@owlmeans/client-auth 0.1.18-rc.57 → 0.1.18-rc.59

package/README.md

@@ -12,7 +12,7 @@ legacy). The server-side counterpart is `@owlmeans/server-auth`.
 ## Installation
 
 ```bash
-bun add @owlmeans/client-auth@^0.1.18-rc.57
+bun add @owlmeans/client-auth@^0.1.18-rc.59
 ```
 
 ## Concepts
@@ -31,10 +31,10 @@ bun add @owlmeans/client-auth@^0.1.18-rc.57
   (embedded, surrogate) and priority. `@owlmeans/web-client` registers the redirect and surrogate
   plugins.
 - **Login method** — one offerable button. `LoginMethodSource`s produce candidates;
-  `resolveLoginMethods` drops restricted ones the config did not name and applies the configured
+  `loginMethodsHelper.resolveLoginMethods` drops restricted ones the config did not name and applies the configured
   order.
 - **Login outcome** — `LoginOutcome` (`Handled`, `Passed`, `Redirected`, `Gesture`, `Orphaned`,
-  `Failed`) tells the caller what to do next. `resumeAction` and `loginAttemptError` are the only
+  `Failed`) tells the caller what to do next. `loginResumeHelper.resumeAction` and `.loginAttemptError` are the only
   readings of it.
 
 ## Usage
@@ -69,7 +69,7 @@ export const clientBindings = [
 ### 2. Guarding a layout and reading the identity
 
 ```tsx
-import { entitySlugOf } from '@owlmeans/auth'
+import { authHelper } from '@owlmeans/auth'
 import { useSelfAuth } from '@owlmeans/client-auth'
 import type { FC, PropsWithChildren } from 'react'
 import { useContext } from '../context.js'
@@ -85,7 +85,7 @@ export const UserLayout: FC<PropsWithChildren> = ({ children }) => {
 
   const auth = context.auth().user()
   // The organization is its renameable entitySlug; the stable entityId never reaches the browser.
-  const organization = entitySlugOf(auth)
+  const organization = authHelper.entitySlugOf(auth)
 
   return <main data-organization={organization}>{children}</main>
 }
@@ -157,7 +157,7 @@ export const appendPartnerLogin = <C extends Config, T extends Context<C>>(conte
 ```tsx
 import { AuthenticationStage } from '@owlmeans/auth'
 import type { AuthenticationRendererProps } from '@owlmeans/client-auth/manager'
-import { registerAuthPlugin } from '@owlmeans/client-auth/manager/plugins'
+import { authPluginHelper } from '@owlmeans/client-auth/manager/plugins'
 import type { AuthenticationPlugin } from '@owlmeans/client-auth/manager/plugins'
 import { useEffect } from 'react'
 
@@ -183,7 +183,7 @@ export const passkeyPlugin: AuthenticationPlugin = {
   },
 }
 
