@owlmeans/client-auth 0.1.18-rc.28 → 0.1.18-rc.29

package/README.md

@@ -1,13 +1,13 @@
 # @owlmeans/client-auth
 
-Client-side authentication service providing user auth state and external auth flow setup.
-
-## Overview
-
-- `useSelfAuth()` — React hook that returns the current authenticated user's `Auth` object
-- `setupExternalAuthentication()` — configure the client to authenticate against an external identity provider
-- `entrypoints` — pre-built bindings for the auth protocols (login, dispatcher)
-- `DEFAULT_ALIAS` — the auth service alias (`'auth'`)
+The browser side of OwlMeans authentication: the client `AuthService` that holds the bearer token,
+the dispatcher HOC that handles the authentication return leg, the authentication-plugin registry
+and screen (`./manager`), and the login-plugin host with its sign-in method registry, terms
+confirmation and `useLogin` / `useLogout` hooks (`./login`). A web app normally gets the auth
+service and the login host from `@owlmeans/web-client`'s `makeContext`, and the styled sign-in
+screen from `@owlmeans/web-panel`. It imports this package for the hooks, the dispatcher contract
+and plugin authoring. The OIDC relying party is `@owlmeans/web-oidc-rp` (`@owlmeans/mui-oidc-rp` is
+legacy). The server-side counterpart is `@owlmeans/server-auth`.
 
 ## Installation
 
@@ -15,60 +15,301 @@ Client-side authentication service providing user auth state and external auth f
 bun add @owlmeans/client-auth@^0.1.18-rc.19
 ```
 
+## Concepts
+
+- **Auth service** — `context.auth()`. The token lives in the `AUTH_RESOURCE` resource under the
+  single id `USER_ID`. `authenticated()` resolves to the token or `null`, `user()` returns the
+  decoded `Auth` (throwing `AuthorizationError` when there is none), and `update(token | undefined)`
+  adopts or drops a session.
+- **Dispatcher** — `DispatcherHOC` wraps a renderer that reads the return-leg query. It hands the
+  renderer `provideToken(token, query)` and `navigate()`, adopts the token, and strips `AUTH_QUERY`
+  before navigating on.
+- **Authentication plugin** (`./manager/plugins`) — *how* a person proves identity: `type`,
+  `Implementation`, an optional `Renderer` a UI package supplies, and `method` metadata when it is
+  offered on the sign-in screen.
+- **Login plugin** (`./login`) — *where* the round trip runs. Plugins are selected by `LoginEnv`
+  (embedded, surrogate) and priority. `@owlmeans/web-client` registers the redirect and surrogate
+  plugins.
+- **Login method** — one offerable button. `LoginMethodSource`s produce candidates;
+  `resolveLoginMethods` drops restricted ones the config did not name and applies the configured
+  order.
+- **Login outcome** — `LoginOutcome` (`Handled`, `Passed`, `Redirected`, `Gesture`, `Orphaned`,
+  `Failed`) tells the caller what to do next. `resumeAction` and `loginAttemptError` are the only
+  readings of it.
+
 ## Usage
 
-Access current auth state in a component:
+### 1. A context built by hand
+
+`@owlmeans/web-client`'s `makeContext` already does this. Only a context composed without it
+registers the pieces itself.
+
+```ts
+import { makeClientContext } from '@owlmeans/client'
+import { appendAuthService, bindExternalAuthentication, entrypoints as authEntrypoints } from '@owlmeans/client-auth'
+import { appendLogin } from '@owlmeans/client-auth/login'
+import { MY_APP_WEB } from 'my-app-common'
+import type { Config, Context } from './types.js'
+
+export const makeContext = <C extends Config, T extends Context<C>>(cfg: C): T => {
+  const context = makeClientContext(cfg) as T
+  appendAuthService<C, T>(context)   // registers under DEFAULT_ALIAS ('auth'), exposes context.auth()
+  appendLogin<C, T>(context)         // registers the login host, exposes context.login()
+
+  return context
+}
+
+export const clientBindings = [
+  ...authEntrypoints,
+  // The screen an external provider redirects into, pinned to this app's service.
+  bindExternalAuthentication(MY_APP_WEB),
+]
+```
+
+### 2. Guarding a layout and reading the identity
 
-```typescript
+```tsx
+import { entitySlugOf } from '@owlmeans/auth'
 import { useSelfAuth } from '@owlmeans/client-auth'
+import type { FC, PropsWithChildren } from 'react'
+import { useContext } from '../context.js'
 
-function UserMenu() {
-  const auth = useSelfAuth()
-  return <span>{auth?.userId}</span>
+export const UserLayout: FC<PropsWithChildren> = ({ children }) => {
+  // `true` navigates to DISPATCHER when there is no session.
+  const authenticated = useSelfAuth(true)
+  const context = useContext()
+
+  if (!authenticated) {
+    return null
+  }
+
+  const auth = context.auth().user()
+  // The organization is its renameable entitySlug; the stable entityId never reaches the browser.
