@owlmeans/client-auth 0.1.18-rc.9 → 0.1.18

package/build/login/land/types.d.ts

@@ -0,0 +1,52 @@
+import type { LoginLandingParams } from '../types.js';
+/** Where a finished sign-in (or a pending step) lands. */
+export interface LoginLanding {
+    alias: string;
+    params?: LoginLandingParams;
+    query?: LoginLandingParams;
+    /** The step alias this landing came from, when it came from one. */
+    step?: string;
+}
+/** Options for {@link LoginService.landAfterLogin}-shaped helpers (./land.js). */
+export interface LandOptions {
+    /** Where to land when nothing else claims the flow. Defaults to `{ alias: HOME }`. */
+    fallback?: LoginLanding;
+    /** `false` skips `resumeSuspendedFlow` — the caller already has its own concrete destination. */
+    resume?: boolean;
+    /** Skip every step up to and including this alias — the resume point for a step's re-entry. */
+    after?: string;
+    /**
+     * Overrides the step/hook timeout for this call. Mainly for tests; production callers leave it
+     * at the default (`LOGIN_STEP_TIMEOUT`).
+     */
+    stepTimeout?: number;
+}
+/** Where one context's finished sign-in goes: its pending steps, a suspended flow, or the fallback. */
+export interface LoginLandingHelper {
+    /**
+     * Where a finished sign-in should go: the first pending step, else a suspended flow, else the
+     * fallback (ordinarily `HOME`).
+     *
+     * Re-checks `env().surrogate` even though {@link landAfterLogin} already did — this function is
+     * also called directly (e.g. from `useContinueLogin`, after the surrogate window has already
+     * closed), and the check is cheap insurance either way: **no step and no landing hook ever runs
+     * inside the surrogate popup.** It has nothing of its own to collect and nowhere to navigate —
+     * the popup's own `DispatcherHOC` has no `navigate() → HOME` at all.
+     */
+    continueLogin: (opts?: LandOptions) => Promise<LoginLanding>;
+    /**
+     * The whole post-sign-in landing decision: run any due landing hooks for a freshly seen token,
+     * then delegate to {@link continueLogin} for where the flow actually goes.
+     *
+     * This is what a plugin that just adopted a token calls in place of the old inline
+     * "`resumeSuspendedFlow` else `HOME`" — `DispatcherHOC`, the supervisor plugin and both Google
+     * plugins all replace their own copy of that logic with this one.
+     */
+    landAfterLogin: (opts?: LandOptions) => Promise<LoginLanding>;
+    /**
+     * The absolute URL a landing resolves to — the same shape the supervisor and Google plugins
+     * already build their own `window.location.href` from.
+     */
+    landingUrl: (landing: LoginLanding) => Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/land/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/land/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAErD,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,iGAAiG;IACjG,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,uGAAuG;AACvG,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC5D;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC7D;;;OAGG;IACH,UAAU,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CACvD"}

package/build/login/land/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/land/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/land/types.ts"],"names":[],"mappings":""}

package/build/login/land.d.ts

@@ -0,0 +1,6 @@
+import type { LoginContext } from './types.js';
+import type { LoginLandingHelper } from './land/types.js';
+export declare const makeLoginLandingHelper: (ctx: LoginContext) => LoginLandingHelper;
+/** The landing helper of a context — one per context. */
+export declare const loginLandingOf: (target: LoginContext) => LoginLandingHelper;
+//# sourceMappingURL=land.d.ts.map

package/build/login/land.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"land.d.ts","sourceRoot":"","sources":["../../src/login/land.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,YAAY,CAAA;AAC5D,OAAO,KAAK,EAA6B,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AA6BpF,eAAO,MAAM,sBAAsB,QAAS,YAAY,KAAG,kBA4G1D,CAAA;AAED,yDAAyD;AACzD,eAAO,MAAM,cAAc,8CAA6C,CAAA"}