-registerAuthPlugin(passkeyPlugin)
+authPluginHelper.registerAuthPlugin(passkeyPlugin)
 ```
 
 A UI package then assigns `plugins[MY_APP_PASSKEY].Renderer`, and the renderer calls
@@ -215,7 +215,7 @@ Importing it registers `basic-ed25519`, `re-captcha` and `wallet-consumer`, plus
 
 | Symbol | Kind | Purpose |
 |---|---|---|
-| `plugins`, `registerAuthPlugin`, `getAuthPlugin`, `listAuthPlugins` | registry | The module-global authentication-plugin registry |
+| `plugins`, `authPluginHelper` (`registerAuthPlugin`, `getAuthPlugin`, `listAuthPlugins`), `AuthPluginHelper` | registry | The module-global authentication-plugin registry |
 | `AuthenticationHOC(Renderer?, type?)` | HOC | The authentication screen hosting a plugin |
 | `AuthenticationProps`, `TAuthenticationHOC` | type | Screen props (`type?`, `callback?`, `source?`) |
 | `makeControl(context, callback?)` | function | The control a plugin drives: `requestAllowence`, `authenticate`, `persist` / `restore` / `hasPersistentState` / `cleanUpState`, `setError`, `flow` |
@@ -240,7 +240,7 @@ The plugin-authoring surface, with no registration side effect.
 | `AuthenticationPlugin` | type | `type`, `Implementation`, `Renderer?`, `requiresRenderer?`, `method?`, `authenticate` / `beforeAuthenticate` / `afterAuthenticate` |
 | `PluginImplemnetation` (sic) | type | `(Renderer?) => FC<AuthenticationRendererProps>` |
 | `AuthMethodMeta` | type | `id`, `label`, `i18nKey`, `icon`, `order`, `emphasis`, `restricted`, `hidden`, `available(ctx)` |
-| `plugins`, `registerAuthPlugin`, `getAuthPlugin`, `listAuthPlugins` | registry | Same registry as `./manager` |
+| `plugins`, `authPluginHelper`, `AuthPluginHelper` | registry | Same registry as `./manager` |
 | `pluginMethodSource` | const | The `LoginMethodSource` that offers registered plugins |
 | `createWalletFacade`, `PinSchema`, `PinForm`, `TunnelAuthenticationRenderer`, `TunnelAuthenticationRendererProps` | function, const, type | Wallet-tunnel helpers |
 | `ed25519BasicUIPlugin`, `reCaptchaPlugin`, `tunnelConsumerUIPlugin` | const | Shipped plugin objects |
@@ -256,18 +256,19 @@ The plugin-authoring surface, with no registration side effect.
 | `LoginOutcome`, `LoginIntent` | enum | Stage results; login or logout surrogate |
 | `useLogin(target?)` | hook | `[dispatcherPath, onLogIn]` |
 | `useLogout(target?)` | hook | `onLogOut` |
-| `registerMethodSource`, `listMethodSources`, `resolveLoginMethods(ctx, cfg?, extra?)`, `primaryLoginMethod(methods)` | function | Global method sources and resolution |
+| `loginMethodsHelper` — `.registerMethodSource`, `.listMethodSources`, `.resolveLoginMethods(ctx, cfg?, extra?)`, `.primaryLoginMethod(methods)`; `LoginMethodsHelper` | helper, type | Global method sources and resolution |
 | `LoginMethod`, `LoginMethodSource`, `LoginMethodContext` | type | Method contract |
-| `resolveTerms(cfg?)`, `termsAccepted(resolved)`, `acceptTerms(resolved, accepted)`, `ResolvedTerms` | function, type | Terms confirmation, stored in `localStorage` against a version derived from the URLs |
-| `termsLabelResolver(translate, locale)`, `termsAcceptanceOf(resolved, locale?)`, `TermsAcceptanceRef` | function, type | The one document-label resolver every terms renderer shares; the wire shape a sign-in-time acceptance sends the server (structurally `@owlmeans/marketing-consent`'s `TermsAcceptance`, no dependency on it) |
-| `termsDeferred(ctx)` | function | True once a registered AND bound `LoginStep` declares `confirmsTerms` — the sign-in screen then renders no checkbox and blocks nothing, because the confirmation lives on that step instead |
+| `loginTermsHelper` — `.resolveTerms(cfg?)`, `.termsAccepted(resolved)`, `.acceptTerms(resolved, accepted)`; `LoginTermsHelper`, `ResolvedTerms` | helper, type | Terms confirmation, stored in `localStorage` against a version derived from the URLs |
+| `loginTermsHelper` — `.termsLabelResolver(translate, locale)`, `.termsAcceptanceOf(resolved, locale?)`; `LoginTermsAcceptance`, `TermsAcceptanceRef` | helper, type | The one document-label resolver every terms renderer shares; the wire shape a sign-in-time acceptance sends the server (structurally `@owlmeans/marketing-consent`'s `TermsAcceptance`, no dependency on it) |
+| `loginTermsHelper.termsDeferred(ctx)` | helper | True once a registered AND bound `LoginStep` declares `confirmsTerms` — the sign-in screen then renders no checkbox and blocks nothing, because the confirmation lives on that step instead |
 | `resolveCredit(cfg?, brand?, service?)`, `ResolvedCredit` | function, type | The credit and copyright line |
 | `FallbackLoginScreen`, `LoginScreenProps`, `LoginScreenComponent` | component, type | The plain screen used when no UI family registered one |
 | `surrogatePath(ctx, target)`, `SurrogateTarget` | function, type | Where a surrogate window opens; `null` on an entrypoint list without the surrogate route |
-| `resumeAction(outcome)`, `ResumeAction`, `loginAttemptError(outcome)` | function, enum | The shared readings of a `resume` outcome and of a finished attempt |
+| `loginResumeHelper` — `.resumeAction(outcome)`, `.loginAttemptError(outcome)`; `LoginResumeHelper`, `ResumeAction` | helper, enum | The shared readings of a `resume` outcome and of a finished attempt |
 | `enterOidcAuthorization(model)` | function | Move a flow to the step that can authorize; idempotent |
-| `adoptToken(ctx, token)`, `revokeToken(ctx)` | function | The single adoption and de-adoption paths |
-| `isEmbedded`, `isSurrogate`, `markSurrogate`, `clearSurrogate`, `defaultLoginEnv` | function | Environment probes behind `LoginEnv` |
+| `loginTokenOf(ctx)` — `.adoptToken(token)`, `.revokeToken()`; `makeLoginTokenHelper`, `LoginTokenHelper` | helper | The single adoption and de-adoption paths |
+| `loginLandingOf(ctx)` — `.landAfterLogin(opts?)`, `.continueLogin(opts?)`, `.landingUrl(landing)`; `makeLoginLandingHelper`, `LoginLandingHelper`, `useContinueLogin()` | helper, hook | Where a finished sign-in lands: pending steps, landing hooks, a suspended flow, else the fallback |
+| `loginEnvHelper` — `isEmbedded`, `isSurrogate`, `markSurrogate`, `clearSurrogate`, `defaultLoginEnv`; `LoginEnvHelper` | helper | Environment probes behind `LoginEnv` |
 | `LOGIN_SERVICE`, `DEFAULT_ALIAS`, `DEFAULT_LOGIN_PRIORITY`, `DEFAULT_METHOD_ORDER`, `LOGIN_SURROGATE_NAME`, `LOGIN_TOKEN_MESSAGE`, `LOGIN_LOGOUT_MESSAGE`, `LOGIN_SURROGATE_MARKER`, `LOGIN_SURROGATE_FEATURES`, `LOGIN_WATCH_INTERVAL`, `LOGIN_INTENT_QUERY`, `LOGIN_NEXT_QUERY`, `LOGIN_METHOD_QUERY`, `LOGIN_TERMS_STORAGE` | const | Service alias, ordering defaults and cross-document wire values |
 
 Importing `./login` also registers the `login` strings of the `auth` library namespace in all
@@ -281,7 +282,7 @@ seven supported languages.
   precondition.
 - **Never start login from an effect.** Without a user gesture the window is blocked. Render a
   control and let the person click.
-- **Adopt and drop tokens only through the auth service or `adoptToken` / `revokeToken`.**
+- **Adopt and drop tokens only through the auth service or `loginTokenOf(ctx).adoptToken` / `.revokeToken`.**
   Hand-written access to `AUTH_RESOURCE` drifts from the envelope decoding beside it.
 - **Import names from the right subpath.** The plugin contract (`AuthenticationPlugin`,
   `AuthMethodMeta`, `pluginMethodSource`, tunnel helpers) resolves only through
@@ -296,14 +297,14 @@ seven supported languages.
 - **Authorization stays server-side.** The browser ends up holding an ordinary OwlMeans bearer token
   whichever provider issued it. Product checks live in entrypoint gates and handlers, never in
   client-only state.
-- **The organization on the wire is its `entitySlug`.** Read it with `entitySlugOf` from
+- **The organization on the wire is its `entitySlug`.** Read it with `authHelper.entitySlugOf` from
   `@owlmeans/auth`; the stable `entityId` never reaches the browser.
 - **Overrides of the `login` strings cover all seven languages** (`en`, `pl`, `ru`, `be`, `uk`,
   `es`, `de`).
 
 ## Related packages
 
-- [`@owlmeans/auth`](../auth) — `Auth`, aliases, `entitySlugOf`, auth errors
+- [`@owlmeans/auth`](../auth) — `Auth`, aliases, `authHelper.entitySlugOf`, auth errors
 - [`@owlmeans/auth-common`](../auth-common) — `authProtocols`, `authMiddleware`, guard aliases
 - [`@owlmeans/web-client`](../web-client) — appends the auth service and login host; ships the dispatcher and login plugins
 - [`@owlmeans/web-panel`](../web-panel) — the shadcn sign-in screen (`appendLoginScreen`)
@@ -321,7 +322,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.48
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.57",
-  "generatedAt": "2026-10-05T08:32:19.089Z",
+  "version": "0.1.18-rc.59",
+  "generatedAt": "2026-10-06T11:45:57.652Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-auth
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.57"` in `dependencies`
+**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.59"` in `dependencies`
 
 Five subpaths, five jobs:
 
@@ -52,7 +52,7 @@ conflate them.
 
 | Export | Description |
 |--------|-------------|
-| `plugins`, `registerAuthPlugin`, `getAuthPlugin`, `listAuthPlugins` | The module-global registry |
+| `plugins`, `authPluginHelper` → `.registerAuthPlugin`, `.getAuthPlugin`, `.listAuthPlugins` | The module-global registry |
 | `AuthenticationHOC`, `AuthenticationProps`, `TAuthenticationHOC` | The screen that hosts a plugin's implementation |
 | `makeControl`, `AuthenticationControl`, `AuthenticationControlState` | The control a plugin drives: `requestAllowence`, `authenticate`, and the state it persists across a provider redirect |
 | `AuthenticationRenderer`, `AuthenticationRendererProps`, `ClientAuthType`, `ClientAuthenticationMethod`, `AuthenticationCallback` | Rendering contract |
@@ -66,7 +66,7 @@ conflate them.
 | `AuthenticationPlugin` | `type`, `Implementation`, optional `Renderer`, `requiresRenderer?`, `method?` and the `authenticate` / `beforeAuthenticate` / `afterAuthenticate` hooks |
 | `PluginImplemnetation` (sic) | `(Renderer?) => FC<AuthenticationRendererProps>` — the shape of `Implementation` |
 | `AuthMethodMeta` | How the plugin presents itself as a sign-in method — see `login-methods` |
-| `plugins`, `registerAuthPlugin`, `getAuthPlugin`, `listAuthPlugins` | The same registry as `./manager` |
+| `plugins`, `authPluginHelper` | The same registry as `./manager` |
