@owlmeans/client-panel 0.1.18-rc.57 → 0.1.18-rc.59

package/README.md

@@ -16,7 +16,7 @@ headless navigation model.
 ## Installation
 
 ```bash
-bun add @owlmeans/client-panel@^0.1.18-rc.57
+bun add @owlmeans/client-panel@^0.1.18-rc.59
 ```
 
 ## Usage
@@ -130,12 +130,12 @@ Returns `sections` (with `hidden` filtered out), `current` (the active screen's
   keyboard-operable, openable in a new tab). It returns `undefined` for a path carrying route
   parameters.
 
-### `resolveNavLabel(translate, label, key, alias)`
+### `navLabelHelper.resolveNavLabel(translate, label, key, alias)`
 
 Resolves a label as literal `label` → `translate(key, defaultNavLabel(alias))` → the humanized
-alias. `translate` always reaches a component as a **prop**, defaulting to `defaultNavTranslate`
+alias. `translate` always reaches a component as a **prop**, defaulting to `navLabelHelper.defaultNavTranslate`
 (which returns the fallback) — a menu must never read an i18n context implicitly, because an app
-mounted without an i18n provider throws inside render and blanks the page. `defaultNavLabel`
+mounted without an i18n provider throws inside render and blanks the page. `navLabelHelper.defaultNavLabel`
 humanizes the last alias segment
 (`my-app:web:user-list` → `User list`). Default key families are `nav.<section>` and
 `modules.<alias>`.
@@ -153,7 +153,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.48
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/client-panel",
-  "version": "0.1.18-rc.57",
-  "generatedAt": "2026-10-05T08:32:19.132Z",
+  "version": "0.1.18-rc.59",
+  "generatedAt": "2026-10-06T11:45:57.680Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-panel/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-panel
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-panel": "^0.1.18-rc.57"` in `dependencies`
+**Install:** `"@owlmeans/client-panel": "^0.1.18-rc.59"` in `dependencies`
 
 ## Key Exports
 
@@ -34,15 +34,17 @@ controller; apps may override it through their own `buttons` resource.
 | `usePanelLayout()` / `useLayoutTitle(name?, alias?)` / `prepareLayoutTitle(title)` | The entrypoint the current layout is rendering, and its translated title |
 | `BlockScaling` | `Full` / `Half` / `Wide` — the sizing vocabulary both platform families render |
 | `usePanelNav(config)` | Headless navigation model behind a two-layer menu |
-| `resolveNavLabel`, `defaultNavLabel`, `defaultNavTranslate` | Label resolution helpers |
+| `navLabelHelper` → `.resolveNavLabel`, `.defaultNavLabel`, `.defaultNavTranslate` | Label resolution helpers |
 | `PanelNavConfig`, `PanelNavSection`, `PanelNavItem`, `PanelNavLink`, `PanelNavModel`, `NavTranslate` | Navigation types |
 | `FormProps`, `FormRef`, `FormOnSubmit`, `TFormContext`, `FormFieldProps`, `FormActionProps`, `FormActionRenderArgs`, `InputControllerProps`, `TPanelContext`, `StatusOptions` | The model shapes a renderer is written against |
 
 ## Subpath Exports
 
-- `./auth` — `useLoginMethods` and the login model types (`LoginMethodsModel`, `LoginTermsModel`,
-  `LoginCreditModel`, `UseLoginMethodsOptions`). Importing it also registers this package's own
-  seven-language `client-panel-auth` bundle by side effect.
+- `./auth` — `useLoginMethods`, `loginProviderHelper` and the login model types
+  (`LoginMethodsModel`, `LoginTermsModel`, `LoginCreditModel`, `LoginProviderConfig`,
+  `LoginProviderModel`, `LoginProviderPlacement`, `UseLoginMethodsOptions`). Importing it also
+  registers this package's own seven-language `client-panel-auth` bundle and the
+  `LoginScreenConfig.provider` augmentation of `@owlmeans/config` by side effect.
 - `./auth/plugins` — the shapes an auth UI plugin is written against: `Ed22519BasicAuthUIPluginForm`
   and its `Ed22519BasicAuthUIPluginFormSchema`.
 
@@ -55,13 +57,37 @@ same split the form and navigation models already use. See `login-methods`.
 `@owlmeans/client-auth/login`) rather than a flat `urls: { terms, privacy, cookies? }` — that field
 is gone; nothing in the repo read it outside this model and its one renderer, so it was dropped
 rather than kept alongside the replacement. It also carries `revisedAt?` and `version`. A renderer
-turns `documents`/`notices` into markup with `termsSentence` (`@owlmeans/client-auth/login`), never
-by re-deriving link/label pairs itself.
-
-`LoginTermsModel.deferred` mirrors `termsDeferred(ctx)`: true once a registered, bound `LoginStep`
-confirms the terms instead of this screen. `LoginMethodsModel.blocked` folds it in
-(`required && !deferred && !accepted`) — a renderer never blocks on `required`/`accepted` alone,
-or it would re-block a screen whose confirmation moved elsewhere.
+turns `documents`/`notices` into markup with `loginTermsHelper.termsSentence`
+(`@owlmeans/client-auth/login`), never by re-deriving link/label pairs itself.
+
+`LoginTermsModel.deferred` mirrors `loginTermsHelper.termsDeferred(ctx)`: true once a registered,
+bound `LoginStep` confirms the terms instead of this screen. `LoginMethodsModel.blocked` folds it in
+(`required && !deferred && !accepted`) — a renderer never blocks on `required`/`accepted` alone, or
+it would re-block a screen whose confirmation moved elsewhere.
+
+### The provider disclosure — `LoginMethodsModel.provider`
+
+A sign-in screen that a third party runs for an application (a generated target signing people in
+through the platform's IAM) names both parties: who signs the person in, and on behalf of which
+product. The rules live here, headless, so every renderer discloses the same thing:
+
+- **Config** — `cfg.security.auth.login.provider?: LoginProviderConfig`
+  (`{ name, operator?, info?, placement?: 'top' | 'inline' }`), declared onto `@owlmeans/config`'s
+  `LoginScreenConfig` by module augmentation in `auth/login/provider-config.ts` (the
+  `client-auth/login/terms-config.ts` pattern), never by editing `@owlmeans/config`. The `./auth`
+  barrel re-exports it, so any import of `@owlmeans/client-panel/auth` loads the field; a program
+  that builds the literal without one adds `import type {} from '@owlmeans/client-panel/auth'`.
+- **Model** — `loginProviderHelper.resolve(cfg, brand)` → `LoginProviderModel { name, operator,
+  product, info: string | null, placement }` or `null`. Null unless the provider `name` AND the
+  product (`cfg.brand.name`) are set — a relationship with one party missing is never shown. Blank
+  strings are unset (build-time env arrives as `''`); `operator` defaults to `name`; `placement` to
+  `'inline'` (anything but `'top'` is inline); `info` survives only as an absolute `http(s)` URL or
+  a root-relative path (`//host` and `/\` are refused). `useLoginMethods().provider` carries it.
+- **Copy** — `loginProviderHelper.fill(template, model)` puts `{{provider}}`, `{{operator}}` and
+  `{{product}}` into an ALREADY-TRANSLATED sentence in one pass; names never travel as i18next
+  params. The keys (`login.provider.*`) and the markup belong to `web-panel`.
+- The disclosure is independent of the credit line: `credit.poweredBy: false` never hides who
+  signs a person in.
 
