@owlmeans/client-auth 0.1.18-rc.12 → 0.1.18-rc.13

package/build/login/types.d.ts

@@ -1,4 +1,6 @@
+import type { ComponentType, ReactNode } from 'react';
 import type { LazyService, BasicContext } from '@owlmeans/context';
+import type { LoginMethodEmphasis, LoginScreenConfig, LoginTermsConfig } from '@owlmeans/config';
 /**
  * The context a login plugin is handed.
  *
@@ -34,11 +36,16 @@ export declare enum LoginOutcome {
     Redirected = "redirected",
     /** Cannot proceed without a fresh user gesture — the caller renders a sign-in control. */
     Gesture = "gesture",
-    /** Authenticated, but with no channel back to the window that started the flow. */
+    /** Authenticated, but with no channel back to the window that started it. */
     Orphaned = "orphaned",
     /** The attempt ended with no token (blocked window, user closed it, provider refused). */
     Failed = "failed"
 }
+/** Why a surrogate window was opened. */
+export declare enum LoginIntent {
+    Login = "login",
+    Logout = "logout"
+}
 export interface LoginRequest {
     /** Where the login flow starts — a resolved dispatcher path, or the current address. */
     url: string;
@@ -51,6 +58,12 @@ export interface LoginRequest {
     /** Entrypoint alias to return to after login. */
     target?: string;
 }
+export interface LogoutRequest {
+    /** Where a surrogate logout runs — a resolved surrogate path. */
+    url: string;
+    /** The in-app continuation once the local session is gone. */
+    navigate?: () => void | Promise<void>;
+}
 /**
  * A pluggable login mechanic — WHERE the authorization round trip runs.
  *
@@ -86,19 +99,128 @@ export interface LoginPlugin {
     authorize: (ctx: LoginContext, url: string, env: LoginEnv) => Promise<LoginOutcome>;
     /** A bearer token was issued in this document — decide where it goes. */
     complete: (ctx: LoginContext, token: string, env: LoginEnv) => Promise<LoginOutcome>;
+    /**
+     * This document ALREADY holds a session — decide whether it is useful here.
+     *
+     * Absent means `Passed`: keep it and carry on, which is what an ordinary tab has always done.
+     * A surrogate hands it back to its opener instead, which is the whole point: a popup that
+     * discovers an existing session must sign the framed application in, not display the
+     * application to itself.
+     *
+     * Deliberately not `complete`: "a token was just issued here" and "a token was already here"
+     * are different facts, and a silent-refresh plugin will need to tell them apart.
+     */
+    resume?: (ctx: LoginContext, token: string, env: LoginEnv) => Promise<LoginOutcome>;
+    /**
+     * Start logout from a user gesture.
+     *
+     * MUST open any window synchronously, for exactly the reason `begin` must — logging out of a
+     * framed application opens a window too. Implement as a NON-async function.
+     */
+    logout?: (ctx: LoginContext, request: LogoutRequest, env: LoginEnv) => Promise<LoginOutcome>;
+    /** The local session is gone in this document — decide what to tell whom. */
+    logoutComplete?: (ctx: LoginContext, env: LoginEnv) => Promise<LoginOutcome>;
 }
+/**
+ * Something that must be true before a login flow may start.
+ *
+ * SYNCHRONOUS on purpose. `begin` must not cross a microtask boundary before a plugin's
+ * `window.open`, or the popup blocker eats the window. A precondition that has to ask a server
+ * belongs somewhere else entirely.
+ *
+ * Returning false stops the flow and resolves `begin` as {@link LoginOutcome.Gesture} — which
+ * already means "cannot proceed without a fresh user gesture; render a control", and is exactly
+ * the state a user is in after a blocking dialog has opened over the page.
+ */
+export interface LoginPrecondition {
+    alias: string;
+    /** Higher runs first. Defaults to 0. */
+    priority?: number;
+    check: (ctx: LoginContext, request: LoginRequest, env: LoginEnv) => boolean;
+}
+/** What a source needs in order to describe the methods it offers. */
+export interface LoginMethodContext {
+    context: LoginContext;
+    env: LoginEnv;
+    /** In-app navigation, when a component supplied it. */
+    navigate?: (alias: string, params?: Record<string, string>) => void | Promise<void>;
+}
+/**
+ * One way to sign in, as the screen renders it.
+ *
+ * `start` is what a button calls. It MUST be callable synchronously from a click — branch on
+ * `env.embedded && !env.surrogate` first and open any window before the first `await`.
+ */
+export interface LoginMethod {
+    id: string;
+    /** Set when an `AuthenticationPlugin` drives this method. */
+    type?: string;
+    label?: string;
+    i18nKey?: string;
+    icon?: string;
+    order?: number;
+    emphasis?: LoginMethodEmphasis;
+    restricted?: boolean;
+    params?: Record<string, string>;
+    start: (ctx: LoginMethodContext) => Promise<LoginOutcome>;
+}
+export interface LoginMethodSource {
+    alias: string;
+    list: (ctx: LoginMethodContext) => LoginMethod[];
+}
+/** What every rendering of the sign-in screen accepts, whatever its UI family. */
+export interface LoginScreenProps {
+    /** The one thing a consuming application is expected to supply. */
+    Logo?: ComponentType<{
+        className?: string;
+    }> | ReactNode;
+    title?: ReactNode;
+    subtitle?: ReactNode;
+    /**
+     * `(key, defaultValue) => string`. A prop, never an implicit context read: a component that
+     * reaches for an i18n provider crashes the whole render in an app mounted without one.
+     */
+    translate?: (key: string, defaultValue: string) => string;
+    /** Replace or reorder what the resolver produced. */
+    methods?: LoginMethod[] | ((methods: LoginMethod[]) => LoginMethod[]);
+    terms?: LoginTermsConfig | false;
+    config?: LoginScreenConfig;
+    /** Replaces the composed credit line entirely. */
+    footer?: ReactNode;
+    className?: string;
+    containerClassName?: string;
+}
+export type LoginScreenComponent = ComponentType<LoginScreenProps>;
 export interface LoginService extends LazyService {
     registerPlugin: (plugin: LoginPlugin) => void;
     /** Select the active plugin for the given (or default) environment. */
     plugin: (env?: LoginEnv) => LoginPlugin;
     /** The environment the cascade is currently selecting on. */
     env: () => LoginEnv;
+    /** Something that must hold before any flow starts. Checked synchronously, in `begin`. */
+    registerPrecondition: (precondition: LoginPrecondition) => void;
+    /** A source of offerable sign-in methods, scoped to this context. */
+    registerMethodSource: (source: LoginMethodSource) => void;
+    methods: (ctx: LoginMethodContext) => LoginMethod[];
+    /**
+     * The screen a dispatcher renders when it cannot proceed.
+     *
+     * A slot rather than an import, because a relying party (`web-oidc-rp`) must never depend on a
+     * UI family (`web-panel` / `mui-panel`) — that edge would force every relying party to pick one.
+     */
+    registerScreen: (screen: LoginScreenComponent) => void;
+    screen: () => LoginScreenComponent | null;
     enter: () => void;
     begin: (request: LoginRequest) => Promise<LoginOutcome>;
     authorize: (url: string) => Promise<LoginOutcome>;
     complete: (token: string) => Promise<LoginOutcome>;
+    resume: (token: string) => Promise<LoginOutcome>;
+    logout: (request: LogoutRequest) => Promise<LoginOutcome>;
+    logoutComplete: () => Promise<LoginOutcome>;
     /** Adopt an issued bearer token as this context's authentication. */
     adopt: (token: string) => Promise<void>;
+    /** Drop this document's authentication. The single de-adoption path. */
+    revoke: () => Promise<void>;
 }
 export interface LoginServiceAppend {
     login: () => LoginService;

