@owlmeans/client-auth 0.1.18-rc.3 → 0.1.18-rc.31

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAGnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAS3D,eAAO,MAAM,KAAK,WACR,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,iDA2BjF,CAAA;AAED,eAAO,MAAM,WAAW,WAAW,OAAO,YAoBzC,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAGnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAS3D,eAAO,MAAM,KAAK,WACR,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,YAAY,SAAS,iDAiDtG,CAAA;AAED,eAAO,MAAM,WAAW,WAAW,OAAO,YAoBzC,CAAA"}

package/build/helper.js

@@ -6,12 +6,15 @@ import { AUTH_QUERY, DISPATCHER } from '@owlmeans/auth';
 // import { useFlow } from '@owlmeans/web-flow'
 // import { DEFAULT_ENTITY } from './consts.js'
 // import { OidcAuthStep } from '@owlmeans/flow'
-export const useWs = (module, _request) => {
+export const useWs = (module, _request, options) => {
     const ctx = useContext();
     const mod = useMemo(() => typeof module === 'string' ? ctx.entrypoint(module) : module, [module]);
+    // Captured before the token is filled in below, so a caller who supplied their own token
+    // keeps full control of it across a reconnect too — `beforeConnect` only refreshes ours.
+    const callerSuppliedToken = _request?.query?.[AUTH_QUERY] != null;
     const request = useMemo(() => {
         if (_request == null) {
-            _request = provideRequest(mod.getAlias(), mod.getPath());
+            _request = provideRequest(mod.alias, mod.path());
         }
         try {
             if (_request?.query?.[AUTH_QUERY] == null) {
@@ -26,7 +29,25 @@ export const useWs = (module, _request) => {
         }
         return _request;
     }, [_request]);
-    return useWebSocket(module, request);
+    const wsOptions = useMemo(() => ({
+        ...options,
+        beforeConnect: async (req) => {
+            // A reconnect can land minutes after the socket first opened — refresh the bearer token
+            // on every attempt rather than trust the one `request` was built with, or a token rotated
+            // in between reopens the socket with a stale one the guard then rejects.
+            if (!callerSuppliedToken) {
+                try {
+                    req.query ??= {};
+                    req.query[AUTH_QUERY] = ctx.auth().token;
+                }
+                catch (e) {
+                    console.error(e);
+                }
+            }
+            await options?.beforeConnect?.(req);
+        }
+    }), [options, callerSuppliedToken]);
+    return useWebSocket(module, request, wsOptions);
 };
 export const useSelfAuth = (force = true /*, entity: string = DEFAULT_ENTITY*/) => {
     const context = useContext();

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAChF,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAY,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAAE,OAAmB,EACrG,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,yFAAyF;IACzF,yFAAyF;IACzF,MAAM,mBAAmB,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;IAEjE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,SAAS,GAAG,OAAO,CAAY,GAAG,EAAE,CAAC,CAAC;QAC1C,GAAG,OAAO;QACV,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,wFAAwF;YACxF,0FAA0F;YAC1F,yEAAyE;YACzE,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,GAAG,CAAC,KAAK,KAAK,EAAE,CAAA;oBAChB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;KACF,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAEnC,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AACjD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAY,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}

package/build/index.d.ts

@@ -2,6 +2,6 @@ export * from './components/index.js';
 export type * from './types.js';
 export * from './service.js';
 export * from './consts.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './helper.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAA;AACrC,mBAAmB,YAAY,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAA;AACrC,mBAAmB,YAAY,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA"}

package/build/index.js

@@ -1,6 +1,6 @@
 export * from './components/index.js';
 export * from './service.js';
 export * from './consts.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './helper.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAA;AAErC,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAA;AAErC,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA"}

