@owlmeans/client-auth 0.1.18-rc.6 → 0.1.18-rc.60

package/build/login/credit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/credit/types.ts"],"names":[],"mappings":""}

package/build/login/credit.d.ts

@@ -0,0 +1,19 @@
+import type { BrandSettings, LoginCreditConfig } from '@owlmeans/config';
+import type { ResolvedCredit } from './credit/types.js';
+/**
+ * What the bottom of the sign-in screen says.
+ *
+ * It is a copyright notice, so it is composed as one: `© <year> <holder>`. That is the whole
+ * reason `copyright` defaults to on — the name on its own reads as a caption, and an application
+ * that means to assert a copyright would have had to write the mark and the year into a literal
+ * `line` to get one.
+ *
+ * The organization falls back to its slug because an organization record carries no readable name
+ * — so "no name" is the ordinary case, not an error, and a screen that rendered an empty line for
+ * it would be worse than one that renders the slug.
+ *
+ * `line` replaces everything when an app supplies it: a product with its own legal wording should
+ * not have to defeat a composition rule to use it.
+ */
+export declare const resolveCredit: (cfg?: LoginCreditConfig, brand?: BrandSettings, service?: string) => ResolvedCredit;
+//# sourceMappingURL=credit.d.ts.map

package/build/login/credit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit.d.ts","sourceRoot":"","sources":["../../src/login/credit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAuBvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,SAClB,iBAAiB,UAAU,aAAa,YAAY,MAAM,KAC/D,cA2BF,CAAA"}

package/build/login/credit.js

@@ -0,0 +1,58 @@
+/**
+ * The years one notice covers.
+ *
+ * A range only while the first year is genuinely in the past — an app configured with the current
+ * year, or with a year a skewed clock puts in the future, still gets a well-formed notice rather
+ * than `© 2026–2026` or a range that runs backwards.
+ */
+const years = (since, now) => since != null && since > 0 && since < now ? `${since}–${now}` : `${now}`;
+/**
+ * A configured value that was actually SET.
+ *
+ * Empty is how a build-time default spells "unset", and this config is filled from environment
+ * variables a platform delivers — `BRANDING_ORGANIZATION: meta.brandingOrganization ?? ''` is the
+ * shape of every one of them. `??` does not fall through an empty string, so an undelivered
+ * organization used to win the fallback chain and compose a line ending in a bare dash.
+ */
+const set = (value) => value != null && value.trim() !== '' ? value : null;
+/**
+ * What the bottom of the sign-in screen says.
+ *
+ * It is a copyright notice, so it is composed as one: `© <year> <holder>`. That is the whole
+ * reason `copyright` defaults to on — the name on its own reads as a caption, and an application
+ * that means to assert a copyright would have had to write the mark and the year into a literal
+ * `line` to get one.
+ *
+ * The organization falls back to its slug because an organization record carries no readable name
+ * — so "no name" is the ordinary case, not an error, and a screen that rendered an empty line for
+ * it would be worse than one that renders the slug.
+ *
+ * `line` replaces everything when an app supplies it: a product with its own legal wording should
+ * not have to defeat a composition rule to use it.
+ */
+export const resolveCredit = (cfg, brand, service) => {
+    const poweredBy = cfg?.poweredBy ?? true;
+    const literal = set(cfg?.line);
+    if (literal != null) {
+        return { poweredBy, line: literal };
+    }
+    const product = set(cfg?.product) ?? set(brand?.name) ?? set(service);
+    const organization = set(cfg?.organization) ?? set(brand?.organization)
+        ?? set(cfg?.entity) ?? set(brand?.entity);
+    // Whoever the notice names. A product with no organization behind it holds its own copyright,
+    // which is why this falls through to the product rather than dropping the notice.
+    const holder = set(cfg?.holder) ?? organization ?? product;
+    const wording = typeof cfg?.copyright === 'string' ? set(cfg.copyright) : null;
+    const notice = cfg?.copyright === false || holder == null
+        ? organization
+        : wording ?? `© ${years(cfg?.since, new Date().getFullYear())} ${holder}`;
+    // The product is named beside the notice only when it is not already the thing being claimed —
+    // "OwlMeans — © 2026 OwlMeans" says the name twice and neither time usefully.
+    return {
+        poweredBy,
+        line: product != null && notice != null && product !== holder
+            ? `${product} — ${notice}`
+            : notice ?? product,
+    };
+};
+//# sourceMappingURL=credit.js.map

