@hanzo/ui 8.31.0 → 8.32.0

package/dist/auth/SignInPanel.cjs

@@ -0,0 +1,49 @@
+'use client';"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignInPanel = SignInPanel;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const react_2 = require("@hanzo/i18n/react");
+const react_3 = require("@hanzo/iam/react");
+const react_simple_icons_1 = require("@icons-pack/react-simple-icons");
+const button_1 = require("../backends/gui/button.cjs");
+const field_1 = require("../backends/gui/field.cjs");
+const input_1 = require("../backends/gui/input.cjs");
+const layout_1 = require("../backends/gui/layout.cjs");
+const handoff_1 = require("./handoff.cjs");
+const NAME = { google: 'Google', github: 'GitHub' };
+function SignInPanel({ title, line, providers = ['google', 'github'], signin = handoff_1.SIGNIN, signup = true, termsHref = 'https://hanzo.ai/terms', privacyHref = 'https://hanzo.ai/privacy', authorize = (u) => u, track, }) {
+    const { t } = (0, react_2.useI18n)();
+    const { sdk } = (0, react_3.useIam)();
+    const [email, setEmail] = (0, react_1.useState)('');
+    const [busy, setBusy] = (0, react_1.useState)(null);
+    const [wrong, setWrong] = (0, react_1.useState)(null);
+    /** Mint this site's own request, then leave for where `way` goes. */
+    async function leave(method, way, hint) {
+        setWrong(null);
+        setBusy(method);
+        track?.('signin_started', { method });
+        try {
+            const request = await sdk.getSigninUrl(hint ? { additionalParams: { login_hint: hint } } : undefined);
+            window.location.assign(authorize((0, handoff_1.handoff)(request, way, signin)));
+        }
+        catch (err) {
+            setWrong(err instanceof Error && err.message ? err.message : 'Signing in could not start. Try again.');
+            setBusy(null);
+        }
+    }
+    function withEmail(e) {
+        e.preventDefault();
+        const typed = (0, handoff_1.address)(email);
+        if (!typed) {
+            setWrong('Enter your email address.');
+            return;
+        }
+        void leave('email', { kind: 'email', email: typed }, typed);
+    }