 ## Usage
 
@@ -122,13 +148,14 @@ alias, or null), `active` (its section), `showSide`, `isSectionActive` / `isItem
 - **`showSide` owns the one-screen rule.** It is false when the active section holds a single
   screen — a second level offering the page you are already on is noise. A renderer asks the model;
   it does not count items itself.
-- **Label resolution never touches i18n implicitly.** `NavTranslate` is a `(key, defaultValue) =>
-  string` **prop**, defaulting to `defaultNavTranslate`, which returns the fallback. An app mounted
-  without an i18n provider (`renderApp` from `@owlmeans/web-client` mounts none) crashes if a menu
-  reaches for the panel i18n context: the hook dereferences `i18n.options` on the empty object
-  `react-i18next` returns without an instance, and a throw inside render blanks the whole app.
-  `resolveNavLabel(translate, label, key, alias)` applies the order — literal `label` →
-  `translate(key, humanized)` → `defaultNavLabel(alias)`, which humanizes the last alias segment
+- **Label resolution never touches i18n implicitly.** `NavTranslate` is a
+  `(key, defaultValue) => string` **prop**, defaulting to `navLabelHelper.defaultNavTranslate`,
+  which returns the fallback. An app mounted without an i18n provider (`renderApp` from
+  `@owlmeans/web-client` mounts none) crashes if a menu reaches for the panel i18n context: the hook
+  dereferences `i18n.options` on the empty object `react-i18next` returns without an instance, and a
+  throw inside render blanks the whole app.
+  `navLabelHelper.resolveNavLabel(translate, label, key, alias)` applies the order — literal `label`
+  → `translate(key, humanized)` → `.defaultNavLabel(alias)`, which humanizes the last alias segment
   (`my-app:web:user-list` → `User list`). Default key families: `nav.<name>` for sections,
   `modules.<alias>` for items and footer links.
 - **Resolving the current screen needs two sources.** The router's `location.state.alias` is

package/build/auth/i18n.js

@@ -1,4 +1,4 @@
-import { addI18nLib } from '@owlmeans/i18n';
+import { i18nHelper } from '@owlmeans/i18n';
 import en from './i18n/en.json' with { type: 'json' };
 import pl from './i18n/pl.json' with { type: 'json' };
 import ru from './i18n/ru.json' with { type: 'json' };
@@ -7,12 +7,12 @@ import uk from './i18n/uk.json' with { type: 'json' };
 import es from './i18n/es.json' with { type: 'json' };
 import de from './i18n/de.json' with { type: 'json' };
 import fr from './i18n/fr.json' with { type: 'json' };
-addI18nLib('en', 'client-panel-auth', en);
-addI18nLib('pl', 'client-panel-auth', pl);
-addI18nLib('ru', 'client-panel-auth', ru);
-addI18nLib('be', 'client-panel-auth', be);
-addI18nLib('uk', 'client-panel-auth', uk);
-addI18nLib('es', 'client-panel-auth', es);
-addI18nLib('de', 'client-panel-auth', de);
-addI18nLib('fr', 'client-panel-auth', fr);
+i18nHelper.addI18nLib('en', 'client-panel-auth', en);
+i18nHelper.addI18nLib('pl', 'client-panel-auth', pl);
+i18nHelper.addI18nLib('ru', 'client-panel-auth', ru);
+i18nHelper.addI18nLib('be', 'client-panel-auth', be);
+i18nHelper.addI18nLib('uk', 'client-panel-auth', uk);
+i18nHelper.addI18nLib('es', 'client-panel-auth', es);
+i18nHelper.addI18nLib('de', 'client-panel-auth', de);
+i18nHelper.addI18nLib('fr', 'client-panel-auth', fr);
 //# sourceMappingURL=i18n.js.map

package/build/auth/i18n.js.map

@@ -1 +1 @@
-{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/auth/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAErD,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA"}
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/auth/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAErD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA"}

package/build/auth/login/index.d.ts

@@ -1,3 +1,5 @@
 export type * from './types.js';
 export * from './model.js';
+export * from './provider.js';
+export * from './provider-config.js';
 //# sourceMappingURL=index.d.ts.map

package/build/auth/login/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA"}

package/build/auth/login/index.js

@@ -1,2 +1,4 @@
 export * from './model.js';
+export * from './provider.js';
+export * from './provider-config.js';
 //# sourceMappingURL=index.js.map

package/build/auth/login/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA"}

package/build/auth/login/model.d.ts

@@ -3,8 +3,8 @@ import type { LoginMethodsModel, UseLoginMethodsOptions } from './types.js';
  * Everything a sign-in screen needs, with no opinion about how it looks.
  *
  * Headless and cross-platform, like `usePanelNav`: the rules about what may be offered, what must
- * be confirmed first and what the credit line says are the same on every platform, and only the
- * rendering differs. A renderer that re-derives any of them will drift from the one that does not.
+ * be confirmed first, what the credit line says and who is disclosed as signing the person in are
+ * the same on every platform, and only the rendering differs. A renderer that re-derives any of them will drift from the one that does not.
  */
 export declare const useLoginMethods: (opts?: UseLoginMethodsOptions) => LoginMethodsModel;
 //# sourceMappingURL=model.d.ts.map

package/build/auth/login/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,UAAW,sBAAsB,KAAG,iBAoF/D,CAAA"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAG3E;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,UAAW,sBAAsB,KAAG,iBAsF/D,CAAA"}

package/build/auth/login/model.js

@@ -1,12 +1,13 @@
 import { useCallback, useMemo, useState } from 'react';
 import { useContext, useNavigate } from '@owlmeans/client';
-import { acceptTerms, primaryLoginMethod, resolveCredit, resolveTerms, termsAccepted, termsDeferred, LoginOutcome, LOGIN_SERVICE, } from '@owlmeans/client-auth/login';
+import { resolveCredit, LoginOutcome, LOGIN_SERVICE, loginMethodsHelper, loginTermsHelper } from '@owlmeans/client-auth/login';
+import { loginProviderHelper } from './provider.js';
 /**
  * Everything a sign-in screen needs, with no opinion about how it looks.
  *
  * Headless and cross-platform, like `usePanelNav`: the rules about what may be offered, what must
- * be confirmed first and what the credit line says are the same on every platform, and only the
- * rendering differs. A renderer that re-derives any of them will drift from the one that does not.
+ * be confirmed first, what the credit line says and who is disclosed as signing the person in are
+ * the same on every platform, and only the rendering differs. A renderer that re-derives any of them will drift from the one that does not.
  */
 export const useLoginMethods = (opts) => {
     const context = useContext();
@@ -14,9 +15,10 @@ export const useLoginMethods = (opts) => {
     const login = context.service(LOGIN_SERVICE);
     const cfg = opts?.config ?? context.cfg.security?.auth?.login;
     const brand = context.cfg.brand;
-    const resolved = useMemo(() => resolveTerms(opts?.terms ?? cfg?.terms), [opts?.terms, cfg]);
+    const resolved = useMemo(() => loginTermsHelper.resolveTerms(opts?.terms ?? cfg?.terms), [opts?.terms, cfg]);
     const credit = useMemo(() => resolveCredit(cfg?.credit, brand, context.cfg.service), [cfg, brand, context]);
-    const [accepted, setAccepted] = useState(() => termsAccepted(resolved));
+    const provider = useMemo(() => loginProviderHelper.resolve(cfg?.provider, brand), [cfg, brand]);
+    const [accepted, setAccepted] = useState(() => loginTermsHelper.termsAccepted(resolved));
     const [attempted, setAttempted] = useState(false);
     const [busy, setBusy] = useState(null);
     const [outcome, setOutcome] = useState(null);
@@ -29,7 +31,7 @@ export const useLoginMethods = (opts) => {
     const methods = typeof opts?.methods === 'function'
         ? opts.methods(all)
         : opts?.methods ?? all;
-    const deferred = termsDeferred(context);
+    const deferred = loginTermsHelper.termsDeferred(context);
     const blocked = resolved != null && resolved.required && !deferred && !accepted;
     const select = useCallback((method) => {
         if (blocked) {
@@ -58,11 +60,11 @@ export const useLoginMethods = (opts) => {
     const accept = useCallback((value) => {
         setAccepted(value);
         setAttempted(false);
-        acceptTerms(resolved, value);
+        loginTermsHelper.acceptTerms(resolved, value);
     }, [resolved]);
     return {
         methods,
-        primary: primaryLoginMethod(methods),
+        primary: loginMethodsHelper.primaryLoginMethod(methods),
         terms: {
             required: resolved?.required ?? false,
             accepted: resolved == null ? true : accepted,
@@ -75,6 +77,7 @@ export const useLoginMethods = (opts) => {
             accept,
         },
         credit,
+        provider,
         blocked,
         busy,
         outcome,