package/build/login/credit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit.js","sourceRoot":"","sources":["../../src/login/credit.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAE,GAAW,EAAU,EAAE,CAC/D,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAA;AAE1E;;;;;;;GAOG;AACH,MAAM,GAAG,GAAG,CAAC,KAAqB,EAAiB,EAAE,CACnD,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAuB,EAAE,KAAqB,EAAE,OAAgB,EAChD,EAAE;IAClB,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,IAAI,IAAI,CAAA;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC9B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACrC,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC;WAClE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAE3C,8FAA8F;IAC9F,kFAAkF;IAClF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,YAAY,IAAI,OAAO,CAAA;IAC1D,MAAM,OAAO,GAAG,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9E,MAAM,MAAM,GAAG,GAAG,EAAE,SAAS,KAAK,KAAK,IAAI,MAAM,IAAI,IAAI;QACvD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,EAAE,CAAA;IAE3E,+FAA+F;IAC/F,8EAA8E;IAC9E,OAAO;QACL,SAAS;QACT,IAAI,EAAE,OAAO,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,MAAM;YAC3D,CAAC,CAAC,GAAG,OAAO,MAAM,MAAM,EAAE;YAC1B,CAAC,CAAC,MAAM,IAAI,OAAO;KACtB,CAAA;AACH,CAAC,CAAA"}

package/build/login/env/types.d.ts

@@ -0,0 +1,35 @@
+import type { LoginEnv } from '../types.js';
+/** What this browsing context is for a sign-in: framed, the surrogate window, opened by another. */
+export interface LoginEnvHelper {
+    /**
+     * Whether this document is embedded in a frame.
+     *
+     * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
+     * differs and a `top` that cannot be reached both mean "framed".
+     */
+    isEmbedded: () => boolean;
+    /**
+     * Record that this window is the surrogate login window, while that is still knowable.
+     *
+     * Must run on the surrogate's **first** load, before the flow navigates to the provider:
+     * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
+     * context goes cross-origin — so by the time the provider redirects back, the name is gone and
+     * this window would look like an ordinary tab.
+     *
+     * Idempotent, and a no-op in every window that is not the surrogate.
+     */
+    markSurrogate: () => void;
+    /** Whether this document is the surrogate login window. */
+    isSurrogate: () => boolean;
+    /** Forget the surrogate marker — called once its token has been handed back. */
+    clearSurrogate: () => void;
+    /**
+     * Default login environment.
+     *
+     * The single source of environment truth for cascade selection — a plugin's `match` reads this
+     * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
+     * own descriptor.
+     */
+    defaultLoginEnv: () => LoginEnv;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/env/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/env/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,UAAU,EAAE,MAAM,OAAO,CAAA;IACzB;;;;;;;;;OASG;IACH,aAAa,EAAE,MAAM,IAAI,CAAA;IACzB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,OAAO,CAAA;IAC1B,gFAAgF;IAChF,cAAc,EAAE,MAAM,IAAI,CAAA;IAC1B;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,QAAQ,CAAA;CAChC"}

package/build/login/env/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/env/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/env/types.ts"],"names":[],"mappings":""}

package/build/login/env.d.ts

@@ -0,0 +1,8 @@
+import type { LoginEnvHelper } from './env/types.js';
+export declare const createLoginEnvHelper: () => LoginEnvHelper;
+export declare const loginEnvHelper: LoginEnvHelper;
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.markSurrogate()` */
+export declare const markSurrogate: () => void;
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.clearSurrogate()` */
+export declare const clearSurrogate: () => void;
+//# sourceMappingURL=env.d.ts.map

package/build/login/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,eAAO,MAAM,oBAAoB,QAAO,cA6DvC,CAAA;AAED,eAAO,MAAM,cAAc,gBAAyB,CAAA;AAEpD,iFAAiF;AACjF,eAAO,MAAM,aAAa,QAAO,IAAsC,CAAA;AAEvE,kFAAkF;AAClF,eAAO,MAAM,cAAc,QAAO,IAAuC,CAAA"}

