@owlmeans/client-auth 0.1.18-rc.8 → 0.1.18

package/build/login/service.js

@@ -1,8 +1,12 @@
 import { createLazyService } from '@owlmeans/context';
-import { DEFAULT_ALIAS } from './consts.js';
-import { defaultLoginEnv } from './env.js';
-import { adoptToken } from './adopt.js';
-import { LoginOutcome } from './types.js';
+import { flowLandingOf } from '@owlmeans/client-flow';
+import { logger } from '@owlmeans/log';
+import { DEFAULT_ALIAS, LOGIN_TARGET_TTL, LoginOutcome } from './consts.js';
+import { UNSIGNED_OUTCOMES } from './consts.local.js';
+import { loginEnvHelper } from './env.js';
+import { loginTokenOf } from './adopt.js';
+import { loginMethodsHelper } from './methods.js';
+const log = logger('client-auth:login');
 /**
  * Login service = plugin host. It holds a registry of login plugins and, on every facade call,
  * resolves the active plugin by cascade (priority desc, first whose `match(env)` is truthy) and
@@ -16,13 +20,51 @@ import { LoginOutcome } from './types.js';
  * stage. `context.service()` throws for an uninitialized non-lazy service, which would make
  * `ensureLoginService` fail exactly where apps are told to call it.
  *
- * `begin` is deliberately NOT `async`. An async facade method defers the plugin's body past a
- * microtask boundary, and a `window.open` that lands after the user gesture has finished being
- * handled is eaten by the popup blocker. The same rule binds every plugin's own `begin`.
+ * `begin` and `logout` are deliberately NOT `async`. An async facade method defers the plugin's
+ * body past a microtask boundary, and a `window.open` that lands after the user gesture has
+ * finished being handled is eaten by the popup blocker. The same rule binds every plugin's own
+ * `begin` and `logout`, and it is why a precondition must be synchronous too.
  */
 export const makeLoginService = (alias = DEFAULT_ALIAS) => {
     const plugins = [];
+    const preconditions = [];
+    const methodSources = [];
+    const steps = [];
+    const hooks = [];
+    let screen = null;
+    let notifier = null;
     const ctx = () => service.ctx;
+    /**
+     * Park `request.target` for the post-sign-in landing, and hand back the request whose continuation
+     * waits for that write.
+     *
+     * The write is STARTED here and never awaited on the way in: `begin` must reach the plugin's
+     * `window.open` inside the gesture. Only the continuation waits — the redirect plugin's in-app hop
+     * to the dispatcher and the surrogate's hop after the popup has handed its token back — so the
+     * dispatcher that resumes the landing always finds the record, whatever the storage behind it.
+     * A write that fails costs the landing, never the sign-in.
+     */
+    const parkTarget = (ctx, request) => {
+        if (request.target == null || request.target === '') {
+            return [request, null];
+        }
+        const parked = flowLandingOf(ctx).suspendLanding({ entrypoint: request.target, query: {} }, { expiresAt: Date.now() + LOGIN_TARGET_TTL }).catch((error) => {
+            log.warn('Could not park the sign-in target; the landing falls back', {
+                target: request.target, error,
+            });
+            return false;
+        });
+        const navigate = request.navigate;
+        return [
+            navigate == null ? request : {
+                ...request, navigate: async () => {
+                    await parked;
+                    await navigate();
+                },
+            },
+            parked,
+        ];
+    };
     const service = createLazyService(alias, {
         registerPlugin: (plugin) => {
             const existing = plugins.findIndex(candidate => candidate.alias === plugin.alias);
@@ -32,32 +74,116 @@ export const makeLoginService = (alias = DEFAULT_ALIAS) => {
             plugins.push(plugin);
             plugins.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
         },
+        registerPrecondition: (precondition) => {
+            const existing = preconditions.findIndex(candidate => candidate.alias === precondition.alias);
+            if (existing >= 0) {
+                preconditions.splice(existing, 1);
+            }
+            preconditions.push(precondition);
+            preconditions.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        },
+        registerMethodSource: (source) => {
+            const existing = methodSources.findIndex(candidate => candidate.alias === source.alias);
+            if (existing >= 0) {
+                methodSources.splice(existing, 1);
+            }
+            methodSources.push(source);
+        },
+        methods: methodCtx => loginMethodsHelper.resolveLoginMethods(methodCtx, methodCtx.context.cfg.security?.auth?.login, methodSources),
+        registerScreen: value => { screen = value; },
+        screen: () => screen,
+        registerNotifier: value => { notifier = value; },
+        registerStep: (step) => {
