@owlmeans/client-auth 0.1.18-rc.4 → 0.1.18-rc.41

package/build/manager/plugins/methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.js","sourceRoot":"","sources":["../../../src/manager/plugins/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAG3E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAE/C;;;;;;;;;;;;;GAaG;AACH,MAAM,SAAS,GAAG,CAAC,MAA4B,EAAE,GAAuB,EAAW,EAAE;IACnF,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAChE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAA;AACjD,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,KAAK,EAAE,wBAAwB;IAE/B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,eAAe,EAAE;SAC3B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,MAAM,EAAe,EAAE;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAO,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAA;QAE1B,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,oBAAoB;YACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,EAAE,IAAI,EAAE;YAEhB,2FAA2F;YAC3F,gFAAgF;YAChF,KAAK,EAAE,SAAS,CAAC,EAAE;gBACjB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;gBACpE,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAmB,oBAAoB,CAAC,CAAA;gBACvF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;gBAExE,OAAO,KAAK,CAAC,KAAK,CAAC;oBACjB,GAAG;oBACH,oFAAoF;oBACpF,8EAA8E;oBAC9E,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,IAAI;wBAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;wBAC1E,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAA;YACJ,CAAC;SACF,CAAA;IACH,CAAC,CAAC;CACL,CAAA"}

package/build/manager/plugins/re-captcha.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"re-captcha.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAGtD,eAAO,MAAM,eAAe,EAAE,oBA0B7B,CAAA"}
+{"version":3,"file":"re-captcha.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAGtD,eAAO,MAAM,eAAe,EAAE,oBAiC7B,CAAA"}

package/build/manager/plugins/re-captcha.js

@@ -3,6 +3,11 @@ import { AuthenticationStage, AuthenticationType } from '@owlmeans/auth';
 import { useEffect } from 'react';
 export const reCaptchaPlugin = {
     type: AuthenticationType.ReCaptcha,
+    // A STEP inside another flow, never a way to sign in — so it is registered and never offered.
+    method: { hidden: true },
+    // Its widget is a `Renderer` a panel package assigns. `hidden` already keeps it off the sign-in
+    // screen; this is what the flow that DOES drive it can check before handing it a stage.
+    requiresRenderer: true,
     Implementation: Renderer => ({ type, stage, control, params }) => {
         Renderer = Renderer ?? reCaptchaPlugin.Renderer;
         // ReCaptcha authentication requests allowance unconditionally 

package/build/manager/plugins/re-captcha.js.map

@@ -1 +1 @@
-{"version":3,"file":"re-captcha.js","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,IAAI,EAAE,kBAAkB,CAAC,SAAS;IAElC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,QAAQ,GAAG,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAA;QAE/C,+DAA+D;QAC/D,+CAA+C;QAC/C,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC/C,KAAK,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YACjE,CAAC;QACH,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAEV,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,8CAA8C,CAAC,CAAA;QACvE,CAAC;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACjF,CAAC;IAED;;;OAGG;IACH,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;CAC1C,CAAA"}
+{"version":3,"file":"re-captcha.js","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,IAAI,EAAE,kBAAkB,CAAC,SAAS;IAElC,8FAA8F;IAC9F,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;IAExB,gGAAgG;IAChG,wFAAwF;IACxF,gBAAgB,EAAE,IAAI;IAEtB,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,QAAQ,GAAG,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAA;QAE/C,+DAA+D;QAC/D,+CAA+C;QAC/C,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC/C,KAAK,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YACjE,CAAC;QACH,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAEV,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,8CAA8C,CAAC,CAAA;QACvE,CAAC;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACjF,CAAC;IAED;;;OAGG;IACH,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;CAC1C,CAAA"}

package/build/manager/plugins/registry.d.ts

@@ -0,0 +1,20 @@
+import type { ClientAuthType } from '../components/authentication/types.js';
+import type { AuthenticationPlugin } from './types.js';
+/**
+ * The registry every authentication plugin lands in.
+ *
+ * It stays a plain exported object, and every registration stays a plain assignment, because four
+ * packages already write into it from side-effect imports (`web-oidc-rp`, `mui-oidc-rp`,
+ * `web-auth`, and this package's own `index`). Hiding it behind an API would break all of them for
+ * no gain — the functions below simply read it.
+ *
+ * It lives in its own module rather than in `index.ts` so that the method source can read it
+ * without the two importing each other.
+ */
+export declare const plugins: {
+    [type: ClientAuthType]: AuthenticationPlugin;
+};
+export declare const registerAuthPlugin: (plugin: AuthenticationPlugin) => AuthenticationPlugin;
+export declare const getAuthPlugin: (type: ClientAuthType) => AuthenticationPlugin | undefined;
+export declare const listAuthPlugins: () => AuthenticationPlugin[];
+//# sourceMappingURL=registry.d.ts.map