+  const organization = entitySlugOf(auth)
+
+  return <main data-organization={organization}>{children}</main>
 }
 ```
 
-Set up external authentication (e.g. OIDC redirect):
+### 3. Sign-in and sign-out controls
 
-```typescript
-import { setupExternalAuthentication } from '@owlmeans/client-auth'
+```tsx
+import type { FC } from 'react'
+import { useLogin, useLogout } from '@owlmeans/client-auth/login'
 
-// In context setup
-setupExternalAuthentication(context, { serviceUrl: process.env.AUTH_URL })
+export const HeaderActions: FC<{ authenticated: boolean | null }> = ({ authenticated }) => {
+  const [loginPath, onLogIn] = useLogin()
+  const onLogOut = useLogout()
+
+  if (authenticated == null) {
+    return null
+  }
+
+  return authenticated
+    ? <button type="button" onClick={onLogOut}>Log out</button>
+    : <a href={loginPath} onClick={onLogIn}>Log in</a>
+}
 ```
 
+One control and one handler, with no conditions around them. The login service decides whether the
+flow redirects this tab or runs one window up, because the app is framed.
+
+### 4. Offering a sign-in method and gating the flow
+
+```ts
+import { ensureLoginService, LoginOutcome } from '@owlmeans/client-auth/login'
+import type { LoginMethodSource, LoginPrecondition } from '@owlmeans/client-auth/login'
+
+const partnerMethods: LoginMethodSource = {
+  alias: 'my-app-partner-methods',
+  list: () => [{
+    id: 'partner-sso',
+    label: 'Partner SSO',
+    i18nKey: 'partner',
+    icon: 'building',
+    order: 20,
+    // Callable synchronously from the click: leave before the first await.
+    start: () => {
+      window.location.href = partnerAuthorizeUrl()
+
+      return Promise.resolve(LoginOutcome.Redirected)
+    },
+  }],
+}
+
+const maintenanceWindow: LoginPrecondition = {
+  alias: 'my-app-maintenance',
+  // Synchronous by contract — a precondition that asks a server belongs elsewhere.
+  check: () => !isMaintenanceBannerOpen(),
+}
+
+export const appendPartnerLogin = <C extends Config, T extends Context<C>>(context: T): T => {
+  const login = ensureLoginService(context)
+  login.registerMethodSource(partnerMethods)
+  login.registerPrecondition(maintenanceWindow)
+
+  return context
+}
+```
+
+### 5. Authoring an authentication plugin
+
+```tsx
+import { AuthenticationStage } from '@owlmeans/auth'
+import type { AuthenticationRendererProps } from '@owlmeans/client-auth/manager'
+import { registerAuthPlugin } from '@owlmeans/client-auth/manager/plugins'
+import type { AuthenticationPlugin } from '@owlmeans/client-auth/manager/plugins'
+import { useEffect } from 'react'
+
+const MY_APP_PASSKEY = 'my-app-passkey'
+
+export const passkeyPlugin: AuthenticationPlugin = {
+  type: MY_APP_PASSKEY,
+  method: { label: 'Passkey', icon: 'key', order: 50 },
+  // The form comes from a UI package; without one the screen must not offer the method.
+  requiresRenderer: true,
+  Implementation: Renderer => ({ type, stage, control, params }: AuthenticationRendererProps) => {
+    useEffect(() => {
+      if (control.stage === AuthenticationStage.Init) {
+        void control.requestAllowence()
+      }
+    }, [type])
+
+    if (Renderer == null) {
+      throw new SyntaxError(`Renderer is not defined for ${MY_APP_PASSKEY}`)
+    }
+
+    return <Renderer type={type} stage={stage} control={control} params={params} />
+  },
+}
+
+registerAuthPlugin(passkeyPlugin)
+```
+
+A UI package then assigns `plugins[MY_APP_PASSKEY].Renderer`, and the renderer calls
+`control.authenticate({ userId, credential })` once the person has answered the challenge.
+
 ## API
 
-### `useSelfAuth(): Auth | null`
+### `@owlmeans/client-auth`
+
+| Symbol | Kind | Purpose |
+|---|---|---|
+| `makeAuthService(alias?)` | function | The client `AuthService` — `authenticate`, `update`, `authenticated`, `user`, `store` |
+| `appendAuthService(ctx, alias?)` | function | Register it and `authMiddleware`; expose `context.auth()` |
+| `entrypoints` | const | `[bind(authProtocols.dispatcherAuthenticate)]` |
+| `bindExternalAuthentication(service)` | function | Bind `authProtocols.flowEnter` as a URL-only screen on the given service |
+| `useSelfAuth(force = true)` | hook | Resolves to `boolean`; navigates to `DISPATCHER` when unauthenticated and `force` is set |
+| `useWs(entrypoint, request?, options?)` | hook | `@owlmeans/client-socket`'s `useWs` with the token in `AUTH_QUERY`, refreshed before every reconnect unless the caller supplied its own |
+| `DispatcherHOC` | HOC | The return-leg wrapper — see *Concepts* |
+| `DispatcherProps`, `TDispatcherHOC`, `DispatcherRenderer`, `DispatcherRendererProps` | type | Dispatcher contract |
+| `DEFAULT_ALIAS` | const | `'auth'` — the service alias and the client guard alias |
+| `AUTH_RESOURCE`, `USER_ID` | const | `'auth'` resource and `'user'` record id holding the token |
+| `DEFAULT_ENTITY` | const | `'owlmeans'` |
+| `AuthServiceAppend`, `ClientAuthRecord`, `ClientAuthResource` | type | `context.auth()` and the stored record |
+
+### `@owlmeans/client-auth/manager`
+
+Importing it registers `basic-ed25519`, `re-captcha` and `wallet-consumer`, plus
+`pluginMethodSource`, by side effect.
