@owlmeans/client-auth 0.1.18-rc.9 → 0.1.18

package/build/login/consts.js

@@ -2,17 +2,105 @@ export const DEFAULT_ALIAS = 'login-service';
 export const LOGIN_SERVICE = DEFAULT_ALIAS;
 /** Priority of a plugin that makes no claim about the environment. */
 export const DEFAULT_LOGIN_PRIORITY = 0;
+/** Order given to a method that declares none. */
+export const DEFAULT_METHOD_ORDER = 100;
 /**
- * Name given to the surrogate login window, and the marker it records about itself.
+ * Name given to the surrogate login window, the marker it records about itself, and the values the
+ * two documents exchange.
  *
- * These values are a wire protocol between two documents that may be running different builds —
- * an opener holding an older bundle and a surrogate freshly loaded, or the reverse. They are
- * therefore fixed, and must never be "tidied" to match a newer vocabulary.
+ * These are a wire protocol between two documents that may be running different builds — an opener
+ * holding an older bundle and a surrogate freshly loaded, or the reverse. They are therefore fixed,
+ * and must never be "tidied" to match a newer vocabulary. That applies to the query names and the
+ * message types added later just as much as to the original three.
  */
 export const LOGIN_SURROGATE_NAME = 'owlmeans-oidc-login';
 export const LOGIN_TOKEN_MESSAGE = 'owlmeans:oidc:popup-token';
+export const LOGIN_LOGOUT_MESSAGE = 'owlmeans:oidc:popup-logout';
 export const LOGIN_SURROGATE_MARKER = '_owlmeans-oidc-popup';
-export const LOGIN_SURROGATE_FEATURES = 'popup=yes,width=520,height=760';
+export const LOGIN_SURROGATE_WIDTH = 520;
+export const LOGIN_SURROGATE_HEIGHT = 760;
+/**
+ * @deprecated Never centered the window — it carried no `left`/`top`, so the surrogate always
+ * opened wherever the browser's own default popup placement put it. Superseded by
+ * `@owlmeans/web-client`'s `centeredPopupFeatures(LOGIN_SURROGATE_WIDTH, LOGIN_SURROGATE_HEIGHT)`,
+ * computed fresh per call since centering depends on where the browser window currently sits.
+ * Kept, unchanged, for the same reason as the rest of this block: an already-generated app may
+ * carry a copy of code that still imports it.
+ */
+export const LOGIN_SURROGATE_FEATURES = `popup=yes,width=${LOGIN_SURROGATE_WIDTH},height=${LOGIN_SURROGATE_HEIGHT}`;
 /** How often a surrogate window is checked for having been closed by the user. */
 export const LOGIN_WATCH_INTERVAL = 500;
+/** Carries WHY the surrogate window was opened across the window boundary. */
+export const LOGIN_INTENT_QUERY = 'intent';
+/**
+ * Carries the address the surrogate should run, so the flow parameters the opener's URL held are
+ * forwarded rather than discarded.
+ */
+export const LOGIN_NEXT_QUERY = 'next';
+/**
+ * Carries the method the user already chose, one window up.
+ *
+ * A surrogate acting on it is not an auto-redirect in the "never choose for the user" sense: the
+ * choice was made, by a person, in the document that opened this one.
+ */
+export const LOGIN_METHOD_QUERY = 'method';
+/** Where a browser records that it agreed to one exact set of legal documents. */
+export const LOGIN_TERMS_STORAGE = '_owlmeans-login-terms';
+/**
+ * Bound on a single step's `pending` check, or a landing hook's `landed` call.
+ *
+ * A step/hook that hangs must never HANG sign-in itself — both `continueLogin` and
+ * `landAfterLogin` treat a timeout exactly like a rejection, resolving within this budget either
+ * way. What that resolves TO is fail-open ("not pending") for an ordinary step, and fail-closed
+ * ("pending") for one that declared itself `required` — see `continueLogin`'s `onBroken`.
+ */
+export const LOGIN_STEP_TIMEOUT = 5_000;
+/** Where a browser records the last token a landing hook has already run for. */
+export const LOGIN_LANDED_STORAGE = '_owlmeans-login-landed';
+/** What a dispatcher does once `login().resume(...)` has answered. */
+export var ResumeAction;
+(function (ResumeAction) {
+    /** The plugin took it over — the browser is leaving, or the window is closing. */
+    ResumeAction["Stop"] = "stop";
+    /** Render the outcome to the user; there is nothing further to do automatically. */
+    ResumeAction["Render"] = "render";
+    /** Ordinary tab: keep the session and carry on to the application. */
+    ResumeAction["Navigate"] = "navigate";
+})(ResumeAction || (ResumeAction = {}));
+/** What a stage did, and therefore what the caller must do next. */
+export var LoginOutcome;
+(function (LoginOutcome) {
+    /** The plugin took the flow over and it is finished. The caller does nothing more. */
+    LoginOutcome["Handled"] = "handled";
+    /** The plugin did nothing — the caller carries on with its ordinary continuation. */
+    LoginOutcome["Passed"] = "passed";
+    /** The browser is leaving this document. The caller must not navigate or render. */
+    LoginOutcome["Redirected"] = "redirected";
+    /** Cannot proceed without a fresh user gesture — the caller renders a sign-in control. */
+    LoginOutcome["Gesture"] = "gesture";
+    /** Authenticated, but with no channel back to the window that started it. */
+    LoginOutcome["Orphaned"] = "orphaned";
+    /** The attempt ended with no token (the user closed the window, or the provider refused it). */
+    LoginOutcome["Failed"] = "failed";
+    /**
+     * A window this flow needed could not be opened at all — `window.open` returned `null`, which is
+     * the browser's own popup blocker, not a flow failure. Distinct from {@link Failed}: a caller
+     * with nowhere inline to render (a header "Log in"/"Log out" control, not the sign-in screen)
+     * needs to know specifically that a fresh click reopening the SAME control will not help, and
+     * that the browser is already showing its own blocked-popup affordance somewhere.
+     */
+    LoginOutcome["Blocked"] = "blocked";
+})(LoginOutcome || (LoginOutcome = {}));
+/** Why a surrogate window was opened. */
+export var LoginIntent;
+(function (LoginIntent) {
+    LoginIntent["Login"] = "login";
+    LoginIntent["Logout"] = "logout";
+})(LoginIntent || (LoginIntent = {}));
+/**
+ * How long a sign-in aimed at a screen (`LoginRequest.target`) keeps that screen parked: long
+ * enough for a sign-in with an emailed code, short enough that a tab abandoned mid-way never lands
+ * a later, unrelated sign-in on it.
+ */
+export const LOGIN_TARGET_TTL = 30 * 60 * 1000;
 //# sourceMappingURL=consts.js.map