package/build/login/env.js

@@ -0,0 +1,67 @@
+import { LOGIN_SURROGATE_MARKER, LOGIN_SURROGATE_NAME } from './consts.js';
+export const createLoginEnvHelper = () => {
+    const isEmbedded = () => {
+        try {
+            return window.self !== window.top;
+        }
+        catch {
+            return true;
+        }
+    };
+    const markSurrogate = () => {
+        if (typeof window === 'undefined' || window.name !== LOGIN_SURROGATE_NAME) {
+            return;
+        }
+        try {
+            window.sessionStorage.setItem(LOGIN_SURROGATE_MARKER, '1');
+        }
+        catch {
+            // Storage can be unavailable (private modes, blocked cookies). The `window.name` check still
+            // covers the case where nothing cross-origin happened in between.
+        }
+    };
+    const isSurrogate = () => {
+        if (typeof window === 'undefined') {
+            return false;
+        }
+        if (window.name === LOGIN_SURROGATE_NAME) {
+            return true;
+        }
+        try {
+            return window.sessionStorage.getItem(LOGIN_SURROGATE_MARKER) === '1';
+        }
+        catch {
+            return false;
+        }
+    };
+    const clearSurrogate = () => {
+        if (typeof window === 'undefined') {
+            return;
+        }
+        try {
+            window.sessionStorage.removeItem(LOGIN_SURROGATE_MARKER);
+        }
+        catch { /* nothing to clean up if storage was never available */ }
+    };
+    const defaultLoginEnv = () => {
+        const hasWindow = typeof window !== 'undefined';
+        if (!hasWindow) {
+            return { hasWindow, embedded: false, surrogate: false, hasOpener: false };
+        }
+        return {
+            hasWindow,
+            embedded: isEmbedded(),
+            surrogate: isSurrogate(),
+            // `Cross-Origin-Opener-Policy: same-origin` from the provider severs this permanently, which
+            // is why it is observed rather than assumed from "we were opened by someone".
+            hasOpener: window.opener != null,
+        };
+    };
+    return { isEmbedded, markSurrogate, isSurrogate, clearSurrogate, defaultLoginEnv };
+};
+export const loginEnvHelper = createLoginEnvHelper();
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.markSurrogate()` */
+export const markSurrogate = () => loginEnvHelper.markSurrogate();
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.clearSurrogate()` */
+export const clearSurrogate = () => loginEnvHelper.clearSurrogate();
+//# sourceMappingURL=env.js.map

package/build/login/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAI1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAmB,EAAE;IACvD,MAAM,UAAU,GAAG,GAAY,EAAE;QAC/B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,GAAS,EAAE;QAC/B,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1E,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,kEAAkE;QACpE,CAAC;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,GAAY,EAAE;QAChC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,GAAG,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,GAAS,EAAE;QAChC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;IACtE,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,GAAa,EAAE;QACrC,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC3E,CAAC;QAED,OAAO;YACL,SAAS;YACT,QAAQ,EAAE,UAAU,EAAE;YACtB,SAAS,EAAE,WAAW,EAAE;YACxB,6FAA6F;YAC7F,8EAA8E;YAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;SACjC,CAAA;IACH,CAAC,CAAA;IAED,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,CAAA;AACpF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;AAEpD,iFAAiF;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,CAAA;AAEvE,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAS,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,CAAA"}

package/build/login/flow.d.ts

@@ -0,0 +1,20 @@
+import type { FlowModel } from '@owlmeans/flow';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export declare const enterOidcAuthorization: (model: FlowModel) => FlowModel;
+//# sourceMappingURL=flow.d.ts.map

package/build/login/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,UAAW,SAAS,KAAG,SAsBzD,CAAA"}

package/build/login/flow.js

@@ -0,0 +1,39 @@
+import { FLOW_PLACEHOLDER, OidcAuthStep, STD_OIDC_FLOW } from '@owlmeans/flow';
+import { DEFAULT_ENTITY } from '../consts.js';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export const enterOidcAuthorization = (model) => {
+    const state = model.state();
+    if (state.flow !== STD_OIDC_FLOW || state.step !== OidcAuthStep.Dispatch) {
+        return model;
+    }
+    const target = model.step().service;
+    if (state.service == null || state.service === '') {
+        model.target(target);
+    }
+    // The entity travels to this app's own backend, which resolves its default provider by `def`
+    // alone. It still has to BE there: the init endpoint rejects a body without one.
+    if (state.entityId == null) {
+        model.entity(DEFAULT_ENTITY);
+    }
+    if (target === FLOW_PLACEHOLDER) {
+        model.transit(OidcAuthStep.Ephemeral, true);
+    }
+    return model;
+};
+//# sourceMappingURL=flow.js.map

package/build/login/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAgB,EAAa,EAAE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAA;IACnC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,6FAA6F;IAC7F,iFAAiF;IACjF,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/login/hook.d.ts