+    return ((0, jsx_runtime_1.jsxs)(layout_1.YStack, { width: "100%", maxW: 400, items: "center", gap: "$4", children: [title ? ((0, jsx_runtime_1.jsx)(layout_1.Heading, { render: "h1", size: "$8", fontWeight: "500", color: "$ink", m: 0, text: "center", children: title })) : null, line ? ((0, jsx_runtime_1.jsx)(layout_1.Paragraph, { size: "$3", color: "$quiet", m: 0, text: "center", maxW: 360, children: line })) : null, (0, jsx_runtime_1.jsx)(layout_1.YStack, { width: "100%", gap: "$2.5", mt: title || line ? '$2' : 0, children: providers.map((p) => ((0, jsx_runtime_1.jsxs)(button_1.Button, { type: "button", variant: "secondary", size: "lg", rounded: "$10", width: "100%", disabled: busy !== null, onClick: () => void leave(p, { kind: 'provider', provider: p }), children: [p === 'google' ? (0, jsx_runtime_1.jsx)(react_simple_icons_1.SiGoogle, { size: 16 }) : (0, jsx_runtime_1.jsx)(react_simple_icons_1.SiGithub, { size: 16 }), t('Continue with {provider}', { provider: NAME[p] })] }, p))) }), providers.length ? ((0, jsx_runtime_1.jsx)(layout_1.YStack, { width: "100%", children: (0, jsx_runtime_1.jsx)(field_1.FieldSeparator, { children: t('or') }) })) : null, (0, jsx_runtime_1.jsxs)(layout_1.YStack, { render: (0, jsx_runtime_1.jsx)("form", { onSubmit: withEmail, noValidate: true }), width: "100%", gap: "$3", children: [(0, jsx_runtime_1.jsx)(field_1.Field, { gap: "$2", children: (0, jsx_runtime_1.jsx)(input_1.Input, { id: "hanzo-signin-email", type: "email", name: "email", autoComplete: "username", "aria-label": t('Email'), value: email, onChangeText: setEmail, placeholder: "you@company.com" }) }), wrong ? (0, jsx_runtime_1.jsx)(field_1.FieldError, { children: t(wrong) }) : null, (0, jsx_runtime_1.jsx)(button_1.Button, { type: "submit", size: "lg", rounded: "$10", width: "100%", bg: "$ink", color: "$background", borderColor: "$ink", hoverStyle: { opacity: 0.92 }, disabled: busy !== null, children: t('Continue with email') })] }), signup ? ((0, jsx_runtime_1.jsxs)(layout_1.Paragraph, { size: "$2", color: "$quiet", m: 0, children: [`${t('New to Hanzo?')} `, (0, jsx_runtime_1.jsx)(button_1.Button, { type: "button", variant: "link", size: "sm", px: 0, height: "auto", disabled: busy !== null, onClick: () => void leave('signup', { kind: 'signup' }), children: t('Create account') })] })) : null, (0, jsx_runtime_1.jsx)(layout_1.Paragraph, { size: "$1", color: "$quiet", m: 0, text: "center", maxW: 400, children: t("By continuing, you agree to Hanzo's {terms} and {privacy}.", {
+                    terms: ((0, jsx_runtime_1.jsx)(layout_1.Anchor, { href: termsHref, color: "$ink", textDecorationLine: "underline", children: t('Terms') })),
+                    privacy: ((0, jsx_runtime_1.jsx)(layout_1.Anchor, { href: privacyHref, color: "$ink", textDecorationLine: "underline", children: t('Privacy Policy') })),
+                }) })] }));
+}