package/build/auth/login/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EACL,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAC1F,YAAY,EAAE,aAAa,GAC5B,MAAM,6BAA6B,CAAA;AAIpC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAA6B,EAAqB,EAAE;IAClF,MAAM,OAAO,GAAG,UAAU,EAA6B,CAAA;IACvD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAA;IAC/E,MAAM,KAAK,GAAI,OAAO,CAAC,GAAoB,CAAC,KAAK,CAAA;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;IAC3F,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CACpF,CAAA;IAED,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACvE,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACrD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;KACxF,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,UAAU;QACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAA;IAExB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAA;IAE/E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,MAAmB,EAAE,EAAE;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,4FAA4F;YAC5F,8FAA8F;YAC9F,YAAY,CAAC,IAAI,CAAC,CAAA;YAElB,OAAM;QACR,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,KAAK,CAAC;YAChB,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;SACxF,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACf,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,uFAAuF;YACvF,IAAI,MAAM,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YACpB,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO;QACL,OAAO;QACP,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC;QACpC,KAAK,EAAE;YACL,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,KAAK;YACrC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC5C,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,EAAE;YACpC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,MAAM;SACP;QACD,MAAM;QACN,OAAO;QACP,IAAI;QACJ,OAAO;QACP,KAAK;QACL,MAAM;KACP,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAG9H,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAA6B,EAAqB,EAAE;IAClF,MAAM,OAAO,GAAG,UAAU,EAA6B,CAAA;IACvD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAA;IAC/E,MAAM,KAAK,GAAI,OAAO,CAAC,GAAoB,CAAC,KAAK,CAAA;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5G,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CACpF,CAAA;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAE/F,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACrD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;KACxF,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,UAAU;QACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAA;IAExB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAA;IAE/E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,MAAmB,EAAE,EAAE;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,4FAA4F;YAC5F,8FAA8F;YAC9F,YAAY,CAAC,IAAI,CAAC,CAAA;YAElB,OAAM;QACR,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,KAAK,CAAC;YAChB,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;SACxF,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACf,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,uFAAuF;YACvF,IAAI,MAAM,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YACpB,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,gBAAgB,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO;QACL,OAAO;QACP,OAAO,EAAE,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE;YACL,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,KAAK;YACrC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC5C,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,EAAE;YACpC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,MAAM;SACP;QACD,MAAM;QACN,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,OAAO;QACP,KAAK;QACL,MAAM;KACP,CAAA;AACH,CAAC,CAAA"}

package/build/auth/login/provider/consts.local.d.ts

@@ -0,0 +1,3 @@
+/** The names a provider sentence may carry, matched in one pass. */
+export declare const PROVIDER_PLACEHOLDER: RegExp;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/auth/login/provider/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../../../src/auth/login/provider/consts.local.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,QAAyC,CAAA"}

package/build/auth/login/provider/consts.local.js

@@ -0,0 +1,3 @@
+/** The names a provider sentence may carry, matched in one pass. */
+export const PROVIDER_PLACEHOLDER = /\{\{(provider|operator|product)\}\}/g;
+//# sourceMappingURL=consts.local.js.map

package/build/auth/login/provider/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../../../src/auth/login/provider/consts.local.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAA"}

package/build/auth/login/provider-config.d.ts

@@ -0,0 +1,37 @@
+import type { LoginProviderConfig } from './types.js';
+/**
+ * `LoginScreenConfig.provider`, added by TypeScript module augmentation rather than by editing
+ * `@owlmeans/config` itself.
+ *
+ * `@owlmeans/config` has roughly 85 dependents, and every one of them sits in the same release
+ * closure — a config bump ripples through every package that pins a range against it, whether or
+ * not it touches sign-in. The field below is read by exactly one consumer family (the sign-in
+ * screen's headless model here and its renderers), so it is declared here instead, merged onto the
+ * base interface by TypeScript's own declaration merging — the pattern
+ * `@owlmeans/client-auth/login`'s `terms-config.ts` set.
+ *
+ * This file must be part of whatever a consumer's own compilation actually loads, or the merge
+ * never happens — an ambient augmentation applies only once the compiler has read the file that
+ * declares it. `@owlmeans/client-panel/auth`'s barrel re-exports this module for exactly that
+ * reason, so ANY import from `@owlmeans/client-panel/auth` pulls this augmentation into that
+ * program. An app that builds its `security.auth.login` literal in a file that imports nothing from
+ * it (a config file importing only `@owlmeans/config`) still benefits as long as some other file in
+ * the same `tsc` program does; if none does, add `import type {} from '@owlmeans/client-panel/auth'`
+ * to the file building the literal — an import with an empty type list, kept only to pull this
+ * file into that program's graph.
+ *
+ * `export {}` below is required, not decorative: without at least one top-level import/export this
+ * file is a SCRIPT to TypeScript, not a MODULE, and `declare module '@owlmeans/config'` inside a
+ * script augments the global scope instead of merging onto the named module's exports.
+ */
+declare module '@owlmeans/config' {
+    interface LoginScreenConfig {
+        /**
+         * Who signs a person in on this application's behalf — an identity service the application
+         * does not itself run. Absent, the screen discloses nothing and renders exactly as before.
+         */
+        provider?: LoginProviderConfig;
+    }
+}
+export {};
+//# sourceMappingURL=provider-config.d.ts.map

package/build/auth/login/provider-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-config.d.ts","sourceRoot":"","sources":["../../../src/auth/login/provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,QAAQ,kBAAkB,CAAC;IAChC,UAAU,iBAAiB;QACzB;;;WAGG;QACH,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B;CACF;AAED,OAAO,EAAG,CAAA"}

package/build/auth/login/provider-config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider-config.js.map

package/build/auth/login/provider-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-config.js","sourceRoot":"","sources":["../../../src/auth/login/provider-config.ts"],"names":[],"mappings":""}

package/build/auth/login/provider.d.ts

@@ -0,0 +1,5 @@
+import type { LoginProviderHelper } from './types.js';
+import './provider-config.js';
+export declare const createLoginProviderHelper: () => LoginProviderHelper;
+export declare const loginProviderHelper: LoginProviderHelper;
+//# sourceMappingURL=provider.d.ts.map

package/build/auth/login/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/auth/login/provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,mBAAmB,EAAsB,MAAM,YAAY,CAAA;AAE9F,OAAO,sBAAsB,CAAA;AAE7B,eAAO,MAAM,yBAAyB,QAAO,mBAyD5C,CAAA;AAED,eAAO,MAAM,mBAAmB,qBAA8B,CAAA"}

