@owlmeans/client-auth 0.1.18-rc.2 → 0.1.18-rc.21

package/README.md

@@ -6,13 +6,13 @@ Client-side authentication service providing user auth state and external auth f
 
 - `useSelfAuth()` — React hook that returns the current authenticated user's `Auth` object
 - `setupExternalAuthentication()` — configure the client to authenticate against an external identity provider
-- `modules` — pre-built client modules for the auth flow (login, dispatcher)
+- `entrypoints` — pre-built client entrypoints for the auth flow (login, dispatcher)
 - `DEFAULT_ALIAS` — the auth service alias (`'auth'`)
 
 ## Installation
 
 ```bash
-bun add @owlmeans/client-auth
+bun add @owlmeans/client-auth@^0.1.18-rc.19
 ```
 
 ## Usage
@@ -47,9 +47,9 @@ Returns the current `Auth` object from the context, or `null` if not authenticat
 
 Configures the context to redirect to an external identity provider for authentication.
 
-### `modules`
+### `entrypoints`
 
-Pre-built `ClientModule[]` for the auth flow (mirrors `@owlmeans/auth-common`'s modules with client route models).
+Pre-built `ClientEntrypoint[]` for the auth flow (mirrors `@owlmeans/auth-common`'s entrypoints with client route models).
 
 ### `DEFAULT_ALIAS`
 
@@ -65,7 +65,7 @@ Auth service alias: `'auth'`.
 ## Related Packages
 
 - [`@owlmeans/auth`](../auth) — `Auth` type returned by `useSelfAuth`
-- [`@owlmeans/auth-common`](../auth-common) — auth module route definitions
+- [`@owlmeans/auth-common`](../auth-common) — auth entrypoint route definitions
 - [`@owlmeans/server-auth`](../server-auth) — server-side counterpart
 
 <!-- owlmeans:agent-guidance:start -->
@@ -76,7 +76,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.13
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.498Z",
+  "version": "0.1.18-rc.21",
+  "generatedAt": "2026-09-10T18:54:42.486Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-auth/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: client-auth
-description: How to use @owlmeans/client-auth — client-side auth manager and UI components, setupExternalAuthentication() to wire OAuth/OIDC flows. Auto-invoked when importing client-auth helpers or registering external authentication.
+description: How to use @owlmeans/client-auth — the browser side of OwlMeans authentication. Root exports the auth service, the shared client entrypoints and the dispatcher HOC; ./manager holds the authentication screen, its control and the plugin registry; ./manager/plugins holds the authentication-plugin contract a plugin package writes against; ./login holds the login-plugin host, the sign-in method registry, the terms confirmation and the useLogin/useLogout hooks. Auto-invoked when importing client-auth helpers, registering an authentication plugin, or wiring a sign-in control.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,41 +8,154 @@ user-invocable: false
 # @owlmeans/client-auth
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.21"` in `dependencies`
 