 | `pluginMethodSource` | The `LoginMethodSource` that turns registered plugins into offerable methods |
 | `createWalletFacade`, `PinSchema`, `PinForm`, `TunnelAuthenticationRenderer`, `TunnelAuthenticationRendererProps` | Wallet-tunnel helpers a consumer plugin builds on |
 | `ed25519BasicUIPlugin`, `reCaptchaPlugin`, `tunnelConsumerUIPlugin` | The shipped plugin objects |
@@ -85,24 +85,25 @@ browsing context the round trip can complete at all.
 | `appendLogin(ctx)` | Register the host and expose it as `context.login()` |
 | `makeLoginService(alias?)`, `ensureLoginService(ctx)` | The host itself — a **lazy** service, so `makeContext` can reach it at the Loading stage — and the idempotent getter a plugin package calls before `registerPlugin` |
 | `LoginPlugin`, `LoginEnv`, `LoginRequest`, `LogoutRequest`, `LoginOutcome`, `LoginIntent`, `LoginService`, `LoginContext`, `LoginPrecondition` | The contract |
-| `registerMethodSource`, `listMethodSources`, `resolveLoginMethods`, `primaryLoginMethod` | Which sign-in methods are offered — see `login-methods` |
+| `loginMethodsHelper` → `.registerMethodSource`, `.listMethodSources`, `.resolveLoginMethods`, `.primaryLoginMethod` | Which sign-in methods are offered — see `login-methods` |
 | `LoginMethod`, `LoginMethodSource`, `LoginMethodContext` | Method types |
-| `landAfterLogin(ctx, opts?)`, `continueLogin(ctx, opts?)`, `landingUrl(ctx, landing)`, `useContinueLogin()` | The post-login landing decision (`src/login/land.ts`) — see `login-plugins`. `landAfterLogin` runs due landing hooks then delegates to `continueLogin`, which walks pending `LoginStep`s, then `resumeSuspendedFlow`, then `LandOptions.fallback ?? { alias: HOME }`; `landingUrl` builds the absolute URL a plugin's own `window.location.href` needs; `useContinueLogin()` is what a step's own screen calls once satisfied |
-| `LoginStep`, `LoginLanding`, `LoginLandingHook`, `LandOptions`, `LoginLandingParams` | Landing-seam types. `registerStep`/`steps`/`onLanded`/`landingHooks` on `LoginService` are the same replace-by-alias, priority-sorted registries as `registerPlugin`. `LoginStep` also carries `confirmsTerms?: boolean` (this step is where the Terms confirmation lives — see `termsDeferred` below) and `required?: boolean` (a throw/timeout in `pending` reads as PENDING, not "not pending" — see `login-plugins`) |
+| `loginLandingOf(ctx)` → `.landAfterLogin(opts?)`, `.continueLogin(opts?)`, `.landingUrl(landing)`; `useContinueLogin()` | The post-login landing decision (`src/login/land.ts`) — see `login-plugins`. `landAfterLogin` runs due landing hooks then delegates to `continueLogin`, which walks pending `LoginStep`s, then `flowLandingOf(ctx).resumeSuspendedFlow`, then `LandOptions.fallback ?? { alias: HOME }`; `landingUrl` builds the absolute URL a plugin's own `window.location.href` needs; `useContinueLogin()` is what a step's own screen calls once satisfied |
+| `LoginStep`, `LoginLanding`, `LoginLandingHook`, `LandOptions`, `LoginLandingParams` | Landing-seam types. `registerStep`/`steps`/`onLanded`/`landingHooks` on `LoginService` are the same replace-by-alias, priority-sorted registries as `registerPlugin`. `LoginStep` also carries `confirmsTerms?: boolean` (this step is where the Terms confirmation lives — see `loginTermsHelper.termsDeferred` below) and `required?: boolean` (a throw/timeout in `pending` reads as PENDING, not "not pending" — see `login-plugins`) |
 | `LOGIN_STEP_TIMEOUT`, `LOGIN_LANDED_STORAGE` | A step's `pending`/a hook's `landed` is bounded by the former; the latter is where the last-landed token is recorded (the raw string, never a digest) |
-| `resolveTerms`, `termsAccepted`, `acceptTerms`, `termsSentence`, `ResolvedTerms`, `ResolvedTermsDocument`, `TermsSentencePart` | The confirmation. `resolveTerms` produces `documents` (what the checkbox agrees to: terms, then billing/product/custom when configured) and `notices` (what is only disclosed: privacy, plus cookies per its own inclusion rule) — see the terms-confirmation section of `login-methods`. The extra `LoginTermsConfig` fields (`billing`, `product`, `documents`, `revisions`, `showRevision`) are added by module augmentation in `src/login/terms-config.ts`, never by editing `@owlmeans/config` — importing anything from `@owlmeans/client-auth/login` pulls it in |
-| `termsLabelResolver(translate, locale)`, `termsAcceptanceOf(resolved, locale?)`, `TermsAcceptanceRef` | The ONE document-label resolver and ONE wire-shape builder every terms renderer/recorder shares (`FallbackLoginScreen`, `web-panel`'s `LoginTerms`, `web-marketing-consent`'s Terms box and `termsRecorder`) — no more hand-kept duplicate `DEFAULT_LABEL`/`resolveLabelFor` per package. `termsAcceptanceOf` keeps only `{key, href, revisedAt}` per document — structurally `@owlmeans/marketing-consent`'s `TermsAcceptance`, with no dependency on that package |
-| `termsDeferred(ctx)` | True once a registered AND BOUND `LoginStep` declares `confirmsTerms` — see the "Deferring the confirmation" section of `login-methods`. Reads `ctx.hasService`/`.hasEntrypoint` directly, never `ensureLoginService` (which has the side effect of registering an empty host) |
+| `loginTermsHelper` → `.resolveTerms`, `.termsAccepted`, `.acceptTerms`, `.termsSentence`, `ResolvedTerms`, `ResolvedTermsDocument`, `TermsSentencePart` | The confirmation. `resolveTerms` produces `documents` (what the checkbox agrees to: terms, then billing/product/custom when configured) and `notices` (what is only disclosed: privacy, plus cookies per its own inclusion rule) — see the terms-confirmation section of `login-methods`. The extra `LoginTermsConfig` fields (`billing`, `product`, `documents`, `revisions`, `showRevision`) are added by module augmentation in `src/login/terms-config.ts`, never by editing `@owlmeans/config` — importing anything from `@owlmeans/client-auth/login` pulls it in |
+| `loginTermsHelper.termsLabelResolver(translate, locale)`, `loginTermsHelper.termsAcceptanceOf(resolved, locale?)`, `TermsAcceptanceRef` | The ONE document-label resolver and ONE wire-shape builder every terms renderer/recorder shares (`FallbackLoginScreen`, `web-panel`'s `LoginTerms`, `web-marketing-consent`'s Terms box and `termsRecorder`) — no more hand-kept duplicate `DEFAULT_LABEL`/`resolveLabelFor` per package. `termsAcceptanceOf` keeps only `{key, href, revisedAt}` per document — structurally `@owlmeans/marketing-consent`'s `TermsAcceptance`, with no dependency on that package |
+| `loginTermsHelper.termsDeferred(ctx)` | True once a registered AND BOUND `LoginStep` declares `confirmsTerms` — see the "Deferring the confirmation" section of `login-methods`. Reads `ctx.hasService`/`.hasEntrypoint` directly, never `ensureLoginService` (which has the side effect of registering an empty host) |
 | `resolveCredit`, `ResolvedCredit` | The credit and copyright line |
 | `FallbackLoginScreen`, `LoginScreenProps` (now also carries `locale?: string`, for `Intl.ListFormat` and a custom document's locale-keyed label), `LoginScreenComponent` | The plain sign-in screen a relying party renders when no UI family registered one |
 | `surrogatePath(ctx, target)`, `SurrogateTarget` | Where a surrogate login window opens; `null` on an older entrypoint list |
-| `resumeAction(outcome)`, `ResumeAction`, `loginAttemptError(outcome)` | The one reading of a `resume` outcome, and the one reading of a finished attempt |
+| `loginResumeHelper.resumeAction(outcome)`, `ResumeAction`, `loginResumeHelper.loginAttemptError(outcome)` | The one reading of a `resume` outcome, and the one reading of a finished attempt |
 | `registerNotifier(notifier)` (on `LoginService`), `LoginNotifier` | Surfaces a `begin`/`logout` outcome that has no inline screen to render it on — e.g. a toast on `LoginOutcome.Blocked` for a header "Log in"/"Log out" control. `web-panel`'s `appendLoginScreen` registers a default; unregistered, it is silence |
 | `enterOidcAuthorization(model)` | Move a flow to the step that can authorize — idempotent, call it before every `authenticate` |
-| `adoptToken(ctx, token)`, `revokeToken(ctx)` | The single adoption and de-adoption paths |
-| `useLogin(target?)`, `useLogout(target?)` | Wiring for a sign-in / sign-out control; `target` is the entrypoint alias the flow lands on when it is over |
-| `isEmbedded`, `isSurrogate`, `markSurrogate`, `clearSurrogate`, `defaultLoginEnv` | Environment probes the host builds `LoginEnv` from |
-| `LOGIN_SERVICE`, `LOGIN_SURROGATE_NAME`, `LOGIN_TOKEN_MESSAGE`, `LOGIN_LOGOUT_MESSAGE`, `LOGIN_SURROGATE_MARKER`, `LOGIN_SURROGATE_WIDTH`, `LOGIN_SURROGATE_HEIGHT`, `LOGIN_WATCH_INTERVAL`, `LOGIN_INTENT_QUERY`, `LOGIN_NEXT_QUERY`, `LOGIN_METHOD_QUERY`, `LOGIN_TERMS_STORAGE`, `DEFAULT_LOGIN_PRIORITY`, `DEFAULT_METHOD_ORDER` | Aliases and the fixed cross-document wire values. `LOGIN_SURROGATE_FEATURES` also still exports (deprecated, never centered) — `@owlmeans/web-client`'s `centeredPopupFeatures(LOGIN_SURROGATE_WIDTH, LOGIN_SURROGATE_HEIGHT)` is what the surrogate plugin actually opens the window with |
+| `loginTokenOf(ctx).adoptToken(token)`, `.revokeToken()` | The single adoption and de-adoption paths |
+| `useLogin(target?)`, `useLogout(target?)` | Wiring for a sign-in / sign-out control. `useLogin`'s `target` is the screen to land on AFTER sign-in (parked, never navigated to first); `useLogout`'s is where the document goes once the session is gone |
+| `loginStartOf(ctx).startLogin({ url, target?, go })`, `LoginStart` | The React-free decision behind `useLogin` (`src/login/start.ts`): a target with a session already held goes straight there; otherwise `begin` with the target and a continuation to `DISPATCHER` |
+| `loginEnvHelper` → `.isEmbedded`, `.isSurrogate`, `.markSurrogate`, `.clearSurrogate`, `.defaultLoginEnv` | Environment probes the host builds `LoginEnv` from |
+| `LOGIN_SERVICE`, `LOGIN_SURROGATE_NAME`, `LOGIN_TOKEN_MESSAGE`, `LOGIN_LOGOUT_MESSAGE`, `LOGIN_SURROGATE_MARKER`, `LOGIN_SURROGATE_WIDTH`, `LOGIN_SURROGATE_HEIGHT`, `LOGIN_WATCH_INTERVAL`, `LOGIN_INTENT_QUERY`, `LOGIN_NEXT_QUERY`, `LOGIN_METHOD_QUERY`, `LOGIN_TERMS_STORAGE`, `LOGIN_TARGET_TTL`, `DEFAULT_LOGIN_PRIORITY`, `DEFAULT_METHOD_ORDER` | Aliases and the fixed cross-document wire values. `LOGIN_SURROGATE_FEATURES` also still exports (deprecated, never centered) — `@owlmeans/web-client`'s `centeredPopupFeatures(LOGIN_SURROGATE_WIDTH, LOGIN_SURROGATE_HEIGHT)` is what the surrogate plugin actually opens the window with |
 
