@owlmeans/client-auth 0.1.18-rc.6 → 0.1.18-rc.8

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.6",
-  "generatedAt": "2026-08-18T14:48:00.497Z",
+  "version": "0.1.18-rc.7",
+  "generatedAt": "2026-08-21T09:53:56.640Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-auth
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.6"` in `dependencies`
+**Install:** `"@owlmeans/client-auth": "^0.1.18-rc.7"` in `dependencies`
 
 ## Key Exports
 

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAGnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAS3D,eAAO,MAAM,KAAK,WACR,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,iDA2BjF,CAAA;AAED,eAAO,MAAM,WAAW,WAAW,OAAO,YAoBzC,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAGnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAS3D,eAAO,MAAM,KAAK,GAChB,QAAQ,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,WAAW,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,iDA2BjF,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,QAAO,OAAc,YAoBhD,CAAA"}

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAChF,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAY,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACvD,+CAA+C;AAC/C,+CAA+C;AAC/C,gDAAgD;AAEhD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAsC,EAAE,QAAwC,EAChF,EAAE;IACF,MAAM,GAAG,GAAG,UAAU,EAAkD,CAAA;IAExE,MAAM,GAAG,GAAG,OAAO,CACjB,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAmB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAC/F,CAAA;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAA;gBACrB,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAiB,IAAI,CAAA,qCAAqC,EAAE,EAAE;IACxF,MAAM,OAAO,GAAG,UAAU,EAAkD,CAAA;IAC5E,sEAAsE;IACtE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,SAAS,CAAC,GAAG,EAAE;QACb,2BAA2B;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;gBAClB,6BAA6B;gBAC7B,qEAAqE;YACvE,CAAC;YAED,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}

package/build/login/adopt.d.ts

@@ -0,0 +1,15 @@
+import type { LoginContext } from './types.js';
+/**
+ * The one path an issued bearer token becomes this context's authentication.
+ *
+ * Resolved by alias rather than through `ctx.auth()` so the login host does not require
+ * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
+ * carries the auth service, including one it did not build.
+ *
+ * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
+ * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
+ * the MUI relying party each used to do — leaves the same state on a good day and diverges the
+ * moment any of it changes.
+ */
+export declare const adoptToken: (ctx: LoginContext, token: string) => Promise<void>;
+//# sourceMappingURL=adopt.d.ts.map

package/build/login/adopt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,GAAU,KAAK,YAAY,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,IAAI,CAE/E,CAAA"}

package/build/login/adopt.js

@@ -0,0 +1,17 @@
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js';
+/**
+ * The one path an issued bearer token becomes this context's authentication.
+ *
+ * Resolved by alias rather than through `ctx.auth()` so the login host does not require
+ * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
+ * carries the auth service, including one it did not build.
+ *
+ * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
+ * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
+ * the MUI relying party each used to do — leaves the same state on a good day and diverges the
+ * moment any of it changes.
+ */
+export const adoptToken = async (ctx, token) => {
+    await ctx.service(AUTH_ALIAS).update(token);
+};
+//# sourceMappingURL=adopt.js.map

package/build/login/adopt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/login/adopt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AAG1D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAiB,EAAE,KAAa,EAAiB,EAAE;IAClF,MAAM,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1D,CAAC,CAAA"}

package/build/login/consts.d.ts

@@ -0,0 +1,18 @@
+export declare const DEFAULT_ALIAS = "login-service";
+export declare const LOGIN_SERVICE = "login-service";
+/** Priority of a plugin that makes no claim about the environment. */
+export declare const DEFAULT_LOGIN_PRIORITY = 0;
+/**
+ * Name given to the surrogate login window, and the marker it records about itself.
+ *
+ * These values are a wire protocol between two documents that may be running different builds —
+ * an opener holding an older bundle and a surrogate freshly loaded, or the reverse. They are
+ * therefore fixed, and must never be "tidied" to match a newer vocabulary.
+ */
+export declare const LOGIN_SURROGATE_NAME = "owlmeans-oidc-login";
+export declare const LOGIN_TOKEN_MESSAGE = "owlmeans:oidc:popup-token";
+export declare const LOGIN_SURROGATE_MARKER = "_owlmeans-oidc-popup";
+export declare const LOGIN_SURROGATE_FEATURES = "popup=yes,width=520,height=760";
+/** How often a surrogate window is checked for having been closed by the user. */
+export declare const LOGIN_WATCH_INTERVAL = 500;
+//# sourceMappingURL=consts.d.ts.map

package/build/login/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,eAAO,MAAM,aAAa,kBAAgB,CAAA;AAE1C,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AAEzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,eAAO,MAAM,sBAAsB,yBAAyB,CAAA;AAE5D,eAAO,MAAM,wBAAwB,mCAAmC,CAAA;AAExE,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA"}

package/build/login/consts.js

@@ -0,0 +1,18 @@
+export const DEFAULT_ALIAS = 'login-service';
+export const LOGIN_SERVICE = DEFAULT_ALIAS;
+/** Priority of a plugin that makes no claim about the environment. */
+export const DEFAULT_LOGIN_PRIORITY = 0;
+/**
+ * Name given to the surrogate login window, and the marker it records about itself.
+ *
+ * These values are a wire protocol between two documents that may be running different builds —
+ * an opener holding an older bundle and a surrogate freshly loaded, or the reverse. They are
+ * therefore fixed, and must never be "tidied" to match a newer vocabulary.
+ */
+export const LOGIN_SURROGATE_NAME = 'owlmeans-oidc-login';
+export const LOGIN_TOKEN_MESSAGE = 'owlmeans:oidc:popup-token';
+export const LOGIN_SURROGATE_MARKER = '_owlmeans-oidc-popup';
+export const LOGIN_SURROGATE_FEATURES = 'popup=yes,width=520,height=760';
+/** How often a surrogate window is checked for having been closed by the user. */
+export const LOGIN_WATCH_INTERVAL = 500;
+//# sourceMappingURL=consts.js.map

package/build/login/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAA;AAExE,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA"}

package/build/login/env.d.ts

@@ -0,0 +1,32 @@
+import type { LoginEnv } from './types.js';
+/**
+ * Whether this document is embedded in a frame.
+ *
+ * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
+ * differs and a `top` that cannot be reached both mean "framed".
+ */
+export declare const isEmbedded: () => boolean;
+/**
+ * Record that this window is the surrogate login window, while that is still knowable.
+ *
+ * Must run on the surrogate's **first** load, before the flow navigates to the provider:
+ * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
+ * context goes cross-origin — so by the time the provider redirects back, the name is gone and
+ * this window would look like an ordinary tab.
+ *
+ * Idempotent, and a no-op in every window that is not the surrogate.
+ */
+export declare const markSurrogate: () => void;
+/** Whether this document is the surrogate login window. */
+export declare const isSurrogate: () => boolean;
+/** Forget the surrogate marker — called once its token has been handed back. */
+export declare const clearSurrogate: () => void;
+/**
+ * Default login environment.
+ *
+ * The single source of environment truth for cascade selection — a plugin's `match` reads this
+ * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
+ * own descriptor.
+ */
+export declare const defaultLoginEnv: () => LoginEnv;
+//# sourceMappingURL=env.d.ts.map