-## Key Exports
+Five subpaths, five jobs:
+
+| Subpath | Job |
+|---------|-----|
+| `.` | The client `AuthService`, the shared auth entrypoints, and the dispatcher HOC |
+| `./manager` | The registry's four names plus the authentication screen, control and error — *how* a user proves identity. Importing it registers the three shipped browser plugins and `pluginMethodSource` by side effect |
+| `./manager/entrypoints` | The manager application's own front-end entrypoint elevations |
+| `./manager/plugins` | The plugin-authoring surface, and a superset of the registry: the `AuthenticationPlugin` contract, `pluginMethodSource`, the wallet-tunnel helpers and the shipped plugin objects — with no registration side effect |
+| `./login` | The **login**-plugin host — *where* the authorization round trip runs, and which method a person picks |
+
+A plugin package imports from both, and the split is fixed: `AuthenticationPlugin`,
+`AuthMethodMeta`, `pluginMethodSource`, `PinSchema`, `createWalletFacade`,
+`TunnelAuthenticationRenderer` and the shipped plugin objects resolve **only** through
+`./manager/plugins`; the registry (`plugins`, `registerAuthPlugin`, …) and the rendering types
+(`AuthenticationRenderer`, `AuthenticationControl`, `ClientAuthType`, `AuthenticationHOC`) resolve
+through `./manager`. Importing the contract from `./manager` gets an unresolvable name.
+
+`./manager/plugins` and `./login` answer different questions and are separate registries. Do not
+conflate them.
+
+## Key Exports — root
+
+| Export | Description |
+|--------|-------------|
+| `makeAuthService(alias?)` | The client `AuthService` — `authenticate(token)`, `update(token)`, `authenticated()`, `user()`, `store()`. Decodes the bearer envelope and persists the record |
+| `appendAuthService(ctx, alias?)` | Register it, register `authMiddleware`, and expose `context.auth()` |
+| `setupExternalAuthentication(service)` | Point the `CAUTHEN_FLOW_ENTER` entrypoint at a service, so an external provider can redirect into this app |
+| `entrypoints` | The shared auth entrypoint list with `DISPATCHER_AUTHEN` elevated |
+| `DEFAULT_ALIAS` | `'auth'` — the client-side counterpart of `DEFAULT_GUARD` |
+| `AUTH_RESOURCE` | `'auth'` — the resource the token record is stored in |
+| `USER_ID` | `'user'` — the id of that single record |
+| `DEFAULT_ENTITY` | `'owlmeans'` |
+| `DispatcherHOC` | The return-leg HOC. It wraps a `DispatcherRenderer`, hands it `provideToken(token, query)` and `navigate()`, adopts the supplied token through the auth service, and strips `AUTH_QUERY` before navigating on. Reading the return-leg query is the renderer's job — `@owlmeans/web-client` reads `AUTH_QUERY`, `@owlmeans/web-oidc-rp` also reads `OIDC_ERROR_QUERY` and forwards the remaining params |
+| `DispatcherProps`, `TDispatcherHOC`, `DispatcherRenderer`, `DispatcherRendererProps` | Dispatcher types |
+| `useWs(entrypoint, request?)` | A socket hook that attaches the current token as the `AUTH_QUERY` param |
+| `useSelfAuth(force?)` | Whether this context is authenticated; navigates to `DISPATCHER` when it is not and `force` |
+| `AuthServiceAppend`, `ClientAuthRecord`, `ClientAuthResource` | Types |
+
+## `./manager` — the authentication screen and the registry
+
+| Export | Description |
+|--------|-------------|
+| `plugins`, `registerAuthPlugin`, `getAuthPlugin`, `listAuthPlugins` | The module-global registry |
+| `AuthenticationHOC`, `AuthenticationProps`, `TAuthenticationHOC` | The screen that hosts a plugin's implementation |
+| `makeControl`, `AuthenticationControl`, `AuthenticationControlState` | The control a plugin drives: `requestAllowence`, `authenticate`, and the state it persists across a provider redirect |
+| `AuthenticationRenderer`, `AuthenticationRendererProps`, `ClientAuthType`, `ClientAuthenticationMethod`, `AuthenticationCallback` | Rendering contract |
+| `TunnelConsumer`, `TunnelAuthenticationProps`, `TunnelAuthCallback` | The wallet-tunnel consumer screen |
+| `AuthenCredError` | Thrown when the entered credential cannot be used |
+
+## `./manager/plugins` — the authentication-plugin contract
 
 | Export | Description |
 |--------|-------------|
-| `setupExternalAuthentication(alias)` | Register OAuth/OIDC external auth flow module |
-| Auth components | Login UI primitives |
-| Auth service | Client-side auth manager service |
-| Modules | Auth module declarations |
-| Constants | Auth aliases (re-exports `AUTH_API`) |
+| `AuthenticationPlugin` | `type`, `Implementation`, optional `Renderer`, `requiresRenderer?`, `method?` and the `authenticate` / `beforeAuthenticate` / `afterAuthenticate` hooks |
+| `PluginImplemnetation` (sic) | `(Renderer?) => FC<AuthenticationRendererProps>` — the shape of `Implementation` |
+| `AuthMethodMeta` | How the plugin presents itself as a sign-in method — see `login-methods` |
+| `plugins`, `registerAuthPlugin`, `getAuthPlugin`, `listAuthPlugins` | The same registry as `./manager` |
+| `pluginMethodSource` | The `LoginMethodSource` that turns registered plugins into offerable methods |
+| `createWalletFacade`, `PinSchema`, `PinForm`, `TunnelAuthenticationRenderer`, `TunnelAuthenticationRendererProps` | Wallet-tunnel helpers a consumer plugin builds on |
+| `ed25519BasicUIPlugin`, `reCaptchaPlugin`, `tunnelConsumerUIPlugin` | The shipped plugin objects |
 
-## Subpath Exports
+Shipped plugins register themselves by side effect: `basic-ed25519`, `re-captcha` and
+`wallet-consumer` when `@owlmeans/client-auth/manager` is imported, OIDC and Google from
+`@owlmeans/web-oidc-rp/auth/plugins`, the PK supervisor from `@owlmeans/web-auth`.
 