+
+| Symbol | Kind | Purpose |
+|---|---|---|
+| `plugins`, `registerAuthPlugin`, `getAuthPlugin`, `listAuthPlugins` | registry | The module-global authentication-plugin registry |
+| `AuthenticationHOC(Renderer?, type?)` | HOC | The authentication screen hosting a plugin |
+| `AuthenticationProps`, `TAuthenticationHOC` | type | Screen props (`type?`, `callback?`, `source?`) |
+| `makeControl(context, callback?)` | function | The control a plugin drives: `requestAllowence`, `authenticate`, `persist` / `restore` / `hasPersistentState` / `cleanUpState`, `setError`, `flow` |
+| `AuthenticationControl`, `AuthenticationControlState` | type | Control shape and the state persisted across a provider redirect |
+| `AuthenticationRenderer`, `AuthenticationRendererProps`, `ClientAuthType`, `ClientAuthenticationMethod`, `AuthenticationCallback` | type | Rendering contract |
+| `TunnelConsumer`, `TunnelAuthenticationProps`, `TunnelAuthCallback` | component, type | Wallet-tunnel consumer screen |
+| `AuthenCredError` | class | The entered credential cannot be used |
+| `CONTROL_STATE_ID` | const | Resource id of the persisted control state |
+
+### `@owlmeans/client-auth/manager/entrypoints`
 
-Returns the current `Auth` object from the context, or `null` if not authenticated.
+| Symbol | Kind | Purpose |
+|---|---|---|
+| `entrypoints` | const | The authentication manager app's bindings: `authen`, `init`, `authenticate`, `rely`, `client`, `login`, the `loginDefault` / `loginTyped` screens and the dispatcher |
 
-### `setupExternalAuthentication(ctx, opts?)`
+### `@owlmeans/client-auth/manager/plugins`
 
-Configures the context to redirect to an external identity provider for authentication.
+The plugin-authoring surface, with no registration side effect.
 
-### `entrypoints`
+| Symbol | Kind | Purpose |
+|---|---|---|
+| `AuthenticationPlugin` | type | `type`, `Implementation`, `Renderer?`, `requiresRenderer?`, `method?`, `authenticate` / `beforeAuthenticate` / `afterAuthenticate` |
+| `PluginImplemnetation` (sic) | type | `(Renderer?) => FC<AuthenticationRendererProps>` |
+| `AuthMethodMeta` | type | `id`, `label`, `i18nKey`, `icon`, `order`, `emphasis`, `restricted`, `hidden`, `available(ctx)` |
+| `plugins`, `registerAuthPlugin`, `getAuthPlugin`, `listAuthPlugins` | registry | Same registry as `./manager` |
+| `pluginMethodSource` | const | The `LoginMethodSource` that offers registered plugins |
+| `createWalletFacade`, `PinSchema`, `PinForm`, `TunnelAuthenticationRenderer`, `TunnelAuthenticationRendererProps` | function, const, type | Wallet-tunnel helpers |
+| `ed25519BasicUIPlugin`, `reCaptchaPlugin`, `tunnelConsumerUIPlugin` | const | Shipped plugin objects |
 
-Pre-built protocol bindings for the auth flow (mirrors `@owlmeans/auth-common`'s declarations with
-client route models). New application code should resolve its shared protocol with
-`context.entrypoint(protocol)` rather than supplying a caller-side type.