@@ -0,0 +1,52 @@
+import { type MouseEvent } from 'react';
+import type { LandOptions } from './land/types.js';
+/**
+ * Wiring for a "Log in" control: where it points, and what it does when clicked.
+ *
+ * The caller renders one control and attaches one handler — which browsing context the flow can
+ * actually complete in is the login service's problem, not the app's. An ordinary tab redirects;
+ * an app embedded in a frame runs the flow one window up, because the provider refuses to be
+ * framed and its cookies are third-party there.
+ *
+ * `target` is the screen to land on once signed in — sign-in FIRST, then the screen, in an ordinary
+ * tab and in a framed application alike, with any pending post-sign-in step (a consent screen) run
+ * on the way. The control still leads to the dispatcher; the target is parked for the landing
+ * (`LoginRequest.target`), and somebody already signed in goes straight to it (`loginStartOf(ctx).startLogin`).
+ * Without a target the landing is the ordinary one.
+ *
+ * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
+ * opened after the user gesture has finished being handled is eaten by the popup blocker.
+ *
+ * The dispatcher entrypoint is resolved INSIDE the hook, never at module scope. Module bodies run
+ * while the app is still being imported, before `registerEntrypoints` has put anything on the
+ * context, and a top-level lookup throws `Entrypoint dispatcher not found` — which escapes during
+ * import, takes the whole render down, and paints an empty page with no component at fault.
+ */
+export declare const useLogin: (target?: string) => readonly [string, (event?: MouseEvent) => void];
+/**
+ * Wiring for a "Log out" control.
+ *
+ * One control, one handler, no decision — the mirror of {@link useLogin}. Where the session has to
+ * be ended (here, or one window up in a surrogate whose storage partition this document cannot
+ * reach) is the login plugin's call.
+ *
+ * NOT async, and nothing is awaited before delegating: logging out of a framed application opens a
+ * window, and a window opened after the gesture has finished being handled is eaten by the popup
+ * blocker. The surrogate entrypoint is resolved INSIDE the hook for the same reason `useLogin`
+ * resolves the dispatcher there.
+ *
+ * The return shape stays a bare handler rather than `useLogin`'s tuple: a logout control has no
+ * address to point at, and every generated application carries a copy of a component that writes
+ * `const onLogOut = useLogout()`. `(event?: MouseEvent) => void` is assignable to `() => void`, so
+ * `onClick={onLogOut}` keeps compiling everywhere.
+ */
+export declare const useLogout: (target?: string) => ((event?: MouseEvent) => void);
+/**
+ * For a component that runs its own post-login step (the marketing-consent screen, for one) to
+ * call once it is satisfied — moves the flow on to the next step, or the ordinary landing.
+ *
+ * Not async at the call site by accident of its own — it is a callback a component holds and
+ * fires later, so nothing here needs the synchronous-gesture discipline `useLogin`/`useLogout` do.
+ */
+export declare const useContinueLogin: () => ((opts?: LandOptions) => Promise<void>);
+//# sourceMappingURL=hook.d.ts.map

package/build/login/hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/login/hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,OAAO,CAAA;AAMpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAMlD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,QAAQ,YAAa,MAAM,KAAG,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,KAAK,IAAI,CAcxF,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,SAAS,YAAa,MAAM,KAAG,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,KAAK,IAAI,CAcxE,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAQzE,CAAA"}