package/build/login/adopt.d.ts

@@ -0,0 +1,24 @@
+import type { LoginContext } from './types.js';
+/**
+ * The one path an issued bearer token becomes this context's authentication.
+ *
+ * Resolved by alias rather than through `ctx.auth()` so the login host does not require
+ * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
+ * carries the auth service, including one it did not build.
+ *
+ * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
+ * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
+ * the MUI relying party each used to do — leaves the same state on a good day and diverges the
+ * moment any of it changes.
+ */
+export declare const adoptToken: (ctx: LoginContext, token: string) => Promise<void>;
+/**
+ * The one path this context's authentication is dropped, and the exact mirror of {@link adoptToken}.
+ *
+ * `undefined`, not `null`: `undefined` is the declared clearing value, and on the web the auth
+ * service reacts to it by navigating to the dispatcher. Everything that signs a user out goes
+ * through here — the hook, both browser plugins and the surrogate screen — so there is one place
+ * where "signed out" is defined rather than four that agree until one of them changes.
+ */
+export declare const revokeToken: (ctx: LoginContext) => Promise<void>;
+//# sourceMappingURL=adopt.d.ts.map

package/build/login/adopt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,QAAe,YAAY,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAE/E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,QAAe,YAAY,KAAG,OAAO,CAAC,IAAI,CAEjE,CAAA"}

package/build/login/adopt.js

@@ -0,0 +1,28 @@
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js';
+/**
+ * The one path an issued bearer token becomes this context's authentication.
+ *
+ * Resolved by alias rather than through `ctx.auth()` so the login host does not require
+ * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
+ * carries the auth service, including one it did not build.
+ *
+ * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
+ * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
+ * the MUI relying party each used to do — leaves the same state on a good day and diverges the
+ * moment any of it changes.
+ */
+export const adoptToken = async (ctx, token) => {
+    await ctx.service(AUTH_ALIAS).update(token);
+};
+/**
+ * The one path this context's authentication is dropped, and the exact mirror of {@link adoptToken}.
+ *
+ * `undefined`, not `null`: `undefined` is the declared clearing value, and on the web the auth
+ * service reacts to it by navigating to the dispatcher. Everything that signs a user out goes
+ * through here — the hook, both browser plugins and the surrogate screen — so there is one place
+ * where "signed out" is defined rather than four that agree until one of them changes.
+ */
+export const revokeToken = async (ctx) => {
+    await ctx.service(AUTH_ALIAS).update(undefined);
+};
+//# sourceMappingURL=adopt.js.map

package/build/login/adopt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AAG1D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAiB,EAAE,KAAa,EAAiB,EAAE;IAClF,MAAM,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1D,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAiB,EAAiB,EAAE;IACpE,MAAM,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAC9D,CAAC,CAAA"}