package/build/login/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAA;AAExE,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AAEhE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAExC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,mBAAmB,qBAAqB,WAAW,sBAAsB,EAAE,CAAA;AAE7E,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEvC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA;AAE1D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEvC,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAE5D,sEAAsE;AACtE,MAAM,CAAN,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,kFAAkF;IAClF,6BAAa,CAAA;IACb,oFAAoF;IACpF,iCAAiB,CAAA;IACjB,sEAAsE;IACtE,qCAAqB,CAAA;AACvB,CAAC,EAPW,YAAY,KAAZ,YAAY,QAOvB;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,YAqBX;AArBD,WAAY,YAAY;IACtB,sFAAsF;IACtF,mCAAmB,CAAA;IACnB,qFAAqF;IACrF,iCAAiB,CAAA;IACjB,oFAAoF;IACpF,yCAAyB,CAAA;IACzB,0FAA0F;IAC1F,mCAAmB,CAAA;IACnB,6EAA6E;IAC7E,qCAAqB,CAAA;IACrB,gGAAgG;IAChG,iCAAiB,CAAA;IACjB;;;;;;OAMG;IACH,mCAAmB,CAAA;AACrB,CAAC,EArBW,YAAY,KAAZ,YAAY,QAqBvB;AAED,yCAAyC;AACzC,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,8BAAe,CAAA;IACf,gCAAiB,CAAA;AACnB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA"}