package/build/login/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/login/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAElE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAA;IAClB,kGAAkG;IAClG,QAAQ,EAAE,OAAO,CAAA;IACjB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAA;IAClB,uFAAuF;IACvF,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,oEAAoE;AACpE,oBAAY,YAAY;IACtB,sFAAsF;IACtF,OAAO,YAAY;IACnB,qFAAqF;IACrF,MAAM,WAAW;IACjB,oFAAoF;IACpF,UAAU,eAAe;IACzB,0FAA0F;IAC1F,OAAO,YAAY;IACnB,mFAAmF;IACnF,QAAQ,aAAa;IACrB,0FAA0F;IAC1F,MAAM,WAAW;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,YAAY,KAAK,OAAO,CAAA;IAEtD;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAA;IAElD;;;;;OAKG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAEzF,qEAAqE;IACrE,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAEnF,yEAAyE;IACzE,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;CACrF;AAED,MAAM,WAAW,YAAa,SAAQ,WAAW;IAC/C,cAAc,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;IAC7C,uEAAuE;IACvE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,KAAK,WAAW,CAAA;IACvC,6DAA6D;IAC7D,GAAG,EAAE,MAAM,QAAQ,CAAA;IAInB,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IACvD,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IACjD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAClD,qEAAqE;IACrE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,YAAY,CAAA;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/login/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEhG;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAA;IAClB,kGAAkG;IAClG,QAAQ,EAAE,OAAO,CAAA;IACjB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAA;IAClB,uFAAuF;IACvF,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,oEAAoE;AACpE,oBAAY,YAAY;IACtB,sFAAsF;IACtF,OAAO,YAAY;IACnB,qFAAqF;IACrF,MAAM,WAAW;IACjB,oFAAoF;IACpF,UAAU,eAAe;IACzB,0FAA0F;IAC1F,OAAO,YAAY;IACnB,6EAA6E;IAC7E,QAAQ,aAAa;IACrB,0FAA0F;IAC1F,MAAM,WAAW;CAClB;AAED,yCAAyC;AACzC,oBAAY,WAAW;IACrB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAA;IACX,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,YAAY,KAAK,OAAO,CAAA;IAEtD;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAA;IAElD;;;;;OAKG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAEzF,qEAAqE;IACrE,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAEnF,yEAAyE;IACzE,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAEpF;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAEnF;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE5F,6EAA6E;IAC7E,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;CAC7E;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAA;CAC5E;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,CAAA;IACrB,GAAG,EAAE,QAAQ,CAAA;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpF;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,KAAK,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,WAAW,EAAE,CAAA;CACjD;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,IAAI,CAAC,EAAE,aAAa,CAAC;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAA;IACxD,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,QAAQ,CAAC,EAAE,SAAS,CAAA;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACzD,qDAAqD;IACrD,OAAO,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC,CAAA;IACrE,KAAK,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAA;IAChC,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,kDAAkD;IAClD,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAA;AAElE,MAAM,WAAW,YAAa,SAAQ,WAAW;IAC/C,cAAc,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;IAC7C,uEAAuE;IACvE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,KAAK,WAAW,CAAA;IACvC,6DAA6D;IAC7D,GAAG,EAAE,MAAM,QAAQ,CAAA;IACnB,0FAA0F;IAC1F,oBAAoB,EAAE,CAAC,YAAY,EAAE,iBAAiB,KAAK,IAAI,CAAA;IAC/D,qEAAqE;IACrE,oBAAoB,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAA;IACzD,OAAO,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,WAAW,EAAE,CAAA;IACnD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAA;IACtD,MAAM,EAAE,MAAM,oBAAoB,GAAG,IAAI,CAAA;IAIzC,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IACvD,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IACjD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAChD,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IACzD,cAAc,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAA;IAC3C,qEAAqE;IACrE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,wEAAwE;IACxE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,YAAY,CAAA;CAC1B"}