-- `./manager` — client-side auth manager
-- `./manager/modules` — manager module declarations
-- `./manager/plugins` — pluggable token providers
+## `./login` — the login-plugin host
+
+An `AuthenticationPlugin` answers how a credential is proven; a `LoginPlugin` answers in which
+browsing context the round trip can complete at all.
+
+| Export | Description |
+|--------|-------------|
+| `appendLogin(ctx)` | Register the host and expose it as `context.login()` |
+| `makeLoginService(alias?)`, `ensureLoginService(ctx)` | The host itself — a **lazy** service, so `makeContext` can reach it at the Loading stage — and the idempotent getter a plugin package calls before `registerPlugin` |
+| `LoginPlugin`, `LoginEnv`, `LoginRequest`, `LogoutRequest`, `LoginOutcome`, `LoginIntent`, `LoginService`, `LoginContext`, `LoginPrecondition` | The contract |
+| `registerMethodSource`, `listMethodSources`, `resolveLoginMethods`, `primaryLoginMethod` | Which sign-in methods are offered — see `login-methods` |
+| `LoginMethod`, `LoginMethodSource`, `LoginMethodContext` | Method types |
+| `resolveTerms`, `termsAccepted`, `acceptTerms`, `ResolvedTerms` | The confirmation, recorded in `localStorage` against a version derived from the resolved URLs |
+| `resolveCredit`, `ResolvedCredit` | The credit and copyright line |
+| `FallbackLoginScreen`, `LoginScreenProps`, `LoginScreenComponent` | The plain sign-in screen a relying party renders when no UI family registered one |
+| `surrogatePath(ctx, target)`, `SurrogateTarget` | Where a surrogate login window opens; `null` on an older entrypoint list |
+| `resumeAction(outcome)`, `ResumeAction`, `loginAttemptError(outcome)` | The one reading of a `resume` outcome, and the one reading of a finished attempt |
+| `enterOidcAuthorization(model)` | Move a flow to the step that can authorize — idempotent, call it before every `authenticate` |
+| `adoptToken(ctx, token)`, `revokeToken(ctx)` | The single adoption and de-adoption paths |
+| `useLogin(target?)`, `useLogout(target?)` | Wiring for a sign-in / sign-out control; `target` is the entrypoint alias the flow lands on when it is over |
+| `isEmbedded`, `isSurrogate`, `markSurrogate`, `clearSurrogate`, `defaultLoginEnv` | Environment probes the host builds `LoginEnv` from |
+| `LOGIN_SERVICE`, `LOGIN_SURROGATE_NAME`, `LOGIN_TOKEN_MESSAGE`, `LOGIN_LOGOUT_MESSAGE`, `LOGIN_SURROGATE_MARKER`, `LOGIN_SURROGATE_FEATURES`, `LOGIN_WATCH_INTERVAL`, `LOGIN_INTENT_QUERY`, `LOGIN_NEXT_QUERY`, `LOGIN_METHOD_QUERY`, `LOGIN_TERMS_STORAGE`, `DEFAULT_LOGIN_PRIORITY`, `DEFAULT_METHOD_ORDER` | Aliases and the fixed cross-document wire values |
+
+```typescript
+import { useLogin, useLogout } from '@owlmeans/client-auth/login'
+
+const [loginPath, onLogIn] = useLogin()
+const onLogOut = useLogout()
+```
+
+Both handlers are deliberately **not** async and await nothing before delegating — a window opened
+after the user gesture has finished being handled is eaten by the popup blocker. Each resolves its
+entrypoint **inside** the hook, never at module scope — `DISPATCHER` for `useLogin`, the surrogate
+path for `useLogout`. A module body runs before `registerEntrypoints`, so `useLogin`'s lookup at
+top level throws `Entrypoint dispatcher not found` during import, taking the whole render down.
+
+`target` is an entrypoint alias, and it is what supplies the request's `navigate` continuation —
+the in-app step the plugin runs once the round trip is done. `useLogin` always sends one, falling
+back to `DISPATCHER`; `useLogout` sends one only when a target is given. Omitting it does not leave
+the session behind: the token is revoked either way, and the plugin decides what the document does
+with no continuation to run — `@owlmeans/web-client`'s redirect plugin reloads the page, because
+cached auth reads only forget a session when the application is rebuilt. `useLogin` returns
+`[path, handler]` and `useLogout` a bare handler — a logout control has no address to point at.
+
+Plugin selection, the shipped browser flows and the full invariant list: the `login-plugins` skill.
 