package/build/auth/login/provider.js

@@ -0,0 +1,55 @@
+import { PROVIDER_PLACEHOLDER } from './provider/consts.local.js';
+import './provider-config.js';
+export const createLoginProviderHelper = () => {
+    /**
+     * A configured value that was actually SET — `''` is how a build-time default spells "unset"
+     * (see `resolveCredit` in `@owlmeans/client-auth/login`, which follows the same rule).
+     */
+    const set = (value) => typeof value === 'string' && value.trim() !== '' ? value.trim() : null;
+    /**
+     * A link a person may be sent to: an absolute http(s) URL, or a path on this origin.
+     *
+     * `//host` is protocol-relative — another origin wearing a path's clothes — and `/\` is read as
+     * the same by browsers, so both are refused along with every other scheme (`javascript:` above
+     * all, since this lands in an `href`).
+     */
+    const link = (value) => {
+        const href = set(value);
+        if (href == null) {
+            return null;
+        }
+        if (href.startsWith('/')) {
+            return /^\/[/\\]/.test(href) ? null : href;
+        }
+        try {
+            const url = new URL(href);
+            return url.protocol === 'https:' || url.protocol === 'http:' ? href : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const resolve = (cfg, brand) => {
+        const name = set(cfg?.name);
+        const product = set(brand?.name);
+        if (name == null || product == null) {
+            return null;
+        }
+        return {
+            name,
+            operator: set(cfg?.operator) ?? name,
+            product,
+            info: link(cfg?.info),
+            placement: cfg?.placement === 'top' ? 'top' : 'inline',
+        };
+    };
+    const fill = (template, model) => {
+        const values = {
+            provider: model.name, operator: model.operator, product: model.product,
+        };
+        return template.replace(PROVIDER_PLACEHOLDER, (match, key) => values[key] ?? match);
+    };
+    return { resolve, fill };
+};
+export const loginProviderHelper = createLoginProviderHelper();
+//# sourceMappingURL=provider.js.map

package/build/auth/login/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/auth/login/provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,sBAAsB,CAAA;AAE7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAwB,EAAE;IACjE;;;OAGG;IACH,MAAM,GAAG,GAAG,CAAC,KAAqB,EAAiB,EAAE,CACnD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAExE;;;;;;OAMG;IACH,MAAM,IAAI,GAAG,CAAC,KAAqB,EAAiB,EAAE;QACpD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;QACvB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;YAEzB,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,CAAC,GAAyB,EAAE,KAAqB,EAA6B,EAAE;QAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAChC,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI;YACpC,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;YACrB,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;SACvD,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,KAAyB,EAAU,EAAE;QACnE,MAAM,MAAM,GAA2B;YACrC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;SACvE,CAAA;QAED,OAAO,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAA;IAC7F,CAAC,CAAA;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,EAAE,CAAA"}

package/build/auth/login/types.d.ts

@@ -1,5 +1,5 @@
 import type { LoginMethod, LoginOutcome, ResolvedTermsDocument } from '@owlmeans/client-auth/login';
-import type { LoginScreenConfig, LoginTermsConfig } from '@owlmeans/config';
+import type { BrandSettings, LoginScreenConfig, LoginTermsConfig } from '@owlmeans/config';
 export interface UseLoginMethodsOptions {
     /** Overrides the configuration the context carries. */
     config?: LoginScreenConfig;
@@ -33,12 +33,59 @@ export interface LoginCreditModel {
     poweredBy: boolean;
     line: string | null;
 }
+/** Where the provider disclosure sits: a strip above the card, or a line inside it. */
+export type LoginProviderPlacement = 'top' | 'inline';
+/**
+ * Who actually signs a person in, when that is not the application on whose screen they are.
+ *
+ * Read from `cfg.security.auth.login.provider` (declared onto `LoginScreenConfig` by
+ * `./provider-config.ts`). Blank strings are unset, exactly as they are for the credit line: this
+ * config is filled from build-time environment variables, and an undelivered one arrives as `''`.
+ */
+export interface LoginProviderConfig {
+    /** The sign-in service as a person reads it — "OwlMeans IAM". */
+    name: string;
+    /** Who runs it. Defaults to `name`. */
+    operator?: string;
+    /** "More information" — an absolute http(s) URL or a root-relative path; anything else is dropped. */
+    info?: string;
+    /** Default `'inline'`. */
+    placement?: LoginProviderPlacement;
+}
+export interface LoginProviderModel {
+    name: string;
+    operator: string;
+    /** The application the person is signing in to — `cfg.brand.name`. */
+    product: string;
+    info: string | null;
+    placement: LoginProviderPlacement;
+}
+export interface LoginProviderHelper {
+    /**
+     * The disclosure a sign-in screen renders, or `null` when there is nothing to disclose.
+     *
+     * Null unless both the provider's `name` and the product (`brand.name`) are set — a sentence
+     * relating two parties cannot be written with one of them missing, and a screen that showed half
+     * of it would be worse than one that shows none.
+     */
+    resolve: (cfg?: LoginProviderConfig, brand?: BrandSettings) => LoginProviderModel | null;
+    /**
+     * Put the names into a sentence AFTER it was translated.
+     *
+     * `{{provider}}`, `{{operator}}` and `{{product}}`, replaced in one pass — a name that itself
+     * contains a placeholder is never expanded a second time. The names never travel as i18next
+     * interpolation parameters, so no translation backend gets the chance to escape or format them.
+     */
+    fill: (template: string, model: LoginProviderModel) => string;
+}
 export interface LoginMethodsModel {
     methods: LoginMethod[];
     /** The one a screen highlights and focuses. It is never started automatically. */
     primary: LoginMethod | null;
     terms: LoginTermsModel;
     credit: LoginCreditModel;
+    /** Who signs the person in, on behalf of which product — `null` when the app configured nobody. */
+    provider: LoginProviderModel | null;
     /** True while the terms have not been confirmed and confirming them is required. */
     blocked: boolean;
     /** Id of the method currently starting. */

package/build/auth/login/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/login/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnG,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE3E,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,KAAK,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAA;IAChC,qDAAqD;IACrD,OAAO,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC,CAAA;CACtE;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAA;IAClB,8FAA8F;IAC9F,SAAS,EAAE,qBAAqB,EAAE,CAAA;IAClC,6FAA6F;IAC7F,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,kFAAkF;IAClF,OAAO,EAAE,WAAW,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,eAAe,CAAA;IACtB,MAAM,EAAE,gBAAgB,CAAA;IACxB,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAA;IAChB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;CACtC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/login/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnG,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE1F,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,KAAK,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAA;IAChC,qDAAqD;IACrD,OAAO,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC,CAAA;CACtE;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAA;IAClB,8FAA8F;IAC9F,SAAS,EAAE,qBAAqB,EAAE,CAAA;IAClC,6FAA6F;IAC7F,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAED,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,QAAQ,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0BAA0B;IAC1B,SAAS,CAAC,EAAE,sBAAsB,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,sBAAsB,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,aAAa,KAAK,kBAAkB,GAAG,IAAI,CAAA;IACxF;;;;;;OAMG;IACH,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,KAAK,MAAM,CAAA;CAC9D;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,kFAAkF;IAClF,OAAO,EAAE,WAAW,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,eAAe,CAAA;IACtB,MAAM,EAAE,gBAAgB,CAAA;IACxB,mGAAmG;IACnG,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACnC,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAA;IAChB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;CACtC"}

package/build/components/nav/helper.d.ts

@@ -1,12 +1,4 @@
-import type { NavTranslate, PanelNavConfig, PanelNavModel } from './types.js';
-/** Default resolver: no i18n, the caller's fallback wins. See {@link NavTranslate}. */
-export declare const defaultNavTranslate: NavTranslate;
-/**
- * Turn an alias into something readable — `my-app:web:user-list` becomes `User list`.
- * The last segment is the meaningful one; the prefixes address the app, not the screen.
- */
-export declare const defaultNavLabel: (alias: string) => string;
-export declare const resolveNavLabel: (translate: NavTranslate, label: string | undefined, key: string, alias?: string) => string;
+import type { PanelNavConfig, PanelNavModel } from './types.js';
 /**
  * The navigation model behind both menus.
  *