package/dist/auth/SignInPanel.d.ts

@@ -0,0 +1,38 @@
+import { type ReactNode } from 'react';
+import { type ProviderKind } from './handoff.js';
+/**
+ * The sign-in a Hanzo site draws on its own front page (hanzo.app, hanzo.bot,
+ * hanzo.team), shared so every site asks the same way and leaves the same way.
+ *
+ * It looks like a sign-in and is a door: no credential is typed here, and no
+ * session is made on this origin. Each press mints this site's own authorize
+ * request (`getSigninUrl`, which keeps the PKCE verifier and state here) and
+ * leaves with it (./handoff.ts): Google or GitHub straight to the provider, in one
+ * press; an email to hanzo.ai/login with the address filled in; a new account to
+ * hanzo.ai/signup. The session that answers is hanzo.ai's, so a person signed in
+ * on any Hanzo site is not asked again.
+ *
+ * Drawn from @hanzo/ui components in the theme's tokens; the host mounts its
+ * GuiProvider and imports no stylesheet. Framework-free: a Next export and a Vite
+ * app draw it alike.
+ */
+export interface SignInPanelProps {
+    /** The headline: `Sign in to Hanzo Team`. Omit to draw the panel alone under the host's own. */
+    title?: ReactNode;
+    /** One line under the headline. */
+    line?: ReactNode;
+    /** The providers offered, in order. Default Google, then GitHub. */
+    providers?: ProviderKind[];
+    /** The origin people sign in on. Default https://hanzo.ai. */
+    signin?: string;
+    /** Offer "Create account". Default true. */
+    signup?: boolean;
+    termsHref?: string;
+    privacyHref?: string;
+    /** Decorates an address the browser is about to leave for (the visitor rides along). */
+    authorize?: (url: string) => string;
+    /** A press the stream should hear: `signin_started{method}`. */
+    track?: (name: string, props?: Record<string, unknown>) => void;
+}
+export declare function SignInPanel({ title, line, providers, signin, signup, termsHref, privacyHref, authorize, track, }: SignInPanelProps): import("react").JSX.Element;
+//# sourceMappingURL=SignInPanel.d.ts.map

