@luminaryworks/auth-react 0.4.5 → 0.5.0

package/README.md

@@ -43,6 +43,16 @@ Override layout via `className` / `style` on the root.
   // socialProviders: "auto" | ["google","github"] | []
 />
 
+// Desktop / mobile native shell — Google/GitHub in the system browser (RFC 8252)
+<HeadlessLoginPanel
+  config={idpConfig}
+  productName="VistaRemote"
+  mode="external"
+  openExternalUrl={(url) => window.nativeShell.openExternal(url)}
+  // Password Headless stays in-app; social/SSO open the OS browser.
+  // Register redirect_uri as http://127.0.0.1:<port>/auth/callback or app://…
+/>
+
 // Admin / internal console — hide Experience social connectors
 <HeadlessLoginPanel
   config={idpConfig}
@@ -54,11 +64,15 @@ Override layout via `className` / `style` on the root.
 
 | Prop | Default | Notes |
 |------|---------|--------|
+| `mode` | `"popup"` | `"redirect"` SPA full-page; `"external"` system browser for social/SSO (needs `openExternalUrl`) |
+| `openExternalUrl` | — | Required for `mode="external"`. Electron: `shell.openExternal`; RN: Custom Tabs / ASWebAuthenticationSession |
 | `showSocialConnectors` | `true` | `false` skips fetch and hides divider + social buttons |
 | `socialProviders` | `"auto"` | allowlist, or `[]` (same effect as `showSocialConnectors={false}`) |
 | `experienceAdapter` | catalog default | optional custom `LoginExperienceAdapter`; otherwise `config.iamProvider` |
 | `config.iamProvider` | `logto` | `logto` Headless; `oidc` / `zitadel` Hosted Redirect |
 
+**Desktop callback:** Logto redirects the *system browser* to your loopback `redirect_uri`. The native shell must detect that request, focus the app window onto the same URL (so PKCE `localStorage` matches), and show Chrome a “you can close this tab” page. See VistaRemote Electron `serve-renderer-static` + Viewer preload.
+
 IdP hosted `/sign-in` social row layout: `node scripts/apply-branding.mjs` (customCss wrap). Enable connectors: `ensure-sign-in-experience.mjs` + `verify-social-direct-signin.mjs`.
 
 ### Login experience adapters

package/dist/index.css

@@ -48,6 +48,55 @@
   display: grid;
   gap: 10px;
 }
+.HeadlessLoginPanel_module_channelTabs {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 6px;
+  margin-bottom: 2px;
+}
+.HeadlessLoginPanel_module_channelTab {
+  border: 1px solid #c9d5de;
+  border-radius: 10px;
+  padding: 8px 10px;
+  font-size: 13px;
+  font-weight: 650;
+  cursor: pointer;
+  color: #4b5c68;
+  background: #f7fafc;
+}
+.HeadlessLoginPanel_module_channelTab:disabled {
+  opacity: 0.65;
+  cursor: not-allowed;
+}
+.HeadlessLoginPanel_module_channelTabActive {
+  color: var(--lw-auth-theme-deep);
+  border-color: var(--lw-auth-theme);
+  background: color-mix(in srgb, var(--lw-auth-theme) 10%, #fff);
+}
+.HeadlessLoginPanel_module_codeRow {
+  display: grid;
+  grid-template-columns: 1fr auto;
+  gap: 8px;
+  align-items: stretch;
+}
+.HeadlessLoginPanel_module_codeInput {
+  min-width: 0;
+}
+.HeadlessLoginPanel_module_secondaryBtn {
+  border: 1px solid #b7c9d4;
+  border-radius: 10px;
+  padding: 0 12px;
+  font-size: 13px;
+  font-weight: 650;
+  cursor: pointer;
+  color: #14212b;
+  background: #fff;
+  white-space: nowrap;
+}
+.HeadlessLoginPanel_module_secondaryBtn:disabled {
+  opacity: 0.65;
+  cursor: not-allowed;
+}
 .HeadlessLoginPanel_module_socialStack {
   display: flex;
   flex-wrap: wrap;
@@ -201,6 +250,13 @@
   color: #6b7c87;
   line-height: 1.45;
 }
+.HeadlessLoginPanel_module_domainsHint {
+  margin: -2px 0 0;
+  font-size: 12px;
+  line-height: 1.45;
+  color: #4b5c68;
+  word-break: break-word;
+}
 .HeadlessLoginPanel_module_switchMode {
   margin: 12px 0 0;
   text-align: center;

package/dist/index.css.