package/build/components/nav/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../../src/components/nav/helper.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAgB,aAAa,EAAmB,MAAM,YAAY,CAAA;AAE5G,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,EAAE,YAAmD,CAAA;AAErF;;;GAGG;AACH,eAAO,MAAM,eAAe,UAAW,MAAM,KAAG,MAK/C,CAAA;AAED,eAAO,MAAM,eAAe,cACf,YAAY,SAAS,MAAM,GAAG,SAAS,OAAO,MAAM,UAAU,MAAM,KAC9E,MAAgE,CAAA;AAQnE;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,WAAY,cAAc,KAAG,aA6FpD,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../../src/components/nav/helper.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAgB,aAAa,EAAmB,MAAM,YAAY,CAAA;AAQ9F;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,WAAY,cAAc,KAAG,aA6FpD,CAAA"}

package/build/components/nav/helper.js

@@ -1,17 +1,5 @@
 import { useMemo } from 'react';
 import { useContext, useNavigate } from '@owlmeans/client';
-/** Default resolver: no i18n, the caller's fallback wins. See {@link NavTranslate}. */
-export const defaultNavTranslate = (_key, defaultValue) => defaultValue;
-/**
- * Turn an alias into something readable — `my-app:web:user-list` becomes `User list`.
- * The last segment is the meaningful one; the prefixes address the app, not the screen.
- */
-export const defaultNavLabel = (alias) => {
-    const segment = alias.split(/[:.]/).filter(part => part !== '').pop() ?? alias;
-    const words = segment.replace(/[-_]+/g, ' ').trim();
-    return words.charAt(0).toUpperCase() + words.slice(1);
-};
-export const resolveNavLabel = (translate, label, key, alias) => label ?? translate(key, defaultNavLabel(alias ?? key));
 const visibleItems = (section) => section.items.filter(item => item.hidden !== true);
 const normalizePath = (path) => path.length > 1 && path.endsWith('/') ? path.slice(0, -1) : path;
 /**

package/build/components/nav/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../../src/components/nav/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAI/B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAI1D,uFAAuF;AACvF,MAAM,CAAC,MAAM,mBAAmB,GAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,CAAA;AAErF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAA;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAEnD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACvD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,SAAuB,EAAE,KAAyB,EAAE,GAAW,EAAE,KAAc,EACvE,EAAE,CAAC,KAAK,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAA;AAEnE,MAAM,YAAY,GAAG,CAAC,OAAwB,EAAkB,EAAE,CAChE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;AAEpD,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAElE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAsB,EAAiB,EAAE;IACnE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;IAC5B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,QAAQ,GAA0B,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAA;IAEtE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAA2B,CAAA;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAElC,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ;aAC7B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;aAC1C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;QAEjE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAiB,EAAE;YAC9C,IAAI,CAAC;gBACH,OAAO,aAAa,CAAC,OAAO,CAAC,UAAU,CAA2B,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,sFAAsF;gBACtF,8CAA8C;gBAC9C,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAA;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAEtD,IAAI,OAAO,GAAkB,KAAK,EAAE,KAAK,IAAI,IAAI,CAAA;QACjD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;YACpC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;YAC3D,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,OAAO,GAAG,KAAK,CAAC,KAAK,CAAA;YACvB,CAAC;iBAAM,CAAC;gBACN,mFAAmF;gBACnF,MAAM,QAAQ,GAAG,GAAG;qBACjB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;qBACjD,MAAM,CAAC,CAAC,KAAK,EAAiD,EAAE,CAC/D,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;qBAC/E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACnD,OAAO,GAAG,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAA;YACxC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,KAAoB,EAA0B,EAAE,CACjE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAA;QAE3G,IAAI,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QAC/B,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACtC,oFAAoF;YACpF,uFAAuF;YACvF,IAAI,KAAK,GAAkB,OAAO,CAAA;YAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACf,IAAI,CAAC;oBACH,KAAK,GAAG,OAAO,CAAC,UAAU,CAA2B,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAA;gBACxF,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,GAAG,IAAI,CAAA;gBACd,CAAC;gBACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC9B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,MAAM,GAAG,KAAK,CAAA;oBACd,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAA;QAC5E,MAAM,eAAe,GAAG,CAAC,OAAwB,EAAW,EAAE,CAC5D,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAA;QAEhD,OAAO;YACL,QAAQ;YACR,OAAO;YACP,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACnD,eAAe;YACf,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,EAAE;gBACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAC9B,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACrC,MAAM,EAAE,MAAM,CAAC,EAAE;gBACf,MAAM,KAAK,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAA;gBACvE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,OAAO,SAAS,CAAA;gBAClB,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;gBAE1B,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;YAC9D,CAAC;SACF,CAAA;IACH,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../../src/components/nav/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAI/B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAI1D,MAAM,YAAY,GAAG,CAAC,OAAwB,EAAkB,EAAE,CAChE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;AAEpD,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAElE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAsB,EAAiB,EAAE;IACnE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;IAC5B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,QAAQ,GAA0B,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAA;IAEtE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAA2B,CAAA;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAElC,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ;aAC7B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;aAC1C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;QAEjE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAiB,EAAE;YAC9C,IAAI,CAAC;gBACH,OAAO,aAAa,CAAC,OAAO,CAAC,UAAU,CAA2B,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,sFAAsF;gBACtF,8CAA8C;gBAC9C,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAA;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAEtD,IAAI,OAAO,GAAkB,KAAK,EAAE,KAAK,IAAI,IAAI,CAAA;QACjD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;YACpC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;YAC3D,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,OAAO,GAAG,KAAK,CAAC,KAAK,CAAA;YACvB,CAAC;iBAAM,CAAC;gBACN,mFAAmF;gBACnF,MAAM,QAAQ,GAAG,GAAG;qBACjB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;qBACjD,MAAM,CAAC,CAAC,KAAK,EAAiD,EAAE,CAC/D,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;qBAC/E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACnD,OAAO,GAAG,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAA;YACxC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,KAAoB,EAA0B,EAAE,CACjE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAA;QAE3G,IAAI,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QAC/B,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACtC,oFAAoF;YACpF,uFAAuF;YACvF,IAAI,KAAK,GAAkB,OAAO,CAAA;YAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACf,IAAI,CAAC;oBACH,KAAK,GAAG,OAAO,CAAC,UAAU,CAA2B,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAA;gBACxF,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,GAAG,IAAI,CAAA;gBACd,CAAC;gBACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC9B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,MAAM,GAAG,KAAK,CAAA;oBACd,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAA;QAC5E,MAAM,eAAe,GAAG,CAAC,OAAwB,EAAW,EAAE,CAC5D,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAA;QAEhD,OAAO;YACL,QAAQ;YACR,OAAO;YACP,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACnD,eAAe;YACf,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,EAAE;gBACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAC9B,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACrC,MAAM,EAAE,MAAM,CAAC,EAAE;gBACf,MAAM,KAAK,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAA;gBACvE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,OAAO,SAAS,CAAA;gBAClB,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;gBAE1B,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;YAC9D,CAAC;SACF,CAAA;IACH,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA"}

package/build/components/nav/index.d.ts

@@ -1,3 +1,4 @@
 export type * from './types.js';
+export * from './label.js';
 export * from './helper.js';
 //# sourceMappingURL=index.d.ts.map

package/build/components/nav/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/nav/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/nav/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA"}

package/build/components/nav/index.js

@@ -1,2 +1,3 @@
+export * from './label.js';
 export * from './helper.js';
 //# sourceMappingURL=index.js.map

package/build/components/nav/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/components/nav/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/components/nav/index.ts"],"names":[],"mappings":"AAEA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA"}

package/build/components/nav/label.d.ts

@@ -0,0 +1,4 @@
+import type { NavLabelHelper } from './types.js';
+export declare const createNavLabelHelper: () => NavLabelHelper;
+export declare const navLabelHelper: NavLabelHelper;
+//# sourceMappingURL=label.d.ts.map