 ## Usage
 
 ```typescript
-import { setupExternalAuthentication } from '@owlmeans/client-auth'
+import { appendAuthService, setupExternalAuthentication, DEFAULT_ALIAS } from '@owlmeans/client-auth'
+import { appendLogin } from '@owlmeans/client-auth/login'
 
-setupExternalAuthentication(AUTH_WEB) // alias of the web auth service
+// in makeContext:
+appendAuthService(context)             // registers under DEFAULT_ALIAS ('auth')
+appendLogin(context)
+setupExternalAuthentication(MY_WEB_SERVICE)   // the service alias the provider redirects into
 ```
 
-## Product-Viable Usage Notes
+`@owlmeans/web-client`'s own `makeContext` already appends the auth service and the login host, so
+a web application only calls these when it builds its context by hand.
+
+## Rules
 
-- The manager web app imports `DEFAULT_ALIAS` from `@owlmeans/client-auth` as the client-side equivalent of `DEFAULT_GUARD`.
-- It imports `@owlmeans/web-oidc-rp/auth/plugins` for side effects; that registers OIDC and Google authentication plugins in the client auth manager.
-- During Google/OIDC redirects, plugins persist the client auth control state, restore it on return, then submit `AuthCredentials` to the server auth flow.
-- The browser receives and stores a normal OwlMeans bearer token. Product authorization remains server-side through module gates and handler checks, not through client-only state.
+- The bearer token lives in the `AUTH_RESOURCE` resource under the single id `USER_ID`. Read and
+  write it through the auth service or through `adoptToken` / `revokeToken`; hand-written storage
+  access drifts from the envelope decoding that happens beside it.
+- A plugin that persists state across a provider redirect drives the control's own
+  `persist()` / `restore()` / `hasPersistentState()` / `cleanUpState()`. They keep the type, stage
+  and allowance in the `FLOW_STATE` resource under an id this package owns and does not export —
+  restore before submitting the credential, and clean up after.
+- The browser ends up holding an ordinary OwlMeans bearer token whichever provider issued the
+  login. Product authorization stays server-side, in entrypoint gates and handler checks — never in
+  client-only state.
+- The organization entity a token names is its `entitySlug`, the renameable public name. Read it
+  with `entitySlugOf` from `@owlmeans/auth`; the stable `entityId` never reaches the browser.
 
 ## Depends On
 
-- `@owlmeans/auth`, `@owlmeans/auth-common`
-- `@owlmeans/client-context`, `@owlmeans/client-entrypoint`
+- `@owlmeans/auth`, `@owlmeans/auth-common` — types, aliases, `authMiddleware`
+- `@owlmeans/client`, `@owlmeans/client-context`, `@owlmeans/client-entrypoint`, `@owlmeans/client-socket`
+- `@owlmeans/config` — the login screen, terms and credit configuration
+- `@owlmeans/basic-envelope` — decoding the bearer envelope
 - `react` (peer)
+- `ajv` (peer) — `PinSchema` is typed as `JSONSchemaType<PinForm>`

package/build/components/dispatcher/component.js

@@ -12,7 +12,7 @@ export const DispatcherHOC = Renderer => ({ context, params, alias, query, paylo
     const navigator = useNavigate();
     const navigate = useCallback(async () => {
         alias = alias == null || alias === DISPATCHER ? HOME : alias;
-        const module = context.module(alias);
+        const module = context.entrypoint(alias);
         if (alias === HOME) {
             params = {};
             query = {};