package/build/login/consts.d.ts

@@ -0,0 +1,49 @@
+export declare const DEFAULT_ALIAS = "login-service";
+export declare const LOGIN_SERVICE = "login-service";
+/** Priority of a plugin that makes no claim about the environment. */
+export declare const DEFAULT_LOGIN_PRIORITY = 0;
+/** Order given to a method that declares none. */
+export declare const DEFAULT_METHOD_ORDER = 100;
+/**
+ * Name given to the surrogate login window, the marker it records about itself, and the values the
+ * two documents exchange.
+ *
+ * These are a wire protocol between two documents that may be running different builds — an opener
+ * holding an older bundle and a surrogate freshly loaded, or the reverse. They are therefore fixed,
+ * and must never be "tidied" to match a newer vocabulary. That applies to the query names and the
+ * message types added later just as much as to the original three.
+ */
+export declare const LOGIN_SURROGATE_NAME = "owlmeans-oidc-login";
+export declare const LOGIN_TOKEN_MESSAGE = "owlmeans:oidc:popup-token";
+export declare const LOGIN_LOGOUT_MESSAGE = "owlmeans:oidc:popup-logout";
+export declare const LOGIN_SURROGATE_MARKER = "_owlmeans-oidc-popup";
+export declare const LOGIN_SURROGATE_WIDTH = 520;
+export declare const LOGIN_SURROGATE_HEIGHT = 760;
+/**
+ * @deprecated Never centered the window — it carried no `left`/`top`, so the surrogate always
+ * opened wherever the browser's own default popup placement put it. Superseded by
+ * `@owlmeans/web-client`'s `centeredPopupFeatures(LOGIN_SURROGATE_WIDTH, LOGIN_SURROGATE_HEIGHT)`,
+ * computed fresh per call since centering depends on where the browser window currently sits.
+ * Kept, unchanged, for the same reason as the rest of this block: an already-generated app may
+ * carry a copy of code that still imports it.
+ */
+export declare const LOGIN_SURROGATE_FEATURES = "popup=yes,width=520,height=760";
+/** How often a surrogate window is checked for having been closed by the user. */
+export declare const LOGIN_WATCH_INTERVAL = 500;
+/** Carries WHY the surrogate window was opened across the window boundary. */
+export declare const LOGIN_INTENT_QUERY = "intent";
+/**
+ * Carries the address the surrogate should run, so the flow parameters the opener's URL held are
+ * forwarded rather than discarded.
+ */
+export declare const LOGIN_NEXT_QUERY = "next";
+/**
+ * Carries the method the user already chose, one window up.
+ *
+ * A surrogate acting on it is not an auto-redirect in the "never choose for the user" sense: the
+ * choice was made, by a person, in the document that opened this one.
+ */
+export declare const LOGIN_METHOD_QUERY = "method";
+/** Where a browser records that it agreed to one exact set of legal documents. */
+export declare const LOGIN_TERMS_STORAGE = "_owlmeans-login-terms";
+//# sourceMappingURL=consts.d.ts.map

package/build/login/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,eAAO,MAAM,aAAa,kBAAgB,CAAA;AAE1C,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,eAAO,MAAM,oBAAoB,+BAA+B,CAAA;AAEhE,eAAO,MAAM,sBAAsB,yBAAyB,CAAA;AAE5D,eAAO,MAAM,qBAAqB,MAAM,CAAA;AAExC,eAAO,MAAM,sBAAsB,MAAM,CAAA;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,mCACwC,CAAA;AAE7E,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA"}

package/build/login/consts.js

@@ -0,0 +1,49 @@
+export const DEFAULT_ALIAS = 'login-service';
+export const LOGIN_SERVICE = DEFAULT_ALIAS;
+/** Priority of a plugin that makes no claim about the environment. */
+export const DEFAULT_LOGIN_PRIORITY = 0;
+/** Order given to a method that declares none. */
+export const DEFAULT_METHOD_ORDER = 100;
+/**
+ * Name given to the surrogate login window, the marker it records about itself, and the values the
+ * two documents exchange.
+ *
+ * These are a wire protocol between two documents that may be running different builds — an opener
+ * holding an older bundle and a surrogate freshly loaded, or the reverse. They are therefore fixed,
+ * and must never be "tidied" to match a newer vocabulary. That applies to the query names and the
+ * message types added later just as much as to the original three.
+ */
+export const LOGIN_SURROGATE_NAME = 'owlmeans-oidc-login';
+export const LOGIN_TOKEN_MESSAGE = 'owlmeans:oidc:popup-token';
+export const LOGIN_LOGOUT_MESSAGE = 'owlmeans:oidc:popup-logout';
+export const LOGIN_SURROGATE_MARKER = '_owlmeans-oidc-popup';
+export const LOGIN_SURROGATE_WIDTH = 520;
+export const LOGIN_SURROGATE_HEIGHT = 760;
+/**
+ * @deprecated Never centered the window — it carried no `left`/`top`, so the surrogate always
+ * opened wherever the browser's own default popup placement put it. Superseded by
+ * `@owlmeans/web-client`'s `centeredPopupFeatures(LOGIN_SURROGATE_WIDTH, LOGIN_SURROGATE_HEIGHT)`,
+ * computed fresh per call since centering depends on where the browser window currently sits.
+ * Kept, unchanged, for the same reason as the rest of this block: an already-generated app may
+ * carry a copy of code that still imports it.
+ */
+export const LOGIN_SURROGATE_FEATURES = `popup=yes,width=${LOGIN_SURROGATE_WIDTH},height=${LOGIN_SURROGATE_HEIGHT}`;
+/** How often a surrogate window is checked for having been closed by the user. */
+export const LOGIN_WATCH_INTERVAL = 500;
+/** Carries WHY the surrogate window was opened across the window boundary. */
+export const LOGIN_INTENT_QUERY = 'intent';
+/**
+ * Carries the address the surrogate should run, so the flow parameters the opener's URL held are
+ * forwarded rather than discarded.
+ */
+export const LOGIN_NEXT_QUERY = 'next';
+/**
+ * Carries the method the user already chose, one window up.
+ *
+ * A surrogate acting on it is not an auto-redirect in the "never choose for the user" sense: the
+ * choice was made, by a person, in the document that opened this one.
+ */
+export const LOGIN_METHOD_QUERY = 'method';
+/** Where a browser records that it agreed to one exact set of legal documents. */
+export const LOGIN_TERMS_STORAGE = '_owlmeans-login-terms';
+//# sourceMappingURL=consts.js.map