 ```typescript
 import { useLogin, useLogout } from '@owlmeans/client-auth/login'
@@ -117,13 +118,27 @@ entrypoint **inside** the hook, never at module scope — `DISPATCHER` for `useL
 path for `useLogout`. A module body runs before `registerEntrypoints`, so `useLogin`'s lookup at
 top level throws `Entrypoint dispatcher not found` during import, taking the whole render down.
 
-`target` is an entrypoint alias, and it is what supplies the request's `navigate` continuation —
-the in-app step the plugin runs once the round trip is done. `useLogin` always sends one, falling
-back to `DISPATCHER`; `useLogout` sends one only when a target is given. Omitting it does not leave
-the session behind: the token is revoked either way, and the plugin decides what the document does
-with no continuation to run — `@owlmeans/web-client`'s redirect plugin reloads the page, because
-cached auth reads only forget a session when the application is rebuilt. `useLogin` returns
-`[path, handler]` and `useLogout` a bare handler — a logout control has no address to point at.
+`useLogin(target)` signs in FIRST and lands on `target` after, in an ordinary tab (redirect plugin)
+and in a framed application (surrogate popup) alike, with every pending post-sign-in step run on the
+way. Its `navigate` continuation is ALWAYS `DISPATCHER` — never the target, because a guarded screen
+reached before sign-in renders signed out. The target travels as `LoginRequest.target`: the facade's
+`begin`, past the preconditions, parks it with `flowLandingOf(ctx).suspendLanding`
+(`@owlmeans/client-flow`, the `RESUME_FLOW` record its `resumeSuspendedFlow` reads, expiring after
+`LOGIN_TARGET_TTL`) — the write is started, never awaited before the plugin, so a popup still opens
+inside the gesture — and holds the continuation until the write has landed. The dispatcher's
+`landAfterLogin` (landing hooks → pending steps such as a consent screen → the parked target) then
+ends on it. An attempt that signs nobody in (`Blocked`, `Failed`, `Gesture`) discards the parked
+target; a refused precondition never parks it. A session already held (the auth service's in-memory
+`token`) goes straight to the target. Without a target, `useLogin()` is the plain sign-in to the
+ordinary landing. A caller of `login().begin` that passes a `target` without a `navigate` leaves the
+document at once, so its parked target is best-effort.
+
+`useLogout` sends a continuation only when a target is given. Omitting it does not leave the session
+behind: the token is revoked either way, and the plugin decides what the document does with no
+continuation to run — `@owlmeans/web-client`'s redirect plugin reloads the page, because cached auth
+reads only forget a session when the application is rebuilt. `useLogin` returns `[path, handler]`
+(the path is the dispatcher's, with or without a target) and `useLogout` a bare handler — a logout
+control has no address to point at.
 