package/build/manager/plugins/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,EAAE;IAAE,CAAC,IAAI,EAAE,cAAc,GAAG,oBAAoB,CAAA;CAAO,CAAA;AAE3E,eAAO,MAAM,kBAAkB,WAAY,oBAAoB,KAAG,oBAIjE,CAAA;AAED,eAAO,MAAM,aAAa,SAAU,cAAc,KAAG,oBAAoB,GAAG,SAC7D,CAAA;AAEf,eAAO,MAAM,eAAe,QAAO,oBAAoB,EAA4B,CAAA"}

package/build/manager/plugins/registry.js

@@ -0,0 +1,19 @@
+/**
+ * The registry every authentication plugin lands in.
+ *
+ * It stays a plain exported object, and every registration stays a plain assignment, because four
+ * packages already write into it from side-effect imports (`web-oidc-rp`, `mui-oidc-rp`,
+ * `web-auth`, and this package's own `index`). Hiding it behind an API would break all of them for
+ * no gain — the functions below simply read it.
+ *
+ * It lives in its own module rather than in `index.ts` so that the method source can read it
+ * without the two importing each other.
+ */
+export const plugins = {};
+export const registerAuthPlugin = (plugin) => {
+    plugins[plugin.type] = plugin;
+    return plugin;
+};
+export const getAuthPlugin = (type) => plugins[type];
+export const listAuthPlugins = () => Object.values(plugins);
+//# sourceMappingURL=registry.js.map

package/build/manager/plugins/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/manager/plugins/registry.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,OAAO,GAAqD,EAAE,CAAA;AAE3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA4B,EAAwB,EAAE;IACvF,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;IAE7B,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAoB,EAAoC,EAAE,CACtF,OAAO,CAAC,IAAI,CAAC,CAAA;AAEf,MAAM,CAAC,MAAM,eAAe,GAAG,GAA2B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA"}

package/build/manager/plugins/tunnel-consumer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel-consumer.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/tunnel-consumer.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAStD,eAAO,MAAM,sBAAsB,EAAE,oBA8DpC,CAAA"}
+{"version":3,"file":"tunnel-consumer.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/tunnel-consumer.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAStD,eAAO,MAAM,sBAAsB,EAAE,oBAuEpC,CAAA"}

package/build/manager/plugins/tunnel-consumer.js

@@ -7,11 +7,18 @@ import { RELY_ACTION_TIMEOUT, RELY_PIN_PERFIX } from '@owlmeans/auth-common';
 import { createWalletFacade } from './tunnel/wallet.js';
 export const tunnelConsumerUIPlugin = {
     type: AuthenticationType.WalletConsumer,
+    method: { order: 400, icon: 'wallet' },
+    // The PIN form is a `Renderer` a panel package assigns; without one the Implementation throws on
+    // mount, so the method must not be offered.
+    requiresRenderer: true,
     Implementation: renderer => ({ type, stage, control, params }) => {
         type = type ?? AuthenticationType.WalletConsumer;
         const Renderer = renderer
             ?? tunnelConsumerUIPlugin.Renderer;
-        const connection = useWs(AUTHEN_RELY);
+        // A wallet-tunnel handshake is one-shot and stateful in the browser tab that started it — a
+        // reconnect would dial a brand-new rely session the wallet was never asked to approve, so a
+        // drop here is a real failure (`SocketTimeout` below), never something to retry underneath.
+        const connection = useWs(AUTHEN_RELY, undefined, { reconnect: false });
         if (Renderer == null) {
             throw new SyntaxError('Renderer is not defined for WalletConsumer plugin');
         }

