@owlmeans/client-auth 0.1.18-rc.14 → 0.1.18-rc.16

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.14",
-  "generatedAt": "2026-09-01T12:04:42.696Z",
+  "version": "0.1.18-rc.16",
+  "generatedAt": "2026-09-01T12:34:07.505Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-auth
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.14"` in `dependencies`
+**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.16"` in `dependencies`
 
 ## Key Exports
 

package/build/login/flow.d.ts

@@ -0,0 +1,20 @@
+import type { FlowModel } from '@owlmeans/flow';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export declare const enterOidcAuthorization: (model: FlowModel) => FlowModel;
+//# sourceMappingURL=flow.d.ts.map

package/build/login/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,UAAW,SAAS,KAAG,SAsBzD,CAAA"}

package/build/login/flow.js

@@ -0,0 +1,39 @@
+import { FLOW_PLACEHOLDER, OidcAuthStep, STD_OIDC_FLOW } from '@owlmeans/flow';
+import { DEFAULT_ENTITY } from '../consts.js';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export const enterOidcAuthorization = (model) => {
+    const state = model.state();
+    if (state.flow !== STD_OIDC_FLOW || state.step !== OidcAuthStep.Dispatch) {
+        return model;
+    }
+    const target = model.step().service;
+    if (state.service == null || state.service === '') {
+        model.target(target);
+    }
+    // The entity travels to this app's own backend, which resolves its default provider by `def`
+    // alone. It still has to BE there: the init endpoint rejects a body without one.
+    if (state.entityId == null) {
+        model.entity(DEFAULT_ENTITY);
+    }
+    if (target === FLOW_PLACEHOLDER) {
+        model.transit(OidcAuthStep.Ephemeral, true);
+    }
+    return model;
+};
+//# sourceMappingURL=flow.js.map

package/build/login/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAgB,EAAa,EAAE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAA;IACnC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,6FAA6F;IAC7F,iFAAiF;IACjF,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/login/i18n/be.json

@@ -7,7 +7,7 @@
         "method": {
             "google": "Працягнуць з Google",
             "oidc": "Працягнуць з {{provider}}",
-            "oidc-default": "Увайсці",
+            "oidc-default": "Увайсці / Зарэгістравацца",
             "oidc-client": "Працягнуць з {{provider}}",
             "basic-ed25519": "Увайсці з ключом",
             "pk-supervisor": "Сакрэтны ключ (аператар)",

package/build/login/i18n/de.json

@@ -7,7 +7,7 @@
         "method": {
             "google": "Mit Google fortfahren",
             "oidc": "Mit {{provider}} fortfahren",
-            "oidc-default": "Anmelden",
+            "oidc-default": "Anmelden / Registrieren",
             "oidc-client": "Mit {{provider}} fortfahren",
             "basic-ed25519": "Mit einem Schlüssel anmelden",
             "pk-supervisor": "Geheimer Schlüssel (Betreiber)",

package/build/login/i18n/en.json

@@ -7,7 +7,7 @@
         "method": {
             "google": "Continue with Google",
             "oidc": "Continue with {{provider}}",
-            "oidc-default": "Sign in",
+            "oidc-default": "Sign in / Sign up",
             "oidc-client": "Continue with {{provider}}",
             "basic-ed25519": "Sign in with a key",
             "pk-supervisor": "Secret key (operator)",

package/build/login/i18n/es.json

@@ -7,7 +7,7 @@
         "method": {
             "google": "Continuar con Google",
             "oidc": "Continuar con {{provider}}",
-            "oidc-default": "Iniciar sesión",
+            "oidc-default": "Iniciar sesión / Registrarse",
             "oidc-client": "Continuar con {{provider}}",
             "basic-ed25519": "Iniciar sesión con una clave",
             "pk-supervisor": "Clave secreta (operador)",

package/build/login/i18n/pl.json

@@ -7,7 +7,7 @@
         "method": {
             "google": "Kontynuuj z Google",
             "oidc": "Kontynuuj z {{provider}}",
-            "oidc-default": "Zaloguj się",
+            "oidc-default": "Zaloguj się / Zarejestruj się",
             "oidc-client": "Kontynuuj z {{provider}}",
             "basic-ed25519": "Zaloguj się kluczem",
             "pk-supervisor": "Klucz tajny (operator)",

package/build/login/i18n/ru.json

@@ -7,7 +7,7 @@
         "method": {
             "google": "Продолжить с Google",
             "oidc": "Продолжить с {{provider}}",
-            "oidc-default": "Войти",
+            "oidc-default": "Войти / Зарегистрироваться",
             "oidc-client": "Продолжить с {{provider}}",
             "basic-ed25519": "Войти с ключом",
             "pk-supervisor": "Секретный ключ (оператор)",

