@owlmeans/client-auth 0.1.18-rc.21 → 0.1.18-rc.23

package/README.md

@@ -6,7 +6,7 @@ Client-side authentication service providing user auth state and external auth f
 
 - `useSelfAuth()` — React hook that returns the current authenticated user's `Auth` object
 - `setupExternalAuthentication()` — configure the client to authenticate against an external identity provider
-- `entrypoints` — pre-built client entrypoints for the auth flow (login, dispatcher)
+- `entrypoints` — pre-built bindings for the auth protocols (login, dispatcher)
 - `DEFAULT_ALIAS` — the auth service alias (`'auth'`)
 
 ## Installation
@@ -49,7 +49,9 @@ Configures the context to redirect to an external identity provider for authenti
 
 ### `entrypoints`
 
-Pre-built `ClientEntrypoint[]` for the auth flow (mirrors `@owlmeans/auth-common`'s entrypoints with client route models).
+Pre-built protocol bindings for the auth flow (mirrors `@owlmeans/auth-common`'s declarations with
+client route models). New application code should resolve its shared protocol with
+`context.entrypoint(protocol)` rather than supplying a caller-side type.
 
 ### `DEFAULT_ALIAS`
 
@@ -76,7 +78,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.13
+npx @owlmeans/agent-skills@^0.1.18-rc.15
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.21",
-  "generatedAt": "2026-09-10T18:54:42.486Z",
+  "version": "0.1.18-rc.23",
+  "generatedAt": "2026-09-12T08:39:52.713Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-auth
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.21"` in `dependencies`
+**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.23"` in `dependencies`
 
 Five subpaths, five jobs:
 
@@ -16,7 +16,7 @@ Five subpaths, five jobs:
 |---------|-----|
 | `.` | The client `AuthService`, the shared auth entrypoints, and the dispatcher HOC |
 | `./manager` | The registry's four names plus the authentication screen, control and error — *how* a user proves identity. Importing it registers the three shipped browser plugins and `pluginMethodSource` by side effect |
-| `./manager/entrypoints` | The manager application's own front-end entrypoint elevations |
+| `./manager/entrypoints` | The manager application's own front-end entrypoint bindings |
 | `./manager/plugins` | The plugin-authoring surface, and a superset of the registry: the `AuthenticationPlugin` contract, `pluginMethodSource`, the wallet-tunnel helpers and the shipped plugin objects — with no registration side effect |
 | `./login` | The **login**-plugin host — *where* the authorization round trip runs, and which method a person picks |
 
@@ -37,7 +37,7 @@ conflate them.
 | `makeAuthService(alias?)` | The client `AuthService` — `authenticate(token)`, `update(token)`, `authenticated()`, `user()`, `store()`. Decodes the bearer envelope and persists the record |
 | `appendAuthService(ctx, alias?)` | Register it, register `authMiddleware`, and expose `context.auth()` |
 | `setupExternalAuthentication(service)` | Point the `CAUTHEN_FLOW_ENTER` entrypoint at a service, so an external provider can redirect into this app |
-| `entrypoints` | The shared auth entrypoint list with `DISPATCHER_AUTHEN` elevated |
+| `entrypoints` | The shared auth entrypoint list with `DISPATCHER_AUTHEN` bound |
 | `DEFAULT_ALIAS` | `'auth'` — the client-side counterpart of `DEFAULT_GUARD` |
 | `AUTH_RESOURCE` | `'auth'` — the resource the token record is stored in |
 | `USER_ID` | `'user'` — the id of that single record |

package/build/entrypoints.d.ts

@@ -1,4 +1,7 @@
-import type { ClientEntrypoint } from '@owlmeans/client-entrypoint';
-export declare const entrypoints: ClientEntrypoint[];
-export declare const setupExternalAuthentication: (service: string) => void;
+/** Browser entrypoints for the authentication protocols every client may call. */
+export declare const entrypoints: import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/auth").AuthToken;
+}, import("@owlmeans/auth").AuthToken>>[];
+/** Bind the external-authentication screen to one explicitly selected service. */
+export declare const bindExternalAuthentication: (service: string) => import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>>;
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAInE,eAAO,MAAM,WAAW,EAAE,gBAAgB,EAA+B,CAAA;AAEzE,eAAO,MAAM,2BAA2B,YAAa,MAAM,SAE1D,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAIA,kFAAkF;AAClF,eAAO,MAAM,WAAW;;yCAA+C,CAAA;AAEvE,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,YAAa,MAAM,4MAC+B,CAAA"}