+            const existing = steps.findIndex(candidate => candidate.alias === step.alias);
+            if (existing >= 0) {
+                steps.splice(existing, 1);
+            }
+            steps.push(step);
+            steps.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        },
+        steps: () => [...steps],
+        onLanded: (hook) => {
+            const existing = hooks.findIndex(candidate => candidate.alias === hook.alias);
+            if (existing >= 0) {
+                hooks.splice(existing, 1);
+            }
+            hooks.push(hook);
+            hooks.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        },
+        landingHooks: () => [...hooks],
         plugin: env => {
-            const environment = env ?? defaultLoginEnv();
+            const environment = env ?? loginEnvHelper.defaultLoginEnv();
             const plugin = plugins.find(candidate => candidate.match?.(environment, service.ctx) ?? true);
             if (plugin == null) {
                 throw new Error('login: no plugin matches the current environment');
             }
             return plugin;
         },
-        env: () => defaultLoginEnv(),
+        env: () => loginEnvHelper.defaultLoginEnv(),
         enter: () => {
-            const env = defaultLoginEnv();
+            const env = loginEnvHelper.defaultLoginEnv();
             service.plugin(env).enter?.(ctx(), env);
         },
         begin: request => {
-            const env = defaultLoginEnv();
-            return service.plugin(env).begin(ctx(), request, env);
+            const env = loginEnvHelper.defaultLoginEnv();
+            // Synchronously, before anything can open a window: a precondition that refuses leaves the
+            // user exactly where `Gesture` describes — unable to proceed until they act again.
+            for (const precondition of preconditions) {
+                if (!precondition.check(ctx(), request, env)) {
+                    return Promise.resolve(LoginOutcome.Gesture);
+                }
+            }
+            // Parked only past the preconditions: a refused attempt leaves no landing behind for the
+            // next, unrelated sign-in to resume.
+            const [parkedRequest, parked] = parkTarget(ctx(), request);
+            // Notified here, in the facade, rather than by each caller: `useLogin` fires the flow and
+            // forgets the result, and this is the one place every caller — the header hook and the
+            // sign-in screen's method buttons alike — passes through on the way to a settled outcome.
+            return service.plugin(env).begin(ctx(), parkedRequest, env).then(outcome => {
+                if (parked != null && UNSIGNED_OUTCOMES.has(outcome)) {
+                    void parked.then(async () => {
+                        await flowLandingOf(ctx()).discardSuspendedLanding();
+                    });
+                }
+                notifier?.(outcome, env);
+                return outcome;
+            });
         },
         authorize: async (url) => {
-            const env = defaultLoginEnv();
+            const env = loginEnvHelper.defaultLoginEnv();
             return await service.plugin(env).authorize(ctx(), url, env);
         },
         complete: async (token) => {
-            const env = defaultLoginEnv();
+            const env = loginEnvHelper.defaultLoginEnv();
             return await service.plugin(env).complete(ctx(), token, env);
         },
-        adopt: async (token) => { await adoptToken(ctx(), token); },
+        resume: async (token) => {
+            const env = loginEnvHelper.defaultLoginEnv();
+            // Absent means "keep it and carry on" — which is what an ordinary tab has always done, and
+            // is why the redirect plugin implements nothing here.
+            return await service.plugin(env).resume?.(ctx(), token, env) ?? LoginOutcome.Passed;
+        },
+        logout: request => {
+            const env = loginEnvHelper.defaultLoginEnv();
+            const plugin = service.plugin(env);
+            if (plugin.logout == null) {
+                // A plugin with no logout mechanic still has to end the session it started.
+                return loginTokenOf(ctx()).revokeToken().then(async () => {
+                    await request.navigate?.();
+                    return LoginOutcome.Passed;
+                });
+            }
+            return plugin.logout(ctx(), request, env).then(outcome => {
+                notifier?.(outcome, env);
+                return outcome;
+            });
+        },
+        logoutComplete: async () => {
+            const env = loginEnvHelper.defaultLoginEnv();
+            return await service.plugin(env).logoutComplete?.(ctx(), env) ?? LoginOutcome.Passed;
+        },
+        adopt: async (token) => { await loginTokenOf(ctx()).adoptToken(token); },
+        revoke: async () => { await loginTokenOf(ctx()).revokeToken(); },
     });
     return service;
 };