package/build/login/hook.js

@@ -0,0 +1,89 @@
+import { useCallback } from 'react';
+import { useContext, useNavigate } from '@owlmeans/client';
+import { DISPATCHER } from '@owlmeans/auth';
+import { LoginIntent, LOGIN_SERVICE } from './consts.js';
+import { loginLandingOf } from './land.js';
+import { surrogatePath } from './surrogate.js';
+import { loginStartOf } from './start.js';
+/**
+ * Wiring for a "Log in" control: where it points, and what it does when clicked.
+ *
+ * The caller renders one control and attaches one handler — which browsing context the flow can
+ * actually complete in is the login service's problem, not the app's. An ordinary tab redirects;
+ * an app embedded in a frame runs the flow one window up, because the provider refuses to be
+ * framed and its cookies are third-party there.
+ *
+ * `target` is the screen to land on once signed in — sign-in FIRST, then the screen, in an ordinary
+ * tab and in a framed application alike, with any pending post-sign-in step (a consent screen) run
+ * on the way. The control still leads to the dispatcher; the target is parked for the landing
+ * (`LoginRequest.target`), and somebody already signed in goes straight to it (`loginStartOf(ctx).startLogin`).
+ * Without a target the landing is the ordinary one.
+ *
+ * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
+ * opened after the user gesture has finished being handled is eaten by the popup blocker.
+ *
+ * The dispatcher entrypoint is resolved INSIDE the hook, never at module scope. Module bodies run
+ * while the app is still being imported, before `registerEntrypoints` has put anything on the
+ * context, and a top-level lookup throws `Entrypoint dispatcher not found` — which escapes during
+ * import, takes the whole render down, and paints an empty page with no component at fault.
+ */
+export const useLogin = (target) => {
+    const context = useContext();
+    const nav = useNavigate();
+    const dispatcher = context.entrypoint(DISPATCHER);
+    const path = dispatcher.path();
+    const onLogin = useCallback((event) => {
+        event?.preventDefault();
+        void loginStartOf(context).startLogin({
+            url: path, target, go: alias => nav.go(alias),
+        });
+    }, [context, path, target]);
+    return [path, onLogin];
+};
+/**
+ * Wiring for a "Log out" control.
+ *
+ * One control, one handler, no decision — the mirror of {@link useLogin}. Where the session has to
+ * be ended (here, or one window up in a surrogate whose storage partition this document cannot
+ * reach) is the login plugin's call.
+ *
+ * NOT async, and nothing is awaited before delegating: logging out of a framed application opens a
+ * window, and a window opened after the gesture has finished being handled is eaten by the popup
+ * blocker. The surrogate entrypoint is resolved INSIDE the hook for the same reason `useLogin`
+ * resolves the dispatcher there.
+ *
+ * The return shape stays a bare handler rather than `useLogin`'s tuple: a logout control has no
+ * address to point at, and every generated application carries a copy of a component that writes
+ * `const onLogOut = useLogout()`. `(event?: MouseEvent) => void` is assignable to `() => void`, so
+ * `onClick={onLogOut}` keeps compiling everywhere.
+ */
+export const useLogout = (target) => {
+    const context = useContext();
+    const nav = useNavigate();
+    const path = surrogatePath(context, { intent: LoginIntent.Logout });
+    return useCallback((event) => {
+        event?.preventDefault();
+        const login = context.service(LOGIN_SERVICE);
+        void login.logout({
+            // An application whose entrypoint list predates the surrogate route logs out in place.
+            url: path ?? '',
+            ...(target != null ? { navigate: () => { nav.go(target); } } : {}),
+        });
+    }, [context, path, target]);
+};
+/**
+ * For a component that runs its own post-login step (the marketing-consent screen, for one) to
+ * call once it is satisfied — moves the flow on to the next step, or the ordinary landing.
+ *
+ * Not async at the call site by accident of its own — it is a callback a component holds and
+ * fires later, so nothing here needs the synchronous-gesture discipline `useLogin`/`useLogout` do.
+ */
+export const useContinueLogin = () => {
+    const context = useContext();
+    const nav = useNavigate();
+    return useCallback(async (opts) => {
+        const landing = await loginLandingOf(context).continueLogin(opts);
+        await nav.go(landing.alias, { params: landing.params, query: landing.query });
+    }, [context, nav]);
+};
+//# sourceMappingURL=hook.js.map

package/build/login/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/login/hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAmB,MAAM,OAAO,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAG1D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAmD,EAAE;IAC3F,MAAM,OAAO,GAAG,UAAU,EAA8B,CAAA;IACxD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAmB,UAAU,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;IAE9B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,KAAkB,EAAE,EAAE;QACjD,KAAK,EAAE,cAAc,EAAE,CAAA;QACvB,KAAK,YAAY,CAAC,OAAkC,CAAC,CAAC,UAAU,CAAC;YAC/D,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC;SAC9C,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAE3B,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU,CAAA;AACjC,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAe,EAAkC,EAAE;IAC3E,MAAM,OAAO,GAAG,UAAU,EAA8B,CAAA;IACxD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAkC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IAE9F,OAAO,WAAW,CAAC,CAAC,KAAkB,EAAE,EAAE;QACxC,KAAK,EAAE,cAAc,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;QAC1D,KAAK,KAAK,CAAC,MAAM,CAAC;YAChB,uFAAuF;YACvF,GAAG,EAAE,IAAI,IAAI,EAAE;YACf,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAC7B,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAA4C,EAAE;IAC5E,MAAM,OAAO,GAAG,UAAU,EAA8B,CAAA;IACxD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,OAAO,WAAW,CAAC,KAAK,EAAE,IAAkB,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAkC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5F,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IAC/E,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;AACpB,CAAC,CAAA"}