package/build/components/nav/label.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"label.d.ts","sourceRoot":"","sources":["../../../src/components/nav/label.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,YAAY,CAAA;AAE9D,eAAO,MAAM,oBAAoB,QAAO,cAevC,CAAA;AAED,eAAO,MAAM,cAAc,gBAAyB,CAAA"}

package/build/components/nav/label.js

@@ -0,0 +1,12 @@
+export const createNavLabelHelper = () => {
+    const defaultNavTranslate = (_key, defaultValue) => defaultValue;
+    const defaultNavLabel = (alias) => {
+        const segment = alias.split(/[:.]/).filter(part => part !== '').pop() ?? alias;
+        const words = segment.replace(/[-_]+/g, ' ').trim();
+        return words.charAt(0).toUpperCase() + words.slice(1);
+    };
+    const resolveNavLabel = (translate, label, key, alias) => label ?? translate(key, defaultNavLabel(alias ?? key));
+    return { defaultNavTranslate, defaultNavLabel, resolveNavLabel };
+};
+export const navLabelHelper = createNavLabelHelper();
+//# sourceMappingURL=label.js.map

package/build/components/nav/label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"label.js","sourceRoot":"","sources":["../../../src/components/nav/label.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAmB,EAAE;IACvD,MAAM,mBAAmB,GAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,CAAA;IAE9E,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAA;QAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAEnD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,CACtB,SAAuB,EAAE,KAAyB,EAAE,GAAW,EAAE,KAAc,EACvE,EAAE,CAAC,KAAK,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAA;IAEnE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,CAAA;AAClE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA"}

package/build/components/nav/types.d.ts

@@ -73,4 +73,16 @@ export interface PanelNavModel {
      */
     hrefOf: (target: PanelNavItem | PanelNavSection) => string | undefined;
 }
+/** How a navigation entry gets its label. */
+export interface NavLabelHelper {
+    /** Default resolver: no i18n, the caller's fallback wins. See {@link NavTranslate}. */
+    defaultNavTranslate: NavTranslate;
+    /**
+     * Turn an alias into something readable — `my-app:web:user-list` becomes `User list`.
+     * The last segment is the meaningful one; the prefixes address the app, not the screen.
+     */
+    defaultNavLabel: (alias: string) => string;
+    /** The literal label when given, else the translation of `key` falling back to the humanized alias. */
+    resolveNavLabel: (translate: NavTranslate, label: string | undefined, key: string, alias?: string) => string;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/components/nav/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/components/nav/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAE1C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,4GAA4G;IAC5G,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,aAAa,CAAC;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,eAAe,EAAE,CAAA;CAC5B;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAAA;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,yEAAyE;IACzE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,MAAM,EAAE,eAAe,GAAG,IAAI,CAAA;IAC9B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAA;IACtD,YAAY,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAA;IAC7C,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,MAAM,IAAI,CAAA;IACnD,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,MAAM,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,KAAK,MAAM,GAAG,SAAS,CAAA;CACvE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/components/nav/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAE1C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,4GAA4G;IAC5G,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,aAAa,CAAC;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,eAAe,EAAE,CAAA;CAC5B;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAAA;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,yEAAyE;IACzE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,MAAM,EAAE,eAAe,GAAG,IAAI,CAAA;IAC9B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAA;IACtD,YAAY,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAA;IAC7C,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,MAAM,IAAI,CAAA;IACnD,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,MAAM,IAAI,CAAA;IAC1C;;;;;;;OAOG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,KAAK,MAAM,GAAG,SAAS,CAAA;CACvE;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,mBAAmB,EAAE,YAAY,CAAA;IACjC;;;OAGG;IACH,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1C,uGAAuG;IACvG,eAAe,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;CAC7G"}

package/build/i18n.js

@@ -1,6 +1,6 @@
-import { addI18nLib } from '@owlmeans/i18n';
+import { i18nHelper } from '@owlmeans/i18n';
 import { buttons } from './consts.local.js';
 for (const [language, values] of Object.entries(buttons)) {
-    addI18nLib(language, 'client-panel', values);
+    i18nHelper.addI18nLib(language, 'client-panel', values);
 }
 //# sourceMappingURL=i18n.js.map

package/build/i18n.js.map

@@ -1 +1 @@
-{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-panel",
-  "version": "0.1.18-rc.57",
+  "version": "0.1.18-rc.59",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -36,19 +36,19 @@
   },
   "dependencies": {
     "@hookform/resolvers": "^5.9.1",
-    "@owlmeans/client": "^0.1.18-rc.50",
-    "@owlmeans/client-i18n": "^0.1.18-rc.49",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.46",
-    "@owlmeans/client-route": "^0.1.18-rc.47",
-    "@owlmeans/error": "^0.1.18-rc.37",
-    "@owlmeans/entrypoint": "^0.1.18-rc.40"
+    "@owlmeans/client": "^0.1.18-rc.52",
+    "@owlmeans/client-i18n": "^0.1.18-rc.51",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.48",
+    "@owlmeans/client-route": "^0.1.18-rc.49",
+    "@owlmeans/error": "^0.1.18-rc.38",
+    "@owlmeans/entrypoint": "^0.1.18-rc.41"
   },
   "peerDependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.39",
-    "@owlmeans/client-auth": "^0.1.18-rc.57",
-    "@owlmeans/config": "^0.1.18-rc.43",
-    "@owlmeans/i18n": "^0.1.18-rc.38",
-    "@owlmeans/router": "^0.1.18-rc.32",
+    "@owlmeans/auth": "^0.1.18-rc.40",
+    "@owlmeans/client-auth": "^0.1.18-rc.59",
+    "@owlmeans/config": "^0.1.18-rc.44",
+    "@owlmeans/i18n": "^0.1.18-rc.39",
+    "@owlmeans/router": "^0.1.18-rc.33",
     "ajv": "*",
     "react": "*",
     "react-hook-form": "*"
@@ -63,8 +63,8 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/auth": "^0.1.18-rc.39",
-    "@owlmeans/client-auth": "^0.1.18-rc.57",
+    "@owlmeans/auth": "^0.1.18-rc.40",
+    "@owlmeans/client-auth": "^0.1.18-rc.59",
     "@types/react": "^19.3.0",
     "nodemon": "^3.1.14",
     "react-hook-form": "^7.89.0",

package/src/auth/i18n.ts

@@ -1,4 +1,4 @@
-import { addI18nLib } from '@owlmeans/i18n'
+import { i18nHelper } from '@owlmeans/i18n'
 
 import en from './i18n/en.json' with { type: 'json' }
 import pl from './i18n/pl.json' with { type: 'json' }
@@ -9,11 +9,11 @@ import es from './i18n/es.json' with { type: 'json' }
 import de from './i18n/de.json' with { type: 'json' }
 import fr from './i18n/fr.json' with { type: 'json' }
 
-addI18nLib('en', 'client-panel-auth', en)
-addI18nLib('pl', 'client-panel-auth', pl)
-addI18nLib('ru', 'client-panel-auth', ru)
-addI18nLib('be', 'client-panel-auth', be)
-addI18nLib('uk', 'client-panel-auth', uk)
-addI18nLib('es', 'client-panel-auth', es)
-addI18nLib('de', 'client-panel-auth', de)
-addI18nLib('fr', 'client-panel-auth', fr)
+i18nHelper.addI18nLib('en', 'client-panel-auth', en)
+i18nHelper.addI18nLib('pl', 'client-panel-auth', pl)
+i18nHelper.addI18nLib('ru', 'client-panel-auth', ru)
+i18nHelper.addI18nLib('be', 'client-panel-auth', be)
+i18nHelper.addI18nLib('uk', 'client-panel-auth', uk)
+i18nHelper.addI18nLib('es', 'client-panel-auth', es)
+i18nHelper.addI18nLib('de', 'client-panel-auth', de)
+i18nHelper.addI18nLib('fr', 'client-panel-auth', fr)

package/src/auth/login/index.ts

@@ -1,2 +1,4 @@
 export type * from './types.js'
 export * from './model.js'
+export * from './provider.js'
+export * from './provider-config.js'

package/src/auth/login/model.ts

@@ -1,19 +1,17 @@
 import { useCallback, useMemo, useState } from 'react'
 import { useContext, useNavigate } from '@owlmeans/client'
 import type { CommonConfig } from '@owlmeans/config'
-import {
-  acceptTerms, primaryLoginMethod, resolveCredit, resolveTerms, termsAccepted, termsDeferred,
-  LoginOutcome, LOGIN_SERVICE,
-} from '@owlmeans/client-auth/login'
+import { resolveCredit, LoginOutcome, LOGIN_SERVICE, loginMethodsHelper, loginTermsHelper } from '@owlmeans/client-auth/login'
 import type { LoginContext, LoginMethod, LoginService } from '@owlmeans/client-auth/login'
 import type { LoginMethodsModel, UseLoginMethodsOptions } from './types.js'
+import { loginProviderHelper } from './provider.js'
 