package/build/login/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAGzC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,aAAa,EAAgB,EAAE;IAC9E,MAAM,OAAO,GAAkB,EAAE,CAAA;IAEjC,MAAM,GAAG,GAAG,GAAiB,EAAE,CAAC,OAAO,CAAC,GAAmB,CAAA;IAE3D,MAAM,OAAO,GAAiB,iBAAiB,CAAe,KAAK,EAAE;QACnE,cAAc,EAAE,CAAC,MAAmB,EAAE,EAAE;YACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;YACjF,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC7B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/D,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,EAAE;YACZ,MAAM,WAAW,GAAG,GAAG,IAAI,eAAe,EAAE,CAAA;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,GAA+B,CAAC,IAAI,IAAI,CAC7F,CAAA;YACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACrE,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QAED,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;QAE5B,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;YAC7B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,KAAK,EAAE,OAAO,CAAC,EAAE;YACf,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;YAE7B,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;QAED,SAAS,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACrB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;YAE7B,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC7D,CAAC;QAED,QAAQ,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACtB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;YAE7B,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QAC9D,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;KACzD,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAsB,EAAgB,EAAE;IACzE,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAA;IAClC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAE5B,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,GAAM,EACkB,EAAE;IAC1B,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,UAAU,GAAG,GAA6B,CAAA;IAChD,UAAU,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAEjE,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAuC,MAAM,mBAAmB,CAAA;AAG1F,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAMjD,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAA;AAEvC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAgB,EAAE;IAC9E,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,aAAa,GAAwB,EAAE,CAAA;IAC7C,MAAM,aAAa,GAAwB,EAAE,CAAA;IAC7C,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,IAAI,MAAM,GAAgC,IAAI,CAAA;IAC9C,IAAI,QAAQ,GAAyB,IAAI,CAAA;IAEzC,MAAM,GAAG,GAAG,GAAiB,EAAE,CAAC,OAAO,CAAC,GAAmB,CAAA;IAE3D;;;;;;;;;OASG;IACH,MAAM,UAAU,GAAG,CACjB,GAAiB,EAAE,OAAqB,EACC,EAAE;QAC3C,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACxB,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAA+B,CAAC,CAAC,cAAc,CAC1E,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EACzC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAC7C,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE;gBACpE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK;aAC9B,CAAC,CAAA;YAEF,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAEjC,OAAO;YACL,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3B,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE;oBAC/B,MAAM,MAAM,CAAA;oBACZ,MAAM,QAAQ,EAAE,CAAA;gBAClB,CAAC;aACF;YACD,MAAM;SACP,CAAA;IACH,CAAC,CAAA;IAED,MAAM,OAAO,GAAiB,iBAAiB,CAAe,KAAK,EAAE;QACnE,cAAc,EAAE,CAAC,MAAmB,EAAE,EAAE;YACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;YACjF,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC7B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/D,CAAC;QAED,oBAAoB,EAAE,CAAC,YAA+B,EAAE,EAAE;YACxD,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,YAAY,CAAC,KAAK,CAAC,CAAA;YAC7F,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YACnC,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAChC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAA;QACrE,CAAC;QAED,oBAAoB,EAAE,CAAC,MAAyB,EAAE,EAAE;YAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;YACvF,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YACnC,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5B,CAAC;QAED,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,CAC1D,SAAS,EACR,SAAS,CAAC,OAAO,CAAC,GAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAC7D,aAAa,CACd;QAED,cAAc,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,GAAG,KAAK,CAAA,CAAC,CAAC;QAE3C,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QAEpB,gBAAgB,EAAE,KAAK,CAAC,EAAE,GAAG,QAAQ,GAAG,KAAK,CAAA,CAAC,CAAC;QAE/C,YAAY,EAAE,CAAC,IAAe,EAAE,EAAE;YAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAA;YAC7E,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC3B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAA;QAC7D,CAAC;QAED,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;QAEvB,QAAQ,EAAE,CAAC,IAAsB,EAAE,EAAE;YACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAA;YAC7E,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC3B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAA;QAC7D,CAAC;QAED,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;QAE9B,MAAM,EAAE,GAAG,CAAC,EAAE;YACZ,MAAM,WAAW,GAAG,GAAG,IAAI,cAAc,CAAC,eAAe,EAAE,CAAA;YAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,GAA+B,CAAC,IAAI,IAAI,CAC7F,CAAA;YACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACrE,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QAED,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,eAAe,EAAE;QAE3C,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,GAAG,GAAG,cAAc,CAAC,eAAe,EAAE,CAAA;YAC5C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,KAAK,EAAE,OAAO,CAAC,EAAE;YACf,MAAM,GAAG,GAAG,cAAc,CAAC,eAAe,EAAE,CAAA;YAC5C,2FAA2F;YAC3F,mFAAmF;YACnF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;gBAC9C,CAAC;YACH,CAAC;YAED,yFAAyF;YACzF,qCAAqC;YACrC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAA;YAE1D,0FAA0F;YAC1F,uFAAuF;YACvF,0FAA0F;YAC1F,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACzE,IAAI,MAAM,IAAI,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACrD,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;wBAC1B,MAAM,aAAa,CAAC,GAAG,EAA8B,CAAC,CAAC,uBAAuB,EAAE,CAAA;oBAClF,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;gBAExB,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,SAAS,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACrB,MAAM,GAAG,GAAG,cAAc,CAAC,eAAe,EAAE,CAAA;YAE5C,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC7D,CAAC;QAED,QAAQ,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACtB,MAAM,GAAG,GAAG,cAAc,CAAC,eAAe,EAAE,CAAA;YAE5C,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,GAAG,GAAG,cAAc,CAAC,eAAe,EAAE,CAAA;YAC5C,2FAA2F;YAC3F,sDAAsD;YACtD,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,CAAA;QACrF,CAAC;QAED,MAAM,EAAE,OAAO,CAAC,EAAE;YAChB,MAAM,GAAG,GAAG,cAAc,CAAC,eAAe,EAAE,CAAA;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAClC,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC1B,4EAA4E;gBAC5E,OAAO,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBACvD,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAA;oBAE1B,OAAO,YAAY,CAAC,MAAM,CAAA;gBAC5B,CAAC,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACvD,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;gBAExB,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,MAAM,GAAG,GAAG,cAAc,CAAC,eAAe,EAAE,CAAA;YAE5C,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,CAAA;QACtF,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;QAErE,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA,CAAC,CAAC;KAChE,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAsB,EAAgB,EAAE;IACzE,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAA;IAClC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAE5B,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,GAAM,EACkB,EAAE;IAC1B,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,UAAU,GAAG,GAA6B,CAAA;IAChD,UAAU,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAEjE,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}