package/build/entrypoints.js

@@ -1,9 +1,7 @@
-import { elevate, stab } from '@owlmeans/client-entrypoint';
-import { entrypoints as list } from '@owlmeans/auth-common';
-import { CAUTHEN_FLOW_ENTER, DISPATCHER_AUTHEN } from '@owlmeans/auth';
-elevate(list, DISPATCHER_AUTHEN);
-export const entrypoints = list;
-export const setupExternalAuthentication = (service) => {
-    elevate(list, CAUTHEN_FLOW_ENTER, stab, { routeOptions: { overrides: { service } } });
-};
+import { bind, bindScreen, stab } from '@owlmeans/client-entrypoint';
+import { authProtocols } from '@owlmeans/auth-common';
+/** Browser entrypoints for the authentication protocols every client may call. */
+export const entrypoints = [bind(authProtocols.dispatcherAuthenticate)];
+/** Bind the external-authentication screen to one explicitly selected service. */
+export const bindExternalAuthentication = (service) => bindScreen(authProtocols.flowEnter, stab, { routeOptions: { overrides: { service } } });
 //# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGtE,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;AAEhC,MAAM,CAAC,MAAM,WAAW,GAAuB,IAA0B,CAAA;AAEzE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAe,EAAE,EAAE;IAC7D,OAAO,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;AACvF,CAAC,CAAA"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAEvE,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAe,EAAE,EAAE,CAC5D,UAAU,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA"}

package/build/login/consts.d.ts

@@ -34,24 +34,6 @@ export declare const LOGIN_NEXT_QUERY = "next";
  * choice was made, by a person, in the document that opened this one.
  */
 export declare const LOGIN_METHOD_QUERY = "method";
-/**
- * Says that this window was opened to PRODUCE a session, not to find one.
- *
- * A surrogate window runs on the application's own origin, so it can see a session the application
- * left there earlier — and a session that is merely present is not a session that still works. The
- * document holding it has no way to tell: `authenticated()` reads storage and decodes an envelope,
- * and nothing in the client asks the server whether the record behind it is still there. So a
- * revoked, replaced or expired token was handed straight back to the window that asked for a
- * login, which adopted it, failed every call it made with it, and asked again — the same dead
- * token, every time, for as long as the browser kept it. Clearing site data was the only exit,
- * which is exactly how the defect was reported.
- *
- * With this set, the surrogate and the dispatcher both skip the resume and run the authorization
- * flow. That is not the expensive path it sounds like: the provider's own session normally answers
- * the request without asking the person anything, and what comes back is a token the provider has
- * just vouched for. It is also what makes signing in as somebody else possible at all.
- */
-export declare const LOGIN_FRESH_QUERY = "fresh";
 /** Where a browser records that it agreed to one exact set of legal documents. */
 export declare const LOGIN_TERMS_STORAGE = "_owlmeans-login-terms";
 //# sourceMappingURL=consts.d.ts.map

package/build/login/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,eAAO,MAAM,aAAa,kBAAgB,CAAA;AAE1C,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,eAAO,MAAM,oBAAoB,+BAA+B,CAAA;AAEhE,eAAO,MAAM,sBAAsB,yBAAyB,CAAA;AAE5D,eAAO,MAAM,wBAAwB,mCAAmC,CAAA;AAExE,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAA;AAExC,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,eAAO,MAAM,aAAa,kBAAgB,CAAA;AAE1C,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,eAAO,MAAM,oBAAoB,+BAA+B,CAAA;AAEhE,eAAO,MAAM,sBAAsB,yBAAyB,CAAA;AAE5D,eAAO,MAAM,wBAAwB,mCAAmC,CAAA;AAExE,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA"}