package/build/login/types.js

@@ -9,9 +9,15 @@ export var LoginOutcome;
     LoginOutcome["Redirected"] = "redirected";
     /** Cannot proceed without a fresh user gesture — the caller renders a sign-in control. */
     LoginOutcome["Gesture"] = "gesture";
-    /** Authenticated, but with no channel back to the window that started the flow. */
+    /** Authenticated, but with no channel back to the window that started it. */
     LoginOutcome["Orphaned"] = "orphaned";
     /** The attempt ended with no token (blocked window, user closed it, provider refused). */
     LoginOutcome["Failed"] = "failed";
 })(LoginOutcome || (LoginOutcome = {}));
+/** Why a surrogate window was opened. */
+export var LoginIntent;
+(function (LoginIntent) {
+    LoginIntent["Login"] = "login";
+    LoginIntent["Logout"] = "logout";
+})(LoginIntent || (LoginIntent = {}));
 //# sourceMappingURL=types.js.map

package/build/login/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/login/types.ts"],"names":[],"mappings":"AA6BA,oEAAoE;AACpE,MAAM,CAAN,IAAY,YAaX;AAbD,WAAY,YAAY;IACtB,sFAAsF;IACtF,mCAAmB,CAAA;IACnB,qFAAqF;IACrF,iCAAiB,CAAA;IACjB,oFAAoF;IACpF,yCAAyB,CAAA;IACzB,0FAA0F;IAC1F,mCAAmB,CAAA;IACnB,mFAAmF;IACnF,qCAAqB,CAAA;IACrB,0FAA0F;IAC1F,iCAAiB,CAAA;AACnB,CAAC,EAbW,YAAY,KAAZ,YAAY,QAavB"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/login/types.ts"],"names":[],"mappings":"AA+BA,oEAAoE;AACpE,MAAM,CAAN,IAAY,YAaX;AAbD,WAAY,YAAY;IACtB,sFAAsF;IACtF,mCAAmB,CAAA;IACnB,qFAAqF;IACrF,iCAAiB,CAAA;IACjB,oFAAoF;IACpF,yCAAyB,CAAA;IACzB,0FAA0F;IAC1F,mCAAmB,CAAA;IACnB,6EAA6E;IAC7E,qCAAqB,CAAA;IACrB,0FAA0F;IAC1F,iCAAiB,CAAA;AACnB,CAAC,EAbW,YAAY,KAAZ,YAAY,QAavB;AAED,yCAAyC;AACzC,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,8BAAe,CAAA;IACf,gCAAiB,CAAA;AACnB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB"}

package/build/manager/plugins/basic-ed25519.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"basic-ed25519.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKtD,eAAO,MAAM,oBAAoB,EAAE,oBAmClC,CAAA"}
+{"version":3,"file":"basic-ed25519.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKtD,eAAO,MAAM,oBAAoB,EAAE,oBAqClC,CAAA"}

package/build/manager/plugins/basic-ed25519.js

@@ -5,6 +5,7 @@ import { makeKeyPairModel } from '@owlmeans/basic-keys';
 import { AuthenCredError } from '../errors.js';
 export const ed25519BasicUIPlugin = {
     type: AuthenticationType.BasicEd25519,
+    method: { order: 300, icon: 'key', emphasis: 'secondary' },
     Implementation: Renderer => ({ type, stage, control, params }) => {
         type = type ?? AuthenticationType.BasicEd25519;
         Renderer = Renderer ?? ed25519BasicUIPlugin.Renderer;