package/build/manager/plugins/tunnel-consumer.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel-consumer.js","sourceRoot":"","sources":["../../../src/manager/plugins/tunnel-consumer.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAI3G,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,cAAc;IAEvC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,IAAI,GAAG,IAAI,IAAI,kBAAkB,CAAC,cAAc,CAAA;QAChD,MAAM,QAAQ,GAA6C,QAAQ;eAC9D,sBAAsB,CAAC,QAAQ,CAAA;QAEpC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,CAAA;QAErC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,mDAAmD,CAAC,CAAA;QAC5E,CAAC;QAED,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAA;gBAClD,UAAU,CAAC,IAAI,CACb,mBAAmB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,CAAC,aAAa,EAAE,CACrE,CAAC,IAAI,CAAC,KAAK,EAAE,SAA4B,EAAE,EAAE;oBAC5C,OAAO,CAAC,SAAS,GAAG,SAAS,CAAA;oBAC7B,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;oBAErD,UAAU,CAAC,kBAAkB,GAAG,mBAAmB,GAAG,IAAI,CAAA;gBAC5D,CAAC,CAAC,CAAA;gBAEF,UAAU,CAAC,YAAY,GAAG,KAAK,EAAE,KAA0B,EAAE,OAAY,EAAE,EAAE;oBAC3E,IAAI,KAAK,KAAK,mBAAmB,CAAC,aAAa,EAAE,CAAC;wBAChD,IAAI,CAAC;4BACH,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gCAC7B,MAAM,IAAI,WAAW,CAAC,kEAAkE,CAAC,CAAA;4BAC3F,CAAC;4BACD,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAA;4BAC/D,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;wBACzD,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;4BACxB,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;wBAC3B,CAAC;oBACH,CAAC;oBACD,OAAO,CAAC,IAAI,EAAE,IAAW,CAAC,CAAA;gBAC5B,CAAC,CAAA;gBAED,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;oBACvC,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBACzD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;oBACnD,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QAEhB,MAAM,MAAM,GAAG,WAAW,CACxB,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,EACvE,CAAC,UAAU,IAAI,IAAI,CAAC,CACvB,CAAA;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACnH,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,YAAY,EAAC,EAAE;QACjC,4CAA4C;QAC5C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,OAA8B,EAAE,EAAE,CAAC,KAAK,EAAE,IAAa,EAAE,EAAE;IAC/F,MAAM,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAwB,mBAAmB,CAAC,YAAY,EAAE;YACpF,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE;YAC7C,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC,GAAG;YACtC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,QAAQ,CAAC,KAAK;YACpB,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,CAAC,UAAU,CAAC;SACrB,CAAC,CAAA;QAEF,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,aAAa,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,kEAAkE,CAAC,CAAA;YAC3F,CAAC;YACD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QACxD,CAAC;QACD,SAAS;IACX,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"tunnel-consumer.js","sourceRoot":"","sources":["../../../src/manager/plugins/tunnel-consumer.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAI3G,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,cAAc;IAEvC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;IAEtC,iGAAiG;IACjG,4CAA4C;IAC5C,gBAAgB,EAAE,IAAI;IAEtB,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,IAAI,GAAG,IAAI,IAAI,kBAAkB,CAAC,cAAc,CAAA;QAChD,MAAM,QAAQ,GAA6C,QAAQ;eAC9D,sBAAsB,CAAC,QAAQ,CAAA;QAEpC,4FAA4F;QAC5F,4FAA4F;QAC5F,4FAA4F;QAC5F,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;QAEtE,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,mDAAmD,CAAC,CAAA;QAC5E,CAAC;QAED,SAAS,CAAC,GAAG,EAAE;YACb,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAA;gBAClD,UAAU,CAAC,IAAI,CACb,mBAAmB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,CAAC,aAAa,EAAE,CACrE,CAAC,IAAI,CAAC,KAAK,EAAE,SAA4B,EAAE,EAAE;oBAC5C,OAAO,CAAC,SAAS,GAAG,SAAS,CAAA;oBAC7B,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;oBAErD,UAAU,CAAC,kBAAkB,GAAG,mBAAmB,GAAG,IAAI,CAAA;gBAC5D,CAAC,CAAC,CAAA;gBAEF,UAAU,CAAC,YAAY,GAAG,KAAK,EAAE,KAA0B,EAAE,OAAY,EAAE,EAAE;oBAC3E,IAAI,KAAK,KAAK,mBAAmB,CAAC,aAAa,EAAE,CAAC;wBAChD,IAAI,CAAC;4BACH,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gCAC7B,MAAM,IAAI,WAAW,CAAC,kEAAkE,CAAC,CAAA;4BAC3F,CAAC;4BACD,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAA;4BAC/D,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;wBACzD,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;4BACxB,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;wBAC3B,CAAC;oBACH,CAAC;oBACD,OAAO,CAAC,IAAI,EAAE,IAAW,CAAC,CAAA;gBAC5B,CAAC,CAAA;gBAED,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;oBACvC,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;wBACzD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;oBACnD,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QAEhB,MAAM,MAAM,GAAG,WAAW,CACxB,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,EACvE,CAAC,UAAU,IAAI,IAAI,CAAC,CACvB,CAAA;QAED,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAI,CAAA;IACnH,CAAC;IAED,YAAY,EAAE,KAAK,EAAC,YAAY,EAAC,EAAE;QACjC,4CAA4C;QAC5C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,OAA8B,EAAE,EAAE,CAAC,KAAK,EAAE,IAAa,EAAE,EAAE;IAC/F,MAAM,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAwB,mBAAmB,CAAC,YAAY,EAAE;YACpF,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE;YAC7C,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC,GAAG;YACtC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,QAAQ,CAAC,KAAK;YACpB,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,CAAC,UAAU,CAAC;SACrB,CAAC,CAAA;QAEF,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,aAAa,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,kEAAkE,CAAC,CAAA;YAC3F,CAAC;YACD,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QACxD,CAAC;QACD,SAAS;IACX,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;AACH,CAAC,CAAA"}