package/build/login/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAO,OAM7B,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,QAAO,IAUhC,CAAA;AAED,2DAA2D;AAC3D,eAAO,MAAM,WAAW,QAAO,OAY9B,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,cAAc,QAAO,IAOjC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,QAAO,QAclC,CAAA"}

package/build/login/env.js

@@ -0,0 +1,84 @@
+import { LOGIN_SURROGATE_MARKER, LOGIN_SURROGATE_NAME } from './consts.js';
+/**
+ * Whether this document is embedded in a frame.
+ *
+ * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
+ * differs and a `top` that cannot be reached both mean "framed".
+ */
+export const isEmbedded = () => {
+    try {
+        return window.self !== window.top;
+    }
+    catch {
+        return true;
+    }
+};
+/**
+ * Record that this window is the surrogate login window, while that is still knowable.
+ *
+ * Must run on the surrogate's **first** load, before the flow navigates to the provider:
+ * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
+ * context goes cross-origin — so by the time the provider redirects back, the name is gone and
+ * this window would look like an ordinary tab.
+ *
+ * Idempotent, and a no-op in every window that is not the surrogate.
+ */
+export const markSurrogate = () => {
+    if (typeof window === 'undefined' || window.name !== LOGIN_SURROGATE_NAME) {
+        return;
+    }
+    try {
+        window.sessionStorage.setItem(LOGIN_SURROGATE_MARKER, '1');
+    }
+    catch {
+        // Storage can be unavailable (private modes, blocked cookies). The `window.name` check still
+        // covers the case where nothing cross-origin happened in between.
+    }
+};
+/** Whether this document is the surrogate login window. */
+export const isSurrogate = () => {
+    if (typeof window === 'undefined') {
+        return false;
+    }
+    if (window.name === LOGIN_SURROGATE_NAME) {
+        return true;
+    }
+    try {
+        return window.sessionStorage.getItem(LOGIN_SURROGATE_MARKER) === '1';
+    }
+    catch {
+        return false;
+    }
+};
+/** Forget the surrogate marker — called once its token has been handed back. */
+export const clearSurrogate = () => {
+    if (typeof window === 'undefined') {
+        return;
+    }
+    try {
+        window.sessionStorage.removeItem(LOGIN_SURROGATE_MARKER);
+    }
+    catch { /* nothing to clean up if storage was never available */ }
+};
+/**
+ * Default login environment.
+ *
+ * The single source of environment truth for cascade selection — a plugin's `match` reads this
+ * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
+ * own descriptor.
+ */
+export const defaultLoginEnv = () => {
+    const hasWindow = typeof window !== 'undefined';
+    if (!hasWindow) {
+        return { hasWindow, embedded: false, surrogate: false, hasOpener: false };
+    }
+    return {
+        hasWindow,
+        embedded: isEmbedded(),
+        surrogate: isSurrogate(),
+        // `Cross-Origin-Opener-Policy: same-origin` from the provider severs this permanently, which
+        // is why it is observed rather than assumed from "we were opened by someone".
+        hasOpener: window.opener != null,
+    };
+};
+//# sourceMappingURL=env.js.map

package/build/login/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAG1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,GAAY,EAAE;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1E,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,kEAAkE;IACpE,CAAC;AACH,CAAC,CAAA;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG,GAAY,EAAE;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,GAAG,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAS,EAAE;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;AACtE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAa,EAAE;IAC5C,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IAC3E,CAAC;IAED,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,UAAU,EAAE;QACtB,SAAS,EAAE,WAAW,EAAE;QACxB,6FAA6F;QAC7F,8EAA8E;QAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KACjC,CAAA;AACH,CAAC,CAAA"}

package/build/login/hook.d.ts

@@ -0,0 +1,26 @@
+import type { MouseEvent } from 'react';
+/**
+ * Wiring for a "Log in" control: where it points, and what it does when clicked.
+ *
+ * The caller renders one control and attaches one handler — which browsing context the flow can
+ * actually complete in is the login service's problem, not the app's. An ordinary tab redirects;
+ * an app embedded in a frame runs the flow one window up, because the provider refuses to be
+ * framed and its cookies are third-party there.
+ *
+ * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
+ * opened after the user gesture has finished being handled is eaten by the popup blocker.
+ *
+ * The dispatcher entrypoint is resolved INSIDE the hook, never at module scope. Module bodies run
+ * while the app is still being imported, before `registerEntrypoints` has put anything on the
+ * context, and a top-level lookup throws `Entrypoint dispatcher not found` — which escapes during
+ * import, takes the whole render down, and paints an empty page with no component at fault.
+ */
+export declare const useLogin: (target?: string) => readonly [string, (event?: MouseEvent) => void];
+/**
+ * Wiring for a "Log out" control.
+ *
+ * `update(undefined)` — not `null`. The declared clearing value is `undefined`, and on the web the
+ * auth service reacts to it by navigating to the dispatcher, so this is the whole logout.
+ */
+export declare const useLogout: () => (() => void);
+//# sourceMappingURL=hook.d.ts.map

package/build/login/hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/login/hook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAUvC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ,GAAI,SAAS,MAAM,KAAG,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,KAAK,IAAI,CAmBxF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,QAAO,CAAC,MAAM,IAAI,CAQvC,CAAA"}

package/build/login/hook.js

@@ -0,0 +1,54 @@
+import { useCallback } from 'react';
+import { useContext, useNavigate } from '@owlmeans/client';
+import { DISPATCHER } from '@owlmeans/auth';
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js';
+import { LOGIN_SERVICE } from './consts.js';
+/**
+ * Wiring for a "Log in" control: where it points, and what it does when clicked.
+ *
+ * The caller renders one control and attaches one handler — which browsing context the flow can
+ * actually complete in is the login service's problem, not the app's. An ordinary tab redirects;
+ * an app embedded in a frame runs the flow one window up, because the provider refuses to be
+ * framed and its cookies are third-party there.
+ *
+ * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
+ * opened after the user gesture has finished being handled is eaten by the popup blocker.
+ *
+ * The dispatcher entrypoint is resolved INSIDE the hook, never at module scope. Module bodies run
+ * while the app is still being imported, before `registerEntrypoints` has put anything on the
+ * context, and a top-level lookup throws `Entrypoint dispatcher not found` — which escapes during
+ * import, takes the whole render down, and paints an empty page with no component at fault.
+ */
+export const useLogin = (target) => {
+    const context = useContext();
+    const nav = useNavigate();
+    const dispatcher = context.entrypoint(DISPATCHER);
+    const path = dispatcher.getPath();
+    const onLogin = useCallback((event) => {
+        event?.preventDefault();
+        const login = context.service(LOGIN_SERVICE);
+        void login.begin({
+            url: path,
+            target,
+            // Only a component may call `useNavigate`, so the in-app continuation is handed to the
+            // plugin rather than reinvented by it.
+            navigate: () => { nav.go(target ?? DISPATCHER); },
+        });
+    }, [context, path, target]);
+    return [path, onLogin];
+};
+/**
+ * Wiring for a "Log out" control.
+ *
+ * `update(undefined)` — not `null`. The declared clearing value is `undefined`, and on the web the
+ * auth service reacts to it by navigating to the dispatcher, so this is the whole logout.
+ */
+export const useLogout = () => {
+    const context = useContext();
+    return useCallback(() => {
+        void context.service(AUTH_ALIAS).update(undefined)
+            .then(() => { window.location.reload(); })
+            .catch(console.error);
+    }, [context]);
+};
+//# sourceMappingURL=hook.js.map