package/build/login/i18n/uk.json

@@ -7,7 +7,7 @@
         "method": {
             "google": "Продовжити з Google",
             "oidc": "Продовжити з {{provider}}",
-            "oidc-default": "Увійти",
+            "oidc-default": "Увійти / Зареєструватися",
             "oidc-client": "Продовжити з {{provider}}",
             "basic-ed25519": "Увійти з ключем",
             "pk-supervisor": "Секретний ключ (оператор)",

package/build/login/index.d.ts

@@ -4,6 +4,7 @@ export * from './types.js';
 export * from './env.js';
 export * from './adopt.js';
 export * from './methods.js';
+export * from './flow.js';
 export * from './resume.js';
 export * from './terms.js';
 export * from './credit.js';

package/build/login/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}

package/build/login/index.js

@@ -4,6 +4,7 @@ export * from './types.js';
 export * from './env.js';
 export * from './adopt.js';
 export * from './methods.js';
+export * from './flow.js';
 export * from './resume.js';
 export * from './terms.js';
 export * from './credit.js';

package/build/login/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}

package/build/login/resume.d.ts

@@ -1,4 +1,14 @@
 import { LoginOutcome } from './types.js';
+/**
+ * The message key a FINISHED sign-in attempt should show, or null when it actually went somewhere.
+ *
+ * A dispatcher may treat `Passed` as "carry on with the ordinary continuation", because it has one.
+ * A screen does not: the user clicked, the document did not move, and nothing rendered — which is
+ * indistinguishable from a broken button, and is exactly how a null authorization URL used to
+ * present itself. Every outcome that leaves the user looking at the same screen therefore has to
+ * say something.
+ */
+export declare const loginAttemptError: (outcome: LoginOutcome | null) => string | null;
 /** What a dispatcher does once `login().resume(...)` has answered. */
 export declare enum ResumeAction {
     /** The plugin took it over — the browser is leaving, or the window is closing. */

package/build/login/resume.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resume.d.ts","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,sEAAsE;AACtE,oBAAY,YAAY;IACtB,kFAAkF;IAClF,IAAI,SAAS;IACb,oFAAoF;IACpF,MAAM,WAAW;IACjB,sEAAsE;IACtE,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa,YAAY,KAAG,YAYpD,CAAA"}
+{"version":3,"file":"resume.d.ts","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,YAAa,YAAY,GAAG,IAAI,KAAG,MAAM,GAAG,IAYzE,CAAA;AAED,sEAAsE;AACtE,oBAAY,YAAY;IACtB,kFAAkF;IAClF,IAAI,SAAS;IACb,oFAAoF;IACpF,MAAM,WAAW;IACjB,sEAAsE;IACtE,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa,YAAY,KAAG,YAYpD,CAAA"}

package/build/login/resume.js

@@ -1,4 +1,26 @@
 import { LoginOutcome } from './types.js';
+/**
+ * The message key a FINISHED sign-in attempt should show, or null when it actually went somewhere.
+ *
+ * A dispatcher may treat `Passed` as "carry on with the ordinary continuation", because it has one.
+ * A screen does not: the user clicked, the document did not move, and nothing rendered — which is
+ * indistinguishable from a broken button, and is exactly how a null authorization URL used to
+ * present itself. Every outcome that leaves the user looking at the same screen therefore has to
+ * say something.
+ */
+export const loginAttemptError = (outcome) => {
+    switch (outcome) {
+        case LoginOutcome.Gesture:
+            // The window never opened. That is the popup blocker, and it has its own copy.
+            return 'login.error.blocked';
+        case LoginOutcome.Failed:
+        case LoginOutcome.Passed:
+            return 'login.error.failed';
+        default:
+            // Handled, Redirected and Orphaned all did something; Orphaned reports itself elsewhere.
+            return null;
+    }
+};
 /** What a dispatcher does once `login().resume(...)` has answered. */
 export var ResumeAction;
 (function (ResumeAction) {