package/build/login/consts.local.d.ts

@@ -0,0 +1,16 @@
+import { LoginOutcome } from './consts.js';
+import type { CSSProperties } from 'react';
+/**
+ * The page the card sits in.
+ *
+ * It carries its own viewport height because this screen is rendered straight out of the
+ * dispatcher, into whatever the application happens to have around it — which is usually nothing
+ * with a height, so a percentage minimum would resolve to zero and leave the card at the top.
+ */
+export declare const page: CSSProperties;
+export declare const box: CSSProperties;
+/** The same English fallback a document's `i18nKey` translates to when nothing else names it. */
+export declare const DEFAULT_LABEL: Record<string, string>;
+/** Outcomes after which nobody was signed in, so a screen parked for the landing must not wait. */
+export declare const UNSIGNED_OUTCOMES: ReadonlySet<LoginOutcome>;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/login/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../src/login/consts.local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,EAAE,aAIlB,CAAA;AAGD,eAAO,MAAM,GAAG,EAAE,aAEjB,CAAA;AAED,iGAAiG;AACjG,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAMhD,CAAA;AAED,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,YAAY,CAEtD,CAAA"}

package/build/login/consts.local.js

@@ -0,0 +1,30 @@
+import { LoginOutcome } from './consts.js';
+/**
+ * The page the card sits in.
+ *
+ * It carries its own viewport height because this screen is rendered straight out of the
+ * dispatcher, into whatever the application happens to have around it — which is usually nothing
+ * with a height, so a percentage minimum would resolve to zero and leave the card at the top.
+ */
+export const page = {
+    display: 'flex', alignItems: 'center', justifyContent: 'center',
+    minHeight: '100dvh', padding: '1rem',
+    fontFamily: 'system-ui, sans-serif', lineHeight: 1.5,
+};
+// Centred throughout, so the plain screen and the styled one read the same way.
+export const box = {
+    width: '100%', maxWidth: '24rem', padding: '1.5rem', textAlign: 'center',
+};
+/** The same English fallback a document's `i18nKey` translates to when nothing else names it. */
+export const DEFAULT_LABEL = {
+    terms: 'Terms & Conditions',
+    privacy: 'Privacy Policy',
+    cookies: 'Cookie Policy',
+    billing: 'Billing Terms',
+    product: '{{product}} Product Terms',
+};
+/** Outcomes after which nobody was signed in, so a screen parked for the landing must not wait. */
+export const UNSIGNED_OUTCOMES = new Set([
+    LoginOutcome.Blocked, LoginOutcome.Failed, LoginOutcome.Gesture,
+]);
+//# sourceMappingURL=consts.local.js.map

package/build/login/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../src/login/consts.local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ;IAC/D,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;IACpC,UAAU,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG;CACrD,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,GAAG,GAAkB;IAChC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;CACzE,CAAA;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,KAAK,EAAE,oBAAoB;IAC3B,OAAO,EAAE,gBAAgB;IACzB,OAAO,EAAE,eAAe;IACxB,OAAO,EAAE,eAAe;IACxB,OAAO,EAAE,2BAA2B;CACrC,CAAA;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,iBAAiB,GAA8B,IAAI,GAAG,CAAe;IAChF,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,OAAO;CAChE,CAAC,CAAA"}

package/build/login/credit/types.d.ts

@@ -0,0 +1,7 @@
+export interface ResolvedCredit {
+    /** Whether "Powered by OwlMeans" is rendered. */
+    poweredBy: boolean;
+    /** The product and organization line, already composed. Null when there is nothing to say. */
+    line: string | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/credit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/credit/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,SAAS,EAAE,OAAO,CAAA;IAClB,8FAA8F;IAC9F,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB"}

package/build/login/credit/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/credit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/credit/types.ts"],"names":[],"mappings":""}

package/build/login/credit.d.ts

@@ -0,0 +1,19 @@
+import type { BrandSettings, LoginCreditConfig } from '@owlmeans/config';
+import type { ResolvedCredit } from './credit/types.js';
+/**
+ * What the bottom of the sign-in screen says.
+ *
+ * It is a copyright notice, so it is composed as one: `© <year> <holder>`. That is the whole
+ * reason `copyright` defaults to on — the name on its own reads as a caption, and an application
+ * that means to assert a copyright would have had to write the mark and the year into a literal
+ * `line` to get one.
+ *
+ * The organization falls back to its slug because an organization record carries no readable name
+ * — so "no name" is the ordinary case, not an error, and a screen that rendered an empty line for
+ * it would be worse than one that renders the slug.
+ *
+ * `line` replaces everything when an app supplies it: a product with its own legal wording should
+ * not have to defeat a composition rule to use it.
+ */
+export declare const resolveCredit: (cfg?: LoginCreditConfig, brand?: BrandSettings, service?: string) => ResolvedCredit;
+//# sourceMappingURL=credit.d.ts.map