package/build/login/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/login/hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AAEnC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAG1D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AAG1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAmD,EAAE;IAC3F,MAAM,OAAO,GAAG,UAAU,EAA8B,CAAA;IACxD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAmB,UAAU,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAA;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,KAAkB,EAAE,EAAE;QACjD,KAAK,EAAE,cAAc,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;QAC1D,KAAK,KAAK,CAAC,KAAK,CAAC;YACf,GAAG,EAAE,IAAI;YACT,MAAM;YACN,uFAAuF;YACvF,uCAAuC;YACvC,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,UAAU,CAAC,CAAA,CAAC,CAAC;SACjD,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAE3B,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU,CAAA;AACjC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAiB,EAAE;IAC1C,MAAM,OAAO,GAAG,UAAU,EAA8B,CAAA;IAExD,OAAO,WAAW,CAAC,GAAG,EAAE;QACtB,KAAK,OAAO,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;aAC5D,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA,CAAC,CAAC,CAAC;aACxC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;AACf,CAAC,CAAA"}

package/build/login/index.d.ts

@@ -0,0 +1,7 @@
+export * from './consts.js';
+export * from './types.js';
+export * from './env.js';
+export * from './adopt.js';
+export * from './service.js';
+export * from './hook.js';
+//# sourceMappingURL=index.d.ts.map

package/build/login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}

package/build/login/index.js

@@ -0,0 +1,7 @@
+export * from './consts.js';
+export * from './types.js';
+export * from './env.js';
+export * from './adopt.js';
+export * from './service.js';
+export * from './hook.js';
+//# sourceMappingURL=index.js.map

package/build/login/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}

package/build/login/service.d.ts

@@ -0,0 +1,30 @@
+import type { BasicConfig, BasicContext } from '@owlmeans/context';
+import { LoginOutcome } from './types.js';
+import type { LoginService, LoginServiceAppend } from './types.js';
+/**
+ * Login service = plugin host. It holds a registry of login plugins and, on every facade call,
+ * resolves the active plugin by cascade (priority desc, first whose `match(env)` is truthy) and
+ * delegates to it.
+ *
+ * The facade methods stay ordinary writable properties (never getters) so that non-plugin
+ * implementations — e.g. a native login service — can keep overriding them directly.
+ *
+ * It is a LAZY service on purpose. The host carries no async setup, and plugin packages must be
+ * able to reach it from an app's `makeContext` — i.e. while the context is still in the Loading
+ * stage. `context.service()` throws for an uninitialized non-lazy service, which would make
+ * `ensureLoginService` fail exactly where apps are told to call it.
+ *
+ * `begin` is deliberately NOT `async`. An async facade method defers the plugin's body past a
+ * microtask boundary, and a `window.open` that lands after the user gesture has finished being
+ * handled is eaten by the popup blocker. The same rule binds every plugin's own `begin`.
+ */
+export declare const makeLoginService: (alias?: string) => LoginService;
+/**
+ * Idempotently obtain the login service on a context, registering an empty host if none exists
+ * yet. Plugin packages call this before `registerPlugin`.
+ */
+export declare const ensureLoginService: (ctx: BasicContext<any>) => LoginService;
+/** Register the host and expose it as `context.login()`. */
+export declare const appendLogin: <C extends BasicConfig, T extends BasicContext<C>>(ctx: T) => T & LoginServiceAppend;
+export { LoginOutcome };
+//# sourceMappingURL=service.d.ts.map

package/build/login/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIlE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,KAAK,EAA6B,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAE7F;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAO,MAAsB,KAAG,YAuDhE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,YAAY,CAAC,GAAG,CAAC,KAAG,YAQ3D,CAAA;AAED,4DAA4D;AAC5D,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EAC1E,KAAK,CAAC,KACL,CAAC,GAAG,kBAMN,CAAA;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}

package/build/login/service.js

@@ -0,0 +1,84 @@
+import { createLazyService } from '@owlmeans/context';
+import { DEFAULT_ALIAS } from './consts.js';
+import { defaultLoginEnv } from './env.js';
+import { adoptToken } from './adopt.js';
+import { LoginOutcome } from './types.js';
+/**
+ * Login service = plugin host. It holds a registry of login plugins and, on every facade call,
+ * resolves the active plugin by cascade (priority desc, first whose `match(env)` is truthy) and
+ * delegates to it.
+ *
+ * The facade methods stay ordinary writable properties (never getters) so that non-plugin
+ * implementations — e.g. a native login service — can keep overriding them directly.
+ *
+ * It is a LAZY service on purpose. The host carries no async setup, and plugin packages must be
+ * able to reach it from an app's `makeContext` — i.e. while the context is still in the Loading
+ * stage. `context.service()` throws for an uninitialized non-lazy service, which would make
+ * `ensureLoginService` fail exactly where apps are told to call it.
+ *
+ * `begin` is deliberately NOT `async`. An async facade method defers the plugin's body past a
+ * microtask boundary, and a `window.open` that lands after the user gesture has finished being
+ * handled is eaten by the popup blocker. The same rule binds every plugin's own `begin`.
+ */
+export const makeLoginService = (alias = DEFAULT_ALIAS) => {
+    const plugins = [];
+    const ctx = () => service.ctx;
+    const service = createLazyService(alias, {
+        registerPlugin: (plugin) => {
+            const existing = plugins.findIndex(candidate => candidate.alias === plugin.alias);
+            if (existing >= 0) {
+                plugins.splice(existing, 1);
+            }
+            plugins.push(plugin);
+            plugins.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        },
+        plugin: env => {
+            const environment = env ?? defaultLoginEnv();
+            const plugin = plugins.find(candidate => candidate.match?.(environment, service.ctx) ?? true);
+            if (plugin == null) {
+                throw new Error('login: no plugin matches the current environment');
+            }
+            return plugin;
+        },
+        env: () => defaultLoginEnv(),
+        enter: () => {
+            const env = defaultLoginEnv();
+            service.plugin(env).enter?.(ctx(), env);
+        },
+        begin: request => {
+            const env = defaultLoginEnv();
+            return service.plugin(env).begin(ctx(), request, env);
+        },
+        authorize: async (url) => {
+            const env = defaultLoginEnv();
+            return await service.plugin(env).authorize(ctx(), url, env);
+        },
+        complete: async (token) => {
+            const env = defaultLoginEnv();
+            return await service.plugin(env).complete(ctx(), token, env);
+        },
+        adopt: async (token) => { await adoptToken(ctx(), token); },
+    });
+    return service;
+};
+/**
+ * Idempotently obtain the login service on a context, registering an empty host if none exists
+ * yet. Plugin packages call this before `registerPlugin`.
+ */
+export const ensureLoginService = (ctx) => {
+    if (ctx.hasService(DEFAULT_ALIAS)) {
+        return ctx.service(DEFAULT_ALIAS);
+    }
+    const service = makeLoginService();
+    ctx.registerService(service);
+    return service;
+};
+/** Register the host and expose it as `context.login()`. */
+export const appendLogin = (ctx) => {
+    ensureLoginService(ctx);
+    const contextual = ctx;
+    contextual.login = () => ctx.service(DEFAULT_ALIAS);
+    return contextual;
+};
+export { LoginOutcome };
+//# sourceMappingURL=service.js.map