 Plugin selection, the shipped browser flows and the full invariant list: the `login-plugins` skill.
 
@@ -145,21 +160,26 @@ a web application only calls these when it builds its context by hand.
 ## Rules
 
 - The bearer token lives in the `AUTH_RESOURCE` resource under the single id `USER_ID`. Read and
-  write it through the auth service or through `adoptToken` / `revokeToken`; hand-written storage
-  access drifts from the envelope decoding that happens beside it.
+  write it through the auth service or through `loginTokenOf(ctx).adoptToken` / `.revokeToken`;
+  hand-written storage access drifts from the envelope decoding that happens beside it.
 - A plugin that persists state across a provider redirect drives the control's own
   `persist()` / `restore()` / `hasPersistentState()` / `cleanUpState()`. They keep the type, stage
   and allowance in the `FLOW_STATE` resource under an id this package owns and does not export —
   restore before submitting the credential, and clean up after.
-- After a sign-in, `DispatcherHOC.navigate` calls `landAfterLogin` — a pending `LoginStep`, else a
-  landing suspended in `@owlmeans/client-flow` (`resumeSuspendedFlow`, one-shot, an entrypoint alias
-  plus its query), else `HOME` — read BEFORE `alias` is defaulted to `HOME`. Login plugins that
-  navigate on their own do the same — see `login-plugins`.
+- After a sign-in, `DispatcherHOC.navigate` calls `loginLandingOf(ctx).landAfterLogin` — a pending
+  `LoginStep`, else a landing suspended in `@owlmeans/client-flow`
+  (`flowLandingOf(ctx).resumeSuspendedFlow`, one-shot, an entrypoint alias plus its query — parked
+  by a flow's `.suspendFlow` or by `useLogin(target)`), else `HOME` — read BEFORE `alias` is
+  defaulted to `HOME`. Login plugins that navigate on their own do the same — see `login-plugins`.
+- A control that leads to a screen through sign-in is `useLogin(target)`. Never navigate to a guarded
+  screen to start a sign-in, and never hand a plugin a continuation that goes anywhere but the
+  dispatcher: the landing is the dispatcher's decision.
 - The browser ends up holding an ordinary OwlMeans bearer token whichever provider issued the
   login. Product authorization stays server-side, in entrypoint gates and handler checks — never in
   client-only state.
 - The organization entity a token names is its `entitySlug`, the renameable public name. Read it
-  with `entitySlugOf` from `@owlmeans/auth`; the stable `entityId` never reaches the browser.
+  with `authHelper.entitySlugOf` from `@owlmeans/auth`; the stable `entityId` never reaches the
+  browser.
 
 ## Depends On
 

package/build/components/dispatcher/component.js

@@ -7,7 +7,7 @@ import { useNavigate } from '@owlmeans/client';
 import { DEFAULT_ALIAS as FLOW_SERVICE } from '@owlmeans/client-flow';
 import { FLOW_PLACEHOLDER, OidcAuthStep, STD_OIDC_FLOW } from '@owlmeans/flow';
 import { SERVICE_PARAM } from '@owlmeans/web-flow';
-import { landAfterLogin } from '../../login/land.js';
+import { loginLandingOf } from '../../login/land.js';
 import { logger } from '@owlmeans/log';
 const log = logger('client-auth:dispatcher');
 export const DispatcherHOC = Renderer => ({ context, params, alias, query, payload }) => {
@@ -21,7 +21,7 @@ export const DispatcherHOC = Renderer => ({ context, params, alias, query, paylo
             // post-sign-in landing decision (steps, landing hooks, the suspended flow, then HOME) and
             // takes priority over the ordinary HOME landing, resolved BEFORE `alias` is overwritten,
             // because once it is `HOME` there is no way back to tell the cases apart.
-            const landing = await landAfterLogin(context);
+            const landing = await loginLandingOf(context).landAfterLogin();
             if (landing.alias !== HOME) {
                 await navigator.navigate(context.entrypoint(landing.alias), { params: landing.params, query: landing.query });
                 return;
@@ -36,7 +36,7 @@ export const DispatcherHOC = Renderer => ({ context, params, alias, query, paylo
             if (query != null && AUTH_QUERY in query) {
                 delete query[AUTH_QUERY];
             }
-            const landing = await landAfterLogin(context, { fallback: { alias, params, query }, resume: false });
+            const landing = await loginLandingOf(context).landAfterLogin({ fallback: { alias, params, query }, resume: false });
             await navigator.navigate(context.entrypoint(landing.alias), { params: landing.params, query: landing.query });
             return;
         }