package/build/login/land.js

@@ -0,0 +1,122 @@
+import { DISPATCHER } from '@owlmeans/auth';
+import { HOME, memoHelper } from '@owlmeans/context';
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js';
+import { ensureLoginService } from './service.js';
+import { LOGIN_LANDED_STORAGE, LOGIN_STEP_TIMEOUT } from './consts.js';
+import { flowLandingOf } from '@owlmeans/client-flow';
+/**
+ * Race a promise against a bound, resolving to `onTimeout` (never rejecting) if the bound wins.
+ *
+ * A synchronous throw from the wrapped call is turned into a rejection by the caller before this
+ * ever sees it, so the only two outcomes here are "settled in time" and "timed out". `onTimeout`
+ * defaults to `undefined` — every existing caller that omits it keeps its old fail-open meaning;
+ * `continueLogin` passes a step's own `required` flag through it so a step that hangs is read the
+ * same way as one that throws.
+ */
+const withTimeout = async (promise, ms, onTimeout) => {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise(resolve => { timer = setTimeout(() => resolve(onTimeout), ms); }),
+        ]);
+    }
+    finally {
+        if (timer != null) {
+            clearTimeout(timer);
+        }
+    }
+};
+export const makeLoginLandingHelper = (ctx) => {
+    /**
+     * Run every registered landing hook, once per distinct token.
+     *
+     * The stored token is overwritten BEFORE the hooks run, not after: a hook that throws or hangs
+     * must never make the same token re-run the whole set on the next call, since surviving exactly
+     * that is what the bound-and-swallow contract is for. The raw token string is the marker rather
+     * than a digest of it — it never leaves the browser, and this package already keeps the terms
+     * acceptance marker the same way (`LOGIN_TERMS_STORAGE`).
+     */
+    const runLandingHooks = async (login, timeout) => {
+        const auth = ctx.service(AUTH_ALIAS);
+        const token = await auth.authenticated();
+        if (token == null) {
+            return;
+        }
+        let last = null;
+        try {
+            last = window.localStorage.getItem(LOGIN_LANDED_STORAGE);
+        }
+        catch {
+            // Storage can be unavailable (private modes, blocked cookies). Treated as "never landed",
+            // which just re-runs the hooks — the safe direction, same as the terms-acceptance marker.
+        }
+        if (last === token) {
+            return;
+        }
+        try {
+            window.localStorage.setItem(LOGIN_LANDED_STORAGE, token);
+        }
+        catch { /* nothing to remember if storage was never available */ }
+        for (const hook of login.landingHooks()) {
+            await withTimeout(Promise.resolve().then(() => hook.landed(ctx)), timeout).catch(() => undefined);
+        }
+    };
+    const continueLogin = async (opts) => {
+        const login = ensureLoginService(ctx);
+        if (login.env().surrogate) {
+            return { alias: DISPATCHER };
+        }
+        const timeout = opts?.stepTimeout ?? LOGIN_STEP_TIMEOUT;
+        const auth = ctx.service(AUTH_ALIAS);
+        const token = await auth.authenticated();
+        if (token != null) {
+            const steps = login.steps();
+            let start = 0;
+            if (opts?.after != null) {
+                const index = steps.findIndex(step => step.alias === opts.after);
+                if (index >= 0) {
+                    start = index + 1;
+                }
+            }
+            for (let i = start; i < steps.length; i++) {
+                const step = steps[i];
+                // Registration proves only that some module reached the bundle — the step's own screen may
+                // not be bound in this tree (an older target, a partial import). Skipped, never thrown.
+                if (!ctx.hasEntrypoint(step.entrypoint)) {
+                    continue;
+                }
+                // A step that throws or hangs fails OPEN ("not pending") by default — UNLESS it declared
+                // itself `required`, in which case a broken read must show the step rather than let the
+                // person through it unconfirmed (a Terms box moved here from the sign-in screen).
+                const onBroken = step.required === true;
+                const pending = await withTimeout(Promise.resolve().then(() => step.pending(ctx)), timeout, onBroken).catch(() => onBroken);
+                if (pending === true) {
+                    return { alias: step.entrypoint, query: await step.query?.(ctx), step: step.alias };
+                }
+            }
+        }
+        if (opts?.resume !== false) {
+            const landing = await flowLandingOf(ctx).resumeSuspendedFlow();
+            if (landing != null) {
+                return { alias: landing.entrypoint, query: landing.query };
+            }
+        }
+        return opts?.fallback ?? { alias: HOME };
+    };
+    const landAfterLogin = async (opts) => {
+        const login = ensureLoginService(ctx);
+        // Never run a step or a landing hook while THIS document is the surrogate popup — see the note
+        // on `continueLogin`.
+        if (login.env().surrogate) {
+            return { alias: DISPATCHER };
+        }
+        await runLandingHooks(login, opts?.stepTimeout ?? LOGIN_STEP_TIMEOUT);
+        return continueLogin(opts);
+    };
+    const landingUrl = async (landing) => await ctx.entrypoint(landing.alias).url({ params: landing.params, query: landing.query }, { absolute: true });
+    return { continueLogin, landAfterLogin, landingUrl };
+};
+/** The landing helper of a context — one per context. */
+export const loginLandingOf = memoHelper.oncePer(makeLoginLandingHelper);
+//# sourceMappingURL=land.js.map