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/HeadlessLoginPanel.module.scss"],"sourcesContent":["$ink: #14212b;\n$muted: #4b5c68;\n$hint: #6b7c87;\n$brand: #3d6f8f;\n$brand-deep: #15485c;\n$brand-mid: #1f6f8b;\n$border: #c9d5de;\n$border-soft: #b7c9d4;\n$line: #d5e0e7;\n$divider: #90a0ab;\n$surface: #f7fafc;\n$fallback-bg: #e8eef2;\n$danger: #b42318;\n$footer-line: #e4ebf0;\n$radius-lg: 16px;\n$radius-md: 10px;\n$radius-sm: 4px;\n\n.panel {\n  --lw-auth-theme: #1677ff;\n  --lw-auth-theme-deep: color-mix(in srgb, var(--lw-auth-theme) 72%, #000);\n  width: min(100%, 400px);\n  padding: 28px 28px 22px;\n  border-radius: $radius-lg;\n  background: rgba(255, 255, 255, 0.96);\n  color: $ink;\n  box-shadow: 0 24px 64px rgba(15, 23, 42, 0.28);\n  font-family: \"Segoe UI\", \"PingFang SC\", \"Noto Sans SC\", sans-serif;\n}\n\n.brand {\n  display: flex;\n  gap: 14px;\n  align-items: center;\n  margin-bottom: 12px;\n}\n\n.logo {\n  border-radius: 12px;\n  display: block;\n}\n\n.product {\n  margin: 0;\n  font-size: 13px;\n  font-weight: 650;\n  letter-spacing: 0.04em;\n  text-transform: uppercase;\n  color: var(--lw-auth-theme);\n}\n\n.title {\n  margin: 2px 0 0;\n  font-size: 22px;\n  font-weight: 700;\n  line-height: 1.25;\n}\n\n.subtitle {\n  margin: 0 0 18px;\n  font-size: 14px;\n  line-height: 1.5;\n  color: $muted;\n}\n\n.form {\n  display: grid;\n  gap: 10px;\n}\n\n.socialStack {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 10px;\n  font-size: 12px;\n}\n\n.input {\n  width: 100%;\n  box-sizing: border-box;\n  border: 1px solid $border;\n  border-radius: $radius-md;\n  padding: 10px 12px;\n  font-size: 14px;\n  outline: none;\n  background: $surface;\n\n  &:focus {\n    border-color: var(--lw-auth-theme);\n  }\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.passwordField {\n  position: relative;\n  display: flex;\n  align-items: center;\n}\n\n.passwordInput {\n  padding-right: 42px;\n}\n\n.passwordToggle {\n  position: absolute;\n  right: 4px;\n  top: 50%;\n  transform: translateY(-50%);\n  z-index: 1;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 36px;\n  height: 36px;\n  border: none;\n  border-radius: $radius-sm;\n  padding: 0;\n  color: #5a6b76;\n  background: transparent;\n  cursor: pointer;\n\n  &:hover:not(:disabled) {\n    color: var(--lw-auth-theme);\n    background: color-mix(in srgb, var(--lw-auth-theme) 12%, transparent);\n  }\n\n  &:focus-visible {\n    outline: 2px solid var(--lw-auth-theme);\n    outline-offset: 1px;\n  }\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.primaryBtn {\n  border: none;\n  border-radius: $radius-md;\n  padding: 11px 14px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #fff;\n  background: linear-gradient(135deg, var(--lw-auth-theme) 0%, var(--lw-auth-theme-deep) 100%);\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.socialBtn {\n  flex: 1 1 calc(50% - 5px);\n  min-width: min(140px, 100%);\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  gap: 8px;\n  border: 1px solid $border-soft;\n  border-radius: $radius-md;\n  padding: 11px 10px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: $ink;\n  background: #fff;\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.socialLogo {\n  flex-shrink: 0;\n  display: block;\n}\n\n.logoFallback {\n  width: 18px;\n  height: 18px;\n  border-radius: $radius-sm;\n  background: color-mix(in srgb, var(--lw-auth-theme) 14%, #fff);\n  color: var(--lw-auth-theme-deep);\n  font-size: 11px;\n  font-weight: 700;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  flex-shrink: 0;\n}\n\n.cancelBtn {\n  margin-top: 10px;\n  width: 100%;\n  border: none;\n  background: transparent;\n  color: #5a6b76;\n  font-size: 13px;\n  cursor: pointer;\n  padding: 8px;\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.divider {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  margin: 14px 0;\n  color: $divider;\n}\n\n.dividerLine {\n  flex: 1;\n  height: 1px;\n  background: $line;\n}\n\n.dividerText {\n  font-size: 12px;\n  text-transform: uppercase;\n  letter-spacing: 0.08em;\n}\n\n.hint {\n  margin: 10px 0 0;\n  font-size: 12px;\n  color: $hint;\n  line-height: 1.45;\n}\n\n.switchMode {\n  margin: 12px 0 0;\n  text-align: center;\n}\n\n.switchModeBtn {\n  border: none;\n  background: transparent;\n  color: var(--lw-auth-theme);\n  font-size: 13px;\n  font-weight: 650;\n  cursor: pointer;\n  padding: 4px 8px;\n  text-decoration: underline;\n  text-underline-offset: 3px;\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.error {\n  margin: 12px 0 0;\n  font-size: 13px;\n  color: $danger;\n  line-height: 1.4;\n}\n\n.footer {\n  margin-top: 18px;\n  padding-top: 12px;\n  border-top: 1px solid $footer-line;\n  font-size: 12px;\n  color: $hint;\n  display: flex;\n  gap: 8px;\n  justify-content: center;\n}\n"],"mappings":";AAkBA,CAAAA;AACE,mBAAA;AACA,wBAAA,UAAA,GAAA,IAAA,EAAA,IAAA,iBAAA,GAAA,EAAA;AACA,SAAA,IAAA,IAAA,EAAA;AACA,WAAA,KAAA,KAAA;AACA,iBATU;AAUV,cAAA,KAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA;AACA,SAzBI;AA0BJ,cAAA,EAAA,KAAA,KAAA,KAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AACA;IAAA,UAAA;IAAA,aAAA;IAAA,cAAA;IAAA;;AAGF,CAAAC;AACE,WAAA;AACA,OAAA;AACA,eAAA;AACA,iBAAA;;AAGF,CAAAC;AACE,iBAAA;AACA,WAAA;;AAGF,CAAAC;AACE,UAAA;AACA,aAAA;AACA,eAAA;AACA,kBAAA;AACA,kBAAA;AACA,SAAA,IAAA;;AAGF,CAAAC;AACE,UAAA,IAAA,EAAA;AACA,aAAA;AACA,eAAA;AACA,eAAA;;AAGF,CAAAC;AACE,UAAA,EAAA,EAAA;AACA,aAAA;AACA,eAAA;AACA,SA7DM;;AAgER,CAAAC;AACE,WAAA;AACA,OAAA;;AAGF,CAAAC;AACE,WAAA;AACA,aAAA;AACA,OAAA;AACA,aAAA;;AAGF,CAAAC;AACE,SAAA;AACA,cAAA;AACA,UAAA,IAAA,MAAA;AACA,iBAlEU;AAmEV,WAAA,KAAA;AACA,aAAA;AACA,WAAA;AACA,cA3EQ;;AA6ER,CAVFA,+BAUE;AACE,gBAAA,IAAA;;AAGF,CAdFA,+BAcE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,YAAA;AACA,WAAA;AACA,eAAA;;AAGF,CAAAC;AACE,iBAAA;;AAGF,CAAAC;AACE,YAAA;AACA,SAAA;AACA,OAAA;AACA,aAAA,WAAA;AACA,WAAA;AACA,WAAA;AACA,eAAA;AACA,mBAAA;AACA,SAAA;AACA,UAAA;AACA,UAAA;AACA,iBAvGU;AAwGV,WAAA;AACA,SAAA;AACA,cAAA;AACA,UAAA;;AAEA,CAlBFA,wCAkBE,MAAA,KAAA;AACE,SAAA,IAAA;AACA,cAAA,UAAA,GAAA,IAAA,EAAA,IAAA,iBAAA,GAAA,EAAA;;AAGF,CAvBFA,wCAuBE;AACE,WAAA,IAAA,MAAA,IAAA;AACA,kBAAA;;AAGF,CA5BFA,wCA4BE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,UAAA;AACA,iBAhIU;AAiIV,WAAA,KAAA;AACA,aAAA;AACA,eAAA;AACA,UAAA;AACA,SAAA;AACA;IAAA;MAAA,MAAA;MAAA,IAAA,iBAAA,EAAA;MAAA,IAAA,sBAAA;;AAEA,CAVFA,oCAUE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,QAAA,EAAA,EAAA,KAAA,IAAA,EAAA;AACA,aAAA,IAAA,KAAA,EAAA;AACA,WAAA;AACA,eAAA;AACA,mBAAA;AACA,OAAA;AACA,UAAA,IAAA,MAAA;AACA,iBAtJU;AAuJV,WAAA,KAAA;AACA,aAAA;AACA,eAAA;AACA,UAAA;AACA,SA1KI;AA2KJ,cAAA;;AAEA,CAhBFA,mCAgBE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,eAAA;AACA,WAAA;;AAGF,CAAAC;AACE,SAAA;AACA,UAAA;AACA,iBA3KU;AA4KV,cAAA,UAAA,GAAA,IAAA,EAAA,IAAA,iBAAA,GAAA,EAAA;AACA,SAAA,IAAA;AACA,aAAA;AACA,eAAA;AACA,WAAA;AACA,eAAA;AACA,mBAAA;AACA,eAAA;;AAGF,CAAAC;AACE,cAAA;AACA,SAAA;AACA,UAAA;AACA,cAAA;AACA,SAAA;AACA,aAAA;AACA,UAAA;AACA,WAAA;;AAEA,CAVFA,mCAUE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,WAAA;AACA,eAAA;AACA,OAAA;AACA,UAAA,KAAA;AACA,SAlNQ;;AAqNV,CAAAC;AACE,QAAA;AACA,UAAA;AACA,cAzNK;;AA4NP,CAAAC;AACE,aAAA;AACA,kBAAA;AACA,kBAAA;;AAGF,CAAAC;AACE,UAAA,KAAA,EAAA;AACA,aAAA;AACA,SA3OK;AA4OL,eAAA;;AAGF,CAAAC;AACE,UAAA,KAAA,EAAA;AACA,cAAA;;AAGF,CAAAC;AACE,UAAA;AACA,cAAA;AACA,SAAA,IAAA;AACA,aAAA;AACA,eAAA;AACA,UAAA;AACA,WAAA,IAAA;AACA,mBAAA;AACA,yBAAA;;AAEA,CAXFA,uCAWE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,UAAA,KAAA,EAAA;AACA,aAAA;AACA,SA9PO;AA+PP,eAAA;;AAGF,CAAAC;AACE,cAAA;AACA,eAAA;AACA,cAAA,IAAA,MAAA;AACA,aAAA;AACA,SAjRK;AAkRL,WAAA;AACA,OAAA;AACA,mBAAA;;","names":["panel","brand","logo","product","title","subtitle","form","socialStack","input","passwordField","passwordInput","passwordToggle","primaryBtn","socialBtn","socialLogo","logoFallback","cancelBtn","divider","dividerLine","dividerText","hint","switchMode","switchModeBtn","error","footer"]}
+{"version":3,"sources":["../src/HeadlessLoginPanel.module.scss"],"sourcesContent":["$ink: #14212b;\n$muted: #4b5c68;\n$hint: #6b7c87;\n$brand: #3d6f8f;\n$brand-deep: #15485c;\n$brand-mid: #1f6f8b;\n$border: #c9d5de;\n$border-soft: #b7c9d4;\n$line: #d5e0e7;\n$divider: #90a0ab;\n$surface: #f7fafc;\n$fallback-bg: #e8eef2;\n$danger: #b42318;\n$footer-line: #e4ebf0;\n$radius-lg: 16px;\n$radius-md: 10px;\n$radius-sm: 4px;\n\n.panel {\n  --lw-auth-theme: #1677ff;\n  --lw-auth-theme-deep: color-mix(in srgb, var(--lw-auth-theme) 72%, #000);\n  width: min(100%, 400px);\n  padding: 28px 28px 22px;\n  border-radius: $radius-lg;\n  background: rgba(255, 255, 255, 0.96);\n  color: $ink;\n  box-shadow: 0 24px 64px rgba(15, 23, 42, 0.28);\n  font-family: \"Segoe UI\", \"PingFang SC\", \"Noto Sans SC\", sans-serif;\n}\n\n.brand {\n  display: flex;\n  gap: 14px;\n  align-items: center;\n  margin-bottom: 12px;\n}\n\n.logo {\n  border-radius: 12px;\n  display: block;\n}\n\n.product {\n  margin: 0;\n  font-size: 13px;\n  font-weight: 650;\n  letter-spacing: 0.04em;\n  text-transform: uppercase;\n  color: var(--lw-auth-theme);\n}\n\n.title {\n  margin: 2px 0 0;\n  font-size: 22px;\n  font-weight: 700;\n  line-height: 1.25;\n}\n\n.subtitle {\n  margin: 0 0 18px;\n  font-size: 14px;\n  line-height: 1.5;\n  color: $muted;\n}\n\n.form {\n  display: grid;\n  gap: 10px;\n}\n\n.channelTabs {\n  display: grid;\n  grid-template-columns: 1fr 1fr;\n  gap: 6px;\n  margin-bottom: 2px;\n}\n\n.channelTab {\n  border: 1px solid $border;\n  border-radius: $radius-md;\n  padding: 8px 10px;\n  font-size: 13px;\n  font-weight: 650;\n  cursor: pointer;\n  color: $muted;\n  background: $surface;\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.channelTabActive {\n  color: var(--lw-auth-theme-deep);\n  border-color: var(--lw-auth-theme);\n  background: color-mix(in srgb, var(--lw-auth-theme) 10%, #fff);\n}\n\n.codeRow {\n  display: grid;\n  grid-template-columns: 1fr auto;\n  gap: 8px;\n  align-items: stretch;\n}\n\n.codeInput {\n  min-width: 0;\n}\n\n.secondaryBtn {\n  border: 1px solid $border-soft;\n  border-radius: $radius-md;\n  padding: 0 12px;\n  font-size: 13px;\n  font-weight: 650;\n  cursor: pointer;\n  color: $ink;\n  background: #fff;\n  white-space: nowrap;\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.socialStack {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 10px;\n  font-size: 12px;\n}\n\n.input {\n  width: 100%;\n  box-sizing: border-box;\n  border: 1px solid $border;\n  border-radius: $radius-md;\n  padding: 10px 12px;\n  font-size: 14px;\n  outline: none;\n  background: $surface;\n\n  &:focus {\n    border-color: var(--lw-auth-theme);\n  }\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.passwordField {\n  position: relative;\n  display: flex;\n  align-items: center;\n}\n\n.passwordInput {\n  padding-right: 42px;\n}\n\n.passwordToggle {\n  position: absolute;\n  right: 4px;\n  top: 50%;\n  transform: translateY(-50%);\n  z-index: 1;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 36px;\n  height: 36px;\n  border: none;\n  border-radius: $radius-sm;\n  padding: 0;\n  color: #5a6b76;\n  background: transparent;\n  cursor: pointer;\n\n  &:hover:not(:disabled) {\n    color: var(--lw-auth-theme);\n    background: color-mix(in srgb, var(--lw-auth-theme) 12%, transparent);\n  }\n\n  &:focus-visible {\n    outline: 2px solid var(--lw-auth-theme);\n    outline-offset: 1px;\n  }\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.primaryBtn {\n  border: none;\n  border-radius: $radius-md;\n  padding: 11px 14px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: #fff;\n  background: linear-gradient(135deg, var(--lw-auth-theme) 0%, var(--lw-auth-theme-deep) 100%);\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.socialBtn {\n  flex: 1 1 calc(50% - 5px);\n  min-width: min(140px, 100%);\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  gap: 8px;\n  border: 1px solid $border-soft;\n  border-radius: $radius-md;\n  padding: 11px 10px;\n  font-size: 14px;\n  font-weight: 650;\n  cursor: pointer;\n  color: $ink;\n  background: #fff;\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.socialLogo {\n  flex-shrink: 0;\n  display: block;\n}\n\n.logoFallback {\n  width: 18px;\n  height: 18px;\n  border-radius: $radius-sm;\n  background: color-mix(in srgb, var(--lw-auth-theme) 14%, #fff);\n  color: var(--lw-auth-theme-deep);\n  font-size: 11px;\n  font-weight: 700;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  flex-shrink: 0;\n}\n\n.cancelBtn {\n  margin-top: 10px;\n  width: 100%;\n  border: none;\n  background: transparent;\n  color: #5a6b76;\n  font-size: 13px;\n  cursor: pointer;\n  padding: 8px;\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.divider {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  margin: 14px 0;\n  color: $divider;\n}\n\n.dividerLine {\n  flex: 1;\n  height: 1px;\n  background: $line;\n}\n\n.dividerText {\n  font-size: 12px;\n  text-transform: uppercase;\n  letter-spacing: 0.08em;\n}\n\n.hint {\n  margin: 10px 0 0;\n  font-size: 12px;\n  color: $hint;\n  line-height: 1.45;\n}\n\n.domainsHint {\n  margin: -2px 0 0;\n  font-size: 12px;\n  line-height: 1.45;\n  color: $muted;\n  word-break: break-word;\n}\n\n.switchMode {\n  margin: 12px 0 0;\n  text-align: center;\n}\n\n.switchModeBtn {\n  border: none;\n  background: transparent;\n  color: var(--lw-auth-theme);\n  font-size: 13px;\n  font-weight: 650;\n  cursor: pointer;\n  padding: 4px 8px;\n  text-decoration: underline;\n  text-underline-offset: 3px;\n\n  &:disabled {\n    opacity: 0.65;\n    cursor: not-allowed;\n  }\n}\n\n.error {\n  margin: 12px 0 0;\n  font-size: 13px;\n  color: $danger;\n  line-height: 1.4;\n}\n\n.footer {\n  