package/build/manager/plugins/types.d.ts

@@ -1,9 +1,62 @@
 import type { FC } from 'react';
+import type { LoginMethodEmphasis } from '@owlmeans/config';
+import type { LoginMethodContext } from '../../login/types.js';
 import type { AuthenticationControl, AuthenticationRenderer, AuthenticationRendererProps } from '../components/authentication/types.js';
 export interface AuthenticationPlugin extends Pick<AuthenticationControl, "beforeAuthenticate" | "afterAuthenticate">, Pick<Partial<AuthenticationControl>, "authenticate"> {
     type: string;
     Implementation: PluginImplemnetation;
     Renderer?: AuthenticationRenderer;
+    /**
+     * This plugin's `Implementation` cannot render without a `Renderer` a UI package supplies.
+     *
+     * It is declared rather than inferred because there is nothing to infer it from: a plugin that
+     * renders its own form and one that throws `Renderer is not defined` are the same object until
+     * the screen mounts. Declaring it is what lets the sign-in screen leave out a method whose
+     * renderer nobody registered, instead of offering a button that crashes the page it opens.
+     */
+    requiresRenderer?: boolean;
+    /**
+     * How this method presents itself on the sign-in screen.
+     *
+     * Absent means the plugin is never OFFERED — it is still reachable by type, which is what a
+     * step-in-a-flow (re-captcha) and a plugin an app deep-links to both need. Every field is
+     * optional so an existing plugin object keeps type-checking without being touched.
+     */
+    method?: AuthMethodMeta;
+}
+export interface AuthMethodMeta {
+    /** Defaults to the plugin's `type`. */
+    id?: string;
+    /** Literal fallback used when no translation resolves. */
+    label?: string;
+    /** Key under the `auth` library's `login.method.*`; defaults to the id. */
+    i18nKey?: string;
+    /** Icon registry NAME, never markup — this package must stay free of an icon library. */
+    icon?: string;
+    /** Ascending; default 100. */
+    order?: number;
+    emphasis?: LoginMethodEmphasis;
+    /**
+     * Never offered unless the configuration explicitly enables it.
+     *
+     * This is the secret-key gate: an operator login is registered like any other method and must
+     * not become offerable merely by being registered.
+     */
+    restricted?: boolean;
+    /** Registered, but never a choice. */
+    hidden?: boolean;
+    /**
+     * Whether the application this method is about to be offered in actually wired it.
+     *
+     * The plugin registry is global and is written to by side-effect imports, so being registered
+     * says only that some bundle pulled the module in — and modules arrive in groups. An app that
+     * wanted one method out of a package gets every method that package registers, including ones
+     * whose first act is to look up a service its context never appended. This is where a plugin
+     * says so, per context, at render time; `false` leaves it off the screen.
+     *
+     * Absent means "always", which is right for a plugin that needs nothing but itself.
+     */
+    available?: (ctx: LoginMethodContext) => boolean;
 }
 export interface PluginImplemnetation {
     (Renderer?: AuthenticationRenderer): FC<AuthenticationRendererProps>;

package/build/manager/plugins/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAC/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,2BAA2B,EAAG,MAAM,uCAAuC,CAAA;AAExI,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAChD,qBAAqB,EAAE,oBAAoB,GAAG,mBAAmB,CAClE,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC;IACrD,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,oBAAoB,CAAA;IACpC,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAA;CACrE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,2BAA2B,EAAG,MAAM,uCAAuC,CAAA;AAExI,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAChD,qBAAqB,EAAE,oBAAoB,GAAG,mBAAmB,CAClE,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC;IACrD,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,oBAAoB,CAAA;IACpC,QAAQ,CAAC,EAAE,sBAAsB,CAAA;IACjC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAA;CACjD;AAED,MAAM,WAAW,oBAAoB;IACnC,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAA;CACrE"}

package/build/service.js

@@ -12,7 +12,7 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
         },
         authenticate: async (token) => {
             const context = assertContext(service.ctx, location);
-            const [authToken] = await context.entrypoint(DISPATCHER_AUTHEN)
+            const authToken = await context.entrypoint(DISPATCHER_AUTHEN)
                 .call({ body: token });
             await service.update(authToken.token);
         },