package/build/components/dispatcher/component.js.map

@@ -1 +1 @@
-{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../src/components/dispatcher/component.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGxD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAG9C,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,MAAM,CAAC,MAAM,aAAa,GAAmB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;IACtG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,EAA0B,CAAA;IAEtE,MAAM,SAAS,GAAG,WAAW,EAAE,CAAA;IAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACtC,KAAK,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAA2B,KAAK,CAAC,CAAA;QAC9D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,GAAG,EAAE,CAAA;YACX,KAAK,GAAG,EAAE,CAAA;QACZ,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAA;YAC1C,IAAI,KAAK,IAAI,IAAI,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC,UAAU,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACrD,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAEhB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YAC9B,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;gBACvD,mGAAmG;gBACnG,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAC3B,kDAAkD;oBAClD,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;wBAChC,0EAA0E;wBAC1E,2EAA2E;wBAC3E,qEAAqE;wBACrE,mFAAmF;wBACnF,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;4BAClC,OAAM;wBACR,CAAC;oBACH,CAAC;oBACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAA;oBACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;oBACtE,MAAM,MAAM,GAAG,CACb,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CACnD,CAAA;oBACvB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACnB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBACpB,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;4BACpB,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;wBAC9B,CAAC;oBACH,CAAC;yBAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;wBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAA;wBACnC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBACpB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAA;wBACrC,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;4BACnB,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;wBAC9B,CAAC;wBACD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;4BAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;wBAC7C,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;gBACtB,CAAC,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,aAAa,CAAC,CAAA;gBACxD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAClD,OAAO,MAAM,QAAQ,EAAE,CAAA;gBACzB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;oBACpB,oCAAoC;oBACpC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAClB,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;IAEvB,MAAM,YAAY,GAAG,WAAW,CAA0C,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzF,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACjC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,KAAC,QAAQ,IAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAA;AACrE,CAAC,CAAA"}
+{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../src/components/dispatcher/component.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGxD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAG9C,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,MAAM,CAAC,MAAM,aAAa,GAAmB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;IACtG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,EAA0B,CAAA;IAEtE,MAAM,SAAS,GAAG,WAAW,EAAE,CAAA;IAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACtC,KAAK,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAA2B,KAAK,CAAC,CAAA;QAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,GAAG,EAAE,CAAA;YACX,KAAK,GAAG,EAAE,CAAA;QACZ,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAA;YAC1C,IAAI,KAAK,IAAI,IAAI,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC,UAAU,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACrD,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAEhB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YAC9B,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;gBACvD,mGAAmG;gBACnG,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAC3B,kDAAkD;oBAClD,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;wBAChC,0EAA0E;wBAC1E,2EAA2E;wBAC3E,qEAAqE;wBACrE,mFAAmF;wBACnF,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;4BAClC,OAAM;wBACR,CAAC;oBACH,CAAC;oBACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAA;oBACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;oBACtE,MAAM,MAAM,GAAG,CACb,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CACnD,CAAA;oBACvB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACnB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBACpB,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;4BACpB,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;wBAC9B,CAAC;oBACH,CAAC;yBAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;wBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAA;wBACnC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBACpB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAA;wBACrC,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;4BACnB,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;wBAC9B,CAAC;wBACD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;4BAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;wBAC7C,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;gBACtB,CAAC,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,aAAa,CAAC,CAAA;gBACxD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAClD,OAAO,MAAM,QAAQ,EAAE,CAAA;gBACzB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;oBACpB,oCAAoC;oBACpC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAClB,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;IAEvB,MAAM,YAAY,GAAG,WAAW,CAA0C,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzF,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACjC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,KAAC,QAAQ,IAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAA;AACrE,CAAC,CAAA"}

package/build/{modules.d.ts → entrypoints.d.ts}

@@ -1,4 +1,4 @@
 import type { ClientEntrypoint } from '@owlmeans/client-entrypoint';
-export declare const modules: ClientEntrypoint[];
+export declare const entrypoints: ClientEntrypoint[];
 export declare const setupExternalAuthentication: (service: string) => void;
-//# sourceMappingURL=modules.d.ts.map
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAInE,eAAO,MAAM,WAAW,EAAE,gBAAgB,EAA+B,CAAA;AAEzE,eAAO,MAAM,2BAA2B,YAAa,MAAM,SAE1D,CAAA"}