margin-top: 18px;\n  padding-top: 12px;\n  border-top: 1px solid $footer-line;\n  font-size: 12px;\n  color: $hint;\n  display: flex;\n  gap: 8px;\n  justify-content: center;\n}\n"],"mappings":";AAkBA,CAAAA;AACE,mBAAA;AACA,wBAAA,UAAA,GAAA,IAAA,EAAA,IAAA,iBAAA,GAAA,EAAA;AACA,SAAA,IAAA,IAAA,EAAA;AACA,WAAA,KAAA,KAAA;AACA,iBATU;AAUV,cAAA,KAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA;AACA,SAzBI;AA0BJ,cAAA,EAAA,KAAA,KAAA,KAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AACA;IAAA,UAAA;IAAA,aAAA;IAAA,cAAA;IAAA;;AAGF,CAAAC;AACE,WAAA;AACA,OAAA;AACA,eAAA;AACA,iBAAA;;AAGF,CAAAC;AACE,iBAAA;AACA,WAAA;;AAGF,CAAAC;AACE,UAAA;AACA,aAAA;AACA,eAAA;AACA,kBAAA;AACA,kBAAA;AACA,SAAA,IAAA;;AAGF,CAAAC;AACE,UAAA,IAAA,EAAA;AACA,aAAA;AACA,eAAA;AACA,eAAA;;AAGF,CAAAC;AACE,UAAA,EAAA,EAAA;AACA,aAAA;AACA,eAAA;AACA,SA7DM;;AAgER,CAAAC;AACE,WAAA;AACA,OAAA;;AAGF,CAAAC;AACE,WAAA;AACA,yBAAA,IAAA;AACA,OAAA;AACA,iBAAA;;AAGF,CAAAC;AACE,UAAA,IAAA,MAAA;AACA,iBAhEU;AAiEV,WAAA,IAAA;AACA,aAAA;AACA,eAAA;AACA,UAAA;AACA,SAnFM;AAoFN,cA3EQ;;AA6ER,CAVFA,oCAUE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,SAAA,IAAA;AACA,gBAAA,IAAA;AACA,cAAA,UAAA,GAAA,IAAA,EAAA,IAAA,iBAAA,GAAA,EAAA;;AAGF,CAAAC;AACE,WAAA;AACA,yBAAA,IAAA;AACA,OAAA;AACA,eAAA;;AAGF,CAAAC;AACE,aAAA;;AAGF,CAAAC;AACE,UAAA,IAAA,MAAA;AACA,iBAjGU;AAkGV,WAAA,EAAA;AACA,aAAA;AACA,eAAA;AACA,UAAA;AACA,SArHI;AAsHJ,cAAA;AACA,eAAA;;AAEA,CAXFA,sCAWE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,WAAA;AACA,aAAA;AACA,OAAA;AACA,aAAA;;AAGF,CAAAC;AACE,SAAA;AACA,cAAA;AACA,UAAA,IAAA,MAAA;AACA,iBA3HU;AA4HV,WAAA,KAAA;AACA,aAAA;AACA,WAAA;AACA,cApIQ;;AAsIR,CAVFA,+BAUE;AACE,gBAAA,IAAA;;AAGF,CAdFA,+BAcE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,YAAA;AACA,WAAA;AACA,eAAA;;AAGF,CAAAC;AACE,iBAAA;;AAGF,CAAAC;AACE,YAAA;AACA,SAAA;AACA,OAAA;AACA,aAAA,WAAA;AACA,WAAA;AACA,WAAA;AACA,eAAA;AACA,mBAAA;AACA,SAAA;AACA,UAAA;AACA,UAAA;AACA,iBAhKU;AAiKV,WAAA;AACA,SAAA;AACA,cAAA;AACA,UAAA;;AAEA,CAlBFA,wCAkBE,MAAA,KAAA;AACE,SAAA,IAAA;AACA,cAAA,UAAA,GAAA,IAAA,EAAA,IAAA,iBAAA,GAAA,EAAA;;AAGF,CAvBFA,wCAuBE;AACE,WAAA,IAAA,MAAA,IAAA;AACA,kBAAA;;AAGF,CA5BFA,wCA4BE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,UAAA;AACA,iBAzLU;AA0LV,WAAA,KAAA;AACA,aAAA;AACA,eAAA;AACA,UAAA;AACA,SAAA;AACA;IAAA;MAAA,MAAA;MAAA,IAAA,iBAAA,EAAA;MAAA,IAAA,sBAAA;;AAEA,CAVFA,oCAUE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,QAAA,EAAA,EAAA,KAAA,IAAA,EAAA;AACA,aAAA,IAAA,KAAA,EAAA;AACA,WAAA;AACA,eAAA;AACA,mBAAA;AACA,OAAA;AACA,UAAA,IAAA,MAAA;AACA,iBA/MU;AAgNV,WAAA,KAAA;AACA,aAAA;AACA,eAAA;AACA,UAAA;AACA,SAnOI;AAoOJ,cAAA;;AAEA,CAhBFA,mCAgBE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,eAAA;AACA,WAAA;;AAGF,CAAAC;AACE,SAAA;AACA,UAAA;AACA,iBApOU;AAqOV,cAAA,UAAA,GAAA,IAAA,EAAA,IAAA,iBAAA,GAAA,EAAA;AACA,SAAA,IAAA;AACA,aAAA;AACA,eAAA;AACA,WAAA;AACA,eAAA;AACA,mBAAA;AACA,eAAA;;AAGF,CAAAC;AACE,cAAA;AACA,SAAA;AACA,UAAA;AACA,cAAA;AACA,SAAA;AACA,aAAA;AACA,UAAA;AACA,WAAA;;AAEA,CAVFA,mCAUE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,WAAA;AACA,eAAA;AACA,OAAA;AACA,UAAA,KAAA;AACA,SA3QQ;;AA8QV,CAAAC;AACE,QAAA;AACA,UAAA;AACA,cAlRK;;AAqRP,CAAAC;AACE,aAAA;AACA,kBAAA;AACA,kBAAA;;AAGF,CAAAC;AACE,UAAA,KAAA,EAAA;AACA,aAAA;AACA,SApSK;AAqSL,eAAA;;AAGF,CAAAC;AACE,UAAA,KAAA,EAAA;AACA,aAAA;AACA,eAAA;AACA,SA7SM;AA8SN,cAAA;;AAGF,CAAAC;AACE,UAAA,KAAA,EAAA;AACA,cAAA;;AAGF,CAAAC;AACE,UAAA;AACA,cAAA;AACA,SAAA,IAAA;AACA,aAAA;AACA,eAAA;AACA,UAAA;AACA,WAAA,IAAA;AACA,mBAAA;AACA,yBAAA;;AAEA,CAXFA,uCAWE;AACE,WAAA;AACA,UAAA;;AAIJ,CAAAC;AACE,UAAA,KAAA,EAAA;AACA,aAAA;AACA,SA/TO;AAgUP,eAAA;;AAGF,CAAAC;AACE,cAAA;AACA,eAAA;AACA,cAAA,IAAA,MAAA;AACA,aAAA;AACA,SAlVK;AAmVL,WAAA;AACA,OAAA;AACA,mBAAA;;","names":["panel","brand","logo","product","title","subtitle","form","channelTabs","channelTab","channelTabActive","codeRow","codeInput","secondaryBtn","socialStack","input","passwordField","passwordInput","passwordToggle","primaryBtn","socialBtn","socialLogo","logoFallback","cancelBtn","divider","dividerLine","dividerText","hint","domainsHint","switchMode","switchModeBtn","error","footer"]}

package/dist/index.d.ts

@@ -100,6 +100,8 @@ declare const LOGIN_EXPERIENCE_CAPABILITIES: {
     readonly passwordSignIn: "password-sign-in";
     /** Username + password self-register via Experience (Logto NewPasswordIdentity). */
     readonly passwordSignUp: "password-sign-up";
+    /** Email + verification code + password self-register. */