package/build/manager/plugins/basic-ed25519.js.map

@@ -1 +1 @@
-{"version":3,"file":"basic-ed25519.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACxD,IAAI,EAAE,kBAAkB,CAAC,YAAY;IAErC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAE/D,IAAI,GAAG,IAAI,IAAI,kBAAkB,CAAC,YAAY,CAAA;QAC9C,QAAQ,GAAG,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAA;QAEpD,iEAAiE;QACjE,+CAA+C;QAC/C,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC/C,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAA;YACjC,CAAC;QACH,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAEV,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,iDAAiD,CAAC,CAAA;QAC1E,CAAC;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACjF,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,WAAW,EAAC,EAAE;QAChC,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QAEpD,IAAI,WAAW,CAAC,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAA;QACpD,CAAC;QAED,WAAW,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAE9D,4CAA4C;QAC5C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}
+{"version":3,"file":"basic-ed25519.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACxD,IAAI,EAAE,kBAAkB,CAAC,YAAY;IAErC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE;IAE1D,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAE/D,IAAI,GAAG,IAAI,IAAI,kBAAkB,CAAC,YAAY,CAAA;QAC9C,QAAQ,GAAG,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAA;QAEpD,iEAAiE;QACjE,+CAA+C;QAC/C,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC/C,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAA;YACjC,CAAC;QACH,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAEV,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,iDAAiD,CAAC,CAAA;QAC1E,CAAC;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACjF,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,WAAW,EAAC,EAAE;QAChC,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QAEpD,IAAI,WAAW,CAAC,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAA;QACpD,CAAC;QAED,WAAW,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAE9D,4CAA4C;QAC5C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}

package/build/manager/plugins/exports.d.ts

@@ -1,4 +1,6 @@
 export type * from './types.js';
+export * from './registry.js';
+export * from './methods.js';
 export * from './tunnel/index.js';
 export * from './basic-ed25519.js';
 export * from './re-captcha.js';

package/build/manager/plugins/exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/exports.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}
+{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/exports.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}

package/build/manager/plugins/exports.js

@@ -1,3 +1,5 @@
+export * from './registry.js';
+export * from './methods.js';
 export * from './tunnel/index.js';
 export * from './basic-ed25519.js';
 export * from './re-captcha.js';

package/build/manager/plugins/exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"exports.js","sourceRoot":"","sources":["../../../src/manager/plugins/exports.ts"],"names":[],"mappings":"AACA,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}
+{"version":3,"file":"exports.js","sourceRoot":"","sources":["../../../src/manager/plugins/exports.ts"],"names":[],"mappings":"AACA,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}

package/build/manager/plugins/index.d.ts

@@ -1,6 +1,2 @@
-import type { ClientAuthType } from '../components/index.js';
-import { AuthenticationPlugin } from './types.js';
-export declare const plugins: {
-    [type: ClientAuthType]: AuthenticationPlugin;
-};
+export { plugins, registerAuthPlugin, getAuthPlugin, listAuthPlugins } from './registry.js';
 //# sourceMappingURL=index.d.ts.map

package/build/manager/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAI5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAIjD,eAAO,MAAM,OAAO,EAAE;IAAE,CAAC,IAAI,EAAE,cAAc,GAAG,oBAAoB,CAAA;CAAO,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA"}

package/build/manager/plugins/index.js

@@ -2,8 +2,16 @@ import { AuthenticationType } from '@owlmeans/auth';
 import { ed25519BasicUIPlugin } from './basic-ed25519.js';
 import { reCaptchaPlugin } from './re-captcha.js';
 import { tunnelConsumerUIPlugin } from './tunnel-consumer.js';
-export const plugins = {};
+import { pluginMethodSource } from './methods.js';
+import { registerMethodSource } from '../../login/methods.js';
+import { plugins } from './registry.js';
+export { plugins, registerAuthPlugin, getAuthPlugin, listAuthPlugins } from './registry.js';
 plugins[AuthenticationType.BasicEd25519] = ed25519BasicUIPlugin;
 plugins[AuthenticationType.ReCaptcha] = reCaptchaPlugin;
 plugins[AuthenticationType.WalletConsumer] = tunnelConsumerUIPlugin;
+// Registered from here, not from `login/`, so that importing `@owlmeans/client-auth/login` never
+// drags this module's React plugin implementations into a bundle that only wanted the login host.
+// A generated application imports the login subpath through `client-iam`; it must not gain three
+// authentication methods it never registered as a side effect of that.
+registerMethodSource(pluginMethodSource);
 //# sourceMappingURL=index.js.map

package/build/manager/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,MAAM,CAAC,MAAM,OAAO,GAAqD,EAAE,CAAA;AAE3E,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,GAAG,oBAAoB,CAAA;AAC/D,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAG,eAAe,CAAA;AACvD,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,sBAAsB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAE3F,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,GAAG,oBAAoB,CAAA;AAC/D,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAG,eAAe,CAAA;AACvD,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,sBAAsB,CAAA;AAEnE,iGAAiG;AACjG,kGAAkG;AAClG,iGAAiG;AACjG,uEAAuE;AACvE,oBAAoB,CAAC,kBAAkB,CAAC,CAAA"}

package/build/manager/plugins/methods.d.ts

@@ -0,0 +1,10 @@
+import type { LoginMethodSource } from '../../login/types.js';
+/**
+ * Every registered authentication plugin that declares itself offerable, as a sign-in method.
+ *
+ * A plugin without `method` is deliberately invisible here: `re-captcha` is a STEP inside another
+ * flow, not a way to sign in, and a registry that offered everything registered would put it on
+ * the screen as a choice.
+ */
+export declare const pluginMethodSource: LoginMethodSource;
+//# sourceMappingURL=methods.d.ts.map

package/build/manager/plugins/methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/methods.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAe,iBAAiB,EAAgB,MAAM,sBAAsB,CAAA;AAGxF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,iBAsChC,CAAA"}