package/build/login/start/types.d.ts

@@ -0,0 +1,29 @@
+import type { LoginOutcome } from '../consts.js';
+/** What a "Log in" control hands `startLogin`: where the flow starts, where it lands, how to move. */
+export interface LoginStart {
+    /** The resolved dispatcher path — where the login flow starts. */
+    url: string;
+    /** Entrypoint alias to land on once signed in; absent means the ordinary landing. */
+    target?: string;
+    /** The in-app navigation, supplied by a component because only a component may hold one. */
+    go: (alias: string) => void | Promise<void>;
+}
+/** The decision behind a "Log in" control, bound to the application context. */
+export interface LoginStartHelper {
+    /**
+     * What a "Log in" control does when clicked — the decision behind `useLogin`, kept free of React so
+     * it is the same rule wherever a control is rendered.
+     *
+     * - A target and a session already here: go straight to the target — there is nobody to sign in.
+     * - Otherwise: begin a sign-in whose continuation is ALWAYS the dispatcher, never the target. A
+     *   target travels as `LoginRequest.target`, which the facade parks for the landing; the
+     *   dispatcher's own post-sign-in landing (`landAfterLogin` — landing hooks, pending steps such as a
+     *   consent screen, then the parked target) brings the person there signed in. Navigating to a
+     *   guarded target instead is what used to land a person on it signed out.
+     *
+     * NOT async, and nothing is awaited before `begin`: the surrogate plugin opens its window inside
+     * this call, and a window opened after the gesture has been handled is eaten by the popup blocker.
+     */
+    startLogin: (start: LoginStart) => Promise<LoginOutcome>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/start/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/start/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD,sGAAsG;AACtG,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAA;IACX,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4FAA4F;IAC5F,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;OAaG;IACH,UAAU,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;CACzD"}

package/build/login/start/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/start/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/start/types.ts"],"names":[],"mappings":""}

package/build/login/start.d.ts

@@ -0,0 +1,5 @@
+import type { LoginContext } from './types.js';
+import type { LoginStartHelper } from './start/types.js';
+export declare const makeLoginStartHelper: (ctx: LoginContext) => LoginStartHelper;
+export declare const loginStartOf: (target: LoginContext) => LoginStartHelper;
+//# sourceMappingURL=start.d.ts.map

package/build/login/start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/login/start.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,YAAY,CAAA;AAE5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,eAAO,MAAM,oBAAoB,QAAS,YAAY,KAAG,gBAiCxD,CAAA;AAED,eAAO,MAAM,YAAY,4CAA2C,CAAA"}

package/build/login/start.js

@@ -0,0 +1,36 @@
+import { DISPATCHER } from '@owlmeans/auth';
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js';
+import { LOGIN_SERVICE, LoginOutcome } from './consts.js';
+import { memoHelper } from '@owlmeans/context';
+export const makeLoginStartHelper = (ctx) => {
+    /**
+     * Whether this document already holds a session, answered WITHOUT awaiting anything.
+     *
+     * Read off the auth service's in-memory token, which every guard and `authenticated()` call fills.
+     * A session not yet read from storage answers `false` and costs nothing: the sign-in it starts finds
+     * the session at the dispatcher, which lands on the parked target all the same.
+     */
+    const holdsSession = () => {
+        if (!ctx.hasService(AUTH_ALIAS)) {
+            return false;
+        }
+        const token = ctx.service(AUTH_ALIAS).token;
+        return token != null && token !== '';
+    };
+    const startLogin = start => {
+        const { url, target, go } = start;
+        if (target != null && target !== '' && holdsSession()) {
+            return Promise.resolve(go(target)).then(() => LoginOutcome.Handled);
+        }
+        return ctx.service(LOGIN_SERVICE).begin({
+            url,
+            target,
+            // Only a component may call `useNavigate`, so the in-app continuation is handed to the
+            // plugin rather than reinvented by it.
+            navigate: () => { void go(DISPATCHER); },
+        });
+    };
+    return { startLogin };
+};
+export const loginStartOf = memoHelper.oncePer(makeLoginStartHelper);
+//# sourceMappingURL=start.js.map