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGtE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,KAAK,EAAE,CAAA;IACxC,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,IAAI;QAElD,MAAM,EAAE,KAAK,IAAO,EAAE;YACpB,OAAO,KAAK,CAAM,CAAA;QACpB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAEpD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAA8B,iBAAiB,CAAC;iBACzF,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAExB,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;YAErB,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAA;gBAExB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;gBACtD,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAElC,OAAM;YACR,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;YACtD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAE/C,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC3E,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnC,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;gBACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAE/C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;oBAE1B,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;wBAChB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;wBACzB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAA;wBACxB,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;wBAElC,OAAO,IAAI,CAAA;oBACb,CAAC;oBAED,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC1C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;oBAErB,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAE3E,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;gBACnC,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,CAAA;QAC9B,CAAC;QAED,IAAI,EAAE,GAAG,EAAE;YACT,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,kBAAkB,EAAE,CAAA;YAChC,CAAC;YAED,OAAO,OAAO,CAAC,IAAI,CAAA;QACrB,CAAC;QAED,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;KACjE,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IACzB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAEtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAE1C,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGtE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,KAAK,EAAE,CAAA;IACxC,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,IAAI;QAElD,MAAM,EAAE,KAAK,IAAO,EAAE;YACpB,OAAO,KAAK,CAAM,CAAA;QACpB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAEpD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CAA8B,iBAAiB,CAAC;iBACvF,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAExB,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;YAErB,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAA;gBAExB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;gBACtD,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAElC,OAAM;YACR,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;YACtD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAE/C,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC3E,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnC,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;gBACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAE/C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;oBAE1B,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;wBAChB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;wBACzB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAA;wBACxB,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;wBAElC,OAAO,IAAI,CAAA;oBACb,CAAC;oBAED,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC1C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;oBAErB,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAE3E,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;gBACnC,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,CAAA;QAC9B,CAAC;QAED,IAAI,EAAE,GAAG,EAAE;YACT,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,kBAAkB,EAAE,CAAA;YAChC,CAAC;YAED,OAAO,OAAO,CAAC,IAAI,CAAA;QACrB,CAAC;QAED,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;KACjE,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IACzB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAEtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAE1C,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.4",
+  "version": "0.1.18-rc.41",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -27,12 +27,12 @@
       "module": "./build/manager/index.js",
       "types": "./build/manager/index.d.ts"
     },
-    "./manager/modules": {
-      "import": "./build/manager/modules.js",
-      "require": "./build/manager/modules.js",
-      "default": "./build/manager/modules.js",
-      "module": "./build/manager/modules.js",
-      "types": "./build/manager/modules.d.ts"
+    "./manager/entrypoints": {
+      "import": "./build/manager/entrypoints.js",
+      "require": "./build/manager/entrypoints.js",
+      "default": "./build/manager/entrypoints.js",
+      "module": "./build/manager/entrypoints.js",
+      "types": "./build/manager/entrypoints.d.ts"
     },
     "./manager/plugins": {
       "import": "./build/manager/plugins/exports.js",
@@ -40,27 +40,36 @@
       "default": "./build/manager/plugins/exports.js",
       "module": "./build/manager/plugins/exports.js",
       "types": "./build/manager/plugins/exports.d.ts"
+    },
+    "./login": {
+      "import": "./build/login/index.js",
+      "require": "./build/login/index.js",
+      "default": "./build/login/index.js",
+      "module": "./build/login/index.js",
+      "types": "./build/login/index.d.ts"
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.4",
-    "@owlmeans/auth-common": "^0.1.18-rc.4",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.4",
-    "@owlmeans/basic-keys": "^0.1.18-rc.4",
-    "@owlmeans/client": "^0.1.18-rc.4",
-    "@owlmeans/client-context": "^0.1.18-rc.4",
-    "@owlmeans/client-flow": "^0.1.18-rc.4",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.4",
-    "@owlmeans/client-resource": "^0.1.18-rc.4",
-    "@owlmeans/client-socket": "^0.1.18-rc.4",
-    "@owlmeans/context": "^0.1.18-rc.4",
-    "@owlmeans/did": "^0.1.18-rc.4",
-    "@owlmeans/error": "^0.1.18-rc.4",
-    "@owlmeans/flow": "^0.1.18-rc.4",
-    "@owlmeans/entrypoint": "^0.1.18-rc.4",
-    "@owlmeans/resource": "^0.1.18-rc.4",
-    "@owlmeans/socket": "^0.1.18-rc.4",
-    "@owlmeans/web-flow": "^0.1.18-rc.4",
+    "@owlmeans/auth": "^0.1.18-rc.30",
+    "@owlmeans/auth-common": "^0.1.18-rc.32",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.31",
+    "@owlmeans/basic-keys": "^0.1.18-rc.33",
+    "@owlmeans/client": "^0.1.18-rc.35",
+    "@owlmeans/client-context": "^0.1.18-rc.33",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.32",
+    "@owlmeans/client-flow": "^0.1.18-rc.37",
+    "@owlmeans/client-resource": "^0.1.18-rc.32",
+    "@owlmeans/client-socket": "^0.1.18-rc.33",
+    "@owlmeans/config": "^0.1.18-rc.32",
+    "@owlmeans/context": "^0.1.18-rc.28",
+    "@owlmeans/did": "^0.1.18-rc.31",
+    "@owlmeans/entrypoint": "^0.1.18-rc.31",
+    "@owlmeans/error": "^0.1.18-rc.30",
+    "@owlmeans/flow": "^0.1.18-rc.33",
+    "@owlmeans/i18n": "^0.1.18-rc.31",
+    "@owlmeans/resource": "^0.1.18-rc.30",
+    "@owlmeans/socket": "^0.1.18-rc.28",
+    "@owlmeans/web-flow": "^0.1.18-rc.36",
     "@scure/base": "^2.3.0"
   },
   "peerDependencies": {
@@ -69,8 +78,8 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.4",
-    "@types/bun": "^1.3.14",
+    "@owlmeans/test-auth": "^0.1.18-rc.31",
+    "@types/bun": "^1.4.0",
     "@types/react": "^19.2.17",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/components/dispatcher/component.tsx