package/build/login/consts.js

@@ -34,24 +34,6 @@ export const LOGIN_NEXT_QUERY = 'next';
  * choice was made, by a person, in the document that opened this one.
  */
 export const LOGIN_METHOD_QUERY = 'method';
-/**
- * Says that this window was opened to PRODUCE a session, not to find one.
- *
- * A surrogate window runs on the application's own origin, so it can see a session the application
- * left there earlier — and a session that is merely present is not a session that still works. The
- * document holding it has no way to tell: `authenticated()` reads storage and decodes an envelope,
- * and nothing in the client asks the server whether the record behind it is still there. So a
- * revoked, replaced or expired token was handed straight back to the window that asked for a
- * login, which adopted it, failed every call it made with it, and asked again — the same dead
- * token, every time, for as long as the browser kept it. Clearing site data was the only exit,
- * which is exactly how the defect was reported.
- *
- * With this set, the surrogate and the dispatcher both skip the resume and run the authorization
- * flow. That is not the expensive path it sounds like: the provider's own session normally answers
- * the request without asking the person anything, and what comes back is a token the provider has
- * just vouched for. It is also what makes signing in as somebody else possible at all.
- */
-export const LOGIN_FRESH_QUERY = 'fresh';
 /** Where a browser records that it agreed to one exact set of legal documents. */
 export const LOGIN_TERMS_STORAGE = '_owlmeans-login-terms';
 //# sourceMappingURL=consts.js.map

package/build/login/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAA;AAExE,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAA;AAExC,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAA;AAExE,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA"}

package/build/manager/entrypoints.d.ts

@@ -1,2 +1,11 @@
-export declare const entrypoints: import("@owlmeans/entrypoint").CommonEntrypoint[];
+/** Browser entrypoints for the manager's authentication flows. */
+export declare const entrypoints: (import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>> | import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/auth").AllowanceRequest;
+}, import("@owlmeans/auth").AllowanceResponse>> | import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/auth").AuthCredentials;
+}, import("@owlmeans/auth").AuthToken>> | import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    query: Partial<import("@owlmeans/auth").AuthToken>;
+}, undefined>> | import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    query: import("@owlmeans/auth").AuthToken;
+}, undefined>>)[];
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/manager/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,mDAAO,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAMA,kEAAkE;AAClE,eAAO,MAAM,WAAW;;;;;;;;iBAUvB,CAAA"}

package/build/manager/entrypoints.js

@@ -1,16 +1,17 @@
-import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER } from '@owlmeans/auth';
-import { entrypoints as list } from '@owlmeans/auth-common';
+import { authProtocols } from '@owlmeans/auth-common';
 import { handler } from '@owlmeans/client';
-import { elevate, stab } from '@owlmeans/client-entrypoint';
+import { bind, bindScreen, stab } from '@owlmeans/client-entrypoint';
 import { AuthenticationHOC } from './components/authentication/component.js';
-elevate(list, AUTHEN);
-elevate(list, AUTHEN_INIT, true);
-elevate(list, AUTHEN_AUTHEN, true);
-elevate(list, AUTHEN_RELY);
-elevate(list, CAUTHEN);
-elevate(list, CAUTHEN_AUTHEN);
-elevate(list, CAUTHEN_AUTHEN_DEFAULT, handler(AuthenticationHOC()));
-elevate(list, CAUTHEN_AUTHEN_TYPED, handler(AuthenticationHOC()));
-elevate(list, DISPATCHER, stab);
-export const entrypoints = list;
+/** Browser entrypoints for the manager's authentication flows. */
+export const entrypoints = [
+    bind(authProtocols.authen),
+    bind(authProtocols.init),
+    bind(authProtocols.authenticate),
+    bind(authProtocols.rely),
+    bind(authProtocols.client),
+    bind(authProtocols.login),
+    bindScreen(authProtocols.loginDefault, handler(AuthenticationHOC())),
+    bindScreen(authProtocols.loginTyped, handler(AuthenticationHOC())),
+    bindScreen(authProtocols.dispatcher, stab),
+];
 //# sourceMappingURL=entrypoints.js.map