package/build/login/start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/login/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAiB,EAAoB,EAAE;IAC1E;;;;;;OAMG;IACH,MAAM,YAAY,GAAG,GAAY,EAAE;QACjC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAC,KAAK,CAAA;QAExD,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAA;IACtC,CAAC,CAAA;IAED,MAAM,UAAU,GAAmC,KAAK,CAAC,EAAE;QACzD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAA;QACjC,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,YAAY,EAAE,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACrE,CAAC;QAED,OAAO,GAAG,CAAC,OAAO,CAAe,aAAa,CAAC,CAAC,KAAK,CAAC;YACpD,GAAG;YACH,MAAM;YACN,uFAAuF;YACvF,uCAAuC;YACvC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,UAAU,CAAC,CAAA,CAAC,CAAC;SACxC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,OAAO,EAAE,UAAU,EAAE,CAAA;AACvB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA"}

package/build/login/surrogate/types.d.ts

@@ -0,0 +1,9 @@
+import type { LoginIntent } from '../consts.js';
+export interface SurrogateTarget {
+    intent: LoginIntent;
+    /** The address the surrogate should actually run, once it is one window up. */
+    next?: string;
+    /** The method the user already chose in the opener. */
+    method?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/surrogate/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/surrogate/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB"}

package/build/login/surrogate/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/surrogate/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/surrogate/types.ts"],"names":[],"mappings":""}

package/build/login/surrogate.d.ts

@@ -0,0 +1,13 @@
+import type { LoginContext } from './types.js';
+import type { SurrogateTarget } from './surrogate/types.js';
+/**
+ * Where a surrogate window opens.
+ *
+ * Returns `null` when the application's entrypoint list predates the surrogate route — an app
+ * built against an older `@owlmeans/auth-common` has no such entrypoint, and the caller then falls
+ * back to opening the dispatcher directly, which is exactly what it used to do. That fallback is
+ * the whole compatibility story for already-deployed applications, so it must never be removed in
+ * favour of throwing.
+ */
+export declare const surrogatePath: (ctx: LoginContext, target: SurrogateTarget) => string | null;
+//# sourceMappingURL=surrogate.d.ts.map

package/build/login/surrogate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surrogate.d.ts","sourceRoot":"","sources":["../../src/login/surrogate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAS,YAAY,UAAU,eAAe,KAAG,MAAM,GAAG,IAqBnF,CAAA"}

package/build/login/surrogate.js

@@ -0,0 +1,33 @@
+import { DISPATCHER_SURROGATE } from '@owlmeans/auth';
+import { LOGIN_INTENT_QUERY, LOGIN_METHOD_QUERY, LOGIN_NEXT_QUERY } from './consts.js';
+/**
+ * Where a surrogate window opens.
+ *
+ * Returns `null` when the application's entrypoint list predates the surrogate route — an app
+ * built against an older `@owlmeans/auth-common` has no such entrypoint, and the caller then falls
+ * back to opening the dispatcher directly, which is exactly what it used to do. That fallback is
+ * the whole compatibility story for already-deployed applications, so it must never be removed in
+ * favour of throwing.
+ */
+export const surrogatePath = (ctx, target) => {
+    if (!ctx.hasEntrypoint(DISPATCHER_SURROGATE)) {
+        return null;
+    }
+    let path;
+    try {
+        path = ctx.entrypoint(DISPATCHER_SURROGATE).path();
+    }
+    catch {
+        return null;
+    }
+    const query = new URLSearchParams();
+    query.set(LOGIN_INTENT_QUERY, target.intent);
+    if (target.next != null && target.next !== '') {
+        query.set(LOGIN_NEXT_QUERY, target.next);
+    }
+    if (target.method != null && target.method !== '') {
+        query.set(LOGIN_METHOD_QUERY, target.method);
+    }
+    return `${path}?${query.toString()}`;
+};
+//# sourceMappingURL=surrogate.js.map

package/build/login/surrogate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surrogate.js","sourceRoot":"","sources":["../../src/login/surrogate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAItF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAiB,EAAE,MAAuB,EAAiB,EAAE;IACzF,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,UAAU,CAAmB,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IACnC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC9C,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAClD,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAA;AACtC,CAAC,CAAA"}