package/build/login/land.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"land.js","sourceRoot":"","sources":["../../src/login/land.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGjD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,KAAK,EACvB,OAAmB,EAAE,EAAU,EAAE,SAAa,EACtB,EAAE;IAC1B,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAgB;YACvC,OAAO;YACP,IAAI,OAAO,CAAgB,OAAO,CAAC,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;SAC5F,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAiB,EAAsB,EAAE;IAC9E;;;;;;;;OAQG;IACH,MAAM,eAAe,GAAG,KAAK,EAAE,KAAmB,EAAE,OAAe,EAAiB,EAAE;QACpF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;QACxC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,OAAM;QACR,CAAC;QAED,IAAI,IAAI,GAAkB,IAAI,CAAA;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,0FAA0F;QAC5F,CAAC;QACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;QAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC;YACxC,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACnG,CAAC;IACH,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,KAAK,EAAE,IAAkB,EAAyB,EAAE;QACxE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;QAC9B,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,IAAI,kBAAkB,CAAA;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;QAExC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;YAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChE,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBACf,KAAK,GAAG,KAAK,GAAG,CAAC,CAAA;gBACnB,CAAC;YACH,CAAC;YAED,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBACrB,2FAA2F;gBAC3F,wFAAwF;gBACxF,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxC,SAAQ;gBACV,CAAC;gBAED,yFAAyF;gBACzF,wFAAwF;gBACxF,kFAAkF;gBAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAA;gBACvC,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CACnE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;gBAEvB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAA;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAA+B,CAAC,CAAC,mBAAmB,EAAE,CAAA;YAC1F,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,QAAQ,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,IAAkB,EAAyB,EAAE;QACzE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,+FAA+F;QAC/F,sBAAsB;QACtB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;QAC9B,CAAC;QAED,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,IAAI,kBAAkB,CAAC,CAAA;QAErE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,OAAqB,EAAmB,EAAE,CAClE,MAAM,GAAG,CAAC,UAAU,CAA2B,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAC/D,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CACrE,CAAA;IAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAA;AACtD,CAAC,CAAA;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA"}

package/build/login/methods/types.d.ts

@@ -0,0 +1,30 @@
+import type { LoginScreenConfig } from '@owlmeans/config';
+import type { LoginMethod, LoginMethodContext, LoginMethodSource } from '../types.js';
+/** The sign-in methods on offer: the global source registry and the resolution of a screen's list. */
+export interface LoginMethodsHelper {
+    /** Register a source globally — replacing an earlier one of the same alias. */
+    registerMethodSource: (source: LoginMethodSource) => void;
+    /** The globally registered sources, in registration order. */
+    listMethodSources: () => LoginMethodSource[];
+    /**
+     * Everything the current environment may be offered, in the order it should be offered in.
+     *
+     * Resolution order matters and is not arbitrary:
+     *
+     * 1. Sources produce candidates. A source that throws is skipped rather than taking the screen
+     *    down — a misconfigured provider list must not remove the sign-in method that does work.
+     * 2. `restricted` candidates are dropped unless the configuration named them, which is what makes
+     *    an operator login opt-in rather than merely unadvertised.
+     * 3. An explicit `methods` list is both a filter AND the order, because an app that bothered to
+     *    list them means that list.
+     */
+    resolveLoginMethods: (ctx: LoginMethodContext, cfg?: LoginScreenConfig, extra?: LoginMethodSource[]) => LoginMethod[];
+    /**
+     * The method a screen highlights and focuses.
+     *
+     * The first `primary` one, else the first offered. It is highlighted, never started: requirement
+     * one of this whole feature is that nothing leaves the document without a click.
+     */
+    primaryLoginMethod: (methods: LoginMethod[]) => LoginMethod | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/methods/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/methods/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAErF,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,oBAAoB,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAA;IACzD,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,iBAAiB,EAAE,CAAA;IAC5C;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,CACnB,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,iBAAiB,EAAE,KAC1E,WAAW,EAAE,CAAA;IAClB;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,GAAG,IAAI,CAAA;CACnE"}

package/build/login/methods/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/methods/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/methods/types.ts"],"names":[],"mappings":""}

package/build/login/methods.d.ts

@@ -0,0 +1,7 @@
+import type { LoginMethod } from './types.js';
+import type { LoginMethodsHelper } from './methods/types.js';
+export declare const createLoginMethodsHelper: () => LoginMethodsHelper;
+export declare const loginMethodsHelper: LoginMethodsHelper;
+/** @deprecated compat:factory-refactor — use `loginMethodsHelper.primaryLoginMethod(…)` */
+export declare const primaryLoginMethod: (methods: LoginMethod[]) => LoginMethod | null;
+//# sourceMappingURL=methods.d.ts.map

package/build/login/methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../../src/login/methods.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAyC,MAAM,YAAY,CAAA;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAmB5D,eAAO,MAAM,wBAAwB,QAAO,kBAgF3C,CAAA;AAED,eAAO,MAAM,kBAAkB,oBAA6B,CAAA;AAE5D,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,YAAa,WAAW,EAAE,KAAG,WAAW,GAAG,IAC1B,CAAA"}