package/build/manager/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACnK,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAE5E,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACrB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;AAChC,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;AAClC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC1B,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AACtB,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;AAC7B,OAAO,CAAC,IAAI,EAAE,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAA;AACnE,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAA;AACjE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;AAE/B,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAA"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAE5E,kEAAkE;AAClE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;IAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;IACzB,UAAU,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACpE,UAAU,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAClE,UAAU,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3C,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.21",
+  "version": "0.1.18-rc.23",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -50,26 +50,26 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.10",
-    "@owlmeans/auth-common": "^0.1.18-rc.14",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.13",
-    "@owlmeans/basic-keys": "^0.1.18-rc.13",
-    "@owlmeans/client": "^0.1.18-rc.17",
-    "@owlmeans/client-context": "^0.1.18-rc.14",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.14",
-    "@owlmeans/client-flow": "^0.1.18-rc.18",
-    "@owlmeans/client-resource": "^0.1.18-rc.14",
-    "@owlmeans/client-socket": "^0.1.18-rc.15",
-    "@owlmeans/config": "^0.1.18-rc.13",
-    "@owlmeans/context": "^0.1.18-rc.9",
-    "@owlmeans/did": "^0.1.18-rc.13",
-    "@owlmeans/entrypoint": "^0.1.18-rc.12",
-    "@owlmeans/error": "^0.1.18-rc.9",
-    "@owlmeans/flow": "^0.1.18-rc.15",
-    "@owlmeans/i18n": "^0.1.18-rc.9",
-    "@owlmeans/resource": "^0.1.18-rc.10",
-    "@owlmeans/socket": "^0.1.18-rc.10",
-    "@owlmeans/web-flow": "^0.1.18-rc.18",
+    "@owlmeans/auth": "^0.1.18-rc.12",
+    "@owlmeans/auth-common": "^0.1.18-rc.16",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.15",
+    "@owlmeans/basic-keys": "^0.1.18-rc.15",
+    "@owlmeans/client": "^0.1.18-rc.19",
+    "@owlmeans/client-context": "^0.1.18-rc.16",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.16",
+    "@owlmeans/client-flow": "^0.1.18-rc.20",
+    "@owlmeans/client-resource": "^0.1.18-rc.16",
+    "@owlmeans/client-socket": "^0.1.18-rc.17",
+    "@owlmeans/config": "^0.1.18-rc.15",
+    "@owlmeans/context": "^0.1.18-rc.11",
+    "@owlmeans/did": "^0.1.18-rc.15",
+    "@owlmeans/entrypoint": "^0.1.18-rc.14",
+    "@owlmeans/error": "^0.1.18-rc.11",
+    "@owlmeans/flow": "^0.1.18-rc.17",
+    "@owlmeans/i18n": "^0.1.18-rc.11",
+    "@owlmeans/resource": "^0.1.18-rc.12",
+    "@owlmeans/socket": "^0.1.18-rc.12",
+    "@owlmeans/web-flow": "^0.1.18-rc.20",
     "@scure/base": "^2.3.0"
   },
   "peerDependencies": {
@@ -78,7 +78,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.14",
+    "@owlmeans/test-auth": "^0.1.18-rc.16",
     "@types/bun": "^1.4.0",
     "@types/react": "^19.2.17",
     "nodemon": "^3.1.14",

package/src/entrypoints.ts

@@ -1,13 +1,10 @@
 
-import { elevate, stab } from '@owlmeans/client-entrypoint'
-import { entrypoints as list } from '@owlmeans/auth-common'
-import { CAUTHEN_FLOW_ENTER, DISPATCHER_AUTHEN } from '@owlmeans/auth'
-import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
+import { bind, bindScreen, stab } from '@owlmeans/client-entrypoint'
+import { authProtocols } from '@owlmeans/auth-common'
 
-elevate(list, DISPATCHER_AUTHEN)
+/** Browser entrypoints for the authentication protocols every client may call. */
+export const entrypoints = [bind(authProtocols.dispatcherAuthenticate)]
 
-export const entrypoints: ClientEntrypoint[] = list as ClientEntrypoint[]
-
-export const setupExternalAuthentication = (service: string) => {
-  elevate(list, CAUTHEN_FLOW_ENTER, stab, { routeOptions: { overrides: { service } } })
-}
+/** Bind the external-authentication screen to one explicitly selected service. */
+export const bindExternalAuthentication = (service: string) =>
+  bindScreen(authProtocols.flowEnter, stab, { routeOptions: { overrides: { service } } })

package/src/login/consts.ts

@@ -47,24 +47,5 @@ export const LOGIN_NEXT_QUERY = 'next'
  */
 export const LOGIN_METHOD_QUERY = 'method'
 