package/dist/auth/SignInPanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInPanel.d.ts","sourceRoot":"","sources":["../../src/auth/SignInPanel.tsx"],"names":[],"mappings":"AAEA,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAA;AAQhE,OAAO,EAA4B,KAAK,YAAY,EAAY,MAAM,WAAW,CAAA;AAEjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,mCAAmC;IACnC,IAAI,CAAC,EAAE,SAAS,CAAA;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,YAAY,EAAE,CAAA;IAC1B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4CAA4C;IAC5C,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wFAAwF;IACxF,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IACnC,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CAChE;AAID,wBAAgB,WAAW,CAAC,EAC1B,KAAK,EACL,IAAI,EACJ,SAAgC,EAChC,MAAe,EACf,MAAa,EACb,SAAoC,EACpC,WAAwC,EACxC,SAAoB,EACpB,KAAK,GACN,EAAE,gBAAgB,+BAkGlB"}

package/dist/auth/SignInPanel.js

@@ -0,0 +1,47 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { useI18n } from '@hanzo/i18n/react';
+import { useIam } from '@hanzo/iam/react';
+import { SiGithub, SiGoogle } from '@icons-pack/react-simple-icons';
+import { Button } from '../backends/gui/button.js';
+import { Field, FieldError, FieldSeparator } from '../backends/gui/field.js';
+import { Input } from '../backends/gui/input.js';
+import { Anchor, Heading, Paragraph, YStack } from '../backends/gui/layout.js';
+import { address, handoff, SIGNIN } from './handoff.js';
+const NAME = { google: 'Google', github: 'GitHub' };
+export function SignInPanel({ title, line, providers = ['google', 'github'], signin = SIGNIN, signup = true, termsHref = 'https://hanzo.ai/terms', privacyHref = 'https://hanzo.ai/privacy', authorize = (u) => u, track, }) {
+    const { t } = useI18n();
+    const { sdk } = useIam();
+    const [email, setEmail] = useState('');
+    const [busy, setBusy] = useState(null);
+    const [wrong, setWrong] = useState(null);
+    /** Mint this site's own request, then leave for where `way` goes. */
+    async function leave(method, way, hint) {
+        setWrong(null);
+        setBusy(method);
+        track?.('signin_started', { method });
+        try {
+            const request = await sdk.getSigninUrl(hint ? { additionalParams: { login_hint: hint } } : undefined);
+            window.location.assign(authorize(handoff(request, way, signin)));
+        }
+        catch (err) {
+            setWrong(err instanceof Error && err.message ? err.message : 'Signing in could not start. Try again.');
+            setBusy(null);
+        }
+    }
+    function withEmail(e) {
+        e.preventDefault();
+        const typed = address(email);
+        if (!typed) {
+            setWrong('Enter your email address.');
+            return;
+        }
+        void leave('email', { kind: 'email', email: typed }, typed);
+    }
+    return (_jsxs(YStack, { width: "100%", maxW: 400, items: "center", gap: "$4", children: [title ? (_jsx(Heading, { render: "h1", size: "$8", fontWeight: "500", color: "$ink", m: 0, text: "center", children: title })) : null, line ? (_jsx(Paragraph, { size: "$3", color: "$quiet", m: 0, text: "center", maxW: 360, children: line })) : null, _jsx(YStack, { width: "100%", gap: "$2.5", mt: title || line ? '$2' : 0, children: providers.map((p) => (_jsxs(Button, { type: "button", variant: "secondary", size: "lg", rounded: "$10", width: "100%", disabled: busy !== null, onClick: () => void leave(p, { kind: 'provider', provider: p }), children: [p === 'google' ? _jsx(SiGoogle, { size: 16 }) : _jsx(SiGithub, { size: 16 }), t('Continue with {provider}', { provider: NAME[p] })] }, p))) }), providers.length ? (_jsx(YStack, { width: "100%", children: _jsx(FieldSeparator, { children: t('or') }) })) : null, _jsxs(YStack, { render: _jsx("form", { onSubmit: withEmail, noValidate: true }), width: "100%", gap: "$3", children: [_jsx(Field, { gap: "$2", children: _jsx(Input, { id: "hanzo-signin-email", type: "email", name: "email", autoComplete: "username", "aria-label": t('Email'), value: email, onChangeText: setEmail, placeholder: "you@company.com" }) }), wrong ? _jsx(FieldError, { children: t(wrong) }) : null, _jsx(Button, { type: "submit", size: "lg", rounded: "$10", width: "100%", bg: "$ink", color: "$background", borderColor: "$ink", hoverStyle: { opacity: 0.92 }, disabled: busy !== null, children: t('Continue with email') })] }), signup ? (_jsxs(Paragraph, { size: "$2", color: "$quiet", m: 0, children: [`${t('New to Hanzo?')} `, _jsx(Button, { type: "button", variant: "link", size: "sm", px: 0, height: "auto", disabled: busy !== null, onClick: () => void leave('signup', { kind: 'signup' }), children: t('Create account') })] })) : null, _jsx(Paragraph, { size: "$1", color: "$quiet", m: 0, text: "center", maxW: 400, children: t("By continuing, you agree to Hanzo's {terms} and {privacy}.", {
+                    terms: (_jsx(Anchor, { href: termsHref, color: "$ink", textDecorationLine: "underline", children: t('Terms') })),
+                    privacy: (_jsx(Anchor, { href: privacyHref, color: "$ink", textDecorationLine: "underline", children: t('Privacy Policy') })),
+                }) })] }));
+}
+//# sourceMappingURL=SignInPanel.js.map