package/build/login/methods.js

@@ -0,0 +1,87 @@
+import { DEFAULT_METHOD_ORDER } from './consts.js';
+import { logger } from '@owlmeans/log';
+const log = logger('client-auth:login');
+/**
+ * The module-global registry of method SOURCES.
+ *
+ * A source, rather than a method, because the two things that offer sign-in methods answer
+ * different questions at different times: the plugin registry knows what code is loaded, and the
+ * OIDC configuration knows what an entity is federated with. Both are answered per render — a
+ * provider list can arrive from the api-config middleware after the first paint.
+ *
+ * Global, like the `AuthenticationPlugin` map it mirrors, because a package registers its source
+ * from a side-effect import that has no context to hang it on. A context-scoped registry exists
+ * alongside it on the login service, and both are merged by `resolveLoginMethods`.
+ */
+const sources = [];
+export const createLoginMethodsHelper = () => {
+    const registerMethodSource = (source) => {
+        const existing = sources.findIndex(candidate => candidate.alias === source.alias);
+        if (existing >= 0) {
+            sources.splice(existing, 1);
+        }
+        sources.push(source);
+    };
+    const listMethodSources = () => [...sources];
+    /** Normalize a config entry, which may be a bare id or a full override object. */
+    const asConfig = (entry) => typeof entry === 'string' ? { id: entry } : entry;
+    const merge = (method, override) => override == null ? method : {
+        ...method,
+        ...(override.label != null ? { label: override.label } : {}),
+        ...(override.i18nKey != null ? { i18nKey: override.i18nKey } : {}),
+        ...(override.icon != null ? { icon: override.icon } : {}),
+        ...(override.order != null ? { order: override.order } : {}),
+        ...(override.emphasis != null ? { emphasis: override.emphasis } : {}),
+        ...(override.params != null ? { params: { ...method.params, ...override.params } } : {}),
+    };
+    const resolveLoginMethods = (ctx, cfg, extra = []) => {
+        const candidates = [];
+        for (const source of [...sources, ...extra]) {
+            try {
+                candidates.push(...source.list(ctx));
+            }
+            catch (e) {
+                log.warn('Login method source failed', { source: source.alias, error: e });
+            }
+        }
+        const overrides = cfg?.overrides ?? {};
+        const listed = cfg?.methods?.map(asConfig);
+        const listedIds = listed?.map(entry => entry.id).filter((id) => id != null);
+        const offered = candidates
+            .filter(method => {
+            const override = overrides[method.id] ?? listed?.find(entry => entry.id === method.id);
+            if (override?.enabled === false || override?.hidden === true) {
+                return false;
+            }
+            // A restricted method is offered only where the configuration asked for it — by naming it in
+            // `methods`, or by enabling it in `overrides`. Registering the plugin is deliberately not
+            // enough: an operator login that appears wherever its code happens to be bundled is an
+            // operator login in production.
+            if (method.restricted === true
+                && listedIds?.includes(method.id) !== true
+                && override?.enabled !== true) {
+                return false;
+            }
+            return true;
+        })
+            .map(method => merge(method, overrides[method.id]));
+        if (listedIds != null) {
+            return listedIds
+                .map(id => {
+                const method = offered.find(candidate => candidate.id === id);
+                return method != null ? merge(method, listed?.find(entry => entry.id === id)) : null;
+            })
+                .filter((method) => method != null);
+        }
+        return offered.sort((a, b) => {
+            const order = (a.order ?? DEFAULT_METHOD_ORDER) - (b.order ?? DEFAULT_METHOD_ORDER);
+            return order !== 0 ? order : a.id.localeCompare(b.id);
+        });
+    };
+    const primaryLoginMethod = (methods) => methods.find(method => method.emphasis === 'primary') ?? methods[0] ?? null;
+    return { registerMethodSource, listMethodSources, resolveLoginMethods, primaryLoginMethod };
+};
+export const loginMethodsHelper = createLoginMethodsHelper();
+/** @deprecated compat:factory-refactor — use `loginMethodsHelper.primaryLoginMethod(…)` */
+export const primaryLoginMethod = (methods) => loginMethodsHelper.primaryLoginMethod(methods);
+//# sourceMappingURL=methods.js.map

package/build/login/methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.js","sourceRoot":"","sources":["../../src/login/methods.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAGlD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAA;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAwB,EAAE,CAAA;AAEvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAuB,EAAE;IAC/D,MAAM,oBAAoB,GAAG,CAAC,MAAyB,EAAQ,EAAE;QAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;QACjF,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC7B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,CAAA;IAED,MAAM,iBAAiB,GAAG,GAAwB,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAA;IAEjE,kFAAkF;IAClF,MAAM,QAAQ,GAAG,CAAC,KAAiC,EAAqB,EAAE,CACxE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IAEnD,MAAM,KAAK,GAAG,CAAC,MAAmB,EAAE,QAAuC,EAAe,EAAE,CAC1F,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1B,GAAG,MAAM;QACT,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAA;IAEH,MAAM,mBAAmB,GAAG,CAC1B,GAAuB,EAAE,GAAuB,EAAE,KAAK,GAAwB,EAAE,EAClE,EAAE;QACjB,MAAM,UAAU,GAAkB,EAAE,CAAA;QACpC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAC5E,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,IAAI,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAA;QAEzF,MAAM,OAAO,GAAG,UAAU;aACvB,MAAM,CAAC,MAAM,CAAC,EAAE;YACf,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;YACtF,IAAI,QAAQ,EAAE,OAAO,KAAK,KAAK,IAAI,QAAQ,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC7D,OAAO,KAAK,CAAA;YACd,CAAC;YACD,6FAA6F;YAC7F,0FAA0F;YAC1F,uFAAuF;YACvF,gCAAgC;YAChC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;mBACzB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI;mBACvC,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAA;YACd,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC,CAAC;aACD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAErD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,SAAS;iBACb,GAAG,CAAC,EAAE,CAAC,EAAE;gBACR,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC7D,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACtF,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;QAC9D,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAA;YACnF,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACvD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,kBAAkB,GAAG,CAAC,OAAsB,EAAsB,EAAE,CACxE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IAE7E,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;AAC7F,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,EAAE,CAAA;AAE5D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAsB,EAAsB,EAAE,CAC/E,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA"}