package/build/{modules.js → entrypoints.js}

@@ -1,9 +1,9 @@
 import { elevate, stab } from '@owlmeans/client-entrypoint';
-import { modules as list } from '@owlmeans/auth-common';
+import { entrypoints as list } from '@owlmeans/auth-common';
 import { CAUTHEN_FLOW_ENTER, DISPATCHER_AUTHEN } from '@owlmeans/auth';
 elevate(list, DISPATCHER_AUTHEN);
-export const modules = list;
+export const entrypoints = list;
 export const setupExternalAuthentication = (service) => {
     elevate(list, CAUTHEN_FLOW_ENTER, stab, { routeOptions: { overrides: { service } } });
 };
-//# sourceMappingURL=modules.js.map
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGtE,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;AAEhC,MAAM,CAAC,MAAM,WAAW,GAAuB,IAA0B,CAAA;AAEzE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAe,EAAE,EAAE;IAC7D,OAAO,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;AACvF,CAAC,CAAA"}

package/build/helper.js

@@ -11,7 +11,7 @@ export const useWs = (module, _request) => {
     const mod = useMemo(() => typeof module === 'string' ? ctx.entrypoint(module) : module, [module]);
     const request = useMemo(() => {
         if (_request == null) {
-            _request = provideRequest(mod.getAlias(), mod.getPath());
+            _request = provideRequest(mod.alias, mod.path());
         }
         try {
             if (_request?.query?.[AUTH_QUERY] == null) {

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAChF,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAY,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAChF,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAY,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}

package/build/index.d.ts

@@ -2,6 +2,6 @@ export * from './components/index.js';
 export type * from './types.js';
 export * from './service.js';
 export * from './consts.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './helper.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAA;AACrC,mBAAmB,YAAY,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAA;AACrC,mBAAmB,YAAY,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA"}

package/build/index.js

@@ -1,6 +1,6 @@
 export * from './components/index.js';
 export * from './service.js';
 export * from './consts.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './helper.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAA;AAErC,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAA;AAErC,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA"}

package/build/login/adopt.d.ts

@@ -0,0 +1,24 @@
+import type { LoginContext } from './types.js';
+/**
+ * The one path an issued bearer token becomes this context's authentication.
+ *
+ * Resolved by alias rather than through `ctx.auth()` so the login host does not require
+ * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
+ * carries the auth service, including one it did not build.
+ *
+ * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
+ * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
+ * the MUI relying party each used to do — leaves the same state on a good day and diverges the
+ * moment any of it changes.
+ */
+export declare const adoptToken: (ctx: LoginContext, token: string) => Promise<void>;
+/**
+ * The one path this context's authentication is dropped, and the exact mirror of {@link adoptToken}.
+ *
+ * `undefined`, not `null`: `undefined` is the declared clearing value, and on the web the auth
+ * service reacts to it by navigating to the dispatcher. Everything that signs a user out goes
+ * through here — the hook, both browser plugins and the surrogate screen — so there is one place
+ * where "signed out" is defined rather than four that agree until one of them changes.
+ */
+export declare const revokeToken: (ctx: LoginContext) => Promise<void>;
+//# sourceMappingURL=adopt.d.ts.map

package/build/login/adopt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,QAAe,YAAY,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAE/E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,QAAe,YAAY,KAAG,OAAO,CAAC,IAAI,CAEjE,CAAA"}

package/build/login/adopt.js

@@ -0,0 +1,28 @@
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js';
+/**
+ * The one path an issued bearer token becomes this context's authentication.
+ *
+ * Resolved by alias rather than through `ctx.auth()` so the login host does not require
+ * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
+ * carries the auth service, including one it did not build.
+ *
+ * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
+ * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
+ * the MUI relying party each used to do — leaves the same state on a good day and diverges the
+ * moment any of it changes.
+ */
+export const adoptToken = async (ctx, token) => {
+    await ctx.service(AUTH_ALIAS).update(token);
+};
+/**
+ * The one path this context's authentication is dropped, and the exact mirror of {@link adoptToken}.
+ *
+ * `undefined`, not `null`: `undefined` is the declared clearing value, and on the web the auth
+ * service reacts to it by navigating to the dispatcher. Everything that signs a user out goes
+ * through here — the hook, both browser plugins and the surrogate screen — so there is one place
+ * where "signed out" is defined rather than four that agree until one of them changes.
+ */
+export const revokeToken = async (ctx) => {
+    await ctx.service(AUTH_ALIAS).update(undefined);
+};
+//# sourceMappingURL=adopt.js.map

package/build/login/adopt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AAG1D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAiB,EAAE,KAAa,EAAiB,EAAE;IAClF,MAAM,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1D,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAiB,EAAiB,EAAE;IACpE,MAAM,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAC9D,CAAC,CAAA"}