package/build/login/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAExC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,mBAAmB,qBAAqB,WAAW,sBAAsB,EAAE,CAAA;AAE7E,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA"}

package/build/login/credit.d.ts

@@ -0,0 +1,24 @@
+import type { BrandSettings, LoginCreditConfig } from '@owlmeans/config';
+export interface ResolvedCredit {
+    /** Whether "Powered by OwlMeans" is rendered. */
+    poweredBy: boolean;
+    /** The product and organization line, already composed. Null when there is nothing to say. */
+    line: string | null;
+}
+/**
+ * What the bottom of the sign-in screen says.
+ *
+ * It is a copyright notice, so it is composed as one: `© <year> <holder>`. That is the whole
+ * reason `copyright` defaults to on — the name on its own reads as a caption, and an application
+ * that means to assert a copyright would have had to write the mark and the year into a literal
+ * `line` to get one.
+ *
+ * The organization falls back to its slug because an organization record carries no readable name
+ * — so "no name" is the ordinary case, not an error, and a screen that rendered an empty line for
+ * it would be worse than one that renders the slug.
+ *
+ * `line` replaces everything when an app supplies it: a product with its own legal wording should
+ * not have to defeat a composition rule to use it.
+ */
+export declare const resolveCredit: (cfg?: LoginCreditConfig, brand?: BrandSettings, service?: string) => ResolvedCredit;
+//# sourceMappingURL=credit.d.ts.map

package/build/login/credit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit.d.ts","sourceRoot":"","sources":["../../src/login/credit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAExE,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,SAAS,EAAE,OAAO,CAAA;IAClB,8FAA8F;IAC9F,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAuBD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,SAClB,iBAAiB,UAAU,aAAa,YAAY,MAAM,KAC/D,cA2BF,CAAA"}