+### `@owlmeans/client-auth/login`
 
-### `DEFAULT_ALIAS`
+| Symbol | Kind | Purpose |
+|---|---|---|
+| `appendLogin(ctx)` | function | Register the host; expose `context.login()` |
+| `makeLoginService(alias?)`, `ensureLoginService(ctx)` | function | The lazy login service, and the idempotent getter a plugin package calls first |
+| `LoginService`, `LoginServiceAppend`, `LoginContext` | type | `registerPlugin`, `registerPrecondition`, `registerMethodSource`, `registerScreen`, `screen`, `env`, and the `enter` / `begin` / `authorize` / `complete` / `resume` / `logout` / `logoutComplete` / `adopt` / `revoke` facade |
+| `LoginPlugin`, `LoginEnv`, `LoginRequest`, `LogoutRequest`, `LoginPrecondition` | type | Plugin contract |
+| `LoginOutcome`, `LoginIntent` | enum | Stage results; login or logout surrogate |
+| `useLogin(target?)` | hook | `[dispatcherPath, onLogIn]` |
+| `useLogout(target?)` | hook | `onLogOut` |
+| `registerMethodSource`, `listMethodSources`, `resolveLoginMethods(ctx, cfg?, extra?)`, `primaryLoginMethod(methods)` | function | Global method sources and resolution |
+| `LoginMethod`, `LoginMethodSource`, `LoginMethodContext` | type | Method contract |
+| `resolveTerms(cfg?)`, `termsAccepted(resolved)`, `acceptTerms(resolved, accepted)`, `ResolvedTerms` | function, type | Terms confirmation, stored in `localStorage` against a version derived from the URLs |
+| `resolveCredit(cfg?, brand?, service?)`, `ResolvedCredit` | function, type | The credit and copyright line |
+| `FallbackLoginScreen`, `LoginScreenProps`, `LoginScreenComponent` | component, type | The plain screen used when no UI family registered one |
+| `surrogatePath(ctx, target)`, `SurrogateTarget` | function, type | Where a surrogate window opens; `null` on an entrypoint list without the surrogate route |
+| `resumeAction(outcome)`, `ResumeAction`, `loginAttemptError(outcome)` | function, enum | The shared readings of a `resume` outcome and of a finished attempt |
+| `enterOidcAuthorization(model)` | function | Move a flow to the step that can authorize; idempotent |
+| `adoptToken(ctx, token)`, `revokeToken(ctx)` | function | The single adoption and de-adoption paths |
+| `isEmbedded`, `isSurrogate`, `markSurrogate`, `clearSurrogate`, `defaultLoginEnv` | function | Environment probes behind `LoginEnv` |
+| `LOGIN_SERVICE`, `DEFAULT_ALIAS`, `DEFAULT_LOGIN_PRIORITY`, `DEFAULT_METHOD_ORDER`, `LOGIN_SURROGATE_NAME`, `LOGIN_TOKEN_MESSAGE`, `LOGIN_LOGOUT_MESSAGE`, `LOGIN_SURROGATE_MARKER`, `LOGIN_SURROGATE_FEATURES`, `LOGIN_WATCH_INTERVAL`, `LOGIN_INTENT_QUERY`, `LOGIN_NEXT_QUERY`, `LOGIN_METHOD_QUERY`, `LOGIN_TERMS_STORAGE` | const | Service alias, ordering defaults and cross-document wire values |
 
-Auth service alias: `'auth'`.
+Importing `./login` also registers the `login` strings of the `auth` library namespace in all
+seven supported languages.
 
-## Product-Viable Integration Notes
+## Common pitfalls
 
-- The manager web app imports `DEFAULT_ALIAS` from this package as the client-side guard alias.
-- `@owlmeans/web-oidc-rp/auth/plugins` is imported for side effects to register the `OIDC_CLIENT_AUTH` and `GOOGLE_CLIENT_AUTH` plugins.
-- Redirect plugins persist auth control state before leaving the app and restore it before submitting provider query params as `AuthCredentials`.
-- After login, the browser stores a normal OwlMeans bearer token; product authorization is enforced by server gates and handler checks.
+- **Keep sign-in handlers synchronous.** `useLogin` and `useLogout` handlers await nothing before
+  delegating. Wrapping them in an `async` handler that awaits first makes the popup blocker eat the
+  surrogate window. The same rule binds a plugin's `begin` / `logout`, a method's `start` and every
+  precondition.
+- **Never start login from an effect.** Without a user gesture the window is blocked. Render a
+  control and let the person click.
+- **Adopt and drop tokens only through the auth service or `adoptToken` / `revokeToken`.**
+  Hand-written access to `AUTH_RESOURCE` drifts from the envelope decoding beside it.
+- **Import names from the right subpath.** The plugin contract (`AuthenticationPlugin`,
+  `AuthMethodMeta`, `pluginMethodSource`, tunnel helpers) resolves only through
+  `./manager/plugins`. Rendering types and the registry resolve through `./manager`. Importing
+  `./login` registers no authentication plugin.
+- **Gate operator methods with `method.restricted`,** so the configuration has to name them. Gate
+  dev-only methods on `cfg.debug.supervisor`, never `cfg.debug.all`.
+- **Declare `requiresRenderer`** on a plugin whose `Implementation` cannot render without a UI
+  package's `Renderer`. Otherwise the screen offers a button that crashes the page it opens.
+- **Call `enterOidcAuthorization(model)` before every `authenticate`** in an OIDC flow, rather than
+  re-deriving the transition.
+- **Authorization stays server-side.** The browser ends up holding an ordinary OwlMeans bearer token
+  whichever provider issued it. Product checks live in entrypoint gates and handlers, never in
+  client-only state.
+- **The organization on the wire is its `entitySlug`.** Read it with `entitySlugOf` from
+  `@owlmeans/auth`; the stable `entityId` never reaches the browser.