package/build/login/credit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit.d.ts","sourceRoot":"","sources":["../../src/login/credit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAuBvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,SAClB,iBAAiB,UAAU,aAAa,YAAY,MAAM,KAC/D,cA2BF,CAAA"}

package/build/login/credit.js

@@ -0,0 +1,58 @@
+/**
+ * The years one notice covers.
+ *
+ * A range only while the first year is genuinely in the past — an app configured with the current
+ * year, or with a year a skewed clock puts in the future, still gets a well-formed notice rather
+ * than `© 2026–2026` or a range that runs backwards.
+ */
+const years = (since, now) => since != null && since > 0 && since < now ? `${since}–${now}` : `${now}`;
+/**
+ * A configured value that was actually SET.
+ *
+ * Empty is how a build-time default spells "unset", and this config is filled from environment
+ * variables a platform delivers — `BRANDING_ORGANIZATION: meta.brandingOrganization ?? ''` is the
+ * shape of every one of them. `??` does not fall through an empty string, so an undelivered
+ * organization used to win the fallback chain and compose a line ending in a bare dash.
+ */
+const set = (value) => value != null && value.trim() !== '' ? value : null;
+/**
+ * What the bottom of the sign-in screen says.
+ *
+ * It is a copyright notice, so it is composed as one: `© <year> <holder>`. That is the whole
+ * reason `copyright` defaults to on — the name on its own reads as a caption, and an application
+ * that means to assert a copyright would have had to write the mark and the year into a literal
+ * `line` to get one.
+ *
+ * The organization falls back to its slug because an organization record carries no readable name
+ * — so "no name" is the ordinary case, not an error, and a screen that rendered an empty line for
+ * it would be worse than one that renders the slug.
+ *
+ * `line` replaces everything when an app supplies it: a product with its own legal wording should
+ * not have to defeat a composition rule to use it.
+ */
+export const resolveCredit = (cfg, brand, service) => {
+    const poweredBy = cfg?.poweredBy ?? true;
+    const literal = set(cfg?.line);
+    if (literal != null) {
+        return { poweredBy, line: literal };
+    }
+    const product = set(cfg?.product) ?? set(brand?.name) ?? set(service);
+    const organization = set(cfg?.organization) ?? set(brand?.organization)
+        ?? set(cfg?.entity) ?? set(brand?.entity);
+    // Whoever the notice names. A product with no organization behind it holds its own copyright,
+    // which is why this falls through to the product rather than dropping the notice.
+    const holder = set(cfg?.holder) ?? organization ?? product;
+    const wording = typeof cfg?.copyright === 'string' ? set(cfg.copyright) : null;
+    const notice = cfg?.copyright === false || holder == null
+        ? organization
+        : wording ?? `© ${years(cfg?.since, new Date().getFullYear())} ${holder}`;
+    // The product is named beside the notice only when it is not already the thing being claimed —
+    // "OwlMeans — © 2026 OwlMeans" says the name twice and neither time usefully.
+    return {
+        poweredBy,
+        line: product != null && notice != null && product !== holder
+            ? `${product} — ${notice}`
+            : notice ?? product,
+    };
+};
+//# sourceMappingURL=credit.js.map