@@ -9,7 +9,7 @@ import type { AuthService } from '@owlmeans/auth-common'
 import { useNavigate } from '@owlmeans/client'
 import type { AbstractRequest } from '@owlmeans/entrypoint'
 import type { FlowService } from '@owlmeans/client-flow'
-import { DEFAULT_ALIAS as FLOW_SERVICE } from '@owlmeans/client-flow'
+import { DEFAULT_ALIAS as FLOW_SERVICE, resumeSuspendedFlow } from '@owlmeans/client-flow'
 import { FLOW_PLACEHOLDER, OidcAuthStep, STD_OIDC_FLOW } from '@owlmeans/flow'
 import { SERVICE_PARAM } from '@owlmeans/web-flow'
 
@@ -18,8 +18,21 @@ export const DispatcherHOC: TDispatcherHOC = Renderer => ({ context, params, ali
 
   const navigator = useNavigate()
   const navigate = useCallback(async () => {
-    alias = alias == null || alias === DISPATCHER ? HOME : alias
-    const module = context.module<ClientEntrypoint<string>>(alias)
+    if (alias == null || alias === DISPATCHER) {
+      // A sign-in that started elsewhere — a device or authorization-code consent screen, most
+      // commonly — suspended itself here before leaving. Resuming it takes priority over the
+      // ordinary HOME landing, and does so BEFORE `alias` is overwritten, because once it is
+      // `HOME` there is no way back to tell the two cases apart.
+      const landing = await resumeSuspendedFlow(context)
+      if (landing != null) {
+        await navigator.navigate(
+          context.entrypoint<ClientEntrypoint<string>>(landing.entrypoint), { query: landing.query }
+        )
+        return
+      }
+      alias = HOME
+    }
+    const module = context.entrypoint<ClientEntrypoint<string>>(alias)
     if (alias === HOME) {
       params = {}
       query = {}

package/src/entrypoints.ts

@@ -0,0 +1,10 @@
+
+import { bind, bindScreen, stab } from '@owlmeans/client-entrypoint'
+import { authProtocols } from '@owlmeans/auth-common'
+
+/** Browser entrypoints for the authentication protocols every client may call. */
+export const entrypoints = [bind(authProtocols.dispatcherAuthenticate)]
+
+/** Bind the external-authentication screen to one explicitly selected service. */
+export const bindExternalAuthentication = (service: string) =>
+  bindScreen(authProtocols.flowEnter, stab, { routeOptions: { overrides: { service } } })

package/src/helper.ts

@@ -2,6 +2,7 @@ import { useContext, useNavigate } from '@owlmeans/client'
 import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 import { provideRequest } from '@owlmeans/client-entrypoint'
 import { useWs as useWebSocket } from '@owlmeans/client-socket'
+import type { WsOptions } from '@owlmeans/client-socket'
 import type { AbstractRequest } from '@owlmeans/entrypoint'
 import type { AuthServiceAppend } from './types.js'
 import { useEffect, useMemo, useState } from 'react'
@@ -12,7 +13,7 @@ import { AUTH_QUERY, DISPATCHER } from '@owlmeans/auth'
 // import { OidcAuthStep } from '@owlmeans/flow'
 
 export const useWs = (
-  module: string | ClientEntrypoint<any>, _request?: Partial<AbstractRequest<any>>
+  module: string | ClientEntrypoint<any>, _request?: Partial<AbstractRequest<any>>, options?: WsOptions
 ) => {
   const ctx = useContext() as unknown as AuthServiceAppend & ClientContext
 
@@ -20,9 +21,13 @@ export const useWs = (
     () => typeof module === 'string' ? ctx.entrypoint<ClientEntrypoint>(module) : module, [module]
   )
 