package/build/login/resume/types.d.ts

@@ -0,0 +1,24 @@
+import type { LoginOutcome, ResumeAction } from '../consts.js';
+/** How a settled sign-in outcome is read: by a screen that stayed put, and by a resuming dispatcher. */
+export interface LoginResumeHelper {
+    /**
+     * The message key a FINISHED sign-in attempt should show, or null when it actually went somewhere.
+     *
+     * A dispatcher may treat `Passed` as "carry on with the ordinary continuation", because it has one.
+     * A screen does not: the user clicked, the document did not move, and nothing rendered — which is
+     * indistinguishable from a broken button, and is exactly how a null authorization URL used to
+     * present itself. Every outcome that leaves the user looking at the same screen therefore has to
+     * say something.
+     */
+    loginAttemptError: (outcome: LoginOutcome | null) => string | null;
+    /**
+     * The one reading of a `resume` outcome, shared by every dispatcher.
+     *
+     * Shared because three dispatchers — `web-client`, `web-oidc-rp` and `mui-oidc-rp` — have to agree
+     * on it, and the last time they each held their own copy of a decision they drifted, which is how a
+     * popup came to render the application inside itself in two packages at once. It is also the whole
+     * rule, so it is testable without a DOM.
+     */
+    resumeAction: (outcome: LoginOutcome) => ResumeAction;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/resume/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/resume/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE9D,wGAAwG;AACxG,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI,CAAA;IAClE;;;;;;;OAOG;IACH,YAAY,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,YAAY,CAAA;CACtD"}

package/build/login/resume/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/resume/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/resume/types.ts"],"names":[],"mappings":""}

package/build/login/resume.d.ts

@@ -0,0 +1,9 @@
+import { LoginOutcome, ResumeAction } from './consts.js';
+import type { LoginResumeHelper } from './resume/types.js';
+export declare const createLoginResumeHelper: () => LoginResumeHelper;
+export declare const loginResumeHelper: LoginResumeHelper;
+/** @deprecated compat:factory-refactor — use `loginResumeHelper.loginAttemptError(…)` */
+export declare const loginAttemptError: (outcome: LoginOutcome | null) => string | null;
+/** @deprecated compat:factory-refactor — use `loginResumeHelper.resumeAction(…)` */
+export declare const resumeAction: (outcome: LoginOutcome) => ResumeAction;
+//# sourceMappingURL=resume.d.ts.map

package/build/login/resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.d.ts","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,eAAO,MAAM,uBAAuB,QAAO,iBAgC1C,CAAA;AAED,eAAO,MAAM,iBAAiB,mBAA4B,CAAA;AAE1D,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,YAAa,YAAY,GAAG,IAAI,KAAG,MAAM,GAAG,IAC5B,CAAA;AAE9C,oFAAoF;AACpF,eAAO,MAAM,YAAY,YAAa,YAAY,KAAG,YAAuD,CAAA"}

package/build/login/resume.js

@@ -0,0 +1,38 @@
+import { LoginOutcome, ResumeAction } from './consts.js';
+export const createLoginResumeHelper = () => {
+    const loginAttemptError = (outcome) => {
+        switch (outcome) {
+            case LoginOutcome.Gesture:
+            case LoginOutcome.Blocked:
+                // The window never opened. That is the popup blocker, and it has its own copy.
+                return 'login.error.blocked';
+            case LoginOutcome.Failed:
+            case LoginOutcome.Passed:
+                return 'login.error.failed';
+            default:
+                // Handled, Redirected and Orphaned all did something; Orphaned reports itself elsewhere.
+                return null;
+        }
+    };
+    const resumeAction = (outcome) => {
+        switch (outcome) {
+            case LoginOutcome.Handled:
+            case LoginOutcome.Redirected:
+                return ResumeAction.Stop;
+            case LoginOutcome.Orphaned:
+            case LoginOutcome.Failed:
+            case LoginOutcome.Gesture:
+            case LoginOutcome.Blocked:
+                return ResumeAction.Render;
+            default:
+                return ResumeAction.Navigate;
+        }
+    };
+    return { loginAttemptError, resumeAction };
+};
+export const loginResumeHelper = createLoginResumeHelper();
+/** @deprecated compat:factory-refactor — use `loginResumeHelper.loginAttemptError(…)` */
+export const loginAttemptError = (outcome) => loginResumeHelper.loginAttemptError(outcome);
+/** @deprecated compat:factory-refactor — use `loginResumeHelper.resumeAction(…)` */
+export const resumeAction = (outcome) => loginResumeHelper.resumeAction(outcome);
+//# sourceMappingURL=resume.js.map