-/**
- * Says that this window was opened to PRODUCE a session, not to find one.
- *
- * A surrogate window runs on the application's own origin, so it can see a session the application
- * left there earlier — and a session that is merely present is not a session that still works. The
- * document holding it has no way to tell: `authenticated()` reads storage and decodes an envelope,
- * and nothing in the client asks the server whether the record behind it is still there. So a
- * revoked, replaced or expired token was handed straight back to the window that asked for a
- * login, which adopted it, failed every call it made with it, and asked again — the same dead
- * token, every time, for as long as the browser kept it. Clearing site data was the only exit,
- * which is exactly how the defect was reported.
- *
- * With this set, the surrogate and the dispatcher both skip the resume and run the authorization
- * flow. That is not the expensive path it sounds like: the provider's own session normally answers
- * the request without asking the person anything, and what comes back is a token the provider has
- * just vouched for. It is also what makes signing in as somebody else possible at all.
- */
-export const LOGIN_FRESH_QUERY = 'fresh'
-
 /** Where a browser records that it agreed to one exact set of legal documents. */
 export const LOGIN_TERMS_STORAGE = '_owlmeans-login-terms'

package/src/manager/README.md

@@ -21,9 +21,9 @@ React components that handle various authentication scenarios:
 - **Tunnel Consumer**: Component for handling WebSocket authentication tunnels
 - **Credential Management**: Secure handling of user credentials
 
-### Module Integration
-The manager integrates with the OwlMeans module system to provide:
-- **Elevated Modules**: Enhanced modules with client-specific authentication handling
+### Entrypoint Integration
+The manager integrates with the OwlMeans entrypoint system to provide:
+- **Enhanced Entrypoints**: Entrypoints with client-specific authentication handling
 - **Route Protection**: Automatic authentication requirements for protected routes
 - **API Integration**: Seamless integration with authentication APIs
 
@@ -134,37 +134,22 @@ try {
 }
 ```
 
-### Modules
+### Entrypoints
 
-#### `modules`
-Pre-configured authentication modules for client applications.
-
-```typescript
-const modules: CommonModule[]
-```
-
-Contains elevated modules for:
-- `AUTHEN` - Base authentication module
-- `AUTHEN_INIT` - Authentication initialization
-- `AUTHEN_AUTHEN` - User authentication
-- `AUTHEN_RELY` - Authentication relay
-- `CAUTHEN` - Client authentication
-- `CAUTHEN_AUTHEN` - Client authentication handler
-- `CAUTHEN_AUTHEN_DEFAULT` - Default authentication component
-- `CAUTHEN_AUTHEN_TYPED` - Typed authentication component
-- `DISPATCHER` - Authentication dispatcher
+#### `entrypoints`
+The shared, immutable authentication declarations. Bind them into the client context alongside
+the application's own entrypoints.
 
 ## Usage Examples
 
 ### Basic Authentication Setup
 
 ```typescript
-import { modules } from '@owlmeans/client-auth/manager'
-import { makeClientContext } from '@owlmeans/client-context'
+import { entrypoints } from '@owlmeans/client-auth/manager'
+import { makeContext } from '@owlmeans/web-client'
 
-// Register authentication modules with context
-const context = makeClientContext(config)
-context.registerModules(modules)
+const context = makeContext(config)
+context.registerEntrypoints(entrypoints)
 
 await context.configure().init()
 ```
@@ -256,48 +241,27 @@ function RealtimeApp() {
 
 ### Custom Authentication Flow
 
-```typescript
-import { modules, AuthenCredError } from '@owlmeans/client-auth/manager'
-import { useModule } from '@owlmeans/client'
+Use the typed authentication protocols from `@owlmeans/auth-common`; the context supplies the
+registered client binding and infers the request and response types from the protocol.
 
-function CustomAuthFlow() {
-  const authModule = useModule('auth')
-  
-  const handleLogin = async (credentials) => {
-    try {
-      const initResponse = await authModule.init({
-        type: AuthenticationType.PasswordLogin
-      })
-      
-      const authResponse = await authModule.authenticate({
-        ...credentials,
-        challenge: initResponse.challenge
-      })
-      
-      console.log('Authentication successful:', authResponse)
-    } catch (error) {
-      if (error instanceof AuthenCredError) {
-        console.error('Invalid credentials:', error.message)
-      } else {
-        console.error('Authentication failed:', error)
-      }
-    }
+```typescript
+import { AuthenticationType } from '@owlmeans/auth'
+import { authProtocols } from '@owlmeans/auth-common'
+import { AuthenCredError } from '@owlmeans/client-auth/manager'
+import type { ClientContext } from '@owlmeans/client-context'
+
+async function authenticate(context: ClientContext, credentials: { username: string, password: string }) {
+  try {
+    const allowance = await context.entrypoint(authProtocols.init).call({
+      body: { type: AuthenticationType.PasswordLogin },
+    })
+    return await context.entrypoint(authProtocols.authenticate).call({
+      body: { ...credentials, challenge: allowance.challenge },
+    })
+  } catch (error) {
+    if (error instanceof AuthenCredError) console.error('Invalid credentials:', error.message)
+    throw error
   }
-
-  return (
-    <form onSubmit={(e) => {
-      e.preventDefault()
-      const formData = new FormData(e.target)
-      handleLogin({
-        username: formData.get('username'),
-        password: formData.get('password')
-      })
-    }}>
-      <input name="username" placeholder="Username" required />
-      <input name="password" type="password" placeholder="Password" required />
-      <button type="submit">Login</button>
-    </form>
-  )
 }
 ```
 