 /**
  * Everything a sign-in screen needs, with no opinion about how it looks.
  *
  * Headless and cross-platform, like `usePanelNav`: the rules about what may be offered, what must
- * be confirmed first and what the credit line says are the same on every platform, and only the
- * rendering differs. A renderer that re-derives any of them will drift from the one that does not.
+ * be confirmed first, what the credit line says and who is disclosed as signing the person in are
+ * the same on every platform, and only the rendering differs. A renderer that re-derives any of them will drift from the one that does not.
  */
 export const useLoginMethods = (opts?: UseLoginMethodsOptions): LoginMethodsModel => {
   const context = useContext() as unknown as LoginContext
@@ -23,12 +21,13 @@ export const useLoginMethods = (opts?: UseLoginMethodsOptions): LoginMethodsMode
   const cfg = opts?.config ?? (context.cfg as CommonConfig).security?.auth?.login
   const brand = (context.cfg as CommonConfig).brand
 
-  const resolved = useMemo(() => resolveTerms(opts?.terms ?? cfg?.terms), [opts?.terms, cfg])
+  const resolved = useMemo(() => loginTermsHelper.resolveTerms(opts?.terms ?? cfg?.terms), [opts?.terms, cfg])
   const credit = useMemo(
     () => resolveCredit(cfg?.credit, brand, context.cfg.service), [cfg, brand, context]
   )
+  const provider = useMemo(() => loginProviderHelper.resolve(cfg?.provider, brand), [cfg, brand])
 
-  const [accepted, setAccepted] = useState(() => termsAccepted(resolved))
+  const [accepted, setAccepted] = useState(() => loginTermsHelper.termsAccepted(resolved))
   const [attempted, setAttempted] = useState(false)
   const [busy, setBusy] = useState<string | null>(null)
   const [outcome, setOutcome] = useState<LoginOutcome | null>(null)
@@ -43,7 +42,7 @@ export const useLoginMethods = (opts?: UseLoginMethodsOptions): LoginMethodsMode
     ? opts.methods(all)
     : opts?.methods ?? all
 
-  const deferred = termsDeferred(context)
+  const deferred = loginTermsHelper.termsDeferred(context)
   const blocked = resolved != null && resolved.required && !deferred && !accepted
 
   const select = useCallback((method: LoginMethod) => {
@@ -75,12 +74,12 @@ export const useLoginMethods = (opts?: UseLoginMethodsOptions): LoginMethodsMode
   const accept = useCallback((value: boolean) => {
     setAccepted(value)
     setAttempted(false)
-    acceptTerms(resolved, value)
+    loginTermsHelper.acceptTerms(resolved, value)
   }, [resolved])
 
   return {
     methods,
-    primary: primaryLoginMethod(methods),
+    primary: loginMethodsHelper.primaryLoginMethod(methods),
     terms: {
       required: resolved?.required ?? false,
       accepted: resolved == null ? true : accepted,
@@ -93,6 +92,7 @@ export const useLoginMethods = (opts?: UseLoginMethodsOptions): LoginMethodsMode
       accept,
     },
     credit,
+    provider,
     blocked,
     busy,
     outcome,

package/src/auth/login/provider/consts.local.ts

@@ -0,0 +1,2 @@
+/** The names a provider sentence may carry, matched in one pass. */
+export const PROVIDER_PLACEHOLDER = /\{\{(provider|operator|product)\}\}/g

package/src/auth/login/provider-config.ts

@@ -0,0 +1,38 @@
+import type { LoginProviderConfig } from './types.js'
+
+/**
+ * `LoginScreenConfig.provider`, added by TypeScript module augmentation rather than by editing
+ * `@owlmeans/config` itself.
+ *
+ * `@owlmeans/config` has roughly 85 dependents, and every one of them sits in the same release
+ * closure — a config bump ripples through every package that pins a range against it, whether or
+ * not it touches sign-in. The field below is read by exactly one consumer family (the sign-in
+ * screen's headless model here and its renderers), so it is declared here instead, merged onto the
+ * base interface by TypeScript's own declaration merging — the pattern
+ * `@owlmeans/client-auth/login`'s `terms-config.ts` set.
+ *
+ * This file must be part of whatever a consumer's own compilation actually loads, or the merge
+ * never happens — an ambient augmentation applies only once the compiler has read the file that
+ * declares it. `@owlmeans/client-panel/auth`'s barrel re-exports this module for exactly that
+ * reason, so ANY import from `@owlmeans/client-panel/auth` pulls this augmentation into that
+ * program. An app that builds its `security.auth.login` literal in a file that imports nothing from
+ * it (a config file importing only `@owlmeans/config`) still benefits as long as some other file in
+ * the same `tsc` program does; if none does, add `import type {} from '@owlmeans/client-panel/auth'`
+ * to the file building the literal — an import with an empty type list, kept only to pull this
+ * file into that program's graph.
+ *
+ * `export {}` below is required, not decorative: without at least one top-level import/export this
+ * file is a SCRIPT to TypeScript, not a MODULE, and `declare module '@owlmeans/config'` inside a
+ * script augments the global scope instead of merging onto the named module's exports.
+ */
+declare module '@owlmeans/config' {
+  interface LoginScreenConfig {
+    /**
+     * Who signs a person in on this application's behalf — an identity service the application
+     * does not itself run. Absent, the screen discloses nothing and renders exactly as before.
+     */
+    provider?: LoginProviderConfig
+  }
+}
+
+export { }

package/src/auth/login/provider.ts

@@ -0,0 +1,65 @@
+import type { BrandSettings } from '@owlmeans/config'
+import type { LoginProviderConfig, LoginProviderHelper, LoginProviderModel } from './types.js'
+import { PROVIDER_PLACEHOLDER } from './provider/consts.local.js'
+import './provider-config.js'
+
+export const createLoginProviderHelper = (): LoginProviderHelper => {
+  /**
+   * A configured value that was actually SET — `''` is how a build-time default spells "unset"
+   * (see `resolveCredit` in `@owlmeans/client-auth/login`, which follows the same rule).
+   */
+  const set = (value?: string | null): string | null =>
+    typeof value === 'string' && value.trim() !== '' ? value.trim() : null
+
+  /**
+   * A link a person may be sent to: an absolute http(s) URL, or a path on this origin.
+   *
+   * `//host` is protocol-relative — another origin wearing a path's clothes — and `/\` is read as
+   * the same by browsers, so both are refused along with every other scheme (`javascript:` above
+   * all, since this lands in an `href`).
+   */
+  const link = (value?: string | null): string | null => {
+    const href = set(value)
+    if (href == null) {
+      return null
+    }
+    if (href.startsWith('/')) {
+      return /^\/[/\\]/.test(href) ? null : href
+    }
+    try {
+      const url = new URL(href)
+
+      return url.protocol === 'https:' || url.protocol === 'http:' ? href : null
+    } catch {
+      return null
+    }
+  }
+
+  const resolve = (cfg?: LoginProviderConfig, brand?: BrandSettings): LoginProviderModel | null => {
+    const name = set(cfg?.name)
+    const product = set(brand?.name)
+    if (name == null || product == null) {
+      return null
+    }
+
+    return {
+      name,
+      operator: set(cfg?.operator) ?? name,
+      product,
+      info: link(cfg?.info),
+      placement: cfg?.placement === 'top' ? 'top' : 'inline',
+    }
+  }
+
+  const fill = (template: string, model: LoginProviderModel): string => {
+    const values: Record<string, string> = {
+      provider: model.name, operator: model.operator, product: model.product,
+    }
+
+    return template.replace(PROVIDER_PLACEHOLDER, (match, key: string) => values[key] ?? match)
+  }
+
+  return { resolve, fill }
+}
+
+export const loginProviderHelper = createLoginProviderHelper()