package/dist/auth/SignInPanel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInPanel.js","sourceRoot":"","sources":["../../src/auth/SignInPanel.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,QAAQ,EAAkC,MAAM,OAAO,CAAA;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAC3E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAA+B,MAAM,WAAW,CAAA;AAqCjF,MAAM,IAAI,GAAiC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAEjF,MAAM,UAAU,WAAW,CAAC,EAC1B,KAAK,EACL,IAAI,EACJ,SAAS,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAChC,MAAM,GAAG,MAAM,EACf,MAAM,GAAG,IAAI,EACb,SAAS,GAAG,wBAAwB,EACpC,WAAW,GAAG,0BAA0B,EACxC,SAAS,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EACpB,KAAK,GACY;IACjB,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAA;IACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;IACxB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACrD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,qEAAqE;IACrE,KAAK,UAAU,KAAK,CAAC,MAAc,EAAE,GAAQ,EAAE,IAAa;QAC1D,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,OAAO,CAAC,MAAM,CAAC,CAAA;QACf,KAAK,EAAE,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YACrG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAA;YACtG,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC;IACH,CAAC;IAED,SAAS,SAAS,CAAC,CAAY;QAC7B,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,2BAA2B,CAAC,CAAA;YACrC,OAAM;QACR,CAAC;QACD,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,CACL,MAAC,MAAM,IAAC,KAAK,EAAC,MAAM,EAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAC,QAAQ,EAAC,GAAG,EAAC,IAAI,aACpD,KAAK,CAAC,CAAC,CAAC,CACP,KAAC,OAAO,IAAC,MAAM,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAC,KAAK,EAAC,MAAM,EAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAC,QAAQ,YAC7E,KAAK,GACE,CACX,CAAC,CAAC,CAAC,IAAI,EACP,IAAI,CAAC,CAAC,CAAC,CACN,KAAC,SAAS,IAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,QAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,GAAG,YAC9D,IAAI,GACK,CACb,CAAC,CAAC,CAAC,IAAI,EACR,KAAC,MAAM,IAAC,KAAK,EAAC,MAAM,EAAC,GAAG,EAAC,MAAM,EAAC,EAAE,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YACzD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACpB,MAAC,MAAM,IAAS,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,KAAK,EAAC,MAAM,EAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,aAC5K,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAC,QAAQ,IAAC,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,CAAC,KAAC,QAAQ,IAAC,IAAI,EAAE,EAAE,GAAI,EAChE,CAAC,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAF1C,CAAC,CAGL,CACV,CAAC,GACK,EACR,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAClB,KAAC,MAAM,IAAC,KAAK,EAAC,MAAM,YAClB,KAAC,cAAc,cAAE,CAAC,CAAC,IAAI,CAAC,GAAkB,GACnC,CACV,CAAC,CAAC,CAAC,IAAI,EACR,MAAC,MAAM,IAAC,MAAM,EAAE,eAAM,QAAQ,EAAE,SAAS,EAAE,UAAU,SAAG,EAAE,KAAK,EAAC,MAAM,EAAC,GAAG,EAAC,IAAI,aAC7E,KAAC,KAAK,IAAC,GAAG,EAAC,IAAI,YACb,KAAC,KAAK,IACJ,EAAE,EAAC,oBAAoB,EACvB,IAAI,EAAC,OAAO,EACZ,IAAI,EAAC,OAAO,EACZ,YAAY,EAAC,UAAU,gBACX,CAAC,CAAC,OAAO,CAAC,EACtB,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,QAAQ,EACtB,WAAW,EAAC,iBAAiB,GAC7B,GACI,EACP,KAAK,CAAC,CAAC,CAAC,KAAC,UAAU,cAAE,CAAC,CAAC,KAAK,CAAC,GAAc,CAAC,CAAC,CAAC,IAAI,EACnD,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,KAAK,EAAC,MAAM,EAAC,EAAE,EAAC,MAAM,EAAC,KAAK,EAAC,aAAa,EAAC,WAAW,EAAC,MAAM,EAAC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,KAAK,IAAI,YAC/J,CAAC,CAAC,qBAAqB,CAAC,GAClB,IACF,EACR,MAAM,CAAC,CAAC,CAAC,CACR,MAAC,SAAS,IAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,QAAQ,EAAC,CAAC,EAAE,CAAC,aACrC,GAAG,CAAC,CAAC,eAAe,CAAC,GAAG,EACzB,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,MAAM,EAAC,IAAI,EAAC,IAAI,EAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAC,MAAM,EAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,YACjJ,CAAC,CAAC,gBAAgB,CAAC,GACb,IACC,CACb,CAAC,CAAC,CAAC,IAAI,EACR,KAAC,SAAS,IAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,QAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,GAAG,YAC9D,CAAC,CAAC,4DAA4D,EAAE;oBAC/D,KAAK,EAAE,CACL,KAAC,MAAM,IAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAC,MAAM,EAAC,kBAAkB,EAAC,WAAW,YACjE,CAAC,CAAC,OAAO,CAAC,GACJ,CACV;oBACD,OAAO,EAAE,CACP,KAAC,MAAM,IAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAC,MAAM,EAAC,kBAAkB,EAAC,WAAW,YACnE,CAAC,CAAC,gBAAgB,CAAC,GACb,CACV;iBACF,CAAC,GACQ,IACL,CACV,CAAA;AACH,CAAC"}