package/build/components/dispatcher/component.js.map

@@ -1 +1 @@
-{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../src/components/dispatcher/component.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAoB,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACvF,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAGtC,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAmB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;IACtG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,EAA0B,CAAA;IAEtE,MAAM,SAAS,GAAG,WAAW,EAAE,CAAA;IAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACtC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC1C,yFAAyF;YACzF,kFAAkF;YAClF,wFAAwF;YACxF,0FAA0F;YAC1F,yFAAyF;YACzF,0EAA0E;YAC1E,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;YAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,SAAS,CAAC,QAAQ,CACtB,OAAO,CAAC,UAAU,CAA2B,OAAO,CAAC,KAAK,CAAC,EAC3D,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACjD,CAAA;gBACD,OAAM;YACR,CAAC;YACD,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;aAAM,CAAC;YACN,4FAA4F;YAC5F,sFAAsF;YACtF,sCAAsC;YACtC,KAAK,GAAG,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAA;YAC1C,IAAI,KAAK,IAAI,IAAI,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC,UAAU,CAAC,CAAA;YAC1B,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAC/D,CAAA;YACD,MAAM,SAAS,CAAC,QAAQ,CACtB,OAAO,CAAC,UAAU,CAA2B,OAAO,CAAC,KAAK,CAAC,EAC3D,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACjD,CAAA;YACD,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAA2B,KAAK,CAAC,CAAA;QAClE,MAAM,GAAG,EAAE,CAAA;QACX,KAAK,GAAG,EAAE,CAAA;QACV,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACrD,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAEhB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YAC9B,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;gBACvD,mGAAmG;gBACnG,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAC3B,kDAAkD;oBAClD,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;wBAChC,0EAA0E;wBAC1E,2EAA2E;wBAC3E,qEAAqE;wBACrE,mFAAmF;wBACnF,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;4BAClC,OAAM;wBACR,CAAC;oBACH,CAAC;oBACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAA;oBACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;oBACtE,MAAM,MAAM,GAAG,CACb,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CACnD,CAAA;oBACvB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACnB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBACpB,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;4BACpB,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;wBAC9B,CAAC;oBACH,CAAC;yBAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;wBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAA;wBACnC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBACpB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAA;wBACrC,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;4BACnB,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;wBAC9B,CAAC;wBACD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;4BAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;wBAC7C,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;gBACtB,CAAC,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,aAAa,CAAC,CAAA;gBACxD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAClD,OAAO,MAAM,QAAQ,EAAE,CAAA;gBACzB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;oBACpB,oCAAoC;oBACpC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;gBAClE,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;IAEvB,MAAM,YAAY,GAAG,WAAW,CAA0C,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzF,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACjC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,KAAC,QAAQ,IAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAA;AACrE,CAAC,CAAA"}
+{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../src/components/dispatcher/component.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAoB,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACvF,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAGtC,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAmB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;IACtG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,EAA0B,CAAA;IAEtE,MAAM,SAAS,GAAG,WAAW,EAAE,CAAA;IAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACtC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC1C,yFAAyF;YACzF,kFAAkF;YAClF,wFAAwF;YACxF,0FAA0F;YAC1F,yFAAyF;YACzF,0EAA0E;YAC1E,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,CAAA;YAC9D,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,SAAS,CAAC,QAAQ,CACtB,OAAO,CAAC,UAAU,CAA2B,OAAO,CAAC,KAAK,CAAC,EAC3D,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACjD,CAAA;gBACD,OAAM;YACR,CAAC;YACD,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;aAAM,CAAC;YACN,4FAA4F;YAC5F,sFAAsF;YACtF,sCAAsC;YACtC,KAAK,GAAG,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAA;YAC1C,IAAI,KAAK,IAAI,IAAI,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC,UAAU,CAAC,CAAA;YAC1B,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,cAAc,CAC1D,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CACtD,CAAA;YACD,MAAM,SAAS,CAAC,QAAQ,CACtB,OAAO,CAAC,UAAU,CAA2B,OAAO,CAAC,KAAK,CAAC,EAC3D,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACjD,CAAA;YACD,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAA2B,KAAK,CAAC,CAAA;QAClE,MAAM,GAAG,EAAE,CAAA;QACX,KAAK,GAAG,EAAE,CAAA;QACV,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACrD,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAEhB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YAC9B,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;gBACvD,mGAAmG;gBACnG,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAC3B,kDAAkD;oBAClD,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;wBAChC,0EAA0E;wBAC1E,2EAA2E;wBAC3E,qEAAqE;wBACrE,mFAAmF;wBACnF,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;4BAClC,OAAM;wBACR,CAAC;oBACH,CAAC;oBACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAA;oBACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;oBACtE,MAAM,MAAM,GAAG,CACb,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CACnD,CAAA;oBACvB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACnB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBACpB,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;4BACpB,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;wBAC9B,CAAC;oBACH,CAAC;yBAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;wBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAA;wBACnC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBACpB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAA;wBACrC,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;4BACnB,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;wBAC9B,CAAC;wBACD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;4BAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;wBAC7C,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;gBACtB,CAAC,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,aAAa,CAAC,CAAA;gBACxD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAClD,OAAO,MAAM,QAAQ,EAAE,CAAA;gBACzB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;oBACpB,oCAAoC;oBACpC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;gBAClE,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;IAEvB,MAAM,YAAY,GAAG,WAAW,CAA0C,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzF,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACjC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,KAAC,QAAQ,IAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAA;AACrE,CAAC,CAAA"}

package/build/entrypoints.d.ts

@@ -1,5 +1,7 @@
 /** Browser entrypoints for the authentication protocols every client may call. */
-export declare const entrypoints: import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<any>[];
+export declare const entrypoints: import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/auth").AuthToken;
+}, import("@owlmeans/auth").AuthToken>>[];
 /** Bind the external-authentication screen to one explicitly selected service. */
-export declare const bindExternalAuthentication: (service: string) => import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<any>;
+export declare const bindExternalAuthentication: (service: string) => import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>>;
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAIA,kFAAkF;AAClF,eAAO,MAAM,WAAW,uEAA+C,CAAA;AAEvE,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,YAAa,MAAM,wEAC+B,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAIA,kFAAkF;AAClF,eAAO,MAAM,WAAW;;yCAA+C,CAAA;AAEvE,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,YAAa,MAAM,4MAC+B,CAAA"}

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAGnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAY3D,eAAO,MAAM,KAAK,WACR,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,YAAY,SAAS,iDAiDtG,CAAA;AAED,eAAO,MAAM,WAAW,WAAW,OAAO,YAoBzC,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAa3D,eAAO,MAAM,KAAK,WACR,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,YAAY,SAAS,iDAiDtG,CAAA;AAED,eAAO,MAAM,WAAW,WAAW,OAAO,YAoBzC,CAAA"}

package/build/helper.js

@@ -1,9 +1,9 @@
 import { useContext, useNavigate } from '@owlmeans/client';
-import { provideRequest } from '@owlmeans/client-entrypoint';
 import { useWs as useWebSocket } from '@owlmeans/client-socket';
 import { useEffect, useMemo, useState } from 'react';
 import { AUTH_QUERY, DISPATCHER } from '@owlmeans/auth';
 import { logger } from '@owlmeans/log';
+import { clientRequestHelper } from '@owlmeans/client-entrypoint';
 const log = logger('client-auth');
 // import { useFlow } from '@owlmeans/web-flow'
 // import { DEFAULT_ENTITY } from './consts.js'
@@ -16,7 +16,7 @@ export const useWs = (module, _request, options) => {
     const callerSuppliedToken = _request?.query?.[AUTH_QUERY] != null;
     const request = useMemo(() => {
         if (_request == null) {
-            _request = provideRequest(mod.alias, mod.path());
+            _request = clientRequestHelper.provideRequest(mod.alias, mod.path());
         }
         try {
             if (_request?.query?.[AUTH_QUERY] == null) {