package/build/manager/plugins/methods.js

@@ -0,0 +1,46 @@
+import { CAUTHEN_AUTHEN_TYPED } from '@owlmeans/auth';
+import { DEFAULT_METHOD_ORDER, LOGIN_SERVICE } from '../../login/consts.js';
+import { listAuthPlugins } from './registry.js';
+/**
+ * Every registered authentication plugin that declares itself offerable, as a sign-in method.
+ *
+ * A plugin without `method` is deliberately invisible here: `re-captcha` is a STEP inside another
+ * flow, not a way to sign in, and a registry that offered everything registered would put it on
+ * the screen as a choice.
+ */
+export const pluginMethodSource = {
+    alias: 'authentication-plugins',
+    list: () => listAuthPlugins()
+        .filter(plugin => plugin.method != null && plugin.method.hidden !== true)
+        .map((plugin) => {
+        const meta = plugin.method;
+        const type = plugin.type;
+        const id = meta.id ?? type;
+        return {
+            id, type,
+            ...(meta.label != null ? { label: meta.label } : {}),
+            i18nKey: meta.i18nKey ?? id,
+            ...(meta.icon != null ? { icon: meta.icon } : {}),
+            order: meta.order ?? DEFAULT_METHOD_ORDER,
+            ...(meta.emphasis != null ? { emphasis: meta.emphasis } : {}),
+            ...(meta.restricted === true ? { restricted: true } : {}),
+            params: { type },
+            // Non-async through the whole chain: `login.begin` opens the surrogate window in its first
+            // statement, and a window opened after the gesture has been handled is blocked.
+            start: methodCtx => {
+                const login = methodCtx.context.service(LOGIN_SERVICE);
+                const entrypoint = methodCtx.context.entrypoint(CAUTHEN_AUTHEN_TYPED);
+                const url = entrypoint.getPath().replace(':type', encodeURIComponent(type));
+                return login.begin({
+                    url,
+                    // In an ordinary tab this keeps the application mounted, exactly as the pre-chooser
+                    // dispatcher did; the surrogate plugin ignores it and opens a window instead.
+                    ...(methodCtx.navigate != null
+                        ? { navigate: () => methodCtx.navigate?.(CAUTHEN_AUTHEN_TYPED, { type }) }
+                        : {}),
+                });
+            },
+        };
+    }),
+};
+//# sourceMappingURL=methods.js.map

package/build/manager/plugins/methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.js","sourceRoot":"","sources":["../../../src/manager/plugins/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE3E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,KAAK,EAAE,wBAAwB;IAE/B,IAAI,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;SAC1B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;SACxE,GAAG,CAAC,CAAC,MAAM,EAAe,EAAE;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAO,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAA;QAE1B,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,oBAAoB;YACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,EAAE,IAAI,EAAE;YAEhB,2FAA2F;YAC3F,gFAAgF;YAChF,KAAK,EAAE,SAAS,CAAC,EAAE;gBACjB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;gBACpE,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAmB,oBAAoB,CAAC,CAAA;gBACvF,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;gBAE3E,OAAO,KAAK,CAAC,KAAK,CAAC;oBACjB,GAAG;oBACH,oFAAoF;oBACpF,8EAA8E;oBAC9E,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,IAAI;wBAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;wBAC1E,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAA;YACJ,CAAC;SACF,CAAA;IACH,CAAC,CAAC;CACL,CAAA"}

package/build/manager/plugins/re-captcha.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"re-captcha.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAGtD,eAAO,MAAM,eAAe,EAAE,oBA0B7B,CAAA"}
+{"version":3,"file":"re-captcha.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAGtD,eAAO,MAAM,eAAe,EAAE,oBA6B7B,CAAA"}

package/build/manager/plugins/re-captcha.js

@@ -3,6 +3,8 @@ import { AuthenticationStage, AuthenticationType } from '@owlmeans/auth';
 import { useEffect } from 'react';
 export const reCaptchaPlugin = {
     type: AuthenticationType.ReCaptcha,
+    // A STEP inside another flow, never a way to sign in — so it is registered and never offered.
+    method: { hidden: true },
     Implementation: Renderer => ({ type, stage, control, params }) => {
         Renderer = Renderer ?? reCaptchaPlugin.Renderer;
         // ReCaptcha authentication requests allowance unconditionally 

package/build/manager/plugins/re-captcha.js.map

@@ -1 +1 @@
-{"version":3,"file":"re-captcha.js","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,IAAI,EAAE,kBAAkB,CAAC,SAAS;IAElC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,QAAQ,GAAG,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAA;QAE/C,+DAA+D;QAC/D,+CAA+C;QAC/C,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC/C,KAAK,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YACjE,CAAC;QACH,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAEV,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,8CAA8C,CAAC,CAAA;QACvE,CAAC;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACjF,CAAC;IAED;;;OAGG;IACH,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;CAC1C,CAAA"}
+{"version":3,"file":"re-captcha.js","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,IAAI,EAAE,kBAAkB,CAAC,SAAS;IAElC,8FAA8F;IAC9F,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;IAExB,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,QAAQ,GAAG,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAA;QAE/C,+DAA+D;QAC/D,+CAA+C;QAC/C,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC/C,KAAK,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YACjE,CAAC;QACH,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAEV,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,8CAA8C,CAAC,CAAA;QACvE,CAAC;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACjF,CAAC;IAED;;;OAGG;IACH,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;CAC1C,CAAA"}