@@ -408,18 +372,11 @@ Single-use token authentication for enhanced security.
 5. **Graceful Fallbacks**: Provide fallback UI for authentication failures
 6. **Security**: Never store sensitive credentials in local storage
 
-## Module Elevation
-
-The manager uses module elevation to enhance base authentication modules:
-
-```typescript
-// Base modules are elevated with client-specific handlers
-elevate(list, AUTHEN_INIT, true)           // API call elevation
-elevate(list, AUTHEN_AUTHEN, true)         // Authentication elevation
-elevate(list, CAUTHEN_AUTHEN_DEFAULT, handler(AuthenticationHOC()))  // Component handler
-```
+## Entrypoint wiring
 
-This provides seamless integration between the module system and React components.
+The manager exports a ready-to-use `entrypoints` collection. Compose it with the application's
+own declarations and use `bind`/`bindScreen` from `@owlmeans/client-entrypoint` when adding a
+custom client handler; handlers are attached to declaration objects, never looked up by alias.
 
 ## Dependencies
 
@@ -427,7 +384,7 @@ This manager depends on:
 - `@owlmeans/auth` - Core authentication functionality
 - `@owlmeans/auth-common` - Shared authentication components
 - `@owlmeans/client` - Client-side framework functionality
-- `@owlmeans/client-module` - Client module system
+- `@owlmeans/client-entrypoint` - Typed protocol binding system
 - `@owlmeans/error` - Error management system
 - `react` - React framework for UI components
 
@@ -436,4 +393,4 @@ This manager depends on:
 - [`@owlmeans/client-auth`](../../../README.md) - Parent client authentication package
 - [`@owlmeans/server-auth/manager`](../../../server-auth/src/manager/README.md) - Server-side authentication manager
 - [`@owlmeans/auth`](../../../auth/README.md) - Core authentication library
-- [`@owlmeans/client`](../../../client/README.md) - Client-side framework
+- [`@owlmeans/client`](../../../client/README.md) - Client-side framework

package/src/manager/entrypoints.ts

@@ -1,18 +1,18 @@
 
-import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER } from '@owlmeans/auth'
-import { entrypoints as list } from '@owlmeans/auth-common'
+import { authProtocols } from '@owlmeans/auth-common'
 import { handler } from '@owlmeans/client'
-import { elevate, stab } from '@owlmeans/client-entrypoint'
+import { bind, bindScreen, stab } from '@owlmeans/client-entrypoint'
 import { AuthenticationHOC } from './components/authentication/component.js'
 
-elevate(list, AUTHEN)
-elevate(list, AUTHEN_INIT, true)
-elevate(list, AUTHEN_AUTHEN, true)
-elevate(list, AUTHEN_RELY)
-elevate(list, CAUTHEN)
-elevate(list, CAUTHEN_AUTHEN)
-elevate(list, CAUTHEN_AUTHEN_DEFAULT, handler(AuthenticationHOC()))
-elevate(list, CAUTHEN_AUTHEN_TYPED, handler(AuthenticationHOC()))
-elevate(list, DISPATCHER, stab)
-
-export const entrypoints = list
+/** Browser entrypoints for the manager's authentication flows. */
+export const entrypoints = [
+  bind(authProtocols.authen),
+  bind(authProtocols.init),
+  bind(authProtocols.authenticate),
+  bind(authProtocols.rely),
+  bind(authProtocols.client),
+  bind(authProtocols.login),
+  bindScreen(authProtocols.loginDefault, handler(AuthenticationHOC())),
+  bindScreen(authProtocols.loginTyped, handler(AuthenticationHOC())),
+  bindScreen(authProtocols.dispatcher, stab),
+]