package/build/login/resume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAGxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAsB,EAAE;IAC7D,MAAM,iBAAiB,GAAG,CAAC,OAA4B,EAAiB,EAAE;QACxE,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,YAAY,CAAC,OAAO,CAAC;YAC1B,KAAK,YAAY,CAAC,OAAO;gBACvB,+EAA+E;gBAC/E,OAAO,qBAAqB,CAAA;YAC9B,KAAK,YAAY,CAAC,MAAM,CAAC;YACzB,KAAK,YAAY,CAAC,MAAM;gBACtB,OAAO,oBAAoB,CAAA;YAC7B;gBACE,yFAAyF;gBACzF,OAAO,IAAI,CAAA;QACf,CAAC;IACH,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAgB,EAAE;QAC3D,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,YAAY,CAAC,OAAO,CAAC;YAC1B,KAAK,YAAY,CAAC,UAAU;gBAC1B,OAAO,YAAY,CAAC,IAAI,CAAA;YAC1B,KAAK,YAAY,CAAC,QAAQ,CAAC;YAC3B,KAAK,YAAY,CAAC,MAAM,CAAC;YACzB,KAAK,YAAY,CAAC,OAAO,CAAC;YAC1B,KAAK,YAAY,CAAC,OAAO;gBACvB,OAAO,YAAY,CAAC,MAAM,CAAA;YAC5B;gBACE,OAAO,YAAY,CAAC,QAAQ,CAAA;QAChC,CAAC;IACH,CAAC,CAAA;IAED,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAA;AAC5C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,EAAE,CAAA;AAE1D,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA4B,EAAiB,EAAE,CAC/E,iBAAiB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAgB,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA"}

package/build/login/screen.d.ts

@@ -0,0 +1,17 @@
+import { type FC } from 'react';
+import type { LoginScreenProps } from './types.js';
+/**
+ * The sign-in screen every application gets, whether or not it registered a styled one.
+ *
+ * It exists because a relying party must render SOMETHING rather than start a flow on its own, and
+ * a relying party may not depend on a UI family. So this is deliberately plain: raw elements and
+ * inline styles, no Tailwind class that a consumer's stylesheet would have to scan for, no shadcn
+ * primitive a consumer would have to vendor. An application that registers a real screen through
+ * `login().registerScreen(...)` never sees it.
+ *
+ * Because it is the floor rather than the design, it still has to be correct: it offers the same
+ * methods, enforces the same terms confirmation, centres the same way, and renders the same
+ * credit line.
+ */
+export declare const FallbackLoginScreen: FC<LoginScreenProps>;
+//# sourceMappingURL=screen.d.ts.map

package/build/login/screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":"AAAA,OAAO,EAA6C,KAAK,EAAE,EAAkB,MAAM,OAAO,CAAA;AAG1F,OAAO,KAAK,EAA6B,gBAAgB,EAAgB,MAAM,YAAY,CAAA;AAoB3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,EAAE,EAAE,CAAC,gBAAgB,CAuGpD,CAAA"}

