /* @__PURE__ */ (0, import_jsx_runtime4.jsxs)("span", { className: "dt-auth-legal-item", children: [
+            i > 0 ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { "aria-hidden": "true", children: "\xB7" }) : null,
             renderLink(l)
           ] }, l.href)) }) : null
         ] }) })