+- **Overrides of the `login` strings cover all seven languages** (`en`, `pl`, `ru`, `be`, `uk`,
+  `es`, `de`).
 
-## Related Packages
+## Related packages
 
-- [`@owlmeans/auth`](../auth) — `Auth` type returned by `useSelfAuth`
-- [`@owlmeans/auth-common`](../auth-common) — auth entrypoint route definitions
-- [`@owlmeans/server-auth`](../server-auth) — server-side counterpart
+- [`@owlmeans/auth`](../auth) — `Auth`, aliases, `entitySlugOf`, auth errors
+- [`@owlmeans/auth-common`](../auth-common) — `authProtocols`, `authMiddleware`, guard aliases
+- [`@owlmeans/web-client`](../web-client) — appends the auth service and login host; ships the dispatcher and login plugins
+- [`@owlmeans/web-panel`](../web-panel) — the shadcn sign-in screen (`appendLoginScreen`)
+- [`@owlmeans/client-panel`](../client-panel) — headless login-method and terms models
+- [`@owlmeans/web-oidc-rp`](../web-oidc-rp) — OIDC relying party and its method source
+- [`@owlmeans/web-auth`](../web-auth) — supervisor (PK) login plugin
+- [`@owlmeans/client-socket`](../client-socket) — the socket hook `useWs` wraps
+- [`@owlmeans/server-auth`](../server-auth) — the server-side counterpart
 
 <!-- owlmeans:agent-guidance:start -->
 ## Agent guidance

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.28",
-  "generatedAt": "2026-09-12T14:18:54.779Z",
+  "version": "0.1.18-rc.29",
+  "generatedAt": "2026-09-14T19:17:35.187Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-auth
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.28"` in `dependencies`
+**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.29"` in `dependencies`
 
 Five subpaths, five jobs:
 
@@ -44,7 +44,7 @@ conflate them.
 | `DEFAULT_ENTITY` | `'owlmeans'` |
 | `DispatcherHOC` | The return-leg HOC. It wraps a `DispatcherRenderer`, hands it `provideToken(token, query)` and `navigate()`, adopts the supplied token through the auth service, and strips `AUTH_QUERY` before navigating on. Reading the return-leg query is the renderer's job — `@owlmeans/web-client` reads `AUTH_QUERY`, `@owlmeans/web-oidc-rp` also reads `OIDC_ERROR_QUERY` and forwards the remaining params |
 | `DispatcherProps`, `TDispatcherHOC`, `DispatcherRenderer`, `DispatcherRendererProps` | Dispatcher types |
-| `useWs(entrypoint, request?)` | A socket hook that attaches the current token as the `AUTH_QUERY` param |
+| `useWs(entrypoint, request?, options?)` | A socket hook that attaches the current token as the `AUTH_QUERY` param and refreshes it on every reconnect attempt (via `WsOptions.beforeConnect`), unless the request already carried its own token — in which case that stays untouched across reconnects too. `options` passes straight through to `@owlmeans/client-socket`'s `useWs`, so `{ reconnect: false }` still opts a stateful one-shot handshake out of retries (see `manager/plugins/tunnel-consumer.tsx`) |
 | `useSelfAuth(force?)` | Whether this context is authenticated; navigates to `DISPATCHER` when it is not and `force` |
 | `AuthServiceAppend`, `ClientAuthRecord`, `ClientAuthResource` | Types |
 

package/build/helper.d.ts

@@ -1,5 +1,6 @@
 import type { ClientEntrypoint } from '@owlmeans/client-entrypoint';
+import type { WsOptions } from '@owlmeans/client-socket';
 import type { AbstractRequest } from '@owlmeans/entrypoint';
-export declare const useWs: (module: string | ClientEntrypoint<any>, _request?: Partial<AbstractRequest<any>>) => import("@owlmeans/socket").Connection | null;
+export declare const useWs: (module: string | ClientEntrypoint<any>, _request?: Partial<AbstractRequest<any>>, options?: WsOptions) => import("@owlmeans/socket").Connection | null;
 export declare const useSelfAuth: (force?: boolean) => boolean;
 //# sourceMappingURL=helper.d.ts.map

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAGnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAS3D,eAAO,MAAM,KAAK,WACR,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,iDA2BjF,CAAA;AAED,eAAO,MAAM,WAAW,WAAW,OAAO,YAoBzC,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAGnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAS3D,eAAO,MAAM,KAAK,WACR,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,YAAY,SAAS,iDAiDtG,CAAA;AAED,eAAO,MAAM,WAAW,WAAW,OAAO,YAoBzC,CAAA"}

package/build/helper.js

@@ -6,9 +6,12 @@ import { AUTH_QUERY, DISPATCHER } from '@owlmeans/auth';
 // import { useFlow } from '@owlmeans/web-flow'
 // import { DEFAULT_ENTITY } from './consts.js'
 // import { OidcAuthStep } from '@owlmeans/flow'
-export const useWs = (module, _request) => {
+export const useWs = (module, _request, options) => {
     const ctx = useContext();
     const mod = useMemo(() => typeof module === 'string' ? ctx.entrypoint(module) : module, [module]);
+    // Captured before the token is filled in below, so a caller who supplied their own token
+    // keeps full control of it across a reconnect too — `beforeConnect` only refreshes ours.