package/build/login/credit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit.js","sourceRoot":"","sources":["../../src/login/credit.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAE,GAAW,EAAU,EAAE,CAC/D,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAA;AAE1E;;;;;;;GAOG;AACH,MAAM,GAAG,GAAG,CAAC,KAAqB,EAAiB,EAAE,CACnD,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAuB,EAAE,KAAqB,EAAE,OAAgB,EAChD,EAAE;IAClB,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,IAAI,IAAI,CAAA;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC9B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACrC,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC;WAClE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAE3C,8FAA8F;IAC9F,kFAAkF;IAClF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,YAAY,IAAI,OAAO,CAAA;IAC1D,MAAM,OAAO,GAAG,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9E,MAAM,MAAM,GAAG,GAAG,EAAE,SAAS,KAAK,KAAK,IAAI,MAAM,IAAI,IAAI;QACvD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,EAAE,CAAA;IAE3E,+FAA+F;IAC/F,8EAA8E;IAC9E,OAAO;QACL,SAAS;QACT,IAAI,EAAE,OAAO,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,MAAM;YAC3D,CAAC,CAAC,GAAG,OAAO,MAAM,MAAM,EAAE;YAC1B,CAAC,CAAC,MAAM,IAAI,OAAO;KACtB,CAAA;AACH,CAAC,CAAA"}

package/build/login/env/types.d.ts

@@ -0,0 +1,35 @@
+import type { LoginEnv } from '../types.js';
+/** What this browsing context is for a sign-in: framed, the surrogate window, opened by another. */
+export interface LoginEnvHelper {
+    /**
+     * Whether this document is embedded in a frame.
+     *
+     * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
+     * differs and a `top` that cannot be reached both mean "framed".
+     */
+    isEmbedded: () => boolean;
+    /**
+     * Record that this window is the surrogate login window, while that is still knowable.
+     *
+     * Must run on the surrogate's **first** load, before the flow navigates to the provider:
+     * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
+     * context goes cross-origin — so by the time the provider redirects back, the name is gone and
+     * this window would look like an ordinary tab.
+     *
+     * Idempotent, and a no-op in every window that is not the surrogate.
+     */
+    markSurrogate: () => void;
+    /** Whether this document is the surrogate login window. */
+    isSurrogate: () => boolean;
+    /** Forget the surrogate marker — called once its token has been handed back. */
+    clearSurrogate: () => void;
+    /**
+     * Default login environment.
+     *
+     * The single source of environment truth for cascade selection — a plugin's `match` reads this
+     * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
+     * own descriptor.
+     */
+    defaultLoginEnv: () => LoginEnv;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/env/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/env/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,UAAU,EAAE,MAAM,OAAO,CAAA;IACzB;;;;;;;;;OASG;IACH,aAAa,EAAE,MAAM,IAAI,CAAA;IACzB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,OAAO,CAAA;IAC1B,gFAAgF;IAChF,cAAc,EAAE,MAAM,IAAI,CAAA;IAC1B;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,QAAQ,CAAA;CAChC"}

package/build/login/env/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/env/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/env/types.ts"],"names":[],"mappings":""}

package/build/login/env.d.ts

@@ -1,32 +1,8 @@
-import type { LoginEnv } from './types.js';
-/**
- * Whether this document is embedded in a frame.
- *
- * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
- * differs and a `top` that cannot be reached both mean "framed".
- */
-export declare const isEmbedded: () => boolean;
-/**
- * Record that this window is the surrogate login window, while that is still knowable.
- *
- * Must run on the surrogate's **first** load, before the flow navigates to the provider:
- * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
- * context goes cross-origin — so by the time the provider redirects back, the name is gone and
- * this window would look like an ordinary tab.
- *
- * Idempotent, and a no-op in every window that is not the surrogate.
- */
+import type { LoginEnvHelper } from './env/types.js';
+export declare const createLoginEnvHelper: () => LoginEnvHelper;
+export declare const loginEnvHelper: LoginEnvHelper;
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.markSurrogate()` */
 export declare const markSurrogate: () => void;
-/** Whether this document is the surrogate login window. */
-export declare const isSurrogate: () => boolean;
-/** Forget the surrogate marker — called once its token has been handed back. */
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.clearSurrogate()` */
 export declare const clearSurrogate: () => void;
-/**
- * Default login environment.
- *
- * The single source of environment truth for cascade selection — a plugin's `match` reads this
- * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
- * own descriptor.
- */
-export declare const defaultLoginEnv: () => LoginEnv;
 //# sourceMappingURL=env.d.ts.map