package/build/login/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAGzC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,aAAa,EAAgB,EAAE;IAC9E,MAAM,OAAO,GAAkB,EAAE,CAAA;IAEjC,MAAM,GAAG,GAAG,GAAiB,EAAE,CAAC,OAAO,CAAC,GAAmB,CAAA;IAE3D,MAAM,OAAO,GAAiB,iBAAiB,CAAe,KAAK,EAAE;QACnE,cAAc,EAAE,CAAC,MAAmB,EAAE,EAAE;YACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;YACjF,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC7B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/D,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,EAAE;YACZ,MAAM,WAAW,GAAG,GAAG,IAAI,eAAe,EAAE,CAAA;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,GAA+B,CAAC,IAAI,IAAI,CAC7F,CAAA;YACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACrE,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QAED,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;QAE5B,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;YAC7B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,KAAK,EAAE,OAAO,CAAC,EAAE;YACf,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;YAE7B,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;QAED,SAAS,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACrB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;YAE7B,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC7D,CAAC;QAED,QAAQ,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACtB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;YAE7B,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QAC9D,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;KACzD,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAsB,EAAgB,EAAE;IACzE,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAA;IAClC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAE5B,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,GAAM,EACkB,EAAE;IAC1B,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,UAAU,GAAG,GAA6B,CAAA;IAChD,UAAU,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAEjE,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}

package/build/login/types.d.ts

@@ -0,0 +1,106 @@
+import type { LazyService, BasicContext } from '@owlmeans/context';
+/**
+ * The context a login plugin is handed.
+ *
+ * Deliberately `BasicContext<any>`, matching `RouterService`: a plugin only ever reaches services
+ * by alias, and pinning the config parameter would make every concrete app config — each of which
+ * adds its own required fields — fail to satisfy it, since `makeContext` is invariant in it.
+ */
+export type LoginContext = BasicContext<any>;
+/**
+ * Environment descriptor the cascade selects a login plugin on.
+ *
+ * This is the single source of environment truth — do NOT bake `window.self !== window.top` or a
+ * `sessionStorage` probe into a plugin's `match`. A native host will supply its own descriptor
+ * (`hasWindow: false`) so an in-app-browser plugin wins there without any DOM check.
+ */
+export interface LoginEnv {
+    /** A DOM is present at all (false under SSR, native, and unit tests). */
+    hasWindow: boolean;
+    /** This document is embedded in a frame. A cross-origin `top` read throws — that throw counts. */
+    embedded: boolean;
+    /** This document IS the surrogate login window; survives the cross-origin round trip. */
+    surrogate: boolean;
+    /** The window that opened this one is still reachable (COOP severs it permanently). */
+    hasOpener: boolean;
+}
+/** What a stage did, and therefore what the caller must do next. */
+export declare enum LoginOutcome {
+    /** The plugin took the flow over and it is finished. The caller does nothing more. */
+    Handled = "handled",
+    /** The plugin did nothing — the caller carries on with its ordinary continuation. */
+    Passed = "passed",
+    /** The browser is leaving this document. The caller must not navigate or render. */
+    Redirected = "redirected",
+    /** Cannot proceed without a fresh user gesture — the caller renders a sign-in control. */
+    Gesture = "gesture",
+    /** Authenticated, but with no channel back to the window that started the flow. */
+    Orphaned = "orphaned",
+    /** The attempt ended with no token (blocked window, user closed it, provider refused). */
+    Failed = "failed"
+}
+export interface LoginRequest {
+    /** Where the login flow starts — a resolved dispatcher path, or the current address. */
+    url: string;
+    /**
+     * The ordinary in-app continuation, supplied by the caller because only a component may call
+     * `useNavigate`. A plugin that decides not to take the flow over calls this; without it the
+     * fallback is a full page load of {@link url}.
+     */
+    navigate?: () => void | Promise<void>;
+    /** Entrypoint alias to return to after login. */
+    target?: string;
+}
+/**
+ * A pluggable login mechanic — WHERE the authorization round trip runs.
+ *
+ * Not to be confused with `AuthenticationPlugin` (./manager/plugins), which answers *how* a user
+ * proves their identity. This one answers *in which browsing context the flow can complete*: a
+ * redirect works in an ordinary tab and cannot work inside a frame whose provider refuses to be
+ * embedded, and that difference is a property of the environment, not of the credential.
+ */
+export interface LoginPlugin {
+    alias: string;
+    /** Higher wins among matching plugins. Defaults to 0. */
+    priority?: number;
+    /** Free-form tag, e.g. 'redirect' | 'surrogate' | 'native'. */
+    mode?: string;
+    /** Selector; `undefined` means "always applicable". */
+    match?: (env: LoginEnv, ctx?: LoginContext) => boolean;
+    /**
+     * Record, while it is still knowable, whatever the later stages need about this document.
+     *
+     * Called synchronously as the FIRST statement of the dispatcher's effect: everything after it
+     * can navigate away, and some of the evidence (notably `window.name`) is cleared by the browser
+     * the moment a top-level context goes cross-origin.
+     */
+    enter?: (ctx: LoginContext, env: LoginEnv) => void;
+    /**
+     * Start login from a user gesture.
+     *
+     * MUST open any window synchronously — the popup blocker only yields while the gesture is still
+     * being handled. Implement as a NON-async function returning a promise.
+     */
+    begin: (ctx: LoginContext, request: LoginRequest, env: LoginEnv) => Promise<LoginOutcome>;
+    /** Send the browser to the identity provider's authorization URL. */
+    authorize: (ctx: LoginContext, url: string, env: LoginEnv) => Promise<LoginOutcome>;
+    /** A bearer token was issued in this document — decide where it goes. */
+    complete: (ctx: LoginContext, token: string, env: LoginEnv) => Promise<LoginOutcome>;
+}
+export interface LoginService extends LazyService {
+    registerPlugin: (plugin: LoginPlugin) => void;
+    /** Select the active plugin for the given (or default) environment. */
+    plugin: (env?: LoginEnv) => LoginPlugin;
+    /** The environment the cascade is currently selecting on. */
+    env: () => LoginEnv;
+    enter: () => void;
+    begin: (request: LoginRequest) => Promise<LoginOutcome>;
+    authorize: (url: string) => Promise<LoginOutcome>;
+    complete: (token: string) => Promise<LoginOutcome>;
+    /** Adopt an issued bearer token as this context's authentication. */
+    adopt: (token: string) => Promise<void>;
+}
+export interface LoginServiceAppend {
+    login: () => LoginService;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/login/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAElE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAA;IAClB,kGAAkG;IAClG,QAAQ,EAAE,OAAO,CAAA;IACjB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAA;IAClB,uFAAuF;IACvF,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,oEAAoE;AACpE,oBAAY,YAAY;IACtB,sFAAsF;IACtF,OAAO,YAAY;IACnB,qFAAqF;IACrF,MAAM,WAAW;IACjB,oFAAoF;IACpF,UAAU,eAAe;IACzB,0FAA0F;IAC1F,OAAO,YAAY;IACnB,mFAAmF;IACnF,QAAQ,aAAa;IACrB,0FAA0F;IAC1F,MAAM,WAAW;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,YAAY,KAAK,OAAO,CAAA;IAEtD;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAA;IAElD;;;;;OAKG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAEzF,qEAAqE;IACrE,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAEnF,yEAAyE;IACzE,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;CACrF;AAED,MAAM,WAAW,YAAa,SAAQ,WAAW;IAC/C,cAAc,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;IAC7C,uEAAuE;IACvE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,KAAK,WAAW,CAAA;IACvC,6DAA6D;IAC7D,GAAG,EAAE,MAAM,QAAQ,CAAA;IAInB,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IACvD,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IACjD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAClD,qEAAqE;IACrE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,YAAY,CAAA;CAC1B"}