package/build/login/credit.js

@@ -0,0 +1,58 @@
+/**
+ * The years one notice covers.
+ *
+ * A range only while the first year is genuinely in the past — an app configured with the current
+ * year, or with a year a skewed clock puts in the future, still gets a well-formed notice rather
+ * than `© 2026–2026` or a range that runs backwards.
+ */
+const years = (since, now) => since != null && since > 0 && since < now ? `${since}–${now}` : `${now}`;
+/**
+ * A configured value that was actually SET.
+ *
+ * Empty is how a build-time default spells "unset", and this config is filled from environment
+ * variables a platform delivers — `BRANDING_ORGANIZATION: meta.brandingOrganization ?? ''` is the
+ * shape of every one of them. `??` does not fall through an empty string, so an undelivered
+ * organization used to win the fallback chain and compose a line ending in a bare dash.
+ */
+const set = (value) => value != null && value.trim() !== '' ? value : null;
+/**
+ * What the bottom of the sign-in screen says.
+ *
+ * It is a copyright notice, so it is composed as one: `© <year> <holder>`. That is the whole
+ * reason `copyright` defaults to on — the name on its own reads as a caption, and an application
+ * that means to assert a copyright would have had to write the mark and the year into a literal
+ * `line` to get one.
+ *
+ * The organization falls back to its slug because an organization record carries no readable name
+ * — so "no name" is the ordinary case, not an error, and a screen that rendered an empty line for
+ * it would be worse than one that renders the slug.
+ *
+ * `line` replaces everything when an app supplies it: a product with its own legal wording should
+ * not have to defeat a composition rule to use it.
+ */
+export const resolveCredit = (cfg, brand, service) => {
+    const poweredBy = cfg?.poweredBy ?? true;
+    const literal = set(cfg?.line);
+    if (literal != null) {
+        return { poweredBy, line: literal };
+    }
+    const product = set(cfg?.product) ?? set(brand?.name) ?? set(service);
+    const organization = set(cfg?.organization) ?? set(brand?.organization)
+        ?? set(cfg?.entity) ?? set(brand?.entity);
+    // Whoever the notice names. A product with no organization behind it holds its own copyright,
+    // which is why this falls through to the product rather than dropping the notice.
+    const holder = set(cfg?.holder) ?? organization ?? product;
+    const wording = typeof cfg?.copyright === 'string' ? set(cfg.copyright) : null;
+    const notice = cfg?.copyright === false || holder == null
+        ? organization
+        : wording ?? `© ${years(cfg?.since, new Date().getFullYear())} ${holder}`;
+    // The product is named beside the notice only when it is not already the thing being claimed —
+    // "OwlMeans — © 2026 OwlMeans" says the name twice and neither time usefully.
+    return {
+        poweredBy,
+        line: product != null && notice != null && product !== holder
+            ? `${product} — ${notice}`
+            : notice ?? product,
+    };
+};
+//# sourceMappingURL=credit.js.map

package/build/login/credit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit.js","sourceRoot":"","sources":["../../src/login/credit.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAE,GAAW,EAAU,EAAE,CAC/D,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAA;AAE1E;;;;;;;GAOG;AACH,MAAM,GAAG,GAAG,CAAC,KAAqB,EAAiB,EAAE,CACnD,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAuB,EAAE,KAAqB,EAAE,OAAgB,EAChD,EAAE;IAClB,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,IAAI,IAAI,CAAA;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC9B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACrC,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC;WAClE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAE3C,8FAA8F;IAC9F,kFAAkF;IAClF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,YAAY,IAAI,OAAO,CAAA;IAC1D,MAAM,OAAO,GAAG,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9E,MAAM,MAAM,GAAG,GAAG,EAAE,SAAS,KAAK,KAAK,IAAI,MAAM,IAAI,IAAI;QACvD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,EAAE,CAAA;IAE3E,+FAA+F;IAC/F,8EAA8E;IAC9E,OAAO;QACL,SAAS;QACT,IAAI,EAAE,OAAO,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,MAAM;YAC3D,CAAC,CAAC,GAAG,OAAO,MAAM,MAAM,EAAE;YAC1B,CAAC,CAAC,MAAM,IAAI,OAAO;KACtB,CAAA;AACH,CAAC,CAAA"}

package/build/login/env.d.ts

@@ -0,0 +1,32 @@
+import type { LoginEnv } from './types.js';
+/**
+ * Whether this document is embedded in a frame.
+ *
+ * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
+ * differs and a `top` that cannot be reached both mean "framed".
+ */
+export declare const isEmbedded: () => boolean;
+/**
+ * Record that this window is the surrogate login window, while that is still knowable.
+ *
+ * Must run on the surrogate's **first** load, before the flow navigates to the provider:
+ * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
+ * context goes cross-origin — so by the time the provider redirects back, the name is gone and
+ * this window would look like an ordinary tab.
+ *
+ * Idempotent, and a no-op in every window that is not the surrogate.
+ */
+export declare const markSurrogate: () => void;
+/** Whether this document is the surrogate login window. */
+export declare const isSurrogate: () => boolean;
+/** Forget the surrogate marker — called once its token has been handed back. */
+export declare const clearSurrogate: () => void;
+/**
+ * Default login environment.
+ *
+ * The single source of environment truth for cascade selection — a plugin's `match` reads this
+ * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
+ * own descriptor.
+ */
+export declare const defaultLoginEnv: () => LoginEnv;
+//# sourceMappingURL=env.d.ts.map