package/build/login/i18n/be.json

@@ -0,0 +1,41 @@
+{
+    "login": {
+        "title": "Уваход",
+        "subtitle": "Абярыце спосаб уваходу.",
+        "busy": "Адкрываем акно ўваходу…",
+        "empty": "Для гэтай праграмы не наладжаны ніводзін спосаб уваходу.",
+        "method": {
+            "google": "Працягнуць з Google",
+            "oidc": "Працягнуць з {{provider}}",
+            "oidc-default": "Увайсці / Зарэгістравацца",
+            "oidc-client": "Працягнуць з {{provider}}",
+            "basic-ed25519": "Увайсці з ключом",
+            "pk-supervisor": "Сакрэтны ключ (аператар)",
+            "wallet-consumer": "Гаманец OwlMeans ID",
+            "one-time-token": "Увайсці па кодзе з ліста",
+            "fallback": "Працягнуць з {{method}}"
+        },
+        "terms": {
+            "accept": "Я прачытаў(-ла) і прымаю {{documents}}.",
+            "terms": "Умовы карыстання",
+            "privacy": "Палітыку прыватнасці",
+            "cookies": "Палітыку файлаў cookie",
+            "billing": "Умовы аплаты",
+            "product": "Умовы прадукту {{product}}",
+            "notice": "Як мы апрацоўваем вашы асабістыя дадзеныя: {{notices}}.",
+            "revised": "Апошняе абнаўленне: {{date}}",
+            "required": "Каб працягнуць, пацвердзіце {{documents}}."
+        },
+        "consent": {
+            "required": "Уваход захоўвае сеансавы файл cookie. Прыміце неабходныя файлы cookie, каб працягнуць."
+        },
+        "credit": {
+            "powered": "Працуе на OwlMeans"
+        },
+        "error": {
+            "failed": "Уваход не завершаны. Паспрабуйце яшчэ раз.",
+            "blocked": "Акно ўваходу заблакавана. Націсніце значок заблакаванага ўсплывальнага акна ў адрасным радку браўзера, каб адкрыць яго."
+        },
+        "orphaned": "Уваход выкананы. Можаце закрыць гэтае акно і вярнуцца ў праграму."
+    }
+}

package/build/login/i18n/de.json

@@ -0,0 +1,41 @@
+{
+    "login": {
+        "title": "Anmelden",
+        "subtitle": "Wählen Sie, wie Sie fortfahren möchten.",
+        "busy": "Anmeldung wird geöffnet…",
+        "empty": "Für diese Anwendung ist keine Anmeldemethode konfiguriert.",
+        "method": {
+            "google": "Mit Google fortfahren",
+            "oidc": "Mit {{provider}} fortfahren",
+            "oidc-default": "Anmelden / Registrieren",
+            "oidc-client": "Mit {{provider}} fortfahren",
+            "basic-ed25519": "Mit einem Schlüssel anmelden",
+            "pk-supervisor": "Geheimer Schlüssel (Betreiber)",
+            "wallet-consumer": "OwlMeans-ID-Wallet",
+            "one-time-token": "Mit einem E-Mail-Code anmelden",
+            "fallback": "Mit {{method}} fortfahren"
+        },
+        "terms": {
+            "accept": "Ich habe {{documents}} gelesen und stimme ihnen zu.",
+            "terms": "Allgemeinen Geschäftsbedingungen",
+            "privacy": "Datenschutzerklärung",
+            "cookies": "Cookie-Richtlinie",
+            "billing": "Abrechnungsbedingungen",
+            "product": "{{product}}-Produktbedingungen",
+            "notice": "Wie wir Ihre personenbezogenen Daten verarbeiten: {{notices}}.",
+            "revised": "Zuletzt aktualisiert: {{date}}",
+            "required": "Bitte bestätigen Sie {{documents}}, um fortzufahren."
+        },
+        "consent": {
+            "required": "Bei der Anmeldung wird ein Sitzungs-Cookie gespeichert. Akzeptieren Sie die notwendigen Cookies, um fortzufahren."
+        },
+        "credit": {
+            "powered": "Betrieben mit OwlMeans"
+        },
+        "error": {
+            "failed": "Die Anmeldung wurde nicht abgeschlossen. Bitte versuchen Sie es erneut.",
+            "blocked": "Das Anmeldefenster wurde blockiert. Klicken Sie auf das Symbol für blockierte Pop-ups in der Adressleiste Ihres Browsers, um es zu öffnen."
+        },
+        "orphaned": "Angemeldet. Sie können dieses Fenster schließen und in der Anwendung fortfahren."
+    }
+}