package/build/login/terms/types.d.ts

@@ -0,0 +1,112 @@
+import type { LoginTermsConfig } from '@owlmeans/config';
+import type { LoginContext } from '../types.js';
+/** One document (or notice) a sign-in screen links to. */
+export interface ResolvedTermsDocument {
+    key: string;
+    href: string;
+    /** Published translations, selected at render/record time; `href` remains canonical. */
+    hrefMap?: Record<string, string>;
+    /** A caller's own label, already resolved to one string — only ever set for a custom document. */
+    label?: string;
+    /** A locale map for the label, when the config supplied one — resolved by the renderer, not here. */
+    labelMap?: Record<string, string>;
+    /** Translation key under `login.terms.*`, when this document has one. */
+    i18nKey?: string;
+    revisedAt?: string;
+    /** Extra interpolation values for `i18nKey`'s translation (e.g. `{ product: 'Acme' }`). */
+    params?: Record<string, string>;
+}
+export interface ResolvedTerms {
+    required: boolean;
+    terms: string;
+    privacy: string;
+    cookies?: string;
+    version: string;
+    /** What the checkbox agrees to — terms, then billing/product when configured, then custom. */
+    documents: ResolvedTermsDocument[];
+    /** What is merely DISCLOSED, never consented to — privacy, plus cookies per the rule below. */
+    notices: ResolvedTermsDocument[];
+    /** The latest `revisedAt` among {@link documents}. Only set when `showRevision` is true. */
+    revisedAt?: string;
+    showRevision: boolean;
+}
+/** One document as `@owlmeans/marketing-consent`'s `TermsDocumentRef` shape — structurally, with
+ * no dependency on that package (client-auth is a layer below it). */
+export interface TermsAcceptanceRef {
+    key: string;
+    href: string;
+    revisedAt?: string;
+}
+/** One fragment of an interpolated terms sentence — plain text, or a link to a document. */
+export interface TermsSentencePart {
+    text: string;
+    href?: string;
+    documentKey?: string;
+}
+/** What a sign-in-time terms acceptance sends the server. */
+export interface LoginTermsAcceptance {
+    documents: TermsAcceptanceRef[];
+    notices: TermsAcceptanceRef[];
+    version: string;
+    locale?: string;
+}
+/** The documents a sign-in agrees to: their resolution, the local acceptance record and the sentence. */
+export interface LoginTermsHelper {
+    /** The configured documents and notices, with the version acceptance is recorded against; null when terms are off. */
+    resolveTerms: (cfg?: LoginTermsConfig | false) => ResolvedTerms | null;
+    /**
+     * Whether this browser has already agreed to exactly these documents.
+     *
+     * `localStorage` and not a cookie: the record is a UI convenience, it never travels to a server,
+     * and it must be readable by the surrogate login window — which is same-origin, so it sees the
+     * opener's acceptance and does not ask twice. A preview iframe on a different origin gets its own
+     * partition and therefore its own acceptance, which is correct rather than unfortunate.
+     */
+    termsAccepted: (resolved: ResolvedTerms | null) => boolean;
+    /** Record (or, with `accepted: false`, forget) this browser's agreement to these documents. */
+    acceptTerms: (resolved: ResolvedTerms | null, accepted: boolean) => void;
+    /**
+     * A document's own label: a caller's literal `label`, else its `labelMap` for the current locale,
+     * else its `i18nKey` translated — each with `params` (e.g. `{ product: 'Acme' }`) interpolated
+     * afterwards, since the `translate` contract every renderer shares is a plain
+     * `(key, defaultValue) => string` with no interpolation option of its own.
+     *
+     * The one label resolver every renderer of a terms sentence uses — `FallbackLoginScreen` here, and
+     * `@owlmeans/web-panel`'s `LoginTerms` — so the English fallbacks and the resolution order live in
+     * exactly one place instead of two hand-kept copies.
+     */
+    termsLabelResolver: (translate: (key: string, defaultValue: string) => string, locale: string | undefined) => (doc: ResolvedTermsDocument) => string;
+    /** Explicit locale destination, then base language, then canonical href; never rewrites paths. */
+    termsHrefOf: (doc: ResolvedTermsDocument, locale?: string) => string;
+    /**
+     * What a sign-in-time terms acceptance sends the server — structurally
+     * `@owlmeans/marketing-consent`'s `TermsAcceptance`, so `client.recordTerms(termsAcceptanceOf(...))`
+     * type-checks with no dependency in this direction. Shared by `termsRecorder` (the sign-in screen's
+     * own local acceptance, copied at landing) and a Terms-mode consent screen recording the box it
+     * just showed.
+     */
+    termsAcceptanceOf: (resolved: Pick<ResolvedTerms, 'documents' | 'notices' | 'version'>, locale?: string) => LoginTermsAcceptance;
+    /**
+     * Whether the Terms confirmation has been moved off the sign-in screen onto a registered step.
+     *
+     * True only when a step both DECLARES `confirmsTerms` and is BOUND (`ctx.hasEntrypoint`) — an app
+     * that registers the step (e.g. `appendMarketingConsent({ terms: 'step' })`) but never binds its
+     * screen (an older target, a partial import) keeps the sign-in checkbox, fail-closed: a person must
+     * never find the confirmation missing from both places at once.
+     *
+     * Reads the service directly (`ctx.hasService`), never `ensureLoginService` — that registers an
+     * empty host as a side effect, which a render-time check must not do.
+     */
+    termsDeferred: (ctx: LoginContext) => boolean;
+    /**
+     * Interpolate a translated sentence template around its document list(s).
+     *
+     * Supports `{{documents}}` (→ `resolved.documents`) and `{{notices}}` (→ `resolved.notices`), and
+     * — for backward compatibility with an older template string — the legacy `{{terms}}`, `{{privacy}}`
+     * and `{{cookies}}` placeholders, each resolved to its one matching document. Framework-agnostic on
+     * purpose: it returns plain data, never JSX, so both `@owlmeans/web-panel` and the plain fallback
+     * screen can turn the parts into their own markup.
+     */
+    termsSentence: (template: string, resolved: Pick<ResolvedTerms, 'documents' | 'notices'>, locale: string | undefined, resolveLabel: (doc: ResolvedTermsDocument) => string) => TermsSentencePart[];
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/terms/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/terms/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,0DAA0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,kGAAkG;IAClG,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,8FAA8F;IAC9F,SAAS,EAAE,qBAAqB,EAAE,CAAA;IAClC,+FAA+F;IAC/F,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,OAAO,CAAA;CACtB;AAED;sEACsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,4FAA4F;AAC5F,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,kBAAkB,EAAE,CAAA;IAC/B,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,yGAAyG;AACzG,MAAM,WAAW,gBAAgB;IAC/B,sHAAsH;IACtH,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,KAAK,KAAK,aAAa,GAAG,IAAI,CAAA;IACtE;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,KAAK,OAAO,CAAA;IAC1D,+FAA+F;IAC/F,WAAW,EAAE,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAA;IACxE;;;;;;;;;OASG;IACH,kBAAkB,EAAE,CAClB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KACjF,CAAC,GAAG,EAAE,qBAAqB,KAAK,MAAM,CAAA;IAC3C,kGAAkG;IAClG,WAAW,EAAE,CAAC,GAAG,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IACpE;;;;;;OAMG;IACH,iBAAiB,EAAE,CACjB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,KAChF,oBAAoB,CAAA;IACzB;;;;;;;;;;OAUG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAA;IAC7C;;;;;;;;OAQG;IACH,aAAa,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,SAAS,CAAC,EACtD,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,MAAM,KACjD,iBAAiB,EAAE,CAAA;CACzB"}