package/build/login/types.js

@@ -0,0 +1,17 @@
+/** What a stage did, and therefore what the caller must do next. */
+export var LoginOutcome;
+(function (LoginOutcome) {
+    /** The plugin took the flow over and it is finished. The caller does nothing more. */
+    LoginOutcome["Handled"] = "handled";
+    /** The plugin did nothing — the caller carries on with its ordinary continuation. */
+    LoginOutcome["Passed"] = "passed";
+    /** The browser is leaving this document. The caller must not navigate or render. */
+    LoginOutcome["Redirected"] = "redirected";
+    /** Cannot proceed without a fresh user gesture — the caller renders a sign-in control. */
+    LoginOutcome["Gesture"] = "gesture";
+    /** Authenticated, but with no channel back to the window that started the flow. */
+    LoginOutcome["Orphaned"] = "orphaned";
+    /** The attempt ended with no token (blocked window, user closed it, provider refused). */
+    LoginOutcome["Failed"] = "failed";
+})(LoginOutcome || (LoginOutcome = {}));
+//# sourceMappingURL=types.js.map

package/build/login/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/login/types.ts"],"names":[],"mappings":"AA6BA,oEAAoE;AACpE,MAAM,CAAN,IAAY,YAaX;AAbD,WAAY,YAAY;IACtB,sFAAsF;IACtF,mCAAmB,CAAA;IACnB,qFAAqF;IACrF,iCAAiB,CAAA;IACjB,oFAAoF;IACpF,yCAAyB,CAAA;IACzB,0FAA0F;IAC1F,mCAAmB,CAAA;IACnB,mFAAmF;IACnF,qCAAqB,CAAA;IACrB,0FAA0F;IAC1F,iCAAiB,CAAA;AACnB,CAAC,EAbW,YAAY,KAAZ,YAAY,QAavB"}

package/build/manager/components/authentication/control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../../../src/manager/components/authentication/control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAIvD,OAAO,KAAK,EAAuC,SAAS,EAAmB,MAAM,gBAAgB,CAAA;AACrG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAY5D,eAAO,MAAM,WAAW,YACb,aAAa,CAAC,YAAY,CAAC,aACzB,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,KAChD,qBA2KF,CAAA"}
+{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../../../src/manager/components/authentication/control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAIvD,OAAO,KAAK,EAAuC,SAAS,EAAmB,MAAM,gBAAgB,CAAA;AACrG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAY5D,eAAO,MAAM,WAAW,GACtB,SAAS,aAAa,CAAC,YAAY,CAAC,EACpC,WAAW,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,KAChD,qBA2KF,CAAA"}

package/build/manager/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/manager/errors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,qBAAa,eAAgB,SAAQ,gBAAgB;IACnD,OAAuB,QAAQ,EAAE,MAAM,CAAqC;IAE5E,YAAY,OAAO,GAAE,MAAgB,EAGpC;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/manager/errors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,qBAAa,eAAgB,SAAQ,gBAAgB;IACnD,OAAuB,QAAQ,EAAE,MAAM,CAAqC;gBAEhE,OAAO,GAAE,MAAgB;CAItC"}

package/build/manager/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/manager/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,MAAM,OAAO,eAAgB,SAAQ,gBAAgB;IAC5C,MAAM,CAAU,QAAQ,GAAW,GAAG,gBAAgB,CAAC,QAAQ,MAAM,CAAA;IAE5E,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAA;IACtC,CAAC;CACF;AAED,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/manager/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,MAAM,OAAO,eAAgB,SAAQ,gBAAgB;IAC5C,MAAM,CAAU,QAAQ,GAAW,GAAG,gBAAgB,CAAC,QAAQ,MAAM,CAAA;IAE5E,YAAY,UAAkB,OAAO;QACnC,KAAK,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAA;IACtC,CAAC;;AAGH,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA"}

package/build/manager/plugins/tunnel/wallet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/tunnel/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAGlD,eAAO,MAAM,kBAAkB,SAAU,UAAU,KAAG,YAsCrD,CAAA"}
+{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/tunnel/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAGlD,eAAO,MAAM,kBAAkB,GAAI,MAAM,UAAU,KAAG,YAsCrD,CAAA"}

package/build/modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAInE,eAAO,MAAM,OAAO,EAAE,gBAAgB,EAA+B,CAAA;AAErE,eAAO,MAAM,2BAA2B,YAAa,MAAM,SAE1D,CAAA"}
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAInE,eAAO,MAAM,OAAO,EAAE,gBAAgB,EAA+B,CAAA;AAErE,eAAO,MAAM,2BAA2B,GAAI,SAAS,MAAM,SAE1D,CAAA"}