+    readonly emailCodeSignUp: "email-code-sign-up";
     readonly socialConnectors: "social-connectors";
     readonly socialDirectSignIn: "social-direct-sign-in";
 };
@@ -126,8 +128,42 @@ interface ExperiencePasswordSignInResult {
     raw?: unknown;
 }
 /** Same OIDC bootstrap fields as sign-in; username must match Logto username rules. */
-type ExperiencePasswordSignUpInput = ExperiencePasswordSignInInput;
+type ExperiencePasswordSignUpInput = ExperiencePasswordSignInInput & {
+    /** Optional CAPTCHA token for Logto bot protection (Turnstile / reCAPTCHA). */
+    captchaToken?: string;
+};
 type ExperiencePasswordSignUpResult = ExperiencePasswordSignInResult;
+interface ExperienceEmailSignUpSendCodeInput {
+    apiBase: string;
+    email: string;
+    /** @deprecated alias of email */
+    identifier?: string;
+    captchaToken?: string;
+    issuer?: string;
+    clientId?: string;
+    redirectUri?: string;
+    audience?: string;
+    scopes?: string;
+    returnUrl?: string;
+}
+interface ExperienceEmailSignUpSendCodeResult {
+    verificationId: string;
+}
+interface ExperienceEmailSignUpCompleteInput {
+    apiBase: string;
+    email: string;
+    password: string;
+    code: string;
+    verificationId: string;
+    identifier?: string;
+    captchaToken?: string;
+    issuer?: string;
+    clientId?: string;
+    redirectUri?: string;
+    audience?: string;
+    scopes?: string;
+    returnUrl?: string;
+}
 interface ExperienceSocialConnector {
     id: string;
     target: string;
@@ -158,6 +194,8 @@ interface LoginExperienceAdapter {
      * Email/phone sign-up needs verification codes — not covered by this method.
      */
     experiencePasswordSignUp?(input: ExperiencePasswordSignUpInput): Promise<ExperiencePasswordSignUpResult>;
+    sendRegisterEmailCode?(input: ExperienceEmailSignUpSendCodeInput): Promise<ExperienceEmailSignUpSendCodeResult>;
+    experienceEmailPasswordSignUp?(input: ExperienceEmailSignUpCompleteInput): Promise<ExperiencePasswordSignUpResult>;
     fetchSocialConnectors?(input: FetchSocialConnectorsInput): Promise<ExperienceSocialConnector[]>;
     createSocialSignInRequest?(target: string): SocialSignInRequest;
 }
@@ -180,6 +218,76 @@ declare function resolveLoginExperienceAdapter(adapter?: LoginExperienceAdapter
 /** `VITE_IAM_PROVIDER` / `IAM_PROVIDER` / older `IDP_MODE`. */
 declare function resolveLoginExperienceProviderFromEnv(env?: Record<string, string | undefined>): LoginExperienceProvider;
 
+/**
+ * Self-register email policy for early ToC / hosted SaaS.
+ *
+ * Why allowlist: disposable / game / temporary mailboxes drive bot farms and
+ * verification-email cost. Early stage: only well-known consumer providers.
+ * Enterprise / private: set mode `off` or extend allowlist with corporate domains.
+ */
+/** Popular consumer inboxes (CN + global). Lowercase host only. */
+declare const DEFAULT_REGISTER_EMAIL_ALLOWLIST: readonly string[];
+/** Common disposable / throwaway hosts (used when mode is blocklist or as extra deny). */
+declare const DEFAULT_DISPOSABLE_EMAIL_BLOCKLIST: readonly string[];
+type RegisterEmailMode = "allowlist" | "blocklist" | "off";
+interface RegisterEmailPolicy {
+    mode: RegisterEmailMode;
+    allowlist: readonly string[];
+    blocklist: readonly string[];
+}
+interface RegisterEmailPolicyInput {
+    mode?: string | null;
+    allowlist?: string | readonly string[] | null;
+    blocklist?: string | readonly string[] | null;
+}
+declare function normalizeRegisterEmailMode(raw: string | null | undefined): RegisterEmailMode;
+declare function resolveRegisterEmailPolicy(input?: RegisterEmailPolicyInput): RegisterEmailPolicy;
+/** Read VITE_/PUBLIC_/AUTH_REGISTER_* from a static env map (bundler-safe). */
+declare function readRegisterEmailPolicyFromEnv(env?: Record<string, string | undefined>): RegisterEmailPolicy;
+declare function emailDomain(email: string): string | null;
+declare function isValidEmailShape(email: string): boolean;
+type RegisterEmailDecision = {
+    ok: true;
+    domain: string;
+} | {
+    ok: false;
+    reason: "invalid" | "not_allowed" | "disposable";
+    domain?: string;
+};
+/**
+ * Enforce register email policy. `off` still rejects disposable hosts when
+ * `blocklist` is non-empty (defense in depth); pass `blocklist: []` to disable.