package/build/login/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAO,OAM7B,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,QAAO,IAUhC,CAAA;AAED,2DAA2D;AAC3D,eAAO,MAAM,WAAW,QAAO,OAY9B,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,cAAc,QAAO,IAOjC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,QAAO,QAclC,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,eAAO,MAAM,oBAAoB,QAAO,cA6DvC,CAAA;AAED,eAAO,MAAM,cAAc,gBAAyB,CAAA;AAEpD,iFAAiF;AACjF,eAAO,MAAM,aAAa,QAAO,IAAsC,CAAA;AAEvE,kFAAkF;AAClF,eAAO,MAAM,cAAc,QAAO,IAAuC,CAAA"}

package/build/login/env.js

@@ -1,84 +1,67 @@
 import { LOGIN_SURROGATE_MARKER, LOGIN_SURROGATE_NAME } from './consts.js';
-/**
- * Whether this document is embedded in a frame.
- *
- * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
- * differs and a `top` that cannot be reached both mean "framed".
- */
-export const isEmbedded = () => {
-    try {
-        return window.self !== window.top;
-    }
-    catch {
-        return true;
-    }
-};
-/**
- * Record that this window is the surrogate login window, while that is still knowable.
- *
- * Must run on the surrogate's **first** load, before the flow navigates to the provider:
- * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
- * context goes cross-origin — so by the time the provider redirects back, the name is gone and
- * this window would look like an ordinary tab.
- *
- * Idempotent, and a no-op in every window that is not the surrogate.
- */
-export const markSurrogate = () => {
-    if (typeof window === 'undefined' || window.name !== LOGIN_SURROGATE_NAME) {
-        return;
-    }
-    try {
-        window.sessionStorage.setItem(LOGIN_SURROGATE_MARKER, '1');
-    }
-    catch {
-        // Storage can be unavailable (private modes, blocked cookies). The `window.name` check still
-        // covers the case where nothing cross-origin happened in between.
-    }
-};
-/** Whether this document is the surrogate login window. */
-export const isSurrogate = () => {
-    if (typeof window === 'undefined') {
-        return false;
-    }
-    if (window.name === LOGIN_SURROGATE_NAME) {
-        return true;
-    }
-    try {
-        return window.sessionStorage.getItem(LOGIN_SURROGATE_MARKER) === '1';
-    }
-    catch {
-        return false;
-    }
-};
-/** Forget the surrogate marker — called once its token has been handed back. */
-export const clearSurrogate = () => {
-    if (typeof window === 'undefined') {
-        return;
-    }
-    try {
-        window.sessionStorage.removeItem(LOGIN_SURROGATE_MARKER);
-    }
-    catch { /* nothing to clean up if storage was never available */ }
-};
-/**
- * Default login environment.
- *
- * The single source of environment truth for cascade selection — a plugin's `match` reads this
- * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
- * own descriptor.
- */
-export const defaultLoginEnv = () => {
-    const hasWindow = typeof window !== 'undefined';
-    if (!hasWindow) {
-        return { hasWindow, embedded: false, surrogate: false, hasOpener: false };
-    }
-    return {
-        hasWindow,
-        embedded: isEmbedded(),
-        surrogate: isSurrogate(),
-        // `Cross-Origin-Opener-Policy: same-origin` from the provider severs this permanently, which
-        // is why it is observed rather than assumed from "we were opened by someone".
-        hasOpener: window.opener != null,
+export const createLoginEnvHelper = () => {
+    const isEmbedded = () => {
+        try {
+            return window.self !== window.top;
+        }
+        catch {
+            return true;
+        }
+    };
+    const markSurrogate = () => {
+        if (typeof window === 'undefined' || window.name !== LOGIN_SURROGATE_NAME) {
+            return;
+        }
+        try {
+            window.sessionStorage.setItem(LOGIN_SURROGATE_MARKER, '1');
+        }
+        catch {
+            // Storage can be unavailable (private modes, blocked cookies). The `window.name` check still
+            // covers the case where nothing cross-origin happened in between.
+        }
+    };
+    const isSurrogate = () => {
+        if (typeof window === 'undefined') {
+            return false;
+        }
+        if (window.name === LOGIN_SURROGATE_NAME) {
+            return true;
+        }
+        try {
+            return window.sessionStorage.getItem(LOGIN_SURROGATE_MARKER) === '1';
+        }
+        catch {
+            return false;
+        }
+    };
+    const clearSurrogate = () => {
+        if (typeof window === 'undefined') {
+            return;
+        }
+        try {
+            window.sessionStorage.removeItem(LOGIN_SURROGATE_MARKER);
+        }
+        catch { /* nothing to clean up if storage was never available */ }
+    };
+    const defaultLoginEnv = () => {
+        const hasWindow = typeof window !== 'undefined';
+        if (!hasWindow) {
+            return { hasWindow, embedded: false, surrogate: false, hasOpener: false };
+        }
+        return {
+            hasWindow,
+            embedded: isEmbedded(),
+            surrogate: isSurrogate(),
+            // `Cross-Origin-Opener-Policy: same-origin` from the provider severs this permanently, which
+            // is why it is observed rather than assumed from "we were opened by someone".
+            hasOpener: window.opener != null,
+        };
     };
+    return { isEmbedded, markSurrogate, isSurrogate, clearSurrogate, defaultLoginEnv };
 };
+export const loginEnvHelper = createLoginEnvHelper();
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.markSurrogate()` */
+export const markSurrogate = () => loginEnvHelper.markSurrogate();
+/** @deprecated compat:factory-refactor — use `loginEnvHelper.clearSurrogate()` */
+export const clearSurrogate = () => loginEnvHelper.clearSurrogate();
 //# sourceMappingURL=env.js.map