+  // Captured before the token is filled in below, so a caller who supplied their own token
+  // keeps full control of it across a reconnect too — `beforeConnect` only refreshes ours.
+  const callerSuppliedToken = _request?.query?.[AUTH_QUERY] != null
+
   const request = useMemo(() => {
     if (_request == null) {
-      _request = provideRequest(mod.getAlias(), mod.getPath())
+      _request = provideRequest(mod.alias, mod.path())
     }
     try {
       if (_request?.query?.[AUTH_QUERY] == null) {
@@ -38,7 +43,25 @@ export const useWs = (
     return _request
   }, [_request])
 
-  return useWebSocket(module, request)
+  const wsOptions = useMemo<WsOptions>(() => ({
+    ...options,
+    beforeConnect: async req => {
+      // A reconnect can land minutes after the socket first opened — refresh the bearer token
+      // on every attempt rather than trust the one `request` was built with, or a token rotated
+      // in between reopens the socket with a stale one the guard then rejects.
+      if (!callerSuppliedToken) {
+        try {
+          req.query ??= {}
+          req.query[AUTH_QUERY] = ctx.auth().token
+        } catch (e) {
+          console.error(e)
+        }
+      }
+      await options?.beforeConnect?.(req)
+    }
+  }), [options, callerSuppliedToken])
+
+  return useWebSocket(module, request, wsOptions)
 }
 
 export const useSelfAuth = (force: boolean = true/*, entity: string = DEFAULT_ENTITY*/) => {

package/src/index.ts

@@ -3,5 +3,5 @@ export * from './components/index.js'
 export type * from './types.js'
 export * from './service.js'
 export * from './consts.js'
-export * from './modules.js'
+export * from './entrypoints.js'
 export * from './helper.js'

package/src/login/adopt.ts

@@ -0,0 +1,31 @@
+import type { AuthService } from '@owlmeans/auth-common'
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js'
+import type { LoginContext } from './types.js'
+
+/**
+ * The one path an issued bearer token becomes this context's authentication.
+ *
+ * Resolved by alias rather than through `ctx.auth()` so the login host does not require
+ * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
+ * carries the auth service, including one it did not build.
+ *
+ * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
+ * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
+ * the MUI relying party each used to do — leaves the same state on a good day and diverges the
+ * moment any of it changes.
+ */
+export const adoptToken = async (ctx: LoginContext, token: string): Promise<void> => {
+  await ctx.service<AuthService>(AUTH_ALIAS).update(token)
+}
+
+/**
+ * The one path this context's authentication is dropped, and the exact mirror of {@link adoptToken}.
+ *
+ * `undefined`, not `null`: `undefined` is the declared clearing value, and on the web the auth
+ * service reacts to it by navigating to the dispatcher. Everything that signs a user out goes
+ * through here — the hook, both browser plugins and the surrogate screen — so there is one place
+ * where "signed out" is defined rather than four that agree until one of them changes.
+ */
+export const revokeToken = async (ctx: LoginContext): Promise<void> => {
+  await ctx.service<AuthService>(AUTH_ALIAS).update(undefined)
+}

package/src/login/consts.ts

@@ -0,0 +1,64 @@
+export const DEFAULT_ALIAS = 'login-service'
+
+export const LOGIN_SERVICE = DEFAULT_ALIAS
+
+/** Priority of a plugin that makes no claim about the environment. */
+export const DEFAULT_LOGIN_PRIORITY = 0
+
+/** Order given to a method that declares none. */
+export const DEFAULT_METHOD_ORDER = 100
+
+/**
+ * Name given to the surrogate login window, the marker it records about itself, and the values the
+ * two documents exchange.
+ *
+ * These are a wire protocol between two documents that may be running different builds — an opener
+ * holding an older bundle and a surrogate freshly loaded, or the reverse. They are therefore fixed,
+ * and must never be "tidied" to match a newer vocabulary. That applies to the query names and the
+ * message types added later just as much as to the original three.
+ */
+export const LOGIN_SURROGATE_NAME = 'owlmeans-oidc-login'
+
+export const LOGIN_TOKEN_MESSAGE = 'owlmeans:oidc:popup-token'
+
+export const LOGIN_LOGOUT_MESSAGE = 'owlmeans:oidc:popup-logout'
+
+export const LOGIN_SURROGATE_MARKER = '_owlmeans-oidc-popup'
+
+export const LOGIN_SURROGATE_WIDTH = 520
+
+export const LOGIN_SURROGATE_HEIGHT = 760
+
+/**
+ * @deprecated Never centered the window — it carried no `left`/`top`, so the surrogate always
+ * opened wherever the browser's own default popup placement put it. Superseded by
+ * `@owlmeans/web-client`'s `centeredPopupFeatures(LOGIN_SURROGATE_WIDTH, LOGIN_SURROGATE_HEIGHT)`,
+ * computed fresh per call since centering depends on where the browser window currently sits.
+ * Kept, unchanged, for the same reason as the rest of this block: an already-generated app may
+ * carry a copy of code that still imports it.
+ */
+export const LOGIN_SURROGATE_FEATURES =
+  `popup=yes,width=${LOGIN_SURROGATE_WIDTH},height=${LOGIN_SURROGATE_HEIGHT}`
+
+/** How often a surrogate window is checked for having been closed by the user. */
+export const LOGIN_WATCH_INTERVAL = 500
+
+/** Carries WHY the surrogate window was opened across the window boundary. */
+export const LOGIN_INTENT_QUERY = 'intent'
+
+/**
+ * Carries the address the surrogate should run, so the flow parameters the opener's URL held are
+ * forwarded rather than discarded.
+ */
+export const LOGIN_NEXT_QUERY = 'next'
+
+/**
+ * Carries the method the user already chose, one window up.
+ *
+ * A surrogate acting on it is not an auto-redirect in the "never choose for the user" sense: the
+ * choice was made, by a person, in the document that opened this one.
+ */
+export const LOGIN_METHOD_QUERY = 'method'
+
+/** Where a browser records that it agreed to one exact set of legal documents. */
+export const LOGIN_TERMS_STORAGE = '_owlmeans-login-terms'