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;AACjC,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAAE,OAAmB,EACrG,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,yFAAyF;IACzF,yFAAyF;IACzF,MAAM,mBAAmB,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;IAEjE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,CAAC,CAAA;QAC/C,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,SAAS,GAAG,OAAO,CAAY,GAAG,EAAE,CAAC,CAAC;QAC1C,GAAG,OAAO;QACV,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,wFAAwF;YACxF,0FAA0F;YAC1F,yEAAyE;YACzE,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,GAAG,CAAC,KAAK,KAAK,EAAE,CAAA;oBAChB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,CAAC,CAAC,CAAA;gBAChD,CAAC;YACH,CAAC;YACD,MAAM,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;KACF,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAEnC,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AACjD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAY,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEjE,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;AACjC,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAAE,OAAmB,EACrG,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,yFAAyF;IACzF,yFAAyF;IACzF,MAAM,mBAAmB,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;IAEjE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,mBAAmB,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,CAAC,CAAA;QAC/C,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,SAAS,GAAG,OAAO,CAAY,GAAG,EAAE,CAAC,CAAC;QAC1C,GAAG,OAAO;QACV,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,wFAAwF;YACxF,0FAA0F;YAC1F,yEAAyE;YACzE,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,GAAG,CAAC,KAAK,KAAK,EAAE,CAAA;oBAChB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,CAAC,CAAC,CAAA;gBAChD,CAAC;YACH,CAAC;YACD,MAAM,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;KACF,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAEnC,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AACjD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAY,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}

package/build/login/adopt/types.d.ts

@@ -0,0 +1,26 @@
+/** The two paths a context's authentication changes by: a token adopted, a token dropped. */
+export interface LoginTokenHelper {
+    /**
+     * The one path an issued bearer token becomes this context's authentication.
+     *
+     * Resolved by alias rather than through `ctx.auth()` so the login host does not require
+     * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
+     * carries the auth service, including one it did not build.
+     *
+     * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
+     * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
+     * the MUI relying party each used to do — leaves the same state on a good day and diverges the
+     * moment any of it changes.
+     */
+    adoptToken: (token: string) => Promise<void>;
+    /**
+     * The one path this context's authentication is dropped, and the exact mirror of {@link adoptToken}.
+     *
+     * `undefined`, not `null`: `undefined` is the declared clearing value, and on the web the auth
+     * service reacts to it by navigating to the dispatcher. Everything that signs a user out goes
+     * through here — the hook, both browser plugins and the surrogate screen — so there is one place
+     * where "signed out" is defined rather than four that agree until one of them changes.
+     */
+    revokeToken: () => Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/adopt/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/adopt/types.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;OAWG;IACH,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C;;;;;;;OAOG;IACH,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACjC"}

package/build/login/adopt/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/adopt/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/adopt/types.ts"],"names":[],"mappings":""}

package/build/login/adopt.d.ts

@@ -1,24 +1,10 @@
 import type { LoginContext } from './types.js';
-/**
- * The one path an issued bearer token becomes this context's authentication.
- *
- * Resolved by alias rather than through `ctx.auth()` so the login host does not require
- * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
- * carries the auth service, including one it did not build.
- *
- * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
- * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
- * the MUI relying party each used to do — leaves the same state on a good day and diverges the
- * moment any of it changes.
- */
+import type { LoginTokenHelper } from './adopt/types.js';
+export declare const makeLoginTokenHelper: (ctx: LoginContext) => LoginTokenHelper;
+/** The token helper of a context — one per context. */
+export declare const loginTokenOf: (target: LoginContext) => LoginTokenHelper;
+/** @deprecated compat:factory-refactor — use `loginTokenOf(ctx).adoptToken(…)` */
 export declare const adoptToken: (ctx: LoginContext, token: string) => Promise<void>;
-/**
- * The one path this context's authentication is dropped, and the exact mirror of {@link adoptToken}.
- *
- * `undefined`, not `null`: `undefined` is the declared clearing value, and on the web the auth
- * service reacts to it by navigating to the dispatcher. Everything that signs a user out goes
- * through here — the hook, both browser plugins and the surrogate screen — so there is one place
- * where "signed out" is defined rather than four that agree until one of them changes.
- */
+/** @deprecated compat:factory-refactor — use `loginTokenOf(ctx).revokeToken()` */
 export declare const revokeToken: (ctx: LoginContext) => Promise<void>;
 //# sourceMappingURL=adopt.d.ts.map

package/build/login/adopt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,QAAe,YAAY,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAE/E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,QAAe,YAAY,KAAG,OAAO,CAAC,IAAI,CAEjE,CAAA"}
+{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,eAAO,MAAM,oBAAoB,QAAS,YAAY,KAAG,gBAUxD,CAAA;AAED,uDAAuD;AACvD,eAAO,MAAM,YAAY,4CAA2C,CAAA;AAEpE,kFAAkF;AAClF,eAAO,MAAM,UAAU,QAAe,YAAY,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAAwC,CAAA;AAExH,kFAAkF;AAClF,eAAO,MAAM,WAAW,QAAe,YAAY,KAAG,OAAO,CAAC,IAAI,CAAoC,CAAA"}

package/build/login/adopt.js

@@ -1,28 +1,18 @@
+import { memoHelper } from '@owlmeans/context';
 import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js';
-/**
- * The one path an issued bearer token becomes this context's authentication.
- *
- * Resolved by alias rather than through `ctx.auth()` so the login host does not require
- * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
- * carries the auth service, including one it did not build.
- *
- * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
- * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
- * the MUI relying party each used to do — leaves the same state on a good day and diverges the
- * moment any of it changes.
- */
-export const adoptToken = async (ctx, token) => {
-    await ctx.service(AUTH_ALIAS).update(token);
-};
-/**
- * The one path this context's authentication is dropped, and the exact mirror of {@link adoptToken}.
- *
- * `undefined`, not `null`: `undefined` is the declared clearing value, and on the web the auth
- * service reacts to it by navigating to the dispatcher. Everything that signs a user out goes
- * through here — the hook, both browser plugins and the surrogate screen — so there is one place
- * where "signed out" is defined rather than four that agree until one of them changes.
- */
-export const revokeToken = async (ctx) => {
-    await ctx.service(AUTH_ALIAS).update(undefined);
+export const makeLoginTokenHelper = (ctx) => {
+    const adoptToken = async (token) => {
+        await ctx.service(AUTH_ALIAS).update(token);
+    };
+    const revokeToken = async () => {
+        await ctx.service(AUTH_ALIAS).update(undefined);
+    };
+    return { adoptToken, revokeToken };
 };
+/** The token helper of a context — one per context. */
+export const loginTokenOf = memoHelper.oncePer(makeLoginTokenHelper);
+/** @deprecated compat:factory-refactor — use `loginTokenOf(ctx).adoptToken(…)` */
+export const adoptToken = async (ctx, token) => loginTokenOf(ctx).adoptToken(token);
+/** @deprecated compat:factory-refactor — use `loginTokenOf(ctx).revokeToken()` */
+export const revokeToken = async (ctx) => loginTokenOf(ctx).revokeToken();
 //# sourceMappingURL=adopt.js.map

package/build/login/adopt.js.map

@@ -1 +1 @@
-{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AAG1D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAiB,EAAE,KAAa,EAAiB,EAAE;IAClF,MAAM,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1D,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAiB,EAAiB,EAAE;IACpE,MAAM,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAC9D,CAAC,CAAA"}
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AAI1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAiB,EAAoB,EAAE;IAC1E,MAAM,UAAU,GAAG,KAAK,EAAE,KAAa,EAAiB,EAAE;QACxD,MAAM,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1D,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;QAC5C,MAAM,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9D,CAAC,CAAA;IAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;AACpC,CAAC,CAAA;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;AAEpE,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAiB,EAAE,KAAa,EAAiB,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAExH,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAiB,EAAiB,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA"}

package/build/login/consts.d.ts

@@ -94,4 +94,10 @@ export declare enum LoginIntent {
     Login = "login",
     Logout = "logout"
 }
+/**
+ * How long a sign-in aimed at a screen (`LoginRequest.target`) keeps that screen parked: long
+ * enough for a sign-in with an emailed code, short enough that a tab abandoned mid-way never lands
+ * a later, unrelated sign-in on it.
+ */
+export declare const LOGIN_TARGET_TTL: number;
 //# sourceMappingURL=consts.d.ts.map