package/build/login/consts.d.ts

@@ -0,0 +1,57 @@
+export declare const DEFAULT_ALIAS = "login-service";
+export declare const LOGIN_SERVICE = "login-service";
+/** Priority of a plugin that makes no claim about the environment. */
+export declare const DEFAULT_LOGIN_PRIORITY = 0;
+/** Order given to a method that declares none. */
+export declare const DEFAULT_METHOD_ORDER = 100;
+/**
+ * Name given to the surrogate login window, the marker it records about itself, and the values the
+ * two documents exchange.
+ *
+ * These are a wire protocol between two documents that may be running different builds — an opener
+ * holding an older bundle and a surrogate freshly loaded, or the reverse. They are therefore fixed,
+ * and must never be "tidied" to match a newer vocabulary. That applies to the query names and the
+ * message types added later just as much as to the original three.
+ */
+export declare const LOGIN_SURROGATE_NAME = "owlmeans-oidc-login";
+export declare const LOGIN_TOKEN_MESSAGE = "owlmeans:oidc:popup-token";
+export declare const LOGIN_LOGOUT_MESSAGE = "owlmeans:oidc:popup-logout";
+export declare const LOGIN_SURROGATE_MARKER = "_owlmeans-oidc-popup";
+export declare const LOGIN_SURROGATE_FEATURES = "popup=yes,width=520,height=760";
+/** How often a surrogate window is checked for having been closed by the user. */
+export declare const LOGIN_WATCH_INTERVAL = 500;
+/** Carries WHY the surrogate window was opened across the window boundary. */
+export declare const LOGIN_INTENT_QUERY = "intent";
+/**
+ * Carries the address the surrogate should run, so the flow parameters the opener's URL held are
+ * forwarded rather than discarded.
+ */
+export declare const LOGIN_NEXT_QUERY = "next";
+/**
+ * Carries the method the user already chose, one window up.
+ *
+ * A surrogate acting on it is not an auto-redirect in the "never choose for the user" sense: the
+ * choice was made, by a person, in the document that opened this one.
+ */
+export declare const LOGIN_METHOD_QUERY = "method";
+/**
+ * Says that this window was opened to PRODUCE a session, not to find one.
+ *
+ * A surrogate window runs on the application's own origin, so it can see a session the application
+ * left there earlier — and a session that is merely present is not a session that still works. The
+ * document holding it has no way to tell: `authenticated()` reads storage and decodes an envelope,
+ * and nothing in the client asks the server whether the record behind it is still there. So a
+ * revoked, replaced or expired token was handed straight back to the window that asked for a
+ * login, which adopted it, failed every call it made with it, and asked again — the same dead
+ * token, every time, for as long as the browser kept it. Clearing site data was the only exit,
+ * which is exactly how the defect was reported.
+ *
+ * With this set, the surrogate and the dispatcher both skip the resume and run the authorization
+ * flow. That is not the expensive path it sounds like: the provider's own session normally answers
+ * the request without asking the person anything, and what comes back is a token the provider has
+ * just vouched for. It is also what makes signing in as somebody else possible at all.
+ */
+export declare const LOGIN_FRESH_QUERY = "fresh";
+/** Where a browser records that it agreed to one exact set of legal documents. */
+export declare const LOGIN_TERMS_STORAGE = "_owlmeans-login-terms";
+//# sourceMappingURL=consts.d.ts.map

package/build/login/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,eAAO,MAAM,aAAa,kBAAgB,CAAA;AAE1C,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,eAAO,MAAM,oBAAoB,+BAA+B,CAAA;AAEhE,eAAO,MAAM,sBAAsB,yBAAyB,CAAA;AAE5D,eAAO,MAAM,wBAAwB,mCAAmC,CAAA;AAExE,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAA;AAExC,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA"}