package/src/auth/login/types.ts

@@ -1,5 +1,5 @@
 import type { LoginMethod, LoginOutcome, ResolvedTermsDocument } from '@owlmeans/client-auth/login'
-import type { LoginScreenConfig, LoginTermsConfig } from '@owlmeans/config'
+import type { BrandSettings, LoginScreenConfig, LoginTermsConfig } from '@owlmeans/config'
 
 export interface UseLoginMethodsOptions {
   /** Overrides the configuration the context carries. */
@@ -37,12 +37,63 @@ export interface LoginCreditModel {
   line: string | null
 }
 
+/** Where the provider disclosure sits: a strip above the card, or a line inside it. */
+export type LoginProviderPlacement = 'top' | 'inline'
+
+/**
+ * Who actually signs a person in, when that is not the application on whose screen they are.
+ *
+ * Read from `cfg.security.auth.login.provider` (declared onto `LoginScreenConfig` by
+ * `./provider-config.ts`). Blank strings are unset, exactly as they are for the credit line: this
+ * config is filled from build-time environment variables, and an undelivered one arrives as `''`.
+ */
+export interface LoginProviderConfig {
+  /** The sign-in service as a person reads it — "OwlMeans IAM". */
+  name: string
+  /** Who runs it. Defaults to `name`. */
+  operator?: string
+  /** "More information" — an absolute http(s) URL or a root-relative path; anything else is dropped. */
+  info?: string
+  /** Default `'inline'`. */
+  placement?: LoginProviderPlacement
+}
+
+export interface LoginProviderModel {
+  name: string
+  operator: string
+  /** The application the person is signing in to — `cfg.brand.name`. */
+  product: string
+  info: string | null
+  placement: LoginProviderPlacement
+}
+
+export interface LoginProviderHelper {
+  /**
+   * The disclosure a sign-in screen renders, or `null` when there is nothing to disclose.
+   *
+   * Null unless both the provider's `name` and the product (`brand.name`) are set — a sentence
+   * relating two parties cannot be written with one of them missing, and a screen that showed half
+   * of it would be worse than one that shows none.
+   */
+  resolve: (cfg?: LoginProviderConfig, brand?: BrandSettings) => LoginProviderModel | null
+  /**
+   * Put the names into a sentence AFTER it was translated.
+   *
+   * `{{provider}}`, `{{operator}}` and `{{product}}`, replaced in one pass — a name that itself
+   * contains a placeholder is never expanded a second time. The names never travel as i18next
+   * interpolation parameters, so no translation backend gets the chance to escape or format them.
+   */
+  fill: (template: string, model: LoginProviderModel) => string
+}
+
 export interface LoginMethodsModel {
   methods: LoginMethod[]
   /** The one a screen highlights and focuses. It is never started automatically. */
   primary: LoginMethod | null
   terms: LoginTermsModel
   credit: LoginCreditModel
+  /** Who signs the person in, on behalf of which product — `null` when the app configured nobody. */
+  provider: LoginProviderModel | null
   /** True while the terms have not been confirmed and confirming them is required. */
   blocked: boolean
   /** Id of the method currently starting. */

package/src/components/nav/helper.ts

@@ -4,25 +4,7 @@ import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 import type { Location } from '@owlmeans/router'
 import { useContext, useNavigate } from '@owlmeans/client'
 
-import type { NavTranslate, PanelNavConfig, PanelNavItem, PanelNavModel, PanelNavSection } from './types.js'
-
-/** Default resolver: no i18n, the caller's fallback wins. See {@link NavTranslate}. */
-export const defaultNavTranslate: NavTranslate = (_key, defaultValue) => defaultValue
-
-/**
- * Turn an alias into something readable — `my-app:web:user-list` becomes `User list`.
- * The last segment is the meaningful one; the prefixes address the app, not the screen.
- */
-export const defaultNavLabel = (alias: string): string => {
-  const segment = alias.split(/[:.]/).filter(part => part !== '').pop() ?? alias
-  const words = segment.replace(/[-_]+/g, ' ').trim()
-
-  return words.charAt(0).toUpperCase() + words.slice(1)
-}
-
-export const resolveNavLabel = (
-  translate: NavTranslate, label: string | undefined, key: string, alias?: string
-): string => label ?? translate(key, defaultNavLabel(alias ?? key))
+import type { PanelNavConfig, PanelNavItem, PanelNavModel, PanelNavSection } from './types.js'
 
 const visibleItems = (section: PanelNavSection): PanelNavItem[] =>
   section.items.filter(item => item.hidden !== true)

package/src/components/nav/index.ts

@@ -1,3 +1,4 @@
 export type * from './types.js'
 
+export * from './label.js'
 export * from './helper.js'

package/src/components/nav/label.ts

@@ -0,0 +1,20 @@
+import type { NavLabelHelper, NavTranslate } from './types.js'
+
+export const createNavLabelHelper = (): NavLabelHelper => {
+  const defaultNavTranslate: NavTranslate = (_key, defaultValue) => defaultValue
+
+  const defaultNavLabel = (alias: string): string => {
+    const segment = alias.split(/[:.]/).filter(part => part !== '').pop() ?? alias
+    const words = segment.replace(/[-_]+/g, ' ').trim()
+
+    return words.charAt(0).toUpperCase() + words.slice(1)
+  }
+
+  const resolveNavLabel = (
+    translate: NavTranslate, label: string | undefined, key: string, alias?: string
+  ): string => label ?? translate(key, defaultNavLabel(alias ?? key))
+
+  return { defaultNavTranslate, defaultNavLabel, resolveNavLabel }
+}
+
+export const navLabelHelper = createNavLabelHelper()

package/src/components/nav/types.ts

@@ -77,3 +77,16 @@ export interface PanelNavModel {
    */
   hrefOf: (target: PanelNavItem | PanelNavSection) => string | undefined
 }
+
+/** How a navigation entry gets its label. */
+export interface NavLabelHelper {
+  /** Default resolver: no i18n, the caller's fallback wins. See {@link NavTranslate}. */
+  defaultNavTranslate: NavTranslate
+  /**
+   * Turn an alias into something readable — `my-app:web:user-list` becomes `User list`.
+   * The last segment is the meaningful one; the prefixes address the app, not the screen.
+   */
+  defaultNavLabel: (alias: string) => string
+  /** The literal label when given, else the translation of `key` falling back to the humanized alias. */
+  resolveNavLabel: (translate: NavTranslate, label: string | undefined, key: string, alias?: string) => string
+}

package/src/i18n.ts

@@ -1,6 +1,6 @@
-import { addI18nLib } from '@owlmeans/i18n'
+import { i18nHelper } from '@owlmeans/i18n'
 import { buttons } from './consts.local.js'
 
 for (const [language, values] of Object.entries(buttons)) {
-  addI18nLib(language, 'client-panel', values)
+  i18nHelper.addI18nLib(language, 'client-panel', values)
 }