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAA;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAO3E,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WA8E/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OAC7E,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAYN,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAA;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAO3E,eAAO,MAAM,eAAe,GAAI,QAAO,MAAsB,KAAG,WA8E/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,EAClF,KAAK,CAAC,EAAE,QAAO,MAAsB,KACpC,CAAC,GAAG,iBAYN,CAAA"}

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGtE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,KAAK,EAAE,CAAA;IACxC,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,IAAI;QAElD,MAAM,EAAE,KAAK,IAAO,EAAE;YACpB,OAAO,KAAK,CAAM,CAAA;QACpB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAEpD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAA8B,iBAAiB,CAAC;iBACzF,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAExB,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;YAErB,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAA;gBAExB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;gBACtD,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAElC,OAAM;YACR,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;YACtD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAE/C,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC3E,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnC,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;gBACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAE/C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;oBAE1B,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;wBAChB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;wBACzB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAA;wBACxB,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;wBAElC,OAAO,IAAI,CAAA;oBACb,CAAC;oBAED,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC1C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;oBAErB,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAE3E,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;gBACnC,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,CAAA;QAC9B,CAAC;QAED,IAAI,EAAE,GAAG,EAAE;YACT,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,kBAAkB,EAAE,CAAA;YAChC,CAAC;YAED,OAAO,OAAO,CAAC,IAAI,CAAA;QACrB,CAAC;QAED,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;KACjE,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IACzB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAEtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAE1C,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGtE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAgB,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,KAAK,EAAE,CAAA;IACxC,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,IAAI;QAElD,MAAM,EAAE,KAAK,IAAO,EAAE;YACpB,OAAO,KAAK,CAAM,CAAA;QACpB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAEpD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAA8B,iBAAiB,CAAC;iBACzF,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAExB,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;YAErB,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAA;gBAExB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;gBACtD,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAElC,OAAM;YACR,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;YACtD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAE/C,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC3E,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnC,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAoB,CAAA;gBACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAE/C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;oBAE1B,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;wBAChB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;wBACzB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAA;wBACxB,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;wBAElC,OAAO,IAAI,CAAA;oBACb,CAAC;oBAED,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC1C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;oBAErB,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAE3E,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;gBACnC,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,CAAA;QAC9B,CAAC;QAED,IAAI,EAAE,GAAG,EAAE;YACT,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,kBAAkB,EAAE,CAAA;YAChC,CAAC;YAED,OAAO,OAAO,CAAC,IAAI,CAAA;QACrB,CAAC;QAED,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;KACjE,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,QAAgB,aAAa,EACd,EAAE;IACzB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAEtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAE1C,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-auth",
-  "version": "0.1.18-rc.6",
+  "version": "0.1.18-rc.8",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -40,6 +40,13 @@
       "default": "./build/manager/plugins/exports.js",
       "module": "./build/manager/plugins/exports.js",
       "types": "./build/manager/plugins/exports.d.ts"
+    },
+    "./login": {
+      "import": "./build/login/index.js",
+      "require": "./build/login/index.js",
+      "default": "./build/login/index.js",
+      "module": "./build/login/index.js",
+      "types": "./build/login/index.d.ts"
     }
   },
   "dependencies": {

package/src/login/adopt.ts

@@ -0,0 +1,19 @@
+import type { AuthService } from '@owlmeans/auth-common'
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js'
+import type { LoginContext } from './types.js'
+
+/**
+ * The one path an issued bearer token becomes this context's authentication.
+ *
+ * Resolved by alias rather than through `ctx.auth()` so the login host does not require
+ * `AuthServiceAppend` on the context it is given — a plugin can adopt a token on any context that
+ * carries the auth service, including one it did not build.
+ *
+ * Going through `AuthService.update` matters: it stores the record, decodes the envelope and sets
+ * both `auth` and `token` in one place. Writing those three by hand — which is what the popup and
+ * the MUI relying party each used to do — leaves the same state on a good day and diverges the
+ * moment any of it changes.
+ */
+export const adoptToken = async (ctx: LoginContext, token: string): Promise<void> => {
+  await ctx.service<AuthService>(AUTH_ALIAS).update(token)
+}

package/src/login/consts.ts

@@ -0,0 +1,24 @@
+export const DEFAULT_ALIAS = 'login-service'
+
+export const LOGIN_SERVICE = DEFAULT_ALIAS
+
+/** Priority of a plugin that makes no claim about the environment. */
+export const DEFAULT_LOGIN_PRIORITY = 0
+
+/**
+ * Name given to the surrogate login window, and the marker it records about itself.
+ *
+ * These values are a wire protocol between two documents that may be running different builds —
+ * an opener holding an older bundle and a surrogate freshly loaded, or the reverse. They are
+ * therefore fixed, and must never be "tidied" to match a newer vocabulary.
+ */
+export const LOGIN_SURROGATE_NAME = 'owlmeans-oidc-login'
+
+export const LOGIN_TOKEN_MESSAGE = 'owlmeans:oidc:popup-token'
+
+export const LOGIN_SURROGATE_MARKER = '_owlmeans-oidc-popup'
+
+export const LOGIN_SURROGATE_FEATURES = 'popup=yes,width=520,height=760'
+
+/** How often a surrogate window is checked for having been closed by the user. */
+export const LOGIN_WATCH_INTERVAL = 500