package/build/login/screen.js

@@ -0,0 +1,66 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useState } from 'react';
+import { useContext } from '@owlmeans/client';
+import { LOGIN_SERVICE } from './consts.js';
+import { loginMethodsHelper } from './methods.js';
+import { loginTermsHelper } from './terms.js';
+import { resolveCredit } from './credit.js';
+import { box, page } from './consts.local.js';
+const renderParts = (parts) => parts.map((part, index) => part.href != null
+    ? _jsx("a", { href: part.href, target: "_blank", rel: "noreferrer noopener", children: part.text }, index)
+    : _jsx("span", { children: part.text }, index));
+const button = (emphasis) => ({
+    display: 'block', width: '100%', marginTop: '.5rem', padding: '.625rem 1rem',
+    fontSize: '1rem', cursor: 'pointer', borderRadius: '.375rem',
+    border: '1px solid currentColor',
+    ...(emphasis === 'primary' ? { fontWeight: 600 } : {}),
+});
+/**
+ * The sign-in screen every application gets, whether or not it registered a styled one.
+ *
+ * It exists because a relying party must render SOMETHING rather than start a flow on its own, and
+ * a relying party may not depend on a UI family. So this is deliberately plain: raw elements and
+ * inline styles, no Tailwind class that a consumer's stylesheet would have to scan for, no shadcn
+ * primitive a consumer would have to vendor. An application that registers a real screen through
+ * `login().registerScreen(...)` never sees it.
+ *
+ * Because it is the floor rather than the design, it still has to be correct: it offers the same
+ * methods, enforces the same terms confirmation, centres the same way, and renders the same
+ * credit line.
+ */
+export const FallbackLoginScreen = props => {
+    const context = useContext();
+    const t = props.translate ?? ((_key, defaultValue) => defaultValue);
+    const cfg = props.config ?? context.cfg.security?.auth?.login;
+    const brand = context.cfg.brand;
+    const login = context.service(LOGIN_SERVICE);
+    const env = login.env();
+    const resolved = loginTermsHelper.resolveTerms(props.terms ?? cfg?.terms);
+    const credit = resolveCredit(cfg?.credit, brand, context.cfg.service);
+    const resolveLabel = loginTermsHelper.termsLabelResolver(t, props.locale);
+    const deferred = loginTermsHelper.termsDeferred(context);
+    const [accepted, setAccepted] = useState(() => loginTermsHelper.termsAccepted(resolved));
+    const [attempted, setAttempted] = useState(false);
+    const all = login.methods({ context, env });
+    const methods = typeof props.methods === 'function'
+        ? props.methods(all)
+        : props.methods ?? all;
+    const primary = loginMethodsHelper.primaryLoginMethod(methods);
+    const blocked = resolved != null && resolved.required && !deferred && !accepted;
+    const select = useCallback((method) => {
+        if (blocked) {
+            setAttempted(true);
+            return;
+        }
+        void method.start({ context, env });
+    }, [blocked, context, env]);
+    const onAccept = useCallback((value) => {
+        setAccepted(value);
+        setAttempted(false);
+        loginTermsHelper.acceptTerms(resolved, value);
+    }, [resolved]);
+    return _jsx("div", { "data-login-screen": true, style: page, children: _jsxs("div", { style: box, children: [_jsx("h1", { style: { fontSize: '1.25rem', marginBottom: '.25rem' }, children: props.title ?? t('login.title', 'Sign in') }), _jsx("p", { style: { opacity: .75, marginTop: 0 }, children: props.subtitle ?? t('login.subtitle', 'Choose how you would like to continue.') }), methods.length < 1
+                    ? _jsx("p", { role: "status", children: t('login.empty', 'No sign-in method is configured for this application.') })
+                    : methods.map(method => _jsx("button", { type: "button", "data-login-method": method.id, "aria-disabled": blocked, "data-blocked": blocked ? 'true' : undefined, style: { ...button(method.emphasis), opacity: blocked ? .6 : 1 }, autoFocus: method.id === primary?.id, onClick: () => select(method), children: method.label ?? t(`login.method.${method.i18nKey ?? method.id}`, method.id) }, method.id)), resolved != null && !deferred && _jsx("p", { style: { marginTop: '1rem', fontSize: '.875rem' }, children: _jsxs("label", { children: [_jsx("input", { type: "checkbox", checked: accepted, "data-login-terms": true, onChange: event => onAccept(event.target.checked) }), ' ', renderParts(loginTermsHelper.termsSentence(t('login.terms.accept', 'I have read and agree to the {{documents}}.'), resolved, props.locale, resolveLabel))] }) }), resolved?.revisedAt != null && !deferred && _jsx("p", { "data-login-revised": true, style: { fontSize: '.75rem', opacity: .7 }, children: t('login.terms.revised', 'Last updated: {{date}}').split('{{date}}').join(resolved.revisedAt) }), resolved != null && _jsx("p", { "data-login-privacy": true, style: { fontSize: '.875rem' }, children: renderParts(loginTermsHelper.termsSentence(t('login.terms.notice', 'How we handle your personal data: {{notices}}.'), resolved, props.locale, resolveLabel)) }), attempted && blocked && resolved != null && _jsx("p", { role: "alert", style: { color: '#b00', fontSize: '.875rem' }, children: renderParts(loginTermsHelper.termsSentence(t('login.terms.required', 'Please confirm the {{documents}} to continue.'), resolved, props.locale, resolveLabel)) }), props.footer ?? _jsxs("p", { style: { marginTop: '2rem', fontSize: '.75rem', opacity: .7 }, children: [credit.poweredBy && _jsx("span", { children: t('login.credit.powered', 'Powered by OwlMeans') }), credit.poweredBy && credit.line != null && ' · ', credit.line] })] }) });
+};
+//# sourceMappingURL=screen.js.map