+ */
+declare function evaluateRegisterEmail(email: string, policy?: RegisterEmailPolicy): RegisterEmailDecision;
+declare function registerEmailRejectionMessage(decision: RegisterEmailDecision): string;
+/**
+ * Human-readable domain list for the register form (allowlist mode only).
+ * Returns null when domains are not restricted to an allowlist.
+ */
+declare function formatAllowedEmailDomains(policy: RegisterEmailPolicy, options?: {
+    max?: number;
+}): string | null;
+/** Short policy note under the email field on the register form. */
+declare function registerEmailDomainsHint(policy: RegisterEmailPolicy, labels?: {
+    allowedDomainsPrefix?: string;
+    allowedDomainsOpen?: string;
+    allowedDomainsBlocklist?: string;
+}): string | null;
+/** Public policy document from Auth Gateway `GET /api/register-policy`. */
+interface PublicRegisterPolicyResponse {
+    mode?: string;
+    allowlist?: string[];
+    blocklist?: string[];
+    ipDailyLimit?: number;
+    codeHourlyLimit?: number;
+    enabled?: boolean;
+}
+/**
+ * Fetch live register policy from Auth Gateway (or any host that serves `/api/register-policy`).
+ * Falls back to built-in defaults when the endpoint is missing.
+ */
+declare function fetchRegisterEmailPolicy(apiBase: string, init?: RequestInit): Promise<RegisterEmailPolicy>;
+
 /**
  * Logto Experience API (Headless) adapter.
  * Prefer same-origin Experience base (SPA proxies /api/experience) so cookies
@@ -198,12 +306,15 @@ declare function createLogtoDirectSignInRequest(directSignIn: string): SocialSig
 declare class LogtoExperienceAdapter implements LoginExperienceAdapter {
     readonly provider = "logto";
     readonly capabilities: readonly LoginExperienceCapability[];
+    emailPolicy: RegisterEmailPolicy;
     experiencePasswordSignIn(input: ExperiencePasswordSignInInput): Promise<ExperiencePasswordSignInResult>;
     /**
      * Register with username + password via NewPasswordIdentity.
      * Email/phone self-register requires verification codes — use social or invite instead.
      */
     experiencePasswordSignUp(input: ExperiencePasswordSignUpInput): Promise<ExperiencePasswordSignUpResult>;
+    sendRegisterEmailCode(input: ExperienceEmailSignUpSendCodeInput): Promise<ExperienceEmailSignUpSendCodeResult>;
+    experienceEmailPasswordSignUp(input: ExperienceEmailSignUpCompleteInput): Promise<ExperiencePasswordSignUpResult>;
     fetchSocialConnectors(input: FetchSocialConnectorsInput): Promise<ExperienceSocialConnector[]>;
     createSocialSignInRequest(target: string): SocialSignInRequest;
 }
@@ -340,6 +451,23 @@ interface HeadlessLoginLabels {
     passwordMismatch?: string;
     registerTitle?: string;
     registerSubtitle?: string;
+    registerWithEmail?: string;
+    registerWithUsername?: string;
+    emailPlaceholder?: string;
+    verificationCodePlaceholder?: string;
+    sendCode?: string;
+    resendCode?: string;
+    /** Prefix before the allowlisted domain list, e.g. "Allowed email domains". */
+    allowedDomainsPrefix?: string;
+    /** Shown when mode is off / unrestricted (aside from disposable blocklist). */
+    allowedDomainsOpen?: string;
+    /** Shown when only disposable domains are blocked. */
+    allowedDomainsBlocklist?: string;
+    /**
+     * Desktop/mobile system-browser social login: tell the user to finish in the browser
+     * and return to the app (loopback / deep link callback).
+     */
+    waitingExternalBrowser?: string;
 }
 interface HeadlessLoginPanelProps {
     config: Partial<LuminaryIdpConfig>;
@@ -350,8 +478,13 @@ interface HeadlessLoginPanelProps {
     logoSrc?: string;
     labels?: HeadlessLoginLabels;
     returnUrl?: string;
-    /** Prefer popup (default) for reauth; use redirect for full-page login. */
-    mode?: "popup" | "redirect";
+    /** Prefer popup (default) for reauth; redirect for full-page SPA; external for desktop/mobile system browser (RFC 8252). */
+    mode?: "popup" | "redirect" | "external";
+    /**
+     * Open an authorize URL in the OS browser / Custom Tabs / ASWebAuthenticationSession.
+     * Required when `mode="external"` (Google / GitHub / hosted SSO). Password Headless stays in-app.
+     */
+    openExternalUrl?: (url: string) => void | Promise<void>;
     /**
      * Show Experience social connectors (Google / GitHub / …).
      * Default `true`. Set `false` for admin / internal consoles that only allow
@@ -361,11 +494,26 @@ interface HeadlessLoginPanelProps {
      */
     showSocialConnectors?: boolean;
     /**
-     * Show self-register switch + register form (username + password via Experience).
+     * Show self-register switch + register form.
      * Default `true` for end-user product logins. Set `false` for admin / ops consoles.
-     * Hosted OIDC adapters without passwordSignUp hide register automatically.
      */
     showRegister?: boolean;
+    /**
+     * Email domain policy for self-register.
+     * If omitted, the panel loads `GET {experienceApiBase}/api/register-policy` when available,
+     * otherwise uses built-in consumer allowlist defaults.
+     */
+    registerEmailPolicy?: RegisterEmailPolicy;
+    /**
+     * When true (default), fetch live policy from Auth Gateway `/api/register-policy`.
+     * Set false to use only `registerEmailPolicy` / built-in defaults (e.g. local auth-dev-proxy).
+     */
+    fetchRegisterPolicy?: boolean;
+    /**
+     * Optional CAPTCHA token provider (Cloudflare Turnstile / reCAPTCHA).
+     * Token is sent as `captchaToken` on Experience Register init when Logto bot protection is on.