package/dist/auth/handoff.cjs

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * Where a Hanzo site sends somebody to sign in: hanzo.ai, never its own page.
+ *
+ * One IAM, and one origin every Hanzo site signs in on, so the session that
+ * answers every site lives on hanzo.ai. Each site is still its own OAuth client:
+ * it mints its own authorize request (its client, its callback, a fresh state and
+ * a PKCE challenge whose verifier stays in its own storage) with `getSigninUrl`,
+ * and hands hanzo.ai only the query. hanzo.ai answers it and IAM returns the code
+ * to the site's callback, where the site redeems it.
+ *
+ *   a provider     straight to IAM's authorize ON hanzo.ai with `provider`, which
+ *                  sends the browser to Google or GitHub at once (one press) and
+ *                  takes the provider's return on hanzo.ai, so the session lands
+ *                  there. Not the issuer's authorize: a provider hop that starts
+ *                  on hanzo.id returns to hanzo.id and leaves hanzo.ai signed out.
+ *   an email       hanzo.ai/login with `login_hint`, where the password or the
+ *                  code is typed.
+ *   a new account  hanzo.ai/signup.
+ *
+ * Pure, so every address is tested without a browser.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGNIN = void 0;
+exports.handoff = handoff;
+exports.address = address;
+/** The one origin Hanzo signs people in on. */
+exports.SIGNIN = 'https://hanzo.ai';
+/**
+ * The address a press leaves for, from the site's own authorize request
+ * (`request`, as `getSigninUrl` answered it). Only its query travels.
+ */
+function handoff(request, way, signin = exports.SIGNIN) {
+    const q = new URL(request).searchParams;
+    const at = signin.replace(/\/+$/, '');
+    switch (way.kind) {
+        case 'provider':
+            q.set('provider', way.provider);
+            return `${at}/v1/iam/oauth/authorize?${q}`;
+        case 'email':
+            q.set('login_hint', way.email);
+            return `${at}/login?${q}`;
+        case 'another':
+            q.set('prompt', 'select_account');
+            return `${at}/login?${q}`;
+        case 'signup':
+            return `${at}/signup?${q}`;
+        case 'login':
+            return `${at}/login?${q}`;
+    }
+}
+/** The address typed, trimmed, when it reads as an email; null otherwise. */
+function address(typed) {
+    const s = typed.trim();
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s) ? s : null;
+}

package/dist/auth/handoff.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Where a Hanzo site sends somebody to sign in: hanzo.ai, never its own page.
+ *
+ * One IAM, and one origin every Hanzo site signs in on, so the session that
+ * answers every site lives on hanzo.ai. Each site is still its own OAuth client:
+ * it mints its own authorize request (its client, its callback, a fresh state and
+ * a PKCE challenge whose verifier stays in its own storage) with `getSigninUrl`,
+ * and hands hanzo.ai only the query. hanzo.ai answers it and IAM returns the code
+ * to the site's callback, where the site redeems it.
+ *
+ *   a provider     straight to IAM's authorize ON hanzo.ai with `provider`, which
+ *                  sends the browser to Google or GitHub at once (one press) and
+ *                  takes the provider's return on hanzo.ai, so the session lands
+ *                  there. Not the issuer's authorize: a provider hop that starts
+ *                  on hanzo.id returns to hanzo.id and leaves hanzo.ai signed out.
+ *   an email       hanzo.ai/login with `login_hint`, where the password or the
+ *                  code is typed.
+ *   a new account  hanzo.ai/signup.
+ *
+ * Pure, so every address is tested without a browser.
+ */
+/** The one origin Hanzo signs people in on. */
+export declare const SIGNIN = "https://hanzo.ai";
+/** The providers the shared panel draws. IAM names them by these words. */
+export type ProviderKind = 'google' | 'github';
+/**
+ * Where a press goes. A provider is named the way IAM names it: a kind (`google`)
+ * or a provider record's name (`provider-google`); either starts the same hop.
+ */
+export type Way = {
+    kind: 'provider';
+    provider: string;
+} | {
+    kind: 'email';
+    email: string;
+} | {
+    kind: 'login';
+} | {
+    kind: 'signup';
+} | {
+    kind: 'another';
+};
+/**
+ * The address a press leaves for, from the site's own authorize request
+ * (`request`, as `getSigninUrl` answered it). Only its query travels.
+ */
+export declare function handoff(request: string, way: Way, signin?: string): string;
+/** The address typed, trimmed, when it reads as an email; null otherwise. */
+export declare function address(typed: string): string | null;
+//# sourceMappingURL=handoff.d.ts.map