package/build/login/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAO,OAM7B,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,QAAO,IAUhC,CAAA;AAED,2DAA2D;AAC3D,eAAO,MAAM,WAAW,QAAO,OAY9B,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,cAAc,QAAO,IAOjC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,QAAO,QAclC,CAAA"}

package/build/login/env.js

@@ -0,0 +1,84 @@
+import { LOGIN_SURROGATE_MARKER, LOGIN_SURROGATE_NAME } from './consts.js';
+/**
+ * Whether this document is embedded in a frame.
+ *
+ * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
+ * differs and a `top` that cannot be reached both mean "framed".
+ */
+export const isEmbedded = () => {
+    try {
+        return window.self !== window.top;
+    }
+    catch {
+        return true;
+    }
+};
+/**
+ * Record that this window is the surrogate login window, while that is still knowable.
+ *
+ * Must run on the surrogate's **first** load, before the flow navigates to the provider:
+ * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
+ * context goes cross-origin — so by the time the provider redirects back, the name is gone and
+ * this window would look like an ordinary tab.
+ *
+ * Idempotent, and a no-op in every window that is not the surrogate.
+ */
+export const markSurrogate = () => {
+    if (typeof window === 'undefined' || window.name !== LOGIN_SURROGATE_NAME) {
+        return;
+    }
+    try {
+        window.sessionStorage.setItem(LOGIN_SURROGATE_MARKER, '1');
+    }
+    catch {
+        // Storage can be unavailable (private modes, blocked cookies). The `window.name` check still
+        // covers the case where nothing cross-origin happened in between.
+    }
+};
+/** Whether this document is the surrogate login window. */
+export const isSurrogate = () => {
+    if (typeof window === 'undefined') {
+        return false;
+    }
+    if (window.name === LOGIN_SURROGATE_NAME) {
+        return true;
+    }
+    try {
+        return window.sessionStorage.getItem(LOGIN_SURROGATE_MARKER) === '1';
+    }
+    catch {
+        return false;
+    }
+};
+/** Forget the surrogate marker — called once its token has been handed back. */
+export const clearSurrogate = () => {
+    if (typeof window === 'undefined') {
+        return;
+    }
+    try {
+        window.sessionStorage.removeItem(LOGIN_SURROGATE_MARKER);
+    }
+    catch { /* nothing to clean up if storage was never available */ }
+};
+/**
+ * Default login environment.
+ *
+ * The single source of environment truth for cascade selection — a plugin's `match` reads this
+ * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
+ * own descriptor.
+ */
+export const defaultLoginEnv = () => {
+    const hasWindow = typeof window !== 'undefined';
+    if (!hasWindow) {
+        return { hasWindow, embedded: false, surrogate: false, hasOpener: false };
+    }
+    return {
+        hasWindow,
+        embedded: isEmbedded(),
+        surrogate: isSurrogate(),
+        // `Cross-Origin-Opener-Policy: same-origin` from the provider severs this permanently, which
+        // is why it is observed rather than assumed from "we were opened by someone".
+        hasOpener: window.opener != null,
+    };
+};
+//# sourceMappingURL=env.js.map

package/build/login/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAG1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,GAAY,EAAE;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1E,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,kEAAkE;IACpE,CAAC;AACH,CAAC,CAAA;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG,GAAY,EAAE;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,GAAG,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAS,EAAE;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;AACtE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAa,EAAE;IAC5C,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IAC3E,CAAC;IAED,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,UAAU,EAAE;QACtB,SAAS,EAAE,WAAW,EAAE;QACxB,6FAA6F;QAC7F,8EAA8E;QAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KACjC,CAAA;AACH,CAAC,CAAA"}