package/src/login/env.ts

@@ -0,0 +1,86 @@
+import { LOGIN_SURROGATE_MARKER, LOGIN_SURROGATE_NAME } from './consts.js'
+import type { LoginEnv } from './types.js'
+
+/**
+ * Whether this document is embedded in a frame.
+ *
+ * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
+ * differs and a `top` that cannot be reached both mean "framed".
+ */
+export const isEmbedded = (): boolean => {
+  try {
+    return window.self !== window.top
+  } catch {
+    return true
+  }
+}
+
+/**
+ * Record that this window is the surrogate login window, while that is still knowable.
+ *
+ * Must run on the surrogate's **first** load, before the flow navigates to the provider:
+ * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
+ * context goes cross-origin — so by the time the provider redirects back, the name is gone and
+ * this window would look like an ordinary tab.
+ *
+ * Idempotent, and a no-op in every window that is not the surrogate.
+ */
+export const markSurrogate = (): void => {
+  if (typeof window === 'undefined' || window.name !== LOGIN_SURROGATE_NAME) {
+    return
+  }
+  try {
+    window.sessionStorage.setItem(LOGIN_SURROGATE_MARKER, '1')
+  } catch {
+    // Storage can be unavailable (private modes, blocked cookies). The `window.name` check still
+    // covers the case where nothing cross-origin happened in between.
+  }
+}
+
+/** Whether this document is the surrogate login window. */
+export const isSurrogate = (): boolean => {
+  if (typeof window === 'undefined') {
+    return false
+  }
+  if (window.name === LOGIN_SURROGATE_NAME) {
+    return true
+  }
+  try {
+    return window.sessionStorage.getItem(LOGIN_SURROGATE_MARKER) === '1'
+  } catch {
+    return false
+  }
+}
+
+/** Forget the surrogate marker — called once its token has been handed back. */
+export const clearSurrogate = (): void => {
+  if (typeof window === 'undefined') {
+    return
+  }
+  try {
+    window.sessionStorage.removeItem(LOGIN_SURROGATE_MARKER)
+  } catch { /* nothing to clean up if storage was never available */ }
+}
+
+/**
+ * Default login environment.
+ *
+ * The single source of environment truth for cascade selection — a plugin's `match` reads this
+ * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
+ * own descriptor.
+ */
+export const defaultLoginEnv = (): LoginEnv => {
+  const hasWindow = typeof window !== 'undefined'
+  if (!hasWindow) {
+    return { hasWindow, embedded: false, surrogate: false, hasOpener: false }
+  }
+
+  return {
+    hasWindow,
+    embedded: isEmbedded(),
+    surrogate: isSurrogate(),
+    // `Cross-Origin-Opener-Policy: same-origin` from the provider severs this permanently, which
+    // is why it is observed rather than assumed from "we were opened by someone".
+    hasOpener: window.opener != null,
+  }
+}

package/src/login/hook.ts

@@ -0,0 +1,63 @@
+import { useCallback } from 'react'
+import type { MouseEvent } from 'react'
+import { useContext, useNavigate } from '@owlmeans/client'
+import type { ClientContext } from '@owlmeans/client-context'
+import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
+import { DISPATCHER } from '@owlmeans/auth'
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js'
+import type { AuthService } from '@owlmeans/auth-common'
+import type { LoginService } from './types.js'
+import { LOGIN_SERVICE } from './consts.js'
+
+/**
+ * Wiring for a "Log in" control: where it points, and what it does when clicked.
+ *
+ * The caller renders one control and attaches one handler — which browsing context the flow can
+ * actually complete in is the login service's problem, not the app's. An ordinary tab redirects;
+ * an app embedded in a frame runs the flow one window up, because the provider refuses to be
+ * framed and its cookies are third-party there.
+ *
+ * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
+ * opened after the user gesture has finished being handled is eaten by the popup blocker.
+ *
+ * The dispatcher entrypoint is resolved INSIDE the hook, never at module scope. Module bodies run
+ * while the app is still being imported, before `registerEntrypoints` has put anything on the
+ * context, and a top-level lookup throws `Entrypoint dispatcher not found` — which escapes during
+ * import, takes the whole render down, and paints an empty page with no component at fault.
+ */
+export const useLogin = (target?: string): readonly [string, (event?: MouseEvent) => void] => {
+  const context = useContext() as unknown as ClientContext
+  const nav = useNavigate()
+  const dispatcher = context.entrypoint<ClientEntrypoint>(DISPATCHER)
+  const path = dispatcher.getPath()
+
+  const onLogin = useCallback((event?: MouseEvent) => {
+    event?.preventDefault()
+    const login = context.service<LoginService>(LOGIN_SERVICE)
+    void login.begin({
+      url: path,
+      target,
+      // Only a component may call `useNavigate`, so the in-app continuation is handed to the
+      // plugin rather than reinvented by it.
+      navigate: () => { nav.go(target ?? DISPATCHER) },
+    })
+  }, [context, path, target])
+
+  return [path, onLogin] as const
+}
+
+/**
+ * Wiring for a "Log out" control.
+ *
+ * `update(undefined)` — not `null`. The declared clearing value is `undefined`, and on the web the
+ * auth service reacts to it by navigating to the dispatcher, so this is the whole logout.
+ */
+export const useLogout = (): (() => void) => {
+  const context = useContext() as unknown as ClientContext
+
+  return useCallback(() => {
+    void context.service<AuthService>(AUTH_ALIAS).update(undefined)
+      .then(() => { window.location.reload() })
+      .catch(console.error)
+  }, [context])
+}

package/src/login/index.ts

@@ -0,0 +1,6 @@
+export * from './consts.js'
+export * from './types.js'
+export * from './env.js'
+export * from './adopt.js'
+export * from './service.js'
+export * from './hook.js'

package/src/login/service.ts

@@ -0,0 +1,108 @@
+import { createLazyService } from '@owlmeans/context'
+import type { BasicConfig, BasicContext } from '@owlmeans/context'
+import { DEFAULT_ALIAS } from './consts.js'
+import { defaultLoginEnv } from './env.js'
+import { adoptToken } from './adopt.js'
+import { LoginOutcome } from './types.js'
+import type { LoginContext, LoginPlugin, LoginService, LoginServiceAppend } from './types.js'
+
+/**
+ * Login service = plugin host. It holds a registry of login plugins and, on every facade call,
+ * resolves the active plugin by cascade (priority desc, first whose `match(env)` is truthy) and
+ * delegates to it.
+ *
+ * The facade methods stay ordinary writable properties (never getters) so that non-plugin
+ * implementations — e.g. a native login service — can keep overriding them directly.
+ *
+ * It is a LAZY service on purpose. The host carries no async setup, and plugin packages must be
+ * able to reach it from an app's `makeContext` — i.e. while the context is still in the Loading
+ * stage. `context.service()` throws for an uninitialized non-lazy service, which would make
+ * `ensureLoginService` fail exactly where apps are told to call it.
+ *
+ * `begin` is deliberately NOT `async`. An async facade method defers the plugin's body past a
+ * microtask boundary, and a `window.open` that lands after the user gesture has finished being
+ * handled is eaten by the popup blocker. The same rule binds every plugin's own `begin`.
+ */
+export const makeLoginService = (alias: string = DEFAULT_ALIAS): LoginService => {
+  const plugins: LoginPlugin[] = []
+
+  const ctx = (): LoginContext => service.ctx as LoginContext
+
+  const service: LoginService = createLazyService<LoginService>(alias, {
+    registerPlugin: (plugin: LoginPlugin) => {
+      const existing = plugins.findIndex(candidate => candidate.alias === plugin.alias)
+      if (existing >= 0) {
+        plugins.splice(existing, 1)
+      }
+      plugins.push(plugin)
+      plugins.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0))
+    },
+
+    plugin: env => {
+      const environment = env ?? defaultLoginEnv()
+      const plugin = plugins.find(
+        candidate => candidate.match?.(environment, service.ctx as LoginContext | undefined) ?? true
+      )
+      if (plugin == null) {
+        throw new Error('login: no plugin matches the current environment')
+      }
+      return plugin
+    },
+
+    env: () => defaultLoginEnv(),
+
+    enter: () => {
+      const env = defaultLoginEnv()
+      service.plugin(env).enter?.(ctx(), env)
+    },
+
+    begin: request => {
+      const env = defaultLoginEnv()
+
+      return service.plugin(env).begin(ctx(), request, env)
+    },
+
+    authorize: async url => {
+      const env = defaultLoginEnv()
+
+      return await service.plugin(env).authorize(ctx(), url, env)
+    },
+
+    complete: async token => {
+      const env = defaultLoginEnv()
+
+      return await service.plugin(env).complete(ctx(), token, env)
+    },
+
+    adopt: async token => { await adoptToken(ctx(), token) },
+  })
+
+  return service
+}
+
+/**
+ * Idempotently obtain the login service on a context, registering an empty host if none exists
+ * yet. Plugin packages call this before `registerPlugin`.
+ */
+export const ensureLoginService = (ctx: BasicContext<any>): LoginService => {
+  if (ctx.hasService(DEFAULT_ALIAS)) {
+    return ctx.service<LoginService>(DEFAULT_ALIAS)
+  }
+  const service = makeLoginService()
+  ctx.registerService(service)
+
+  return service
+}
+
+/** Register the host and expose it as `context.login()`. */
+export const appendLogin = <C extends BasicConfig, T extends BasicContext<C>>(
+  ctx: T
+): T & LoginServiceAppend => {
+  ensureLoginService(ctx)
+  const contextual = ctx as T & LoginServiceAppend
+  contextual.login = () => ctx.service<LoginService>(DEFAULT_ALIAS)
+
+  return contextual
+}
+
+export { LoginOutcome }