+     */
+    getCaptchaToken?: () => Promise<string | undefined>;
     /**
      * Social providers (when `showSocialConnectors` is not `false`):
      * - omit / `"auto"` — load enabled connectors from IdP (google, github, x, …)
@@ -393,7 +541,7 @@ interface HeadlessLoginPanelProps {
 }
 /** Shared default accent for product login panels (shared/brand --lw-primary). */
 declare const DEFAULT_LOGIN_THEME_COLOR = "#1677ff";
-declare function HeadlessLoginPanel({ config, experienceAdapter: experienceAdapterProp, productName, logoSrc, labels: labelsProp, returnUrl, mode, showSocialConnectors, showRegister, socialProviders, showCancel, onCancel, onOidcSession, onExperienceRedirect, footer, className, style, themeColor, }: HeadlessLoginPanelProps): react.JSX.Element;
+declare function HeadlessLoginPanel({ config, experienceAdapter: experienceAdapterProp, productName, logoSrc, labels: labelsProp, returnUrl, mode, openExternalUrl, showSocialConnectors, showRegister, registerEmailPolicy: registerEmailPolicyProp, fetchRegisterPolicy, getCaptchaToken, socialProviders, showCancel, onCancel, onOidcSession, onExperienceRedirect, footer, className, style, themeColor, }: HeadlessLoginPanelProps): react.JSX.Element;
 
 interface ReauthOverlayProps {
     config: Partial<LuminaryIdpConfig>;
@@ -456,4 +604,4 @@ declare function createPostLoginPathHelpers(options: PostLoginPathOptions): {
     isUnsafeReturnPath: (path: string) => boolean;
 };
 
-export { type AuthGateConfig, type AuthGatePhase, AuthGateProvider, type AuthGateProviderProps, type AuthGateSnapshot, DEFAULT_LOGIN_THEME_COLOR, type ExperienceIdentifierType, type ExperiencePasswordSignInInput, type ExperiencePasswordSignInResult, type ExperiencePasswordSignUpInput, type ExperiencePasswordSignUpResult, type ExperienceSocialConnector, type FetchSocialConnectorsInput, type HeadlessLoginLabels, HeadlessLoginPanel, type HeadlessLoginPanelProps, HostedOidcExperienceAdapter, LOGIN_EXPERIENCE_CAPABILITIES, type LoginExperienceAdapter, type LoginExperienceCapability, type LoginExperienceProvider, LogtoExperienceAdapter, LuminaryAuthProvider, type LuminaryAuthProviderProps, type LuminaryAuthSession, type LuminaryIdpConfig, type PostLoginPathOptions, ReauthOverlay, type ReauthOverlayProps, type SignInOptions, type SocialProviderTarget, type SocialSignInRequest, type UnauthorizedDisposition, authGate, clearStoredSession, createLoginExperienceAdapter, createLogtoDirectSignInRequest, createPostLoginPathHelpers, createUserManager, experiencePasswordSignIn, fetchSocialConnectors, getCurrentUser, getStoredAccessToken, handleSignInCallback, handleSignInPopupCallback, isIdpConfigured, isLogtoRegisterUsername, isOidcPopupWindow, prepareSignInRequestUrl, readIdpConfigFromEnv, resetUserManager, resolveExperienceApiBase, resolveIssuer, resolveLoginExperienceAdapter, resolveLoginExperienceProviderFromEnv, sameOriginAuthorizeUrl, signInPopup, signInRedirect, signOutRedirect, useAuthGate, useAuthGateOptional, useLuminaryAuth, withAuthGateRetry };
+export { type AuthGateConfig, type AuthGatePhase, AuthGateProvider, type AuthGateProviderProps, type AuthGateSnapshot, DEFAULT_DISPOSABLE_EMAIL_BLOCKLIST, DEFAULT_LOGIN_THEME_COLOR, DEFAULT_REGISTER_EMAIL_ALLOWLIST, type ExperienceEmailSignUpCompleteInput, type ExperienceEmailSignUpSendCodeInput, type ExperienceEmailSignUpSendCodeResult, type ExperienceIdentifierType, type ExperiencePasswordSignInInput, type ExperiencePasswordSignInResult, type ExperiencePasswordSignUpInput, type ExperiencePasswordSignUpResult, type ExperienceSocialConnector, type FetchSocialConnectorsInput, type HeadlessLoginLabels, HeadlessLoginPanel, type HeadlessLoginPanelProps, HostedOidcExperienceAdapter, LOGIN_EXPERIENCE_CAPABILITIES, type LoginExperienceAdapter, type LoginExperienceCapability, type LoginExperienceProvider, LogtoExperienceAdapter, LuminaryAuthProvider, type LuminaryAuthProviderProps, type LuminaryAuthSession, type LuminaryIdpConfig, type PostLoginPathOptions, type PublicRegisterPolicyResponse, ReauthOverlay, type ReauthOverlayProps, type RegisterEmailDecision, type RegisterEmailMode, type RegisterEmailPolicy, type RegisterEmailPolicyInput, type SignInOptions, type SocialProviderTarget, type SocialSignInRequest, type UnauthorizedDisposition, authGate, clearStoredSession, createLoginExperienceAdapter, createLogtoDirectSignInRequest, createPostLoginPathHelpers, createUserManager, emailDomain, evaluateRegisterEmail, experiencePasswordSignIn, fetchRegisterEmailPolicy, fetchSocialConnectors, formatAllowedEmailDomains, getCurrentUser, getStoredAccessToken, handleSignInCallback, handleSignInPopupCallback, isIdpConfigured, isLogtoRegisterUsername, isOidcPopupWindow, isValidEmailShape, normalizeRegisterEmailMode, prepareSignInRequestUrl, readIdpConfigFromEnv, readRegisterEmailPolicyFromEnv, registerEmailDomainsHint, registerEmailRejectionMessage, resetUserManager, resolveExperienceApiBase, resolveIssuer, resolveLoginExperienceAdapter, resolveLoginExperienceProviderFromEnv, resolveRegisterEmailPolicy, sameOriginAuthorizeUrl, signInPopup, signInRedirect, signOutRedirect, useAuthGate, useAuthGateOptional, useLuminaryAuth, withAuthGateRetry };