package/build/login/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAG1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,GAAY,EAAE;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1E,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,kEAAkE;IACpE,CAAC;AACH,CAAC,CAAA;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG,GAAY,EAAE;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,GAAG,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAS,EAAE;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;AACtE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAa,EAAE;IAC5C,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IAC3E,CAAC;IAED,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,UAAU,EAAE;QACtB,SAAS,EAAE,WAAW,EAAE;QACxB,6FAA6F;QAC7F,8EAA8E;QAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KACjC,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAI1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAmB,EAAE;IACvD,MAAM,UAAU,GAAG,GAAY,EAAE;QAC/B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,GAAS,EAAE;QAC/B,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1E,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,kEAAkE;QACpE,CAAC;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,GAAY,EAAE;QAChC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,GAAG,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,GAAS,EAAE;QAChC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;IACtE,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,GAAa,EAAE;QACrC,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC3E,CAAC;QAED,OAAO;YACL,SAAS;YACT,QAAQ,EAAE,UAAU,EAAE;YACtB,SAAS,EAAE,WAAW,EAAE;YACxB,6FAA6F;YAC7F,8EAA8E;YAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;SACjC,CAAA;IACH,CAAC,CAAA;IAED,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,CAAA;AACpF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;AAEpD,iFAAiF;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,CAAA;AAEvE,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAS,EAAE,CAAC,cAAc,CAAC,cAAc,EAAE,CAAA"}

package/build/login/flow.d.ts

@@ -0,0 +1,20 @@
+import type { FlowModel } from '@owlmeans/flow';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export declare const enterOidcAuthorization: (model: FlowModel) => FlowModel;
+//# sourceMappingURL=flow.d.ts.map

package/build/login/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,UAAW,SAAS,KAAG,SAsBzD,CAAA"}

package/build/login/flow.js

@@ -0,0 +1,39 @@
+import { FLOW_PLACEHOLDER, OidcAuthStep, STD_OIDC_FLOW } from '@owlmeans/flow';
+import { DEFAULT_ENTITY } from '../consts.js';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export const enterOidcAuthorization = (model) => {
+    const state = model.state();
+    if (state.flow !== STD_OIDC_FLOW || state.step !== OidcAuthStep.Dispatch) {
+        return model;
+    }
+    const target = model.step().service;
+    if (state.service == null || state.service === '') {
+        model.target(target);
+    }
+    // The entity travels to this app's own backend, which resolves its default provider by `def`
+    // alone. It still has to BE there: the init endpoint rejects a body without one.
+    if (state.entityId == null) {
+        model.entity(DEFAULT_ENTITY);
+    }
+    if (target === FLOW_PLACEHOLDER) {
+        model.transit(OidcAuthStep.Ephemeral, true);
+    }
+    return model;
+};
+//# sourceMappingURL=flow.js.map

package/build/login/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAgB,EAAa,EAAE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAA;IACnC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,6FAA6F;IAC7F,iFAAiF;IACjF,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}