package/build/manager/plugins/registry.d.ts

@@ -0,0 +1,20 @@
+import type { ClientAuthType } from '../components/authentication/types.js';
+import type { AuthenticationPlugin } from './types.js';
+/**
+ * The registry every authentication plugin lands in.
+ *
+ * It stays a plain exported object, and every registration stays a plain assignment, because four
+ * packages already write into it from side-effect imports (`web-oidc-rp`, `mui-oidc-rp`,
+ * `web-auth`, and this package's own `index`). Hiding it behind an API would break all of them for
+ * no gain — the functions below simply read it.
+ *
+ * It lives in its own module rather than in `index.ts` so that the method source can read it
+ * without the two importing each other.
+ */
+export declare const plugins: {
+    [type: ClientAuthType]: AuthenticationPlugin;
+};
+export declare const registerAuthPlugin: (plugin: AuthenticationPlugin) => AuthenticationPlugin;
+export declare const getAuthPlugin: (type: ClientAuthType) => AuthenticationPlugin | undefined;
+export declare const listAuthPlugins: () => AuthenticationPlugin[];
+//# sourceMappingURL=registry.d.ts.map

package/build/manager/plugins/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,EAAE;IAAE,CAAC,IAAI,EAAE,cAAc,GAAG,oBAAoB,CAAA;CAAO,CAAA;AAE3E,eAAO,MAAM,kBAAkB,WAAY,oBAAoB,KAAG,oBAIjE,CAAA;AAED,eAAO,MAAM,aAAa,SAAU,cAAc,KAAG,oBAAoB,GAAG,SAC7D,CAAA;AAEf,eAAO,MAAM,eAAe,QAAO,oBAAoB,EAA4B,CAAA"}

package/build/manager/plugins/registry.js

@@ -0,0 +1,19 @@
+/**
+ * The registry every authentication plugin lands in.
+ *
+ * It stays a plain exported object, and every registration stays a plain assignment, because four
+ * packages already write into it from side-effect imports (`web-oidc-rp`, `mui-oidc-rp`,
+ * `web-auth`, and this package's own `index`). Hiding it behind an API would break all of them for
+ * no gain — the functions below simply read it.
+ *
+ * It lives in its own module rather than in `index.ts` so that the method source can read it
+ * without the two importing each other.
+ */
+export const plugins = {};
+export const registerAuthPlugin = (plugin) => {
+    plugins[plugin.type] = plugin;
+    return plugin;
+};
+export const getAuthPlugin = (type) => plugins[type];
+export const listAuthPlugins = () => Object.values(plugins);
+//# sourceMappingURL=registry.js.map

package/build/manager/plugins/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/manager/plugins/registry.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,OAAO,GAAqD,EAAE,CAAA;AAE3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA4B,EAAwB,EAAE;IACvF,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;IAE7B,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAoB,EAAoC,EAAE,CACtF,OAAO,CAAC,IAAI,CAAC,CAAA;AAEf,MAAM,CAAC,MAAM,eAAe,GAAG,GAA2B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA"}

package/build/manager/plugins/tunnel-consumer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel-consumer.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/tunnel-consumer.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAStD,eAAO,MAAM,sBAAsB,EAAE,oBA8DpC,CAAA"}
+{"version":3,"file":"tunnel-consumer.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/tunnel-consumer.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAStD,eAAO,MAAM,sBAAsB,EAAE,oBAgEpC,CAAA"}

package/build/manager/plugins/tunnel-consumer.js

@@ -7,6 +7,7 @@ import { RELY_ACTION_TIMEOUT, RELY_PIN_PERFIX } from '@owlmeans/auth-common';
 import { createWalletFacade } from './tunnel/wallet.js';
 export const tunnelConsumerUIPlugin = {
     type: AuthenticationType.WalletConsumer,
+    method: { order: 400, icon: 'wallet' },
     Implementation: renderer => ({ type, stage, control, params }) => {
         type = type ?? AuthenticationType.WalletConsumer;
         const Renderer = renderer