package/build/login/consts.js

@@ -0,0 +1,57 @@
+export const DEFAULT_ALIAS = 'login-service';
+export const LOGIN_SERVICE = DEFAULT_ALIAS;
+/** Priority of a plugin that makes no claim about the environment. */
+export const DEFAULT_LOGIN_PRIORITY = 0;
+/** Order given to a method that declares none. */
+export const DEFAULT_METHOD_ORDER = 100;
+/**
+ * Name given to the surrogate login window, the marker it records about itself, and the values the
+ * two documents exchange.
+ *
+ * These are a wire protocol between two documents that may be running different builds — an opener
+ * holding an older bundle and a surrogate freshly loaded, or the reverse. They are therefore fixed,
+ * and must never be "tidied" to match a newer vocabulary. That applies to the query names and the
+ * message types added later just as much as to the original three.
+ */
+export const LOGIN_SURROGATE_NAME = 'owlmeans-oidc-login';
+export const LOGIN_TOKEN_MESSAGE = 'owlmeans:oidc:popup-token';
+export const LOGIN_LOGOUT_MESSAGE = 'owlmeans:oidc:popup-logout';
+export const LOGIN_SURROGATE_MARKER = '_owlmeans-oidc-popup';
+export const LOGIN_SURROGATE_FEATURES = 'popup=yes,width=520,height=760';
+/** How often a surrogate window is checked for having been closed by the user. */
+export const LOGIN_WATCH_INTERVAL = 500;
+/** Carries WHY the surrogate window was opened across the window boundary. */
+export const LOGIN_INTENT_QUERY = 'intent';
+/**
+ * Carries the address the surrogate should run, so the flow parameters the opener's URL held are
+ * forwarded rather than discarded.
+ */
+export const LOGIN_NEXT_QUERY = 'next';
+/**
+ * Carries the method the user already chose, one window up.
+ *
+ * A surrogate acting on it is not an auto-redirect in the "never choose for the user" sense: the
+ * choice was made, by a person, in the document that opened this one.
+ */
+export const LOGIN_METHOD_QUERY = 'method';
+/**
+ * Says that this window was opened to PRODUCE a session, not to find one.
+ *
+ * A surrogate window runs on the application's own origin, so it can see a session the application
+ * left there earlier — and a session that is merely present is not a session that still works. The
+ * document holding it has no way to tell: `authenticated()` reads storage and decodes an envelope,
+ * and nothing in the client asks the server whether the record behind it is still there. So a
+ * revoked, replaced or expired token was handed straight back to the window that asked for a
+ * login, which adopted it, failed every call it made with it, and asked again — the same dead
+ * token, every time, for as long as the browser kept it. Clearing site data was the only exit,
+ * which is exactly how the defect was reported.
+ *
+ * With this set, the surrogate and the dispatcher both skip the resume and run the authorization
+ * flow. That is not the expensive path it sounds like: the provider's own session normally answers
+ * the request without asking the person anything, and what comes back is a token the provider has
+ * just vouched for. It is also what makes signing in as somebody else possible at all.
+ */
+export const LOGIN_FRESH_QUERY = 'fresh';
+/** Where a browser records that it agreed to one exact set of legal documents. */
+export const LOGIN_TERMS_STORAGE = '_owlmeans-login-terms';
+//# sourceMappingURL=consts.js.map

package/build/login/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAA;AAExE,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAA;AAExC,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA"}

package/build/login/credit.d.ts

@@ -0,0 +1,24 @@
+import type { BrandSettings, LoginCreditConfig } from '@owlmeans/config';
+export interface ResolvedCredit {
+    /** Whether "Powered by OwlMeans" is rendered. */
+    poweredBy: boolean;
+    /** The product and organization line, already composed. Null when there is nothing to say. */
+    line: string | null;
+}
+/**
+ * What the bottom of the sign-in screen says.
+ *
+ * It is a copyright notice, so it is composed as one: `© <year> <holder>`. That is the whole
+ * reason `copyright` defaults to on — the name on its own reads as a caption, and an application
+ * that means to assert a copyright would have had to write the mark and the year into a literal
+ * `line` to get one.
+ *
+ * The organization falls back to its slug because an organization record carries no readable name
+ * — so "no name" is the ordinary case, not an error, and a screen that rendered an empty line for
+ * it would be worse than one that renders the slug.
+ *
+ * `line` replaces everything when an app supplies it: a product with its own legal wording should
+ * not have to defeat a composition rule to use it.
+ */
+export declare const resolveCredit: (cfg?: LoginCreditConfig, brand?: BrandSettings, service?: string) => ResolvedCredit;
+//# sourceMappingURL=credit.d.ts.map

package/build/login/credit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit.d.ts","sourceRoot":"","sources":["../../src/login/credit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAExE,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,SAAS,EAAE,OAAO,CAAA;IAClB,8FAA8F;IAC9F,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAuBD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,SAClB,iBAAiB,UAAU,aAAa,YAAY,MAAM,KAC/D,cA2BF,CAAA"}