package/build/login/resume.js.map

@@ -1 +1 @@
-{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,sEAAsE;AACtE,MAAM,CAAN,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,kFAAkF;IAClF,6BAAa,CAAA;IACb,oFAAoF;IACpF,iCAAiB,CAAA;IACjB,sEAAsE;IACtE,qCAAqB,CAAA;AACvB,CAAC,EAPW,YAAY,KAAZ,YAAY,QAOvB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAgB,EAAE;IAClE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO,CAAC;QAC1B,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,YAAY,CAAC,IAAI,CAAA;QAC1B,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,MAAM,CAAC;QACzB,KAAK,YAAY,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,MAAM,CAAA;QAC5B;YACE,OAAO,YAAY,CAAC,QAAQ,CAAA;IAChC,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA4B,EAAiB,EAAE;IAC/E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO;YACvB,+EAA+E;YAC/E,OAAO,qBAAqB,CAAA;QAC9B,KAAK,YAAY,CAAC,MAAM,CAAC;QACzB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,oBAAoB,CAAA;QAC7B;YACE,yFAAyF;YACzF,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC,CAAA;AAED,sEAAsE;AACtE,MAAM,CAAN,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,kFAAkF;IAClF,6BAAa,CAAA;IACb,oFAAoF;IACpF,iCAAiB,CAAA;IACjB,sEAAsE;IACtE,qCAAqB,CAAA;AACvB,CAAC,EAPW,YAAY,KAAZ,YAAY,QAOvB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAgB,EAAE;IAClE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO,CAAC;QAC1B,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,YAAY,CAAC,IAAI,CAAA;QAC1B,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,MAAM,CAAC;QACzB,KAAK,YAAY,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,MAAM,CAAA;QAC5B;YACE,OAAO,YAAY,CAAC,QAAQ,CAAA;IAChC,CAAC;AACH,CAAC,CAAA"}

package/build/manager/modules.d.ts

@@ -1,2 +1,2 @@
-export declare const modules: any[];
+export declare const modules: import("@owlmeans/entrypoint").CommonEntrypoint[];
 //# sourceMappingURL=modules.d.ts.map

package/build/manager/modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../src/manager/modules.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,OAAO,OAAO,CAAA"}
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../src/manager/modules.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,OAAO,mDAAO,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.14",
+  "version": "0.1.18-rc.16",
   "license": "MIT",
   "type": "module",
   "scripts": {

package/src/login/flow.ts

@@ -0,0 +1,44 @@
+import { FLOW_PLACEHOLDER, OidcAuthStep, STD_OIDC_FLOW } from '@owlmeans/flow'
+import type { FlowModel } from '@owlmeans/flow'
+import { DEFAULT_ENTITY } from '../consts.js'
+
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export const enterOidcAuthorization = (model: FlowModel): FlowModel => {
+  const state = model.state()
+  if (state.flow !== STD_OIDC_FLOW || state.step !== OidcAuthStep.Dispatch) {
+    return model
+  }
+
+  const target = model.step().service
+  if (state.service == null || state.service === '') {
+    model.target(target)
+  }
+
+  // The entity travels to this app's own backend, which resolves its default provider by `def`
+  // alone. It still has to BE there: the init endpoint rejects a body without one.
+  if (state.entityId == null) {
+    model.entity(DEFAULT_ENTITY)
+  }
+
+  if (target === FLOW_PLACEHOLDER) {
+    model.transit(OidcAuthStep.Ephemeral, true)
+  }
+
+  return model
+}

package/src/login/i18n/be.json

@@ -7,7 +7,7 @@
     "method": {
       "google": "Працягнуць з Google",
       "oidc": "Працягнуць з {{provider}}",
-      "oidc-default": "Увайсці",
+      "oidc-default": "Увайсці / Зарэгістравацца",
       "oidc-client": "Працягнуць з {{provider}}",
       "basic-ed25519": "Увайсці з ключом",
       "pk-supervisor": "Сакрэтны ключ (аператар)",

package/src/login/i18n/de.json

@@ -7,7 +7,7 @@
     "method": {
       "google": "Mit Google fortfahren",
       "oidc": "Mit {{provider}} fortfahren",
-      "oidc-default": "Anmelden",
+      "oidc-default": "Anmelden / Registrieren",
       "oidc-client": "Mit {{provider}} fortfahren",
       "basic-ed25519": "Mit einem Schlüssel anmelden",
       "pk-supervisor": "Geheimer Schlüssel (Betreiber)",

package/src/login/i18n/en.json

@@ -7,7 +7,7 @@
     "method": {
       "google": "Continue with Google",
       "oidc": "Continue with {{provider}}",
-      "oidc-default": "Sign in",
+      "oidc-default": "Sign in / Sign up",
       "oidc-client": "Continue with {{provider}}",
       "basic-ed25519": "Sign in with a key",
       "pk-supervisor": "Secret key (operator)",

package/src/login/i18n/es.json

@@ -7,7 +7,7 @@
     "method": {
       "google": "Continuar con Google",
       "oidc": "Continuar con {{provider}}",
-      "oidc-default": "Iniciar sesión",
+      "oidc-default": "Iniciar sesión / Registrarse",
       "oidc-client": "Continuar con {{provider}}",
       "basic-ed25519": "Iniciar sesión con una clave",
       "pk-supervisor": "Clave secreta (operador)",