package/src/login/types.ts

@@ -0,0 +1,119 @@
+import type { LazyService, BasicContext } from '@owlmeans/context'
+
+/**
+ * The context a login plugin is handed.
+ *
+ * Deliberately `BasicContext<any>`, matching `RouterService`: a plugin only ever reaches services
+ * by alias, and pinning the config parameter would make every concrete app config — each of which
+ * adds its own required fields — fail to satisfy it, since `makeContext` is invariant in it.
+ */
+export type LoginContext = BasicContext<any>
+
+/**
+ * Environment descriptor the cascade selects a login plugin on.
+ *
+ * This is the single source of environment truth — do NOT bake `window.self !== window.top` or a
+ * `sessionStorage` probe into a plugin's `match`. A native host will supply its own descriptor
+ * (`hasWindow: false`) so an in-app-browser plugin wins there without any DOM check.
+ */
+export interface LoginEnv {
+  /** A DOM is present at all (false under SSR, native, and unit tests). */
+  hasWindow: boolean
+  /** This document is embedded in a frame. A cross-origin `top` read throws — that throw counts. */
+  embedded: boolean
+  /** This document IS the surrogate login window; survives the cross-origin round trip. */
+  surrogate: boolean
+  /** The window that opened this one is still reachable (COOP severs it permanently). */
+  hasOpener: boolean
+}
+
+/** What a stage did, and therefore what the caller must do next. */
+export enum LoginOutcome {
+  /** The plugin took the flow over and it is finished. The caller does nothing more. */
+  Handled = 'handled',
+  /** The plugin did nothing — the caller carries on with its ordinary continuation. */
+  Passed = 'passed',
+  /** The browser is leaving this document. The caller must not navigate or render. */
+  Redirected = 'redirected',
+  /** Cannot proceed without a fresh user gesture — the caller renders a sign-in control. */
+  Gesture = 'gesture',
+  /** Authenticated, but with no channel back to the window that started the flow. */
+  Orphaned = 'orphaned',
+  /** The attempt ended with no token (blocked window, user closed it, provider refused). */
+  Failed = 'failed',
+}
+
+export interface LoginRequest {
+  /** Where the login flow starts — a resolved dispatcher path, or the current address. */
+  url: string
+  /**
+   * The ordinary in-app continuation, supplied by the caller because only a component may call
+   * `useNavigate`. A plugin that decides not to take the flow over calls this; without it the
+   * fallback is a full page load of {@link url}.
+   */
+  navigate?: () => void | Promise<void>
+  /** Entrypoint alias to return to after login. */
+  target?: string
+}
+
+/**
+ * A pluggable login mechanic — WHERE the authorization round trip runs.
+ *
+ * Not to be confused with `AuthenticationPlugin` (./manager/plugins), which answers *how* a user
+ * proves their identity. This one answers *in which browsing context the flow can complete*: a
+ * redirect works in an ordinary tab and cannot work inside a frame whose provider refuses to be
+ * embedded, and that difference is a property of the environment, not of the credential.
+ */
+export interface LoginPlugin {
+  alias: string
+  /** Higher wins among matching plugins. Defaults to 0. */
+  priority?: number
+  /** Free-form tag, e.g. 'redirect' | 'surrogate' | 'native'. */
+  mode?: string
+  /** Selector; `undefined` means "always applicable". */
+  match?: (env: LoginEnv, ctx?: LoginContext) => boolean
+
+  /**
+   * Record, while it is still knowable, whatever the later stages need about this document.
+   *
+   * Called synchronously as the FIRST statement of the dispatcher's effect: everything after it
+   * can navigate away, and some of the evidence (notably `window.name`) is cleared by the browser
+   * the moment a top-level context goes cross-origin.
+   */
+  enter?: (ctx: LoginContext, env: LoginEnv) => void
+
+  /**
+   * Start login from a user gesture.
+   *
+   * MUST open any window synchronously — the popup blocker only yields while the gesture is still
+   * being handled. Implement as a NON-async function returning a promise.
+   */
+  begin: (ctx: LoginContext, request: LoginRequest, env: LoginEnv) => Promise<LoginOutcome>
+
+  /** Send the browser to the identity provider's authorization URL. */
+  authorize: (ctx: LoginContext, url: string, env: LoginEnv) => Promise<LoginOutcome>
+
+  /** A bearer token was issued in this document — decide where it goes. */
+  complete: (ctx: LoginContext, token: string, env: LoginEnv) => Promise<LoginOutcome>
+}
+
+export interface LoginService extends LazyService {
+  registerPlugin: (plugin: LoginPlugin) => void
+  /** Select the active plugin for the given (or default) environment. */
+  plugin: (env?: LoginEnv) => LoginPlugin
+  /** The environment the cascade is currently selecting on. */
+  env: () => LoginEnv
+  // Facade — every method re-selects the plugin and delegates.
+  // NOTE: these stay plain writable instance properties, never getters, so that alternative
+  // implementations (e.g. a native login service) can monkey-patch them directly.
+  enter: () => void
+  begin: (request: LoginRequest) => Promise<LoginOutcome>
+  authorize: (url: string) => Promise<LoginOutcome>
+  complete: (token: string) => Promise<LoginOutcome>
+  /** Adopt an issued bearer token as this context's authentication. */
+  adopt: (token: string) => Promise<void>
+}
+
+export interface LoginServiceAppend {
+  login: () => LoginService
+}