package/build/login/screen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAA+C,MAAM,OAAO,CAAA;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAI7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAE7C,MAAM,WAAW,GAAG,CAAC,KAA0B,EAAa,EAAE,CAC5D,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;IAC1C,CAAC,CAAC,YAAe,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAC,QAAQ,EAAC,GAAG,EAAC,qBAAqB,YAAE,IAAI,CAAC,IAAI,IAA5E,KAAK,CAA4E;IAC3F,CAAC,CAAC,yBAAmB,IAAI,CAAC,IAAI,IAAjB,KAAK,CAAoB,CAAC,CAAA;AAE3C,MAAM,MAAM,GAAG,CAAC,QAAiB,EAAiB,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc;IAC5E,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS;IAC5D,MAAM,EAAE,wBAAwB;IAChC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACvD,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAyB,KAAK,CAAC,EAAE;IAC/D,MAAM,OAAO,GAAG,UAAU,EAA6B,CAAA;IACvD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,IAAY,EAAE,YAAoB,EAAE,EAAE,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAK,OAAO,CAAC,GAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAA;IAC/E,MAAM,KAAK,GAAI,OAAO,CAAC,GAAoB,CAAC,KAAK,CAAA;IAEjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC,CAAA;IACzE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,YAAY,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IAExD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEjD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU;QACjD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,CAAA;IACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAE9D,MAAM,OAAO,GAAG,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAA;IAE/E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,MAAmB,EAAE,EAAE;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,IAAI,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;IACrC,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IAE3B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9C,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,gBAAgB,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO,yCAAuB,KAAK,EAAE,IAAI,YAAE,eAAK,KAAK,EAAE,GAAG,aACxD,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,YACvD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,GACxC,EACL,YAAG,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,YACrC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,GAC9E,EAEH,OAAO,CAAC,MAAM,GAAG,CAAC;oBACjB,CAAC,CAAC,YAAG,IAAI,EAAC,QAAQ,YAAE,CAAC,CAAC,aAAa,EAAE,uDAAuD,CAAC,GAAK;oBAClG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,iBACN,IAAI,EAAC,QAAQ,uBAAoB,MAAM,CAAC,EAAE,mBAG3C,OAAO,kBAAgB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAClE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAChE,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,OAAO,EAAE,EAAE,EACpC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAE5B,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,IARvE,MAAM,CAAC,EAAE,CASP,CAAC,EAMX,QAAQ,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,YAAG,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAEpF,4BACE,gBACE,IAAI,EAAC,UAAU,EAAC,OAAO,EAAE,QAAQ,4BACjC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GACjD,EAAC,GAAG,EACL,WAAW,CAAC,gBAAgB,CAAC,aAAa,CACzC,CAAC,CAAC,oBAAoB,EAAE,6CAA6C,CAAC,EACtE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,CACrC,CAAC,IACI,GACN,EAEH,QAAQ,EAAE,SAAS,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,wCAAsB,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,YAC1G,CAAC,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAC5F,EAGH,QAAQ,IAAI,IAAI,IAAI,wCAAsB,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,YACtE,WAAW,CAAC,gBAAgB,CAAC,aAAa,CACzC,CAAC,CAAC,oBAAoB,EAAE,gDAAgD,CAAC,EACzE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,CACrC,CAAC,GACA,EAEH,SAAS,IAAI,OAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,YAAG,IAAI,EAAC,OAAO,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YACvG,WAAW,CAAC,gBAAgB,CAAC,aAAa,CACzC,CAAC,CAAC,sBAAsB,EAAE,+CAA+C,CAAC,EAC1E,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,CACrC,CAAC,GACA,EAEH,KAAK,CAAC,MAAM,IAAI,aAAG,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,aAC9E,MAAM,CAAC,SAAS,IAAI,yBAAO,CAAC,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,GAAQ,EACnF,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,EAChD,MAAM,CAAC,IAAI,IACV,IACA,GAAM,CAAA;AACd,CAAC,CAAA"}

package/build/login/service.d.ts

@@ -1,5 +1,5 @@
-import type { BasicConfig, BasicContext } from '@owlmeans/context';
-import { LoginOutcome } from './types.js';
+import { type BasicConfig, type BasicContext } from '@owlmeans/context';
+import { LoginOutcome } from './consts.js';
 import type { LoginService, LoginServiceAppend } from './types.js';
 /**
  * Login service = plugin host. It holds a registry of login plugins and, on every facade call,
@@ -14,9 +14,10 @@ import type { LoginService, LoginServiceAppend } from './types.js';
  * stage. `context.service()` throws for an uninitialized non-lazy service, which would make
  * `ensureLoginService` fail exactly where apps are told to call it.
  *
- * `begin` is deliberately NOT `async`. An async facade method defers the plugin's body past a
- * microtask boundary, and a `window.open` that lands after the user gesture has finished being
- * handled is eaten by the popup blocker. The same rule binds every plugin's own `begin`.
+ * `begin` and `logout` are deliberately NOT `async`. An async facade method defers the plugin's
+ * body past a microtask boundary, and a `window.open` that lands after the user gesture has
+ * finished being handled is eaten by the popup blocker. The same rule binds every plugin's own
+ * `begin` and `logout`, and it is why a precondition must be synchronous too.
  */
 export declare const makeLoginService: (alias?: string) => LoginService;
 /**

package/build/login/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIlE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,KAAK,EAA6B,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAE7F;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB,WAAW,MAAM,KAAmB,YAuDhE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAS,YAAY,CAAC,GAAG,CAAC,KAAG,YAQ3D,CAAA;AAED,4DAA4D;AAC5D,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,OACrE,CAAC,KACL,CAAC,GAAG,kBAMN,CAAA;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAK1F,OAAO,EAAmC,YAAY,EAAE,MAAM,aAAa,CAAA;AAK3E,OAAO,KAAK,EAE0B,YAAY,EAAE,kBAAkB,EACrE,MAAM,YAAY,CAAA;AAInB;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,WAAW,MAAM,KAAmB,YAgNhE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAS,YAAY,CAAC,GAAG,CAAC,KAAG,YAQ3D,CAAA;AAED,4DAA4D;AAC5D,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,OACrE,CAAC,KACL,CAAC,GAAG,kBAMN,CAAA;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}