package/build/manager/plugins/tunnel-consumer.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel-consumer.js","sourceRoot":"","sources":["../../../src/manager/plugins/tunnel-consumer.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAI3G,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,cAAc;IAEvC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,IAAI,GAAG,IAAI,IAAI,kBAAkB,CAAC,cAAc,CAAA;QAChD,MAAM,QAAQ,GAA6C,QAAQ;eAC9D,sBAAsB,CAAC,QAAQ,CAAA;QAEpC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,CAAA;QAErC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,mDAAmD,CAAC,CAAA;QAC5E,CAAC;QAED,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAA;gBAClD,UAAU,CAAC,IAAI,CACb,mBAAmB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,CAAC,aAAa,EAAE,CACrE,CAAC,IAAI,CAAC,KAAK,EAAE,SAA4B,EAAE,EAAE;oBAC5C,OAAO,CAAC,SAAS,GAAG,SAAS,CAAA;oBAC7B,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;oBAErD,UAAU,CAAC,kBAAkB,GAAG,mBAAmB,GAAG,IAAI,CAAA;gBAC5D,CAAC,CAAC,CAAA;gBAEF,UAAU,CAAC,YAAY,GAAG,KAAK,EAAE,KAA0B,EAAE,OAAY,EAAE,EAAE;oBAC3E,IAAI,KAAK,KAAK,mBAAmB,CAAC,aAAa,EAAE,CAAC;wBAChD,IAAI,CAAC;4BACH,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gCAC7B,MAAM,IAAI,WAAW,CAAC,kEAAkE,CAAC,CAAA;4BAC3F,CAAC;4BACD,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAA;4BAC/D,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;wBACzD,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;4BACxB,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;wBAC3B,CAAC;oBACH,CAAC;oBACD,OAAO,CAAC,IAAI,EAAE,IAAW,CAAC,CAAA;gBAC5B,CAAC,CAAA;gBAED,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;oBACvC,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBACzD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;oBACnD,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QAEhB,MAAM,MAAM,GAAG,WAAW,CACxB,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,EACvE,CAAC,UAAU,IAAI,IAAI,CAAC,CACvB,CAAA;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACnH,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,YAAY,EAAC,EAAE;QACjC,4CAA4C;QAC5C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,OAA8B,EAAE,EAAE,CAAC,KAAK,EAAE,IAAa,EAAE,EAAE;IAC/F,MAAM,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAwB,mBAAmB,CAAC,YAAY,EAAE;YACpF,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE;YAC7C,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC,GAAG;YACtC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,QAAQ,CAAC,KAAK;YACpB,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,CAAC,UAAU,CAAC;SACrB,CAAC,CAAA;QAEF,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,aAAa,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,kEAAkE,CAAC,CAAA;YAC3F,CAAC;YACD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QACxD,CAAC;QACD,SAAS;IACX,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"tunnel-consumer.js","sourceRoot":"","sources":["../../../src/manager/plugins/tunnel-consumer.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAI3G,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,cAAc;IAEvC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;IAEtC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,IAAI,GAAG,IAAI,IAAI,kBAAkB,CAAC,cAAc,CAAA;QAChD,MAAM,QAAQ,GAA6C,QAAQ;eAC9D,sBAAsB,CAAC,QAAQ,CAAA;QAEpC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,CAAA;QAErC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,mDAAmD,CAAC,CAAA;QAC5E,CAAC;QAED,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAA;gBAClD,UAAU,CAAC,IAAI,CACb,mBAAmB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,CAAC,aAAa,EAAE,CACrE,CAAC,IAAI,CAAC,KAAK,EAAE,SAA4B,EAAE,EAAE;oBAC5C,OAAO,CAAC,SAAS,GAAG,SAAS,CAAA;oBAC7B,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;oBAErD,UAAU,CAAC,kBAAkB,GAAG,mBAAmB,GAAG,IAAI,CAAA;gBAC5D,CAAC,CAAC,CAAA;gBAEF,UAAU,CAAC,YAAY,GAAG,KAAK,EAAE,KAA0B,EAAE,OAAY,EAAE,EAAE;oBAC3E,IAAI,KAAK,KAAK,mBAAmB,CAAC,aAAa,EAAE,CAAC;wBAChD,IAAI,CAAC;4BACH,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gCAC7B,MAAM,IAAI,WAAW,CAAC,kEAAkE,CAAC,CAAA;4BAC3F,CAAC;4BACD,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAA;4BAC/D,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;wBACzD,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;4BACxB,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;wBAC3B,CAAC;oBACH,CAAC;oBACD,OAAO,CAAC,IAAI,EAAE,IAAW,CAAC,CAAA;gBAC5B,CAAC,CAAA;gBAED,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;oBACvC,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBACzD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;oBACnD,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QAEhB,MAAM,MAAM,GAAG,WAAW,CACxB,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,EACvE,CAAC,UAAU,IAAI,IAAI,CAAC,CACvB,CAAA;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACnH,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,YAAY,EAAC,EAAE;QACjC,4CAA4C;QAC5C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,OAA8B,EAAE,EAAE,CAAC,KAAK,EAAE,IAAa,EAAE,EAAE;IAC/F,MAAM,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAwB,mBAAmB,CAAC,YAAY,EAAE;YACpF,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE;YAC7C,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC,GAAG;YACtC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,QAAQ,CAAC,KAAK;YACpB,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,CAAC,UAAU,CAAC;SACrB,CAAC,CAAA;QAEF,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,aAAa,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,kEAAkE,CAAC,CAAA;YAC3F,CAAC;YACD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QACxD,CAAC;QACD,SAAS;IACX,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;AACH,CAAC,CAAA"}