+    const callerSuppliedToken = _request?.query?.[AUTH_QUERY] != null;
     const request = useMemo(() => {
         if (_request == null) {
             _request = provideRequest(mod.alias, mod.path());
@@ -26,7 +29,25 @@ export const useWs = (module, _request) => {
         }
         return _request;
     }, [_request]);
-    return useWebSocket(module, request);
+    const wsOptions = useMemo(() => ({
+        ...options,
+        beforeConnect: async (req) => {
+            // A reconnect can land minutes after the socket first opened — refresh the bearer token
+            // on every attempt rather than trust the one `request` was built with, or a token rotated
+            // in between reopens the socket with a stale one the guard then rejects.
+            if (!callerSuppliedToken) {
+                try {
+                    req.query ??= {};
+                    req.query[AUTH_QUERY] = ctx.auth().token;
+                }
+                catch (e) {
+                    console.error(e);
+                }
+            }
+            await options?.beforeConnect?.(req);
+        }
+    }), [options, callerSuppliedToken]);
+    return useWebSocket(module, request, wsOptions);
 };
 export const useSelfAuth = (force = true /*, entity: string = DEFAULT_ENTITY*/) => {
     const context = useContext();

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAChF,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAY,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAAE,OAAmB,EACrG,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,yFAAyF;IACzF,yFAAyF;IACzF,MAAM,mBAAmB,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;IAEjE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,SAAS,GAAG,OAAO,CAAY,GAAG,EAAE,CAAC,CAAC;QAC1C,GAAG,OAAO;QACV,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,wFAAwF;YACxF,0FAA0F;YAC1F,yEAAyE;YACzE,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,GAAG,CAAC,KAAK,KAAK,EAAE,CAAA;oBAChB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;KACF,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAEnC,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AACjD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAY,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}

package/build/login/consts.d.ts

@@ -17,6 +17,16 @@ export declare const LOGIN_SURROGATE_NAME = "owlmeans-oidc-login";
 export declare const LOGIN_TOKEN_MESSAGE = "owlmeans:oidc:popup-token";
 export declare const LOGIN_LOGOUT_MESSAGE = "owlmeans:oidc:popup-logout";
 export declare const LOGIN_SURROGATE_MARKER = "_owlmeans-oidc-popup";
+export declare const LOGIN_SURROGATE_WIDTH = 520;
+export declare const LOGIN_SURROGATE_HEIGHT = 760;
+/**
+ * @deprecated Never centered the window — it carried no `left`/`top`, so the surrogate always
+ * opened wherever the browser's own default popup placement put it. Superseded by
+ * `@owlmeans/web-client`'s `centeredPopupFeatures(LOGIN_SURROGATE_WIDTH, LOGIN_SURROGATE_HEIGHT)`,
+ * computed fresh per call since centering depends on where the browser window currently sits.
+ * Kept, unchanged, for the same reason as the rest of this block: an already-generated app may
+ * carry a copy of code that still imports it.
+ */
 export declare const LOGIN_SURROGATE_FEATURES = "popup=yes,width=520,height=760";
 /** How often a surrogate window is checked for having been closed by the user. */
 export declare const LOGIN_WATCH_INTERVAL = 500;

package/build/login/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,eAAO,MAAM,aAAa,kBAAgB,CAAA;AAE1C,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,eAAO,MAAM,oBAAoB,+BAA+B,CAAA;AAEhE,eAAO,MAAM,sBAAsB,yBAAyB,CAAA;AAE5D,eAAO,MAAM,wBAAwB,mCAAmC,CAAA;AAExE,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,eAAO,MAAM,aAAa,kBAAgB,CAAA;AAE1C,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,eAAO,MAAM,oBAAoB,+BAA+B,CAAA;AAEhE,eAAO,MAAM,sBAAsB,yBAAyB,CAAA;AAE5D,eAAO,MAAM,qBAAqB,MAAM,CAAA;AAExC,eAAO,MAAM,sBAAsB,MAAM,CAAA;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,mCACwC,CAAA;AAE7E,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA"}

package/build/login/consts.js

@@ -17,7 +17,17 @@ export const LOGIN_SURROGATE_NAME = 'owlmeans-oidc-login';
 export const LOGIN_TOKEN_MESSAGE = 'owlmeans:oidc:popup-token';
 export const LOGIN_LOGOUT_MESSAGE = 'owlmeans:oidc:popup-logout';
 export const LOGIN_SURROGATE_MARKER = '_owlmeans-oidc-popup';
-export const LOGIN_SURROGATE_FEATURES = 'popup=yes,width=520,height=760';
+export const LOGIN_SURROGATE_WIDTH = 520;
+export const LOGIN_SURROGATE_HEIGHT = 760;
+/**
+ * @deprecated Never centered the window — it carried no `left`/`top`, so the surrogate always
+ * opened wherever the browser's own default popup placement put it. Superseded by
+ * `@owlmeans/web-client`'s `centeredPopupFeatures(LOGIN_SURROGATE_WIDTH, LOGIN_SURROGATE_HEIGHT)`,
+ * computed fresh per call since centering depends on where the browser window currently sits.