package/src/login/credit.ts

@@ -0,0 +1,75 @@
+import type { BrandSettings, LoginCreditConfig } from '@owlmeans/config'
+
+export interface ResolvedCredit {
+  /** Whether "Powered by OwlMeans" is rendered. */
+  poweredBy: boolean
+  /** The product and organization line, already composed. Null when there is nothing to say. */
+  line: string | null
+}
+
+/**
+ * The years one notice covers.
+ *
+ * A range only while the first year is genuinely in the past — an app configured with the current
+ * year, or with a year a skewed clock puts in the future, still gets a well-formed notice rather
+ * than `© 2026–2026` or a range that runs backwards.
+ */
+const years = (since: number | undefined, now: number): string =>
+  since != null && since > 0 && since < now ? `${since}–${now}` : `${now}`
+
+/**
+ * A configured value that was actually SET.
+ *
+ * Empty is how a build-time default spells "unset", and this config is filled from environment
+ * variables a platform delivers — `BRANDING_ORGANIZATION: meta.brandingOrganization ?? ''` is the
+ * shape of every one of them. `??` does not fall through an empty string, so an undelivered
+ * organization used to win the fallback chain and compose a line ending in a bare dash.
+ */
+const set = (value?: string | null): string | null =>
+  value != null && value.trim() !== '' ? value : null
+
+/**
+ * What the bottom of the sign-in screen says.
+ *
+ * It is a copyright notice, so it is composed as one: `© <year> <holder>`. That is the whole
+ * reason `copyright` defaults to on — the name on its own reads as a caption, and an application
+ * that means to assert a copyright would have had to write the mark and the year into a literal
+ * `line` to get one.
+ *
+ * The organization falls back to its slug because an organization record carries no readable name
+ * — so "no name" is the ordinary case, not an error, and a screen that rendered an empty line for
+ * it would be worse than one that renders the slug.
+ *
+ * `line` replaces everything when an app supplies it: a product with its own legal wording should
+ * not have to defeat a composition rule to use it.
+ */
+export const resolveCredit = (
+  cfg?: LoginCreditConfig, brand?: BrandSettings, service?: string
+): ResolvedCredit => {
+  const poweredBy = cfg?.poweredBy ?? true
+  const literal = set(cfg?.line)
+  if (literal != null) {
+    return { poweredBy, line: literal }
+  }
+
+  const product = set(cfg?.product) ?? set(brand?.name) ?? set(service)
+  const organization = set(cfg?.organization) ?? set(brand?.organization)
+    ?? set(cfg?.entity) ?? set(brand?.entity)
+
+  // Whoever the notice names. A product with no organization behind it holds its own copyright,
+  // which is why this falls through to the product rather than dropping the notice.
+  const holder = set(cfg?.holder) ?? organization ?? product
+  const wording = typeof cfg?.copyright === 'string' ? set(cfg.copyright) : null
+  const notice = cfg?.copyright === false || holder == null
+    ? organization
+    : wording ?? `© ${years(cfg?.since, new Date().getFullYear())} ${holder}`
+
+  // The product is named beside the notice only when it is not already the thing being claimed —
+  // "OwlMeans — © 2026 OwlMeans" says the name twice and neither time usefully.
+  return {
+    poweredBy,
+    line: product != null && notice != null && product !== holder
+      ? `${product} — ${notice}`
+      : notice ?? product,
+  }
+}