package/dist/auth/handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../../src/auth/handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,MAAM,qBAAqB,CAAA;AAExC,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE9C;;;GAGG;AACH,MAAM,MAAM,GAAG,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAE1J;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,GAAE,MAAe,GAAG,MAAM,CAkBlF;AAED,6EAA6E;AAC7E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGpD"}

package/dist/auth/handoff.js

@@ -0,0 +1,52 @@
+/**
+ * Where a Hanzo site sends somebody to sign in: hanzo.ai, never its own page.
+ *
+ * One IAM, and one origin every Hanzo site signs in on, so the session that
+ * answers every site lives on hanzo.ai. Each site is still its own OAuth client:
+ * it mints its own authorize request (its client, its callback, a fresh state and
+ * a PKCE challenge whose verifier stays in its own storage) with `getSigninUrl`,
+ * and hands hanzo.ai only the query. hanzo.ai answers it and IAM returns the code
+ * to the site's callback, where the site redeems it.
+ *
+ *   a provider     straight to IAM's authorize ON hanzo.ai with `provider`, which
+ *                  sends the browser to Google or GitHub at once (one press) and
+ *                  takes the provider's return on hanzo.ai, so the session lands
+ *                  there. Not the issuer's authorize: a provider hop that starts
+ *                  on hanzo.id returns to hanzo.id and leaves hanzo.ai signed out.
+ *   an email       hanzo.ai/login with `login_hint`, where the password or the
+ *                  code is typed.
+ *   a new account  hanzo.ai/signup.
+ *
+ * Pure, so every address is tested without a browser.
+ */
+/** The one origin Hanzo signs people in on. */
+export const SIGNIN = 'https://hanzo.ai';
+/**
+ * The address a press leaves for, from the site's own authorize request
+ * (`request`, as `getSigninUrl` answered it). Only its query travels.
+ */
+export function handoff(request, way, signin = SIGNIN) {
+    const q = new URL(request).searchParams;
+    const at = signin.replace(/\/+$/, '');
+    switch (way.kind) {
+        case 'provider':
+            q.set('provider', way.provider);
+            return `${at}/v1/iam/oauth/authorize?${q}`;
+        case 'email':
+            q.set('login_hint', way.email);
+            return `${at}/login?${q}`;
+        case 'another':
+            q.set('prompt', 'select_account');
+            return `${at}/login?${q}`;
+        case 'signup':
+            return `${at}/signup?${q}`;
+        case 'login':
+            return `${at}/login?${q}`;
+    }
+}
+/** The address typed, trimmed, when it reads as an email; null otherwise. */
+export function address(typed) {
+    const s = typed.trim();
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s) ? s : null;
+}
+//# sourceMappingURL=handoff.js.map

package/dist/auth/handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.js","sourceRoot":"","sources":["../../src/auth/handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,MAAM,GAAG,kBAAkB,CAAA;AAWxC;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,GAAQ,EAAE,MAAM,GAAW,MAAM;IACxE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,CAAA;IACvC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC/B,OAAO,GAAG,EAAE,2BAA2B,CAAC,EAAE,CAAA;QAC5C,KAAK,OAAO;YACV,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;YAC9B,OAAO,GAAG,EAAE,UAAU,CAAC,EAAE,CAAA;QAC3B,KAAK,SAAS;YACZ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;YACjC,OAAO,GAAG,EAAE,UAAU,CAAC,EAAE,CAAA;QAC3B,KAAK,QAAQ;YACX,OAAO,GAAG,EAAE,WAAW,CAAC,EAAE,CAAA;QAC5B,KAAK,OAAO;YACV,OAAO,GAAG,EAAE,UAAU,CAAC,EAAE,CAAA;IAC7B,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IACtB,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACxD,CAAC"}