package/build/login/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,eAAO,MAAM,aAAa,kBAAgB,CAAA;AAE1C,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,eAAO,MAAM,oBAAoB,+BAA+B,CAAA;AAEhE,eAAO,MAAM,sBAAsB,yBAAyB,CAAA;AAE5D,eAAO,MAAM,qBAAqB,MAAM,CAAA;AAExC,eAAO,MAAM,sBAAsB,MAAM,CAAA;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,mCACwC,CAAA;AAE7E,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,OAAQ,CAAA;AAEvC,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,2BAA2B,CAAA;AAE5D,sEAAsE;AACtE,oBAAY,YAAY;IACtB,kFAAkF;IAClF,IAAI,SAAS;IACb,oFAAoF;IACpF,MAAM,WAAW;IACjB,sEAAsE;IACtE,QAAQ,aAAa;CACtB;AAED,oEAAoE;AACpE,oBAAY,YAAY;IACtB,sFAAsF;IACtF,OAAO,YAAY;IACnB,qFAAqF;IACrF,MAAM,WAAW;IACjB,oFAAoF;IACpF,UAAU,eAAe;IACzB,0FAA0F;IAC1F,OAAO,YAAY;IACnB,6EAA6E;IAC7E,QAAQ,aAAa;IACrB,gGAAgG;IAChG,MAAM,WAAW;IACjB;;;;;;OAMG;IACH,OAAO,YAAY;CACpB;AAED,yCAAyC;AACzC,oBAAY,WAAW;IACrB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,eAAO,MAAM,aAAa,kBAAgB,CAAA;AAE1C,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,eAAO,MAAM,oBAAoB,+BAA+B,CAAA;AAEhE,eAAO,MAAM,sBAAsB,yBAAyB,CAAA;AAE5D,eAAO,MAAM,qBAAqB,MAAM,CAAA;AAExC,eAAO,MAAM,sBAAsB,MAAM,CAAA;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,mCACwC,CAAA;AAE7E,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SAAS,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAA;AAE1C,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,OAAQ,CAAA;AAEvC,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,2BAA2B,CAAA;AAE5D,sEAAsE;AACtE,oBAAY,YAAY;IACtB,kFAAkF;IAClF,IAAI,SAAS;IACb,oFAAoF;IACpF,MAAM,WAAW;IACjB,sEAAsE;IACtE,QAAQ,aAAa;CACtB;AAED,oEAAoE;AACpE,oBAAY,YAAY;IACtB,sFAAsF;IACtF,OAAO,YAAY;IACnB,qFAAqF;IACrF,MAAM,WAAW;IACjB,oFAAoF;IACpF,UAAU,eAAe;IACzB,0FAA0F;IAC1F,OAAO,YAAY;IACnB,6EAA6E;IAC7E,QAAQ,aAAa;IACrB,gGAAgG;IAChG,MAAM,WAAW;IACjB;;;;;;OAMG;IACH,OAAO,YAAY;CACpB;AAED,yCAAyC;AACzC,oBAAY,WAAW;IACrB,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAiB,CAAA"}

package/build/login/consts.js

@@ -97,4 +97,10 @@ export var LoginIntent;
     LoginIntent["Login"] = "login";
     LoginIntent["Logout"] = "logout";
 })(LoginIntent || (LoginIntent = {}));
+/**
+ * How long a sign-in aimed at a screen (`LoginRequest.target`) keeps that screen parked: long
+ * enough for a sign-in with an emailed code, short enough that a tab abandoned mid-way never lands
+ * a later, unrelated sign-in on it.
+ */
+export const LOGIN_TARGET_TTL = 30 * 60 * 1000;
 //# sourceMappingURL=consts.js.map

package/build/login/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAExC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,mBAAmB,qBAAqB,WAAW,sBAAsB,EAAE,CAAA;AAE7E,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA;AAE1D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEvC,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAE5D,sEAAsE;AACtE,MAAM,CAAN,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,kFAAkF;IAClF,6BAAa,CAAA;IACb,oFAAoF;IACpF,iCAAiB,CAAA;IACjB,sEAAsE;IACtE,qCAAqB,CAAA;AACvB,CAAC,EAPW,YAAY,KAAZ,YAAY,QAOvB;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,YAqBX;AArBD,WAAY,YAAY;IACtB,sFAAsF;IACtF,mCAAmB,CAAA;IACnB,qFAAqF;IACrF,iCAAiB,CAAA;IACjB,oFAAoF;IACpF,yCAAyB,CAAA;IACzB,0FAA0F;IAC1F,mCAAmB,CAAA;IACnB,6EAA6E;IAC7E,qCAAqB,CAAA;IACrB,gGAAgG;IAChG,iCAAiB,CAAA;IACjB;;;;;;OAMG;IACH,mCAAmB,CAAA;AACrB,CAAC,EArBW,YAAY,KAAZ,YAAY,QAqBvB;AAED,yCAAyC;AACzC,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,8BAAe,CAAA;IACf,gCAAiB,CAAA;AACnB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAExC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,mBAAmB,qBAAqB,WAAW,sBAAsB,EAAE,CAAA;AAE7E,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA;AAE1D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEvC,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAE5D,sEAAsE;AACtE,MAAM,CAAN,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,kFAAkF;IAClF,6BAAa,CAAA;IACb,oFAAoF;IACpF,iCAAiB,CAAA;IACjB,sEAAsE;IACtE,qCAAqB,CAAA;AACvB,CAAC,EAPW,YAAY,KAAZ,YAAY,QAOvB;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,YAqBX;AArBD,WAAY,YAAY;IACtB,sFAAsF;IACtF,mCAAmB,CAAA;IACnB,qFAAqF;IACrF,iCAAiB,CAAA;IACjB,oFAAoF;IACpF,yCAAyB,CAAA;IACzB,0FAA0F;IAC1F,mCAAmB,CAAA;IACnB,6EAA6E;IAC7E,qCAAqB,CAAA;IACrB,gGAAgG;IAChG,iCAAiB,CAAA;IACjB;;;;;;OAMG;IACH,mCAAmB,CAAA;AACrB,CAAC,EArBW,YAAY,KAAZ,YAAY,QAqBvB;AAED,yCAAyC;AACzC,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,8BAAe,CAAA;IACf,gCAAiB,CAAA;AACnB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA"}

package/build/login/consts.local.d.ts

@@ -1,3 +1,4 @@
+import { LoginOutcome } from './consts.js';
 import type { CSSProperties } from 'react';
 /**
  * The page the card sits in.
@@ -10,4 +11,6 @@ export declare const page: CSSProperties;
 export declare const box: CSSProperties;
 /** The same English fallback a document's `i18nKey` translates to when nothing else names it. */
 export declare const DEFAULT_LABEL: Record<string, string>;
+/** Outcomes after which nobody was signed in, so a screen parked for the landing must not wait. */
+export declare const UNSIGNED_OUTCOMES: ReadonlySet<LoginOutcome>;
 //# sourceMappingURL=consts.local.d.ts.map