package/build/login/flow.d.ts

@@ -0,0 +1,20 @@
+import type { FlowModel } from '@owlmeans/flow';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export declare const enterOidcAuthorization: (model: FlowModel) => FlowModel;
+//# sourceMappingURL=flow.d.ts.map

package/build/login/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,UAAW,SAAS,KAAG,SAsBzD,CAAA"}

package/build/login/flow.js

@@ -0,0 +1,39 @@
+import { FLOW_PLACEHOLDER, OidcAuthStep, STD_OIDC_FLOW } from '@owlmeans/flow';
+import { DEFAULT_ENTITY } from '../consts.js';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export const enterOidcAuthorization = (model) => {
+    const state = model.state();
+    if (state.flow !== STD_OIDC_FLOW || state.step !== OidcAuthStep.Dispatch) {
+        return model;
+    }
+    const target = model.step().service;
+    if (state.service == null || state.service === '') {
+        model.target(target);
+    }
+    // The entity travels to this app's own backend, which resolves its default provider by `def`
+    // alone. It still has to BE there: the init endpoint rejects a body without one.
+    if (state.entityId == null) {
+        model.entity(DEFAULT_ENTITY);
+    }
+    if (target === FLOW_PLACEHOLDER) {
+        model.transit(OidcAuthStep.Ephemeral, true);
+    }
+    return model;
+};
+//# sourceMappingURL=flow.js.map

package/build/login/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAgB,EAAa,EAAE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAA;IACnC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,6FAA6F;IAC7F,iFAAiF;IACjF,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/login/hook.d.ts

@@ -0,0 +1,37 @@
+import type { MouseEvent } from 'react';
+/**
+ * Wiring for a "Log in" control: where it points, and what it does when clicked.
+ *
+ * The caller renders one control and attaches one handler — which browsing context the flow can
+ * actually complete in is the login service's problem, not the app's. An ordinary tab redirects;
+ * an app embedded in a frame runs the flow one window up, because the provider refuses to be
+ * framed and its cookies are third-party there.
+ *
+ * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
+ * opened after the user gesture has finished being handled is eaten by the popup blocker.
+ *
+ * The dispatcher entrypoint is resolved INSIDE the hook, never at module scope. Module bodies run
+ * while the app is still being imported, before `registerEntrypoints` has put anything on the
+ * context, and a top-level lookup throws `Entrypoint dispatcher not found` — which escapes during
+ * import, takes the whole render down, and paints an empty page with no component at fault.
+ */
+export declare const useLogin: (target?: string) => readonly [string, (event?: MouseEvent) => void];
+/**
+ * Wiring for a "Log out" control.
+ *
+ * One control, one handler, no decision — the mirror of {@link useLogin}. Where the session has to
+ * be ended (here, or one window up in a surrogate whose storage partition this document cannot
+ * reach) is the login plugin's call.
+ *
+ * NOT async, and nothing is awaited before delegating: logging out of a framed application opens a
+ * window, and a window opened after the gesture has finished being handled is eaten by the popup
+ * blocker. The surrogate entrypoint is resolved INSIDE the hook for the same reason `useLogin`
+ * resolves the dispatcher there.
+ *
+ * The return shape stays a bare handler rather than `useLogin`'s tuple: a logout control has no
+ * address to point at, and every generated application carries a copy of a component that writes
+ * `const onLogOut = useLogout()`. `(event?: MouseEvent) => void` is assignable to `() => void`, so
+ * `onClick={onLogOut}` keeps compiling everywhere.
+ */
+export declare const useLogout: (target?: string) => ((event?: MouseEvent) => void);
+//# sourceMappingURL=hook.d.ts.map

package/build/login/hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/login/hook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAUvC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ,YAAa,MAAM,KAAG,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,KAAK,IAAI,CAmBxF,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,SAAS,YAAa,MAAM,KAAG,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,KAAK,IAAI,CAcxE,CAAA"}