package/build/manager/plugins/types.d.ts

@@ -1,9 +1,40 @@
 import type { FC } from 'react';
+import type { LoginMethodEmphasis } from '@owlmeans/config';
 import type { AuthenticationControl, AuthenticationRenderer, AuthenticationRendererProps } from '../components/authentication/types.js';
 export interface AuthenticationPlugin extends Pick<AuthenticationControl, "beforeAuthenticate" | "afterAuthenticate">, Pick<Partial<AuthenticationControl>, "authenticate"> {
     type: string;
     Implementation: PluginImplemnetation;
     Renderer?: AuthenticationRenderer;
+    /**
+     * How this method presents itself on the sign-in screen.
+     *
+     * Absent means the plugin is never OFFERED — it is still reachable by type, which is what a
+     * step-in-a-flow (re-captcha) and a plugin an app deep-links to both need. Every field is
+     * optional so an existing plugin object keeps type-checking without being touched.
+     */
+    method?: AuthMethodMeta;
+}
+export interface AuthMethodMeta {
+    /** Defaults to the plugin's `type`. */
+    id?: string;
+    /** Literal fallback used when no translation resolves. */
+    label?: string;
+    /** Key under the `auth` library's `login.method.*`; defaults to the id. */
+    i18nKey?: string;
+    /** Icon registry NAME, never markup — this package must stay free of an icon library. */
+    icon?: string;
+    /** Ascending; default 100. */
+    order?: number;
+    emphasis?: LoginMethodEmphasis;
+    /**
+     * Never offered unless the configuration explicitly enables it.
+     *
+     * This is the secret-key gate: an operator login is registered like any other method and must
+     * not become offerable merely by being registered.
+     */
+    restricted?: boolean;
+    /** Registered, but never a choice. */
+    hidden?: boolean;
 }
 export interface PluginImplemnetation {
     (Renderer?: AuthenticationRenderer): FC<AuthenticationRendererProps>;

package/build/manager/plugins/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAC/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,2BAA2B,EAAG,MAAM,uCAAuC,CAAA;AAExI,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAChD,qBAAqB,EAAE,oBAAoB,GAAG,mBAAmB,CAClE,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC;IACrD,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,oBAAoB,CAAA;IACpC,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAA;CACrE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,2BAA2B,EAAG,MAAM,uCAAuC,CAAA;AAExI,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAChD,qBAAqB,EAAE,oBAAoB,GAAG,mBAAmB,CAClE,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC;IACrD,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,oBAAoB,CAAA;IACpC,QAAQ,CAAC,EAAE,sBAAsB,CAAA;IACjC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAA;CACrE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.12",
+  "version": "0.1.18-rc.13",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -50,24 +50,26 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.6",
-    "@owlmeans/auth-common": "^0.1.18-rc.8",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.8",
-    "@owlmeans/basic-keys": "^0.1.18-rc.8",
-    "@owlmeans/client": "^0.1.18-rc.9",
-    "@owlmeans/client-context": "^0.1.18-rc.8",
-    "@owlmeans/client-flow": "^0.1.18-rc.10",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.8",
-    "@owlmeans/client-resource": "^0.1.18-rc.8",
-    "@owlmeans/client-socket": "^0.1.18-rc.8",
+    "@owlmeans/auth": "^0.1.18-rc.7",
+    "@owlmeans/auth-common": "^0.1.18-rc.9",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.9",
+    "@owlmeans/basic-keys": "^0.1.18-rc.9",
+    "@owlmeans/client": "^0.1.18-rc.10",
+    "@owlmeans/client-context": "^0.1.18-rc.9",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.9",
+    "@owlmeans/client-flow": "^0.1.18-rc.11",
+    "@owlmeans/client-resource": "^0.1.18-rc.9",
+    "@owlmeans/client-socket": "^0.1.18-rc.9",
+    "@owlmeans/config": "^0.1.18-rc.8",
     "@owlmeans/context": "^0.1.18-rc.6",
-    "@owlmeans/did": "^0.1.18-rc.8",
+    "@owlmeans/did": "^0.1.18-rc.9",
+    "@owlmeans/entrypoint": "^0.1.18-rc.8",
     "@owlmeans/error": "^0.1.18-rc.6",
-    "@owlmeans/flow": "^0.1.18-rc.9",
-    "@owlmeans/entrypoint": "^0.1.18-rc.7",
+    "@owlmeans/flow": "^0.1.18-rc.10",
+    "@owlmeans/i18n": "^0.1.18-rc.6",
     "@owlmeans/resource": "^0.1.18-rc.7",
-    "@owlmeans/socket": "^0.1.18-rc.6",
-    "@owlmeans/web-flow": "^0.1.18-rc.10",
+    "@owlmeans/socket": "^0.1.18-rc.7",
+    "@owlmeans/web-flow": "^0.1.18-rc.11",
     "@scure/base": "^2.3.0"
   },
   "peerDependencies": {
@@ -76,8 +78,8 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.8",
-    "@types/bun": "^1.3.14",
+    "@owlmeans/test-auth": "^0.1.18-rc.9",
+    "@types/bun": "^1.4.0",
     "@types/react": "^19.2.17",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/login/adopt.ts

@@ -17,3 +17,15 @@ import type { LoginContext } from './types.js'
 export const adoptToken = async (ctx: LoginContext, token: string): Promise<void> => {
   await ctx.service<AuthService>(AUTH_ALIAS).update(token)
 }
+
+/**
+ * The one path this context's authentication is dropped, and the exact mirror of {@link adoptToken}.
+ *
+ * `undefined`, not `null`: `undefined` is the declared clearing value, and on the web the auth
+ * service reacts to it by navigating to the dispatcher. Everything that signs a user out goes
+ * through here — the hook, both browser plugins and the surrogate screen — so there is one place
+ * where "signed out" is defined rather than four that agree until one of them changes.
+ */
+export const revokeToken = async (ctx: LoginContext): Promise<void> => {
+  await ctx.service<AuthService>(AUTH_ALIAS).update(undefined)
+}