package/build/login/i18n/en.json

@@ -0,0 +1,41 @@
+{
+    "login": {
+        "title": "Sign in",
+        "subtitle": "Choose how you would like to continue.",
+        "busy": "Opening sign-in…",
+        "empty": "No sign-in method is configured for this application.",
+        "method": {
+            "google": "Continue with Google",
+            "oidc": "Continue with {{provider}}",
+            "oidc-default": "Sign in / Sign up",
+            "oidc-client": "Continue with {{provider}}",
+            "basic-ed25519": "Sign in with a key",
+            "pk-supervisor": "Secret key (operator)",
+            "wallet-consumer": "OwlMeans ID wallet",
+            "one-time-token": "Sign in with an email code",
+            "fallback": "Continue with {{method}}"
+        },
+        "terms": {
+            "accept": "I have read and agree to the {{documents}}.",
+            "terms": "Terms & Conditions",
+            "privacy": "Privacy Policy",
+            "cookies": "Cookie Policy",
+            "billing": "Billing Terms",
+            "product": "{{product}} Product Terms",
+            "notice": "How we handle your personal data: {{notices}}.",
+            "revised": "Last updated: {{date}}",
+            "required": "Please confirm the {{documents}} to continue."
+        },
+        "consent": {
+            "required": "Signing in stores a session cookie. Accept essential cookies to continue."
+        },
+        "credit": {
+            "powered": "Powered by OwlMeans"
+        },
+        "error": {
+            "failed": "Sign-in did not complete. Please try again.",
+            "blocked": "The sign-in window was blocked. Click the blocked pop-up icon in your browser's address bar to open it."
+        },
+        "orphaned": "Signed in. You can close this window and continue in the application."
+    }
+}

package/build/login/i18n/es.json

@@ -0,0 +1,41 @@
+{
+    "login": {
+        "title": "Iniciar sesión",
+        "subtitle": "Elige cómo quieres continuar.",
+        "busy": "Abriendo el inicio de sesión…",
+        "empty": "No hay ningún método de inicio de sesión configurado para esta aplicación.",
+        "method": {
+            "google": "Continuar con Google",
+            "oidc": "Continuar con {{provider}}",
+            "oidc-default": "Iniciar sesión / Registrarse",
+            "oidc-client": "Continuar con {{provider}}",
+            "basic-ed25519": "Iniciar sesión con una clave",
+            "pk-supervisor": "Clave secreta (operador)",
+            "wallet-consumer": "Cartera OwlMeans ID",
+            "one-time-token": "Iniciar sesión con un código por correo",
+            "fallback": "Continuar con {{method}}"
+        },
+        "terms": {
+            "accept": "He leído y acepto {{documents}}.",
+            "terms": "Términos y Condiciones",
+            "privacy": "Política de Privacidad",
+            "cookies": "Política de Cookies",
+            "billing": "Condiciones de Facturación",
+            "product": "Condiciones del Producto {{product}}",
+            "notice": "Cómo tratamos tus datos personales: {{notices}}.",
+            "revised": "Última actualización: {{date}}",
+            "required": "Confirma {{documents}} para continuar."
+        },
+        "consent": {
+            "required": "Iniciar sesión guarda una cookie de sesión. Acepta las cookies esenciales para continuar."
+        },
+        "credit": {
+            "powered": "Con tecnología de OwlMeans"
+        },
+        "error": {
+            "failed": "El inicio de sesión no se completó. Inténtalo de nuevo.",
+            "blocked": "Se bloqueó la ventana de inicio de sesión. Haz clic en el icono de ventana emergente bloqueada en la barra de direcciones del navegador para abrirla."
+        },
+        "orphaned": "Sesión iniciada. Puedes cerrar esta ventana y continuar en la aplicación."
+    }
+}