package/build/login/terms/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/terms/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/terms/types.ts"],"names":[],"mappings":""}

package/build/login/terms-config.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Extra `LoginTermsConfig` fields, added by TypeScript module augmentation rather than by editing
+ * `@owlmeans/config` itself.
+ *
+ * `@owlmeans/config` has roughly 85 dependents, and every one of them sits in the same release
+ * closure — a config bump ripples through every package that pins a range against it, whether or
+ * not it touches sign-in. The fields below are needed by exactly one consumer family (the sign-in
+ * screen and its terms confirmation, all downstream of `@owlmeans/client-auth`), so they are
+ * declared here instead, merged onto the base interface by TypeScript's own declaration merging.
+ *
+ * This file must be part of whatever a consumer's own compilation actually loads, or the merge
+ * never happens — an ambient augmentation applies only once the compiler has read the file that
+ * declares it. `@owlmeans/client-auth/login`'s barrel (`./index.ts`) re-exports this module for
+ * exactly that reason, so ANY import from `@owlmeans/client-auth/login` — which every application
+ * wiring sign-in already has — pulls this augmentation into that program. An app that constructs a
+ * `LoginTermsConfig` literal in a file that imports NOTHING from `@owlmeans/client-auth/login`
+ * still benefits as long as some other file in the same `tsc` program does; if none does (an
+ * isolated leaf package that only ever imports `@owlmeans/config`), add
+ * `import type {} from '@owlmeans/client-auth/login'` to the file building the literal — an
+ * import with an empty type list, kept only to pull this file into that program's graph.
+ *
+ * `export {}` below is required, not decorative: without at least one top-level import/export this
+ * file is a SCRIPT to TypeScript, not a MODULE, and `declare module '@owlmeans/config'` inside a
+ * script augments the global scope instead of merging onto the named module's exports.
+ */
+declare module '@owlmeans/config' {
+    interface LoginTermsConfig {
+        /** `documents[].key` (or a custom document's own key) → the ISO date it was last revised. */
+        revisions?: Record<string, string>;
+        /**
+         * Document/notice key → locale → published href. Opt-in; omitted locales use the canonical
+         * href. Renderers and acceptance evidence resolve the same current locale, while these
+         * translated destinations leave the canonical agreement version and revisions unchanged.
+         */
+        localizedHrefs?: Record<string, Record<string, string>>;
+        /** Off by default. A bare string is `{ href }`. */
+        billing?: string | {
+            href: string;
+            revisedAt?: string;
+        } | false;
+        /** Off by default. `name` is interpolated into the `login.terms.product` translation. */
+        product?: {
+            name: string;
+            href: string;
+            revisedAt?: string;
+        } | false;
+        /**
+         * Custom documents beyond terms/billing/product, in the order they are agreed to.
+         *
+         * `label` may be a locale map (`{ en: '...', fr: '...' }`) — resolved at RENDER time, by
+         * whichever renderer has the current locale, never here: this file stays locale-free.
+         */
+        documents?: Array<{
+            key: string;
+            href: string;
+            label?: string | Record<string, string>;
+            i18nKey?: string;
+            revisedAt?: string;
+        }>;
+        /** Show the latest revision date beneath the confirmation. Default false. */
+        showRevision?: boolean;
+    }
+}
+export {};
+//# sourceMappingURL=terms-config.d.ts.map