package/src/login/i18n/pl.json

@@ -7,7 +7,7 @@
     "method": {
       "google": "Kontynuuj z Google",
       "oidc": "Kontynuuj z {{provider}}",
-      "oidc-default": "Zaloguj się",
+      "oidc-default": "Zaloguj się / Zarejestruj się",
       "oidc-client": "Kontynuuj z {{provider}}",
       "basic-ed25519": "Zaloguj się kluczem",
       "pk-supervisor": "Klucz tajny (operator)",

package/src/login/i18n/ru.json

@@ -7,7 +7,7 @@
     "method": {
       "google": "Продолжить с Google",
       "oidc": "Продолжить с {{provider}}",
-      "oidc-default": "Войти",
+      "oidc-default": "Войти / Зарегистрироваться",
       "oidc-client": "Продолжить с {{provider}}",
       "basic-ed25519": "Войти с ключом",
       "pk-supervisor": "Секретный ключ (оператор)",

package/src/login/i18n/uk.json

@@ -7,7 +7,7 @@
     "method": {
       "google": "Продовжити з Google",
       "oidc": "Продовжити з {{provider}}",
-      "oidc-default": "Увійти",
+      "oidc-default": "Увійти / Зареєструватися",
       "oidc-client": "Продовжити з {{provider}}",
       "basic-ed25519": "Увійти з ключем",
       "pk-supervisor": "Секретний ключ (оператор)",

package/src/login/index.ts

@@ -5,6 +5,7 @@ export * from './types.js'
 export * from './env.js'
 export * from './adopt.js'
 export * from './methods.js'
+export * from './flow.js'
 export * from './resume.js'
 export * from './terms.js'
 export * from './credit.js'

package/src/login/resume.ts

@@ -1,5 +1,28 @@
 import { LoginOutcome } from './types.js'
 
+/**
+ * The message key a FINISHED sign-in attempt should show, or null when it actually went somewhere.
+ *
+ * A dispatcher may treat `Passed` as "carry on with the ordinary continuation", because it has one.
+ * A screen does not: the user clicked, the document did not move, and nothing rendered — which is
+ * indistinguishable from a broken button, and is exactly how a null authorization URL used to
+ * present itself. Every outcome that leaves the user looking at the same screen therefore has to
+ * say something.
+ */
+export const loginAttemptError = (outcome: LoginOutcome | null): string | null => {
+  switch (outcome) {
+    case LoginOutcome.Gesture:
+      // The window never opened. That is the popup blocker, and it has its own copy.
+      return 'login.error.blocked'
+    case LoginOutcome.Failed:
+    case LoginOutcome.Passed:
+      return 'login.error.failed'
+    default:
+      // Handled, Redirected and Orphaned all did something; Orphaned reports itself elsewhere.
+      return null
+  }
+}
+
 /** What a dispatcher does once `login().resume(...)` has answered. */
 export enum ResumeAction {
   /** The plugin took it over — the browser is leaving, or the window is closing. */

package/tests/login.spec.ts

@@ -6,7 +6,7 @@ import { resolveCredit } from '../src/login/credit.js'
 import { pluginMethodSource } from '../src/manager/plugins/methods.js'
 import { registerAuthPlugin } from '../src/manager/plugins/registry.js'
 import type { AuthenticationPlugin } from '../src/manager/plugins/types.js'
-import { resumeAction, ResumeAction } from '../src/login/resume.js'
+import { resumeAction, ResumeAction, loginAttemptError } from '../src/login/resume.js'
 import { LoginOutcome } from '../src/login/types.js'
 import type {
   LoginEnv, LoginMethod, LoginMethodContext, LoginPlugin, LoginService,
@@ -282,6 +282,24 @@ describe('the authentication-plugin method source', () => {
   })
 })
 
+describe('a finished sign-in attempt', () => {
+  test('reports every outcome that leaves the user on the screen', () => {
+    // The regression: a method that could not build an authorization URL returned `Passed`, the
+    // screen rendered nothing, and the button read as broken. `Passed` is a valid answer TO A
+    // DISPATCHER, which has a continuation; a screen does not.
+    expect(loginAttemptError(LoginOutcome.Passed)).toBe('login.error.failed')
+    expect(loginAttemptError(LoginOutcome.Failed)).toBe('login.error.failed')
+    expect(loginAttemptError(LoginOutcome.Gesture)).toBe('login.error.blocked')
+  })
+
+  test('says nothing when the attempt actually went somewhere', () => {
+    expect(loginAttemptError(LoginOutcome.Handled)).toBeNull()
+    expect(loginAttemptError(LoginOutcome.Redirected)).toBeNull()
+    expect(loginAttemptError(LoginOutcome.Orphaned)).toBeNull()
+    expect(loginAttemptError(null)).toBeNull()
+  })
+})
+
 describe('resume outcomes', () => {
   test('map to exactly one action each', () => {
     expect(resumeAction(LoginOutcome.Handled)).toBe(ResumeAction.Stop)