+ * Kept, unchanged, for the same reason as the rest of this block: an already-generated app may
+ * carry a copy of code that still imports it.
+ */
+export const LOGIN_SURROGATE_FEATURES = `popup=yes,width=${LOGIN_SURROGATE_WIDTH},height=${LOGIN_SURROGATE_HEIGHT}`;
 /** How often a surrogate window is checked for having been closed by the user. */
 export const LOGIN_WATCH_INTERVAL = 500;
 /** Carries WHY the surrogate window was opened across the window boundary. */

package/build/login/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAA;AAExE,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAExC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,mBAAmB,qBAAqB,WAAW,sBAAsB,EAAE,CAAA;AAE7E,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA"}

package/build/login/i18n/be.json

@@ -30,7 +30,7 @@
         },
         "error": {
             "failed": "Уваход не завершаны. Паспрабуйце яшчэ раз.",
-            "blocked": "Акно ўваходу заблакавана. Дазвольце ўсплывальныя вокны для гэтага сайта і паспрабуйце зноў."
+            "blocked": "Акно ўваходу заблакавана. Націсніце значок заблакаванага ўсплывальнага акна ў адрасным радку браўзера, каб адкрыць яго."
         },
         "orphaned": "Уваход выкананы. Можаце закрыць гэтае акно і вярнуцца ў праграму."
     }

package/build/login/i18n/de.json

@@ -30,7 +30,7 @@
         },
         "error": {
             "failed": "Die Anmeldung wurde nicht abgeschlossen. Bitte versuchen Sie es erneut.",
-            "blocked": "Das Anmeldefenster wurde blockiert. Erlauben Sie Pop-ups für diese Website und versuchen Sie es erneut."
+            "blocked": "Das Anmeldefenster wurde blockiert. Klicken Sie auf das Symbol für blockierte Pop-ups in der Adressleiste Ihres Browsers, um es zu öffnen."
         },
         "orphaned": "Angemeldet. Sie können dieses Fenster schließen und in der Anwendung fortfahren."
     }

package/build/login/i18n/en.json

@@ -30,7 +30,7 @@
         },
         "error": {
             "failed": "Sign-in did not complete. Please try again.",
-            "blocked": "The sign-in window was blocked. Allow pop-ups for this site and try again."
+            "blocked": "The sign-in window was blocked. Click the blocked pop-up icon in your browser's address bar to open it."
         },
         "orphaned": "Signed in. You can close this window and continue in the application."
     }

package/build/login/i18n/es.json

@@ -30,7 +30,7 @@
         },
         "error": {
             "failed": "El inicio de sesión no se completó. Inténtalo de nuevo.",
-            "blocked": "Se bloqueó la ventana de inicio de sesión. Permite las ventanas emergentes para este sitio e inténtalo de nuevo."
+            "blocked": "Se bloqueó la ventana de inicio de sesión. Haz clic en el icono de ventana emergente bloqueada en la barra de direcciones del navegador para abrirla."
         },
         "orphaned": "Sesión iniciada. Puedes cerrar esta ventana y continuar en la aplicación."
     }

package/build/login/i18n/pl.json

@@ -30,7 +30,7 @@
         },
         "error": {
             "failed": "Logowanie nie zostało ukończone. Spróbuj ponownie.",
-            "blocked": "Okno logowania zostało zablokowane. Zezwól na wyskakujące okienka dla tej witryny i spróbuj ponownie."
+            "blocked": "Okno logowania zostało zablokowane. Kliknij ikonę zablokowanego okienka w pasku adresu przeglądarki, aby je otworzyć."
         },
         "orphaned": "Zalogowano. Możesz zamknąć to okno i kontynuować w aplikacji."
     }

package/build/login/i18n/ru.json

@@ -30,7 +30,7 @@
         },
         "error": {
             "failed": "Вход не завершён. Попробуйте ещё раз.",
-            "blocked": "Окно входа заблокировано. Разрешите всплывающие окна для этого сайта и попробуйте снова."
+            "blocked": "Окно входа заблокировано. Нажмите на значок заблокированного всплывающего окна в адресной строке браузера, чтобы открыть его."
         },
         "orphaned": "Вход выполнен. Можете закрыть это окно и вернуться в приложение."
     }

package/build/login/i18n/uk.json

@@ -30,7 +30,7 @@
         },
         "error": {
             "failed": "Вхід не завершено. Спробуйте ще раз.",
-            "blocked": "Вікно входу заблоковано. Дозвольте спливаючі вікна для цього сайту та спробуйте знову."
+            "blocked": "Вікно входу заблоковано. Натисніть значок заблокованого спливаючого вікна в адресному рядку браузера, щоб відкрити його."