package/build/login/terms-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms-config.d.ts","sourceRoot":"","sources":["../../src/login/terms-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,QAAQ,kBAAkB,CAAC;IAChC,UAAU,gBAAgB;QACxB,6FAA6F;QAC7F,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAClC;;;;WAIG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QACvD,mDAAmD;QACnD,OAAO,CAAC,EAAE,MAAM,GAAG;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,KAAK,CAAA;QAC/D,yFAAyF;QACzF,OAAO,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,KAAK,CAAA;QACpE;;;;;WAKG;QACH,SAAS,CAAC,EAAE,KAAK,CAAC;YAChB,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YACrF,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC,CAAA;QACF,6EAA6E;QAC7E,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB;CACF;AAED,OAAO,EAAG,CAAA"}

package/build/login/terms-config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=terms-config.js.map

package/build/login/terms-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms-config.js","sourceRoot":"","sources":["../../src/login/terms-config.ts"],"names":[],"mappings":""}

package/build/login/terms.d.ts

@@ -0,0 +1,21 @@
+import { type LoginTermsConfig } from '@owlmeans/config';
+import type { LoginContext } from './types.js';
+import type { LoginTermsAcceptance, LoginTermsHelper, ResolvedTerms, ResolvedTermsDocument, TermsSentencePart } from './terms/types.js';
+import './terms-config.js';
+export declare const createLoginTermsHelper: () => LoginTermsHelper;
+export declare const loginTermsHelper: LoginTermsHelper;
+/** @deprecated compat:factory-refactor — use `loginTermsHelper.resolveTerms(…)` */
+export declare const resolveTerms: (cfg?: LoginTermsConfig | false) => ResolvedTerms | null;
+/** @deprecated compat:factory-refactor — use `loginTermsHelper.termsAccepted(…)` */
+export declare const termsAccepted: (resolved: ResolvedTerms | null) => boolean;
+/** @deprecated compat:factory-refactor — use `loginTermsHelper.acceptTerms(…)` */
+export declare const acceptTerms: (resolved: ResolvedTerms | null, accepted: boolean) => void;
+/** @deprecated compat:factory-refactor — use `loginTermsHelper.termsLabelResolver(…)` */
+export declare const termsLabelResolver: (translate: (key: string, defaultValue: string) => string, locale: string | undefined) => ((doc: ResolvedTermsDocument) => string);
+/** @deprecated compat:factory-refactor — use `loginTermsHelper.termsAcceptanceOf(…)` */
+export declare const termsAcceptanceOf: (resolved: Pick<ResolvedTerms, 'documents' | 'notices' | 'version'>, locale?: string) => LoginTermsAcceptance;
+/** @deprecated compat:factory-refactor — use `loginTermsHelper.termsDeferred(…)` */
+export declare const termsDeferred: (ctx: LoginContext) => boolean;
+/** @deprecated compat:factory-refactor — use `loginTermsHelper.termsSentence(…)` */
+export declare const termsSentence: (template: string, resolved: Pick<ResolvedTerms, 'documents' | 'notices'>, locale: string | undefined, resolveLabel: (doc: ResolvedTermsDocument) => string) => TermsSentencePart[];
+//# sourceMappingURL=terms.d.ts.map

package/build/login/terms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.d.ts","sourceRoot":"","sources":["../../src/login/terms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExH,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,YAAY,CAAA;AAC5D,OAAO,KAAK,EACV,oBAAoB,EAAE,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,EAAE,iBAAiB,EAChG,MAAM,kBAAkB,CAAA;AACzB,OAAO,mBAAmB,CAAA;AAG1B,eAAO,MAAM,sBAAsB,QAAO,gBAgRzC,CAAA;AAED,eAAO,MAAM,gBAAgB,kBAA2B,CAAA;AAExD,mFAAmF;AACnF,eAAO,MAAM,YAAY,SAAU,gBAAgB,GAAG,KAAK,KAAG,aAAa,GAAG,IAA0C,CAAA;AAExH,oFAAoF;AACpF,eAAO,MAAM,aAAa,aAAc,aAAa,GAAG,IAAI,KAAG,OAAmD,CAAA;AAElH,kFAAkF;AAClF,eAAO,MAAM,WAAW,aAAc,aAAa,GAAG,IAAI,YAAY,OAAO,KAAG,IAC9B,CAAA;AAElD,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,cAClB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,UAAU,MAAM,GAAG,SAAS,KACnF,CAAC,CAAC,GAAG,EAAE,qBAAqB,KAAK,MAAM,CAA2D,CAAA;AAErG,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,aAClB,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC,WAAW,MAAM,KAClF,oBAA4E,CAAA;AAE/E,oFAAoF;AACpF,eAAO,MAAM,aAAa,QAAS,YAAY,KAAG,OAA8C,CAAA;AAEhG,oFAAoF;AACpF,eAAO,MAAM,aAAa,aACd,MAAM,YACN,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,SAAS,CAAC,UAC9C,MAAM,GAAG,SAAS,gBACZ,CAAC,GAAG,EAAE,qBAAqB,KAAK,MAAM,KACnD,iBAAiB,EAA8E,CAAA"}