package/dist/auth/index.cjs

@@ -1,12 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.refresher = exports.live = exports.bearer = exports.useSignOut = exports.signOut = exports.SignIn = void 0;
+exports.refresher = exports.live = exports.bearer = exports.useSignOut = exports.signOut = exports.SIGNIN = exports.handoff = exports.address = exports.SignInPanel = exports.SignIn = void 0;
 /**
  * Signing in, signing out, and the session, for every Hanzo site: IAM answers
  * (/v1/iam), the site draws.
  */
 var SignIn_1 = require("./SignIn.cjs");
 Object.defineProperty(exports, "SignIn", { enumerable: true, get: function () { return SignIn_1.SignIn; } });
+var SignInPanel_1 = require("./SignInPanel.cjs");
+Object.defineProperty(exports, "SignInPanel", { enumerable: true, get: function () { return SignInPanel_1.SignInPanel; } });
+var handoff_1 = require("./handoff.cjs");
+Object.defineProperty(exports, "address", { enumerable: true, get: function () { return handoff_1.address; } });
+Object.defineProperty(exports, "handoff", { enumerable: true, get: function () { return handoff_1.handoff; } });
+Object.defineProperty(exports, "SIGNIN", { enumerable: true, get: function () { return handoff_1.SIGNIN; } });
 var signout_1 = require("./signout.cjs");
 Object.defineProperty(exports, "signOut", { enumerable: true, get: function () { return signout_1.signOut; } });
 Object.defineProperty(exports, "useSignOut", { enumerable: true, get: function () { return signout_1.useSignOut; } });

package/dist/auth/index.d.ts

@@ -3,6 +3,8 @@
  * (/v1/iam), the site draws.
  */
 export { SignIn, type Mode, type Provider, type SignInProps } from './SignIn.js';
+export { SignInPanel, type SignInPanelProps } from './SignInPanel.js';
+export { address, handoff, SIGNIN, type ProviderKind, type Way } from './handoff.js';
 export { signOut, useSignOut, type SignOutOptions } from './signout.js';
 export { bearer, live, refresher } from './session.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAClE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,KAAK,GAAG,EAAE,MAAM,WAAW,CAAA;AACjF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA"}

package/dist/auth/index.js

@@ -3,6 +3,8 @@
  * (/v1/iam), the site draws.
  */
 export { SignIn } from './SignIn.js';
+export { SignInPanel } from './SignInPanel.js';
+export { address, handoff, SIGNIN } from './handoff.js';
 export { signOut, useSignOut } from './signout.js';
 export { bearer, live, refresher } from './session.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAA8C,MAAM,UAAU,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAuB,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAA8C,MAAM,UAAU,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAyB,MAAM,eAAe,CAAA;AAClE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAA+B,MAAM,WAAW,CAAA;AACjF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAuB,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA"}

package/dist/gallery.html

@@ -1,4 +1,4 @@
-<!doctype html><html lang="en" class="t_dark"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>@hanzo/ui 8.31.0</title><style>/* @hanzo/ui — generated by scripts/gen-css.mjs. Do not edit. */
+<!doctype html><html lang="en" class="t_dark"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>@hanzo/ui 8.32.0</title><style>/* @hanzo/ui — generated by scripts/gen-css.mjs. Do not edit. */
 :root { --hanzo-ui-styles: 1; }
 /* Hanzo Design System — the entry point. Import THIS one file.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/ui",
-  "version": "8.31.0",
+  "version": "8.32.0",
   "type": "module",
   "description": "Hanzo UI — the one canonical Hanzo component library, on @hanzo/gui + @hanzo/design. ONE substrate: every component renders through @hanzo/gui primitives, so the same import works on web, native (expo) and desktop (Tauri). Self-contained (theme.css), presentational, host-agnostic, clean-room.",
   "exports": {