         },
         "orphaned": "Вхід виконано. Можете закрити це вікно й повернутися до застосунку."
     }

package/build/login/resume.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resume.d.ts","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,YAAa,YAAY,GAAG,IAAI,KAAG,MAAM,GAAG,IAYzE,CAAA;AAED,sEAAsE;AACtE,oBAAY,YAAY;IACtB,kFAAkF;IAClF,IAAI,SAAS;IACb,oFAAoF;IACpF,MAAM,WAAW;IACjB,sEAAsE;IACtE,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa,YAAY,KAAG,YAYpD,CAAA"}
+{"version":3,"file":"resume.d.ts","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,YAAa,YAAY,GAAG,IAAI,KAAG,MAAM,GAAG,IAazE,CAAA;AAED,sEAAsE;AACtE,oBAAY,YAAY;IACtB,kFAAkF;IAClF,IAAI,SAAS;IACb,oFAAoF;IACpF,MAAM,WAAW;IACjB,sEAAsE;IACtE,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa,YAAY,KAAG,YAapD,CAAA"}

package/build/login/resume.js

@@ -11,6 +11,7 @@ import { LoginOutcome } from './types.js';
 export const loginAttemptError = (outcome) => {
     switch (outcome) {
         case LoginOutcome.Gesture:
+        case LoginOutcome.Blocked:
             // The window never opened. That is the popup blocker, and it has its own copy.
             return 'login.error.blocked';
         case LoginOutcome.Failed:
@@ -47,6 +48,7 @@ export const resumeAction = (outcome) => {
         case LoginOutcome.Orphaned:
         case LoginOutcome.Failed:
         case LoginOutcome.Gesture:
+        case LoginOutcome.Blocked:
             return ResumeAction.Render;
         default:
             return ResumeAction.Navigate;

package/build/login/resume.js.map

@@ -1 +1 @@
-{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA4B,EAAiB,EAAE;IAC/E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO;YACvB,+EAA+E;YAC/E,OAAO,qBAAqB,CAAA;QAC9B,KAAK,YAAY,CAAC,MAAM,CAAC;QACzB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,oBAAoB,CAAA;QAC7B;YACE,yFAAyF;YACzF,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC,CAAA;AAED,sEAAsE;AACtE,MAAM,CAAN,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,kFAAkF;IAClF,6BAAa,CAAA;IACb,oFAAoF;IACpF,iCAAiB,CAAA;IACjB,sEAAsE;IACtE,qCAAqB,CAAA;AACvB,CAAC,EAPW,YAAY,KAAZ,YAAY,QAOvB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAgB,EAAE;IAClE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO,CAAC;QAC1B,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,YAAY,CAAC,IAAI,CAAA;QAC1B,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,MAAM,CAAC;QACzB,KAAK,YAAY,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,MAAM,CAAA;QAC5B;YACE,OAAO,YAAY,CAAC,QAAQ,CAAA;IAChC,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA4B,EAAiB,EAAE;IAC/E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO,CAAC;QAC1B,KAAK,YAAY,CAAC,OAAO;YACvB,+EAA+E;YAC/E,OAAO,qBAAqB,CAAA;QAC9B,KAAK,YAAY,CAAC,MAAM,CAAC;QACzB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,oBAAoB,CAAA;QAC7B;YACE,yFAAyF;YACzF,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC,CAAA;AAED,sEAAsE;AACtE,MAAM,CAAN,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,kFAAkF;IAClF,6BAAa,CAAA;IACb,oFAAoF;IACpF,iCAAiB,CAAA;IACjB,sEAAsE;IACtE,qCAAqB,CAAA;AACvB,CAAC,EAPW,YAAY,KAAZ,YAAY,QAOvB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAgB,EAAE;IAClE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO,CAAC;QAC1B,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,YAAY,CAAC,IAAI,CAAA;QAC1B,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,MAAM,CAAC;QACzB,KAAK,YAAY,CAAC,OAAO,CAAC;QAC1B,KAAK,YAAY,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,MAAM,CAAA;QAC5B;YACE,OAAO,YAAY,CAAC,QAAQ,CAAA;IAChC,CAAC;AACH,CAAC,CAAA"}

package/build/login/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAMlE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,KAAK,EAEV,YAAY,EAAE,kBAAkB,EACjC,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,WAAW,MAAM,KAAmB,YA0HhE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAS,YAAY,CAAC,GAAG,CAAC,KAAG,YAQ3D,CAAA;AAED,4DAA4D;AAC5D,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,OACrE,CAAC,KACL,CAAC,GAAG,kBAMN,CAAA;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAMlE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,KAAK,EAEY,YAAY,EAAE,kBAAkB,EACvD,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,WAAW,MAAM,KAAmB,YAwIhE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAS,YAAY,CAAC,GAAG,CAAC,KAAG,YAQ3D,CAAA;AAED,4DAA4D;AAC5D,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,OACrE,CAAC,KACL,CAAC,